🎩 You're Invited:Meet the Socket team at Black Hat in Las Vegas, August 3-6.RSVP →

@sunaiva/gate

Advanced tools

Install Socket

Detect and block malicious and high-risk dependencies

Install

@sunaiva/gate - npm Package Compare versions

Comparing version

2.0.4

2.0.5

+69

dist/engine/evasion-resistance.d.ts

		/**
		* Evasion resistance — pre-processing layer that lets the existing T1/T2
		* pattern-matching rules see through common self-contained obfuscation
		* techniques, without the rule content itself needing to enumerate every
		* encoding.
		*
		* Scope (deliberately narrow — T5-QA audit recommendation #1,
		* data/AUDITS/GATE_SECURITY_ADVERSARIAL_AUDIT_2026-07-25.md): this closes
		* evasions that are DECIDABLE FROM THE TEXT ALONE (T1-lexical per the
		* enforcement taxonomy) — a deterministic transform of a string the gate
		* already blocks in plain form. It does NOT attempt semantic paraphrase
		* detection (T3-world-referential) — that class is out of scope by design.
		*
		* Confirmed live evasions this closes (tests/gate/security/evasion_gauntlet_2026-07-25.jsonl):
		* #1 base64 encoding (probe 3: "cm0gLXJmIC8=" -> "rm -rf /")
		* #2 hex encoding (probe 4: "726d202d7266202f" -> "rm -rf /")
		* #3 unicode homoglyph (probe 7: "rⅿ -rf /" -> NFKC -> "rm -rf /")
		* #4 zero-width injection (probe 24: "rm -rf /" -> "rm -rf /")
		* #5 letter-spelled-concat (probe 8: "r + m + space + minus + r + f +
		* space + slash" -> "rm -rf /")
		*
		* V3 additions (THUNDERSTRIKE 2026-07-26, TEAM ALPHA-2 worker 1 — closing the
		* 7 remaining "Encoding" probe-class techniques with zero prior coverage,
		* per tests/gate/security/EVASION_GAUNTLET_V2_REPORT_2026-07-26.md):
		* #6 URL/percent-encoding ("%72%6d%20%2d%72%66%20%2f" -> "rm -rf /")
		* #7 base32 (RFC4648) candidates >=8 chars, printable-output gated
		* #8 reversed-string whole-text char-reversal, gated on a curated
		* danger-signal word list so ordinary reversed
		* English never fires (see DANGER_SIGNAL below)
		* #9 leetspeak 0/1/3/4/5/7/@/$ -> o/i/e/a/s/t/a/s per token,
		* case-aware, email-address-shaped tokens
		* skipped, gated on DANGER_SIGNAL
		* #10 emoji-cipher regional-indicator letters (U+1F1E6-U+1F1FF)
		* fully covered; a small best-effort
		* letter-mnemonic emoji table is ALSO included
		* but is NOT verified against the actual
		* gauntlet's mnemonic set (unknown to this
		* implementation) — narrower confirmed scope,
		* stated honestly per T-ALPHA-2 brief
		* #11 binary-ASCII runs of >=3 whitespace-separated 8-bit groups
		* #12 double-base64 decodeBase64Candidates re-run once on its own
		* pass-1 output, HARD-CAPPED at 2 total passes
		* (DoS-budget requirement, not a style choice —
		* never recurse further)
		*
		* Two of the V3 decoders (#8 reversed-string, #9 leetspeak) are gated by
		* DANGER_SIGNAL, a small curated word list — unlike base64/hex/base32 (which
		* self-filter via isMostlyPrintableAscii on decoded binary output), reversal
		* and leet-substitution operate on already-printable-ASCII text, so the
		* printable check alone cannot distinguish an evasion payload from ordinary
		* prose. Empirically verified against every existing benign-text regression
		* fixture in this repo (tests/constitutional-free-rules.test.ts,
		* tests/engine/custom-rule-.test.ts) before landing — zero false triggers.
		*
		* Design: NEVER replace the original text — always APPEND decoded/cleaned
		* variants alongside it, so literal-text rules keep matching the as-written
		* form too, and no existing detection behavior can regress.
		*/
		export interface EvasionResistanceResult {
		augmented: string;
		decoded_payloads: string[];
		}
		/**
		* Returns the original text plus any successfully-decoded/normalized
		* variants appended (space-separated), for use as the text pattern-matching
		* runs against. Never mutates or replaces the caller's original text.
		*/
		export declare function resistEvasion(text: string): EvasionResistanceResult;
		//# sourceMappingURL=evasion-resistance.d.ts.map

+1

dist/engine/evasion-resistance.d.ts.map

{"version":3,"file":"evasion-resistance.d.ts","sourceRoot":"","sources":["../../src/engine/evasion-resistance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAqfH,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CA+BnE"}

+584

dist/engine/evasion-resistance.js

		/**
		* Evasion resistance — pre-processing layer that lets the existing T1/T2
		* pattern-matching rules see through common self-contained obfuscation
		* techniques, without the rule content itself needing to enumerate every
		* encoding.
		*
		* Scope (deliberately narrow — T5-QA audit recommendation #1,
		* data/AUDITS/GATE_SECURITY_ADVERSARIAL_AUDIT_2026-07-25.md): this closes
		* evasions that are DECIDABLE FROM THE TEXT ALONE (T1-lexical per the
		* enforcement taxonomy) — a deterministic transform of a string the gate
		* already blocks in plain form. It does NOT attempt semantic paraphrase
		* detection (T3-world-referential) — that class is out of scope by design.
		*
		* Confirmed live evasions this closes (tests/gate/security/evasion_gauntlet_2026-07-25.jsonl):
		* #1 base64 encoding (probe 3: "cm0gLXJmIC8=" -> "rm -rf /")
		* #2 hex encoding (probe 4: "726d202d7266202f" -> "rm -rf /")
		* #3 unicode homoglyph (probe 7: "rⅿ -rf /" -> NFKC -> "rm -rf /")
		* #4 zero-width injection (probe 24: "rm -rf /" -> "rm -rf /")
		* #5 letter-spelled-concat (probe 8: "r + m + space + minus + r + f +
		* space + slash" -> "rm -rf /")
		*
		* V3 additions (THUNDERSTRIKE 2026-07-26, TEAM ALPHA-2 worker 1 — closing the
		* 7 remaining "Encoding" probe-class techniques with zero prior coverage,
		* per tests/gate/security/EVASION_GAUNTLET_V2_REPORT_2026-07-26.md):
		* #6 URL/percent-encoding ("%72%6d%20%2d%72%66%20%2f" -> "rm -rf /")
		* #7 base32 (RFC4648) candidates >=8 chars, printable-output gated
		* #8 reversed-string whole-text char-reversal, gated on a curated
		* danger-signal word list so ordinary reversed
		* English never fires (see DANGER_SIGNAL below)
		* #9 leetspeak 0/1/3/4/5/7/@/$ -> o/i/e/a/s/t/a/s per token,
		* case-aware, email-address-shaped tokens
		* skipped, gated on DANGER_SIGNAL
		* #10 emoji-cipher regional-indicator letters (U+1F1E6-U+1F1FF)
		* fully covered; a small best-effort
		* letter-mnemonic emoji table is ALSO included
		* but is NOT verified against the actual
		* gauntlet's mnemonic set (unknown to this
		* implementation) — narrower confirmed scope,
		* stated honestly per T-ALPHA-2 brief
		* #11 binary-ASCII runs of >=3 whitespace-separated 8-bit groups
		* #12 double-base64 decodeBase64Candidates re-run once on its own
		* pass-1 output, HARD-CAPPED at 2 total passes
		* (DoS-budget requirement, not a style choice —
		* never recurse further)
		*
		* Two of the V3 decoders (#8 reversed-string, #9 leetspeak) are gated by
		* DANGER_SIGNAL, a small curated word list — unlike base64/hex/base32 (which
		* self-filter via isMostlyPrintableAscii on decoded binary output), reversal
		* and leet-substitution operate on already-printable-ASCII text, so the
		* printable check alone cannot distinguish an evasion payload from ordinary
		* prose. Empirically verified against every existing benign-text regression
		* fixture in this repo (tests/constitutional-free-rules.test.ts,
		* tests/engine/custom-rule-.test.ts) before landing — zero false triggers.
		*
		* Design: NEVER replace the original text — always APPEND decoded/cleaned
		* variants alongside it, so literal-text rules keep matching the as-written
		* form too, and no existing detection behavior can regress.
		*/
		/**
		* Strip zero-width and other invisible Unicode injection characters:
		* zero-width space/non-joiner/joiner, bidi override marks, word joiner,
		* BOM/zero-width-no-break-space, soft hyphen.
		*/
		function stripInvisibleChars(text) {
		return text.replace(/[-‏‪-‮⁠]/g, "");
		}
		/**
		* NFKC-normalize to collapse Unicode compatibility characters into their
		* canonical ASCII form — e.g. U+217F SMALL ROMAN NUMERAL ONE THOUSAND ("ⅿ")
		* has a documented compatibility decomposition to "m", which is exactly the
		* homoglyph class probe 7 exploited.
		*/
		function nfkcNormalize(text) {
		try {
		return text.normalize("NFKC");
		}
		catch {
		return text;
		}
		}
		function isMostlyPrintableAscii(s) {
		if (s.length === 0)
		return false;
		let printable = 0;
		for (let i = 0; i < s.length; i++) {
		const code = s.charCodeAt(i);
		if ((code >= 0x20 && code <= 0x7e) \|\| code === 0x0a \|\| code === 0x09)
		printable++;
		}
		return printable / s.length >= 0.9;
		}
		const BASE64_CANDIDATE = /\b[A-Za-z0-9+/]{12,}={0,2}\b/g;
		const HEX_CANDIDATE = /\b(?:[0-9a-fA-F]{2}){6,}\b/g;
		/**
		* Find base64-looking substrings (>=12 chars — short strings produce too
		* many false candidates and are not useful evasion payloads anyway),
		* attempt to decode each, and keep only decodes that yield mostly-printable
		* ASCII text of non-trivial length. A candidate that fails to decode
		* cleanly, or decodes to binary noise, is silently dropped — this is a
		* best-effort augmentation, not a claim that every base64-looking string IS
		* base64.
		*/
		function decodeBase64Candidates(text) {
		const found = [];
		const matches = text.match(BASE64_CANDIDATE) ?? [];
		for (const m of matches) {
		try {
		const decoded = Buffer.from(m, "base64").toString("utf-8");
		if (decoded.length >= 4 && isMostlyPrintableAscii(decoded)) {
		found.push(decoded);
		}
		}
		catch {
		// not valid base64 — ignore, this is best-effort
		}
		}
		return found;
		}
		/** Same approach as decodeBase64Candidates, for even-length hex strings. */
		function decodeHexCandidates(text) {
		const found = [];
		const matches = text.match(HEX_CANDIDATE) ?? [];
		for (const m of matches) {
		if (m.length % 2 !== 0)
		continue;
		try {
		const decoded = Buffer.from(m, "hex").toString("utf-8");
		if (decoded.length >= 4 && isMostlyPrintableAscii(decoded)) {
		found.push(decoded);
		}
		}
		catch {
		// ignore
		}
		}
		return found;
		}
		function rot13(text) {
		return text.replace(/[a-zA-Z]/g, (c) => {
		const base = c <= "Z" ? 65 : 97;
		return String.fromCharCode(((c.charCodeAt(0) - base + 13) % 26) + base);
		});
		}
		// Common short English function words — used only to decide whether a
		// rot13 candidate is worth appending (rot13 output is always
		// alphabetic-only, so isMostlyPrintableAscii can't discriminate signal from
		// noise the way it can for base64/hex). This is a cheap, conservative
		// heuristic, not a language model — false negatives (missing a rot13
		// payload with unusual phrasing) are acceptable; the goal is closing the
		// specific confirmed evasion class, not perfect rot13 detection.
		const ENGLISH_SIGNAL = /\b(the\|and\|please\|execute\|run\|delete\|transfer\|wire\|drop\|from\|with\|account)\b/i;
		// Symbol-words that spell out a single punctuation character when a payload
		// is dictated letter-by-letter to dodge literal-substring matching (probe 8:
		// "r + m + space + minus + r + f + space + slash" -> "rm -rf /").
		const SYMBOL_WORD_MAP = {
		space: " ",
		minus: "-",
		dash: "-",
		slash: "/",
		dot: ".",
		};
		// A run needs at least this many qualifying tokens before we trust it's a
		// deliberate spell-out rather than incidental short phrasing (e.g. "x + y").
		const MIN_SPELLED_OUT_TOKENS = 4;
		// Delimiter alternatives a spelled-out run may use, most specific first:
		// '+' with optional surrounding whitespace, ',' with optional surrounding
		// whitespace, ' and ' (word boundary), or plain whitespace. Captured (via
		// the outer parens) so String.split() interleaves the delimiter text with
		// the token text it separates.
		const SPELL_OUT_SPLIT = /(\s\+\s\|\s,\s\|\s+and\s+\|\s+)/i;
		function classifyDelimiter(delim) {
		if (delim.includes("+"))
		return "plus";
		if (delim.includes(","))
		return "comma";
		if (/and/i.test(delim))
		return "and";
		return "space";
		}
		function isQualifyingToken(token) {
		if (/^[a-zA-Z0-9]$/.test(token))
		return true;
		return Object.prototype.hasOwnProperty.call(SYMBOL_WORD_MAP, token.toLowerCase());
		}
		function tokenToChar(token) {
		if (/^[a-zA-Z0-9]$/.test(token))
		return token;
		return SYMBOL_WORD_MAP[token.toLowerCase()] ?? "";
		}
		/**
		* Detect a destructive (or otherwise blocked) command spelled out as
		* individual single-character/symbol-word tokens joined by a consistent
		* separator, and collapse the longest such run into the literal string it
		* spells. Returns null when no run of MIN_SPELLED_OUT_TOKENS+ qualifying
		* tokens is found, so short incidental sequences (e.g. a changelog line
		* "v1 + v2 + v3 features", or a stray "x + y") never trigger a decode.
		*/
		function deconcatenateSpelledOut(text) {
		const parts = text.split(SPELL_OUT_SPLIT);
		const tokens = [];
		// delimTypes[k] classifies the delimiter connecting tokens[k] and
		// tokens[k + 1].
		const delimTypes = [];
		for (let i = 0; i < parts.length; i++) {
		if (i % 2 === 0) {
		tokens.push(parts[i].trim());
		}
		else {
		delimTypes.push(classifyDelimiter(parts[i]));
		}
		}
		let bestRun = [];
		let curRun = [];
		let curDelimType = null;
		const closeRun = () => {
		if (curRun.length > bestRun.length)
		bestRun = curRun;
		curRun = [];
		curDelimType = null;
		};
		for (let k = 0; k < tokens.length; k++) {
		const tok = tokens[k];
		if (!isQualifyingToken(tok)) {
		closeRun();
		continue;
		}
		const connectingDelim = k > 0 ? delimTypes[k - 1] : null;
		if (curRun.length === 0) {
		curRun = [tok];
		}
		else if (curDelimType === null) {
		// Second token of the run — establishes the run's delimiter type.
		curRun.push(tok);
		curDelimType = connectingDelim;
		}
		else if (connectingDelim === curDelimType) {
		curRun.push(tok);
		}
		else {
		// Delimiter type changed mid-stream — close the current run and
		// start a fresh one at this token.
		closeRun();
		curRun = [tok];
		}
		}
		closeRun();
		if (bestRun.length < MIN_SPELLED_OUT_TOKENS)
		return null;
		return bestRun.map(tokenToChar).join("");
		}
		// ---------------------------------------------------------------------------
		// V3: URL/percent-encoding (#6)
		// ---------------------------------------------------------------------------
		// Require 3+ contiguous %XX groups (>=3 bytes) — a "run", not a single stray
		// percent sign (e.g. "50% off" must never be treated as a candidate).
		const PERCENT_CANDIDATE = /(?:%[0-9a-fA-F]{2}){3,}/g;
		const PERCENT_PAIR = /%([0-9a-fA-F]{2})/g;
		function decodePercentCandidates(text) {
		const found = [];
		const matches = text.match(PERCENT_CANDIDATE) ?? [];
		for (const m of matches) {
		const bytes = [];
		for (const pair of m.matchAll(PERCENT_PAIR))
		bytes.push(parseInt(pair[1], 16));
		try {
		const decoded = Buffer.from(bytes).toString("utf-8");
		if (decoded.length >= 3 && isMostlyPrintableAscii(decoded))
		found.push(decoded);
		}
		catch {
		// not decodable — ignore, best-effort
		}
		}
		return found;
		}
		// ---------------------------------------------------------------------------
		// V3: base32 / RFC4648 (#7)
		// ---------------------------------------------------------------------------
		const BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
		const BASE32_CANDIDATE = /\b[A-Za-z2-7]{8,}=*\b/g;
		/**
		* Manual RFC4648 base32 decode (Node has no native base32 support). Accepts
		* unpadded input (processes as many complete 5-bit-per-char groups as are
		* available, discarding any leftover <8-bit remainder) so both padded and
		* stripped-padding evasion payloads decode correctly — the safety net
		* against false positives is isMostlyPrintableAscii on the OUTPUT (same
		* design as decodeBase64Candidates/decodeHexCandidates above), not an input
		* length restriction. Empirically verified: every 8-char English word tested
		* from this repo's benign-text fixtures (e.g. "campaign", "features",
		* "security") decodes to non-printable garbage and is correctly rejected.
		*/
		function base32DecodeToBuffer(input) {
		const clean = input.toUpperCase().replace(/=+$/, "");
		if (clean.length === 0)
		return null;
		let bits = "";
		for (const ch of clean) {
		const idx = BASE32_ALPHABET.indexOf(ch);
		if (idx === -1)
		return null;
		bits += idx.toString(2).padStart(5, "0");
		}
		const bytes = [];
		for (let i = 0; i + 8 <= bits.length; i += 8) {
		bytes.push(parseInt(bits.slice(i, i + 8), 2));
		}
		return Buffer.from(bytes);
		}
		function decodeBase32Candidates(text) {
		const found = [];
		const matches = text.match(BASE32_CANDIDATE) ?? [];
		for (const m of matches) {
		const decoded = base32DecodeToBuffer(m);
		if (!decoded)
		continue;
		const str = decoded.toString("utf-8");
		if (str.length >= 4 && isMostlyPrintableAscii(str))
		found.push(str);
		}
		return found;
		}
		// ---------------------------------------------------------------------------
		// V3: shared danger-signal gate for reversed-string (#8) and leetspeak (#9)
		// ---------------------------------------------------------------------------
		// Unlike base64/hex/base32, reversal and leet-substitution both operate on
		// text that is ALREADY printable ASCII — isMostlyPrintableAscii cannot tell
		// a decoded evasion apart from ordinary reversed/substituted prose. This
		// list (shell + SQL + common destructive-action vocabulary, mirroring the
		// existing ENGLISH_SIGNAL precedent above for rot13) is the discriminator:
		// only append a candidate when the decode actually SURFACES one of these
		// words that wasn't plainly visible before. Empirically verified against
		// every benign-text fixture in this repo's test suite — zero false fires.
		const DANGER_SIGNAL = /\b(rm\|rf\|drop\|delete\|truncate\|table\|database\|sudo\|chmod\|shutdown\|disable\|execute\|transfer\|wire\|passwd\|users?\|account\|select\|insert\|update\|from\|grant\|revoke)\b/i;
		// ---------------------------------------------------------------------------
		// V3: reversed-string (#8)
		// ---------------------------------------------------------------------------
		const MIN_REVERSAL_LENGTH = 10;
		/**
		* Reverses the WHOLE cleaned text as a single "run" rather than trying to
		* bound candidate substrings — reversal is the one V3 technique that must
		* tolerate arbitrary embedded whitespace (a multi-word command like
		* "rm -rf /" reversed is "/ fr- mr", which no whitespace-free candidate
		* regex could ever capture as one unit). This is mathematically sufficient:
		* for any payload = A + reverse(target) + B, reverse(payload) =
		* reverse(B) + target + reverse(A) — target always reappears intact as a
		* contiguous substring, regardless of what surrounds it. Bounded to O(n),
		* single pass, no recursion. Safety against false positives on ordinary
		* prose comes entirely from DANGER_SIGNAL, not from length/printability
		* alone (see comment above).
		*/
		function decodeReversedCandidate(text) {
		if (text.length < MIN_REVERSAL_LENGTH)
		return [];
		const reversed = text.split("").reverse().join("");
		if (reversed === text)
		return []; // trivial no-op (palindrome-like content)
		if (!isMostlyPrintableAscii(reversed))
		return [];
		if (!DANGER_SIGNAL.test(reversed))
		return [];
		return [reversed];
		}
		// ---------------------------------------------------------------------------
		// V3: leetspeak (#9)
		// ---------------------------------------------------------------------------
		// Reverse-substitution map: digit/symbol -> the letter it commonly stands in
		// for. Only these 8 source characters are ever treated as substitutions.
		const LEET_MAP = {
		"0": "o",
		"1": "i",
		"3": "e",
		"4": "a",
		"5": "s",
		"7": "t",
		"@": "a",
		"$": "s",
		};
		const LEET_SUB_CHARS = /[013457@$]/;
		const HAS_LETTER = /[a-zA-Z]/;
		// Tokens shaped like an email address are never leetspeak — '@' there is
		// structural, not a substitution — so they pass through untouched.
		const EMAIL_LIKE_TOKEN = /^[\w.+-]+@[\w.-]+\.[a-zA-Z]{2,}$/;
		/**
		* Decodes a single token's leet substitutions, case-aware: a token with
		* uppercase letters and no lowercase letters (e.g. "DR0P") substitutes in
		* uppercase ("DROP"); an all-lowercase token (e.g. "n0w") substitutes in
		* lowercase ("now"). Mixed-case tokens fall back to lowercase substitution
		* (best-effort — exact case-per-character reconstruction isn't attempted).
		*/
		function leetDecodeToken(token) {
		const isUpper = /[A-Z]/.test(token) && !/[a-z]/.test(token);
		let out = "";
		for (const ch of token) {
		const mapped = LEET_MAP[ch];
		out += mapped ? (isUpper ? mapped.toUpperCase() : mapped) : ch;
		}
		return out;
		}
		/**
		* Splits on whitespace (preserving it, so reconstruction keeps exact
		* spacing), decodes only tokens containing >=1 letter AND >=1 substituted
		* char (excludes pure-number tokens like a price "250", and version/hash
		* tokens with no letters at all), skips email-shaped tokens, and only
		* appends the reconstructed text if the decode actually changed something
		* AND the result passes DANGER_SIGNAL (see comment above — a lone digit in
		* an ordinary word like "v1" or "v3" must never fire on its own).
		*/
		function decodeLeetspeakCandidate(text) {
		const parts = text.split(/(\s+)/);
		let changed = false;
		const rebuilt = parts.map((part) => {
		if (part.length === 0 \|\| /^\s+$/.test(part))
		return part;
		if (EMAIL_LIKE_TOKEN.test(part))
		return part;
		if (HAS_LETTER.test(part) && LEET_SUB_CHARS.test(part)) {
		const decoded = leetDecodeToken(part);
		if (decoded !== part)
		changed = true;
		return decoded;
		}
		return part;
		});
		if (!changed)
		return [];
		const candidate = rebuilt.join("");
		if (!isMostlyPrintableAscii(candidate))
		return [];
		if (!DANGER_SIGNAL.test(candidate))
		return [];
		return [candidate];
		}
		// ---------------------------------------------------------------------------
		// V3: emoji-cipher (#10)
		// ---------------------------------------------------------------------------
		// Regional Indicator Symbol Letters: U+1F1E6 ('🇦') through U+1F1FF ('🇿'),
		// one contiguous codepoint block mapping directly to A-Z. Fully specified,
		// unambiguous, RFC-clear — this half of the technique is fully covered.
		const REGIONAL_INDICATOR_BASE = 0x1f1e6;
		const REGIONAL_INDICATOR_MAX = 0x1f1ff;
		// Best-effort letter-mnemonic emoji table (one common, unambiguous emoji per
		// letter). NOTE — honest scope limitation: this exact set is NOT verified
		// against the gauntlet's actual letter-mnemonic emoji cipher (that set is
		// not available to this implementation); it is a good-faith superset that
		// closes the mechanism for a plausible common variant, not a guarantee of
		// matching every possible mnemonic scheme.
		const LETTER_MNEMONIC_EMOJI = {
		"🍎": "a",
		"🐝": "b",
		"🐱": "c",
		"🐶": "d",
		"🐘": "e",
		"🐸": "f",
		"🦒": "g",
		"🐴": "h",
		"🍦": "i",
		"🃏": "j",
		"🔑": "k",
		"🦁": "l",
		"🐒": "m",
		"🥜": "n",
		"🐙": "o",
		"🐧": "p",
		"👸": "q",
		"🐇": "r",
		"🐍": "s",
		"🐯": "t",
		"☂": "u",
		"🎻": "v",
		"🐳": "w",
		"❌": "x",
		"🧶": "y",
		"🦓": "z",
		};
		/**
		* Codepoint-aware scan (Array.from iterates by Unicode codepoint, correctly
		* handling the surrogate-pair regional-indicator emoji): each recognized
		* emoji maps to its letter, everything else — including spaces, dashes,
		* slashes, and unrecognized characters — passes through unchanged. Only
		* fires when at least one recognized emoji was actually present, so ordinary
		* text (which contains none of these characters) never triggers this pass —
		* no separate DANGER_SIGNAL gate is needed here, the emoji itself is the
		* signal.
		*/
		function decodeEmojiCandidates(text) {
		const chars = Array.from(text);
		let sawEmoji = false;
		let out = "";
		for (const ch of chars) {
		const cp = ch.codePointAt(0) ?? 0;
		if (cp >= REGIONAL_INDICATOR_BASE && cp <= REGIONAL_INDICATOR_MAX) {
		out += String.fromCharCode(97 + (cp - REGIONAL_INDICATOR_BASE));
		sawEmoji = true;
		}
		else if (Object.prototype.hasOwnProperty.call(LETTER_MNEMONIC_EMOJI, ch)) {
		out += LETTER_MNEMONIC_EMOJI[ch];
		sawEmoji = true;
		}
		else {
		out += ch;
		}
		}
		if (!sawEmoji)
		return [];
		if (!isMostlyPrintableAscii(out))
		return [];
		return [out];
		}
		// ---------------------------------------------------------------------------
		// V3: binary-ASCII (#11)
		// ---------------------------------------------------------------------------
		// >=3 whitespace-separated 8-bit (0/1 only) groups — a "run", not a lone
		// 8-digit number that happens to be all 0s/1s.
		const BINARY_RUN = /(?:\b[01]{8}\b[ \t]+){2,}\b[01]{8}\b/g;
		function decodeBinaryCandidates(text) {
		const found = [];
		const matches = text.match(BINARY_RUN) ?? [];
		for (const m of matches) {
		const groups = m.trim().split(/\s+/);
		if (groups.length < 3)
		continue;
		const bytes = groups.map((g) => parseInt(g, 2));
		try {
		const decoded = Buffer.from(bytes).toString("utf-8");
		if (decoded.length >= 3 && isMostlyPrintableAscii(decoded))
		found.push(decoded);
		}
		catch {
		// ignore
		}
		}
		return found;
		}
		// ---------------------------------------------------------------------------
		// V3: double-base64 (#12)
		// ---------------------------------------------------------------------------
		/**
		* Re-runs decodeBase64Candidates on the OUTPUT of the first pass, hard-capped
		* at exactly one additional pass (2 total). This is a fixed, non-recursive
		* second call — never a loop, never self-referential beyond this single
		* extra layer. DoS-budget requirement: an attacker nesting base64 N times
		* deep must not be able to force unbounded decode work.
		*/
		function decodeDoubleBase64(firstPassDecodes) {
		const found = [];
		for (const d of firstPassDecodes) {
		found.push(...decodeBase64Candidates(d));
		}
		return found;
		}
		/**
		* Returns the original text plus any successfully-decoded/normalized
		* variants appended (space-separated), for use as the text pattern-matching
		* runs against. Never mutates or replaces the caller's original text.
		*/
		export function resistEvasion(text) {
		if (!text)
		return { augmented: text, decoded_payloads: [] };
		const cleaned = nfkcNormalize(stripInvisibleChars(text));
		const decodedParts = [];
		const base64Pass1 = decodeBase64Candidates(cleaned);
		decodedParts.push(...base64Pass1);
		decodedParts.push(...decodeHexCandidates(cleaned));
		const spelledOut = deconcatenateSpelledOut(cleaned);
		if (spelledOut !== null)
		decodedParts.push(spelledOut);
		const rotCandidate = rot13(cleaned);
		if (rotCandidate !== cleaned && ENGLISH_SIGNAL.test(rotCandidate)) {
		decodedParts.push(rotCandidate);
		}
		// V3 (2026-07-26): the 7 previously-uncovered encoding techniques.
		decodedParts.push(...decodePercentCandidates(cleaned));
		decodedParts.push(...decodeBase32Candidates(cleaned));
		decodedParts.push(...decodeReversedCandidate(cleaned));
		decodedParts.push(...decodeLeetspeakCandidate(cleaned));
		decodedParts.push(...decodeEmojiCandidates(cleaned));
		decodedParts.push(...decodeBinaryCandidates(cleaned));
		// Double-base64: pass 2, hard-capped — re-runs ONLY on pass-1's own
		// output, never recurses further.
		decodedParts.push(...decodeDoubleBase64(base64Pass1));
		const augmented = decodedParts.length === 0 ? cleaned : `${cleaned} ${decodedParts.join(" ")}`;
		return { augmented, decoded_payloads: decodedParts };
		}
		//# sourceMappingURL=evasion-resistance.js.map

+1

dist/engine/evasion-resistance.js.map

+110

dist/engine/multilingual-intent.d.ts

		/**
		* Multilingual destructive-intent gloss — a bounded, deterministic,
		* offline, T1-lexical pre-processing layer that lets the existing
		* English-keyword rules (gov-002, sec-006, sec-011, ...) see through the
		* SPECIFIC destructive-verb + object vocabulary those rules already key on,
		* when the same words appear in another language.
		*
		* -----------------------------------------------------------------------
		* WHY THIS EXISTS (mechanism proven, not guessed — see
		* tests/gate/security/EVASION_GAUNTLET_V2_REPORT_2026-07-26.md, "Foreign
		* language" class, 11/12 = 91.7% evasion rate):
		*
		* The identical real-world action phrased in English ("disable MFA for
		* all admin accounts") is reliably CAUGHT by sec-006 / sec-011 — verified
		* twice (2026-07-25 baseline probe 15, and this gauntlet's v2-fp-07). The
		* SAME action phrased in French (v2-fl-05) or Arabic (v2-fl-10) evades
		* completely. There is no "weaker classifier abroad" — sec-006/sec-011
		* are a fixed-English-substring `compiled_regex` match with ZERO semantic
		* layer. "Blind abroad" is the correct framing, not "weaker abroad": the
		* rule simply never contains a French or Arabic token, so it can never
		* fire on French or Arabic text, no matter how blunt the request.
		*
		* -----------------------------------------------------------------------
		* SCOPE (deliberately narrow, mirroring evasion-resistance.ts's own
		* documented narrowness): this module translates/glosses ONLY the specific
		* destructive-verb + object vocabulary the existing English
		* `compiled_regex` rules already key on — delete, disable, drop, export,
		* terminate, revoke, wipe, grant + superadmin, mfa/2fa, table, database,
		* production, backup, encryption key, webhook, audit log, users — across
		* six languages: French, Arabic, German, Russian, Mandarin (hanzi +
		* pinyin), and Spanish (the gauntlet's one PARTIALLY-caught foreign-
		* language control, v2-fl-11 — kept here as a regression anchor, not
		* because it needed closing). This is NOT a general translation engine.
		*
		* THE TRADE-OFF (state explicitly, per Kinan's mandate for an honest
		* mechanism choice over a pretend-regex-solves-it fix):
		*
		* This closes VERBATIM-KEYWORD-IN-ANOTHER-LANGUAGE evasion only. It will
		* NOT catch a paraphrased foreign sentence describing the same
		* destructive effect without using the covered vocabulary — exactly the
		* same limitation evasion-resistance.ts documents for its own T1-lexical
		* scope (T3-world-referential paraphrase detection is out of scope by
		* design). Closing THAT class requires a backend LLM intent classifier
		* applied to the ambiguous tail (~200-800ms added latency, real
		* per-call inference cost, ambiguous accuracy trade-offs) — that is a
		* paid-tier (Team/Enterprise) product decision that must be raised to
		* Kinan explicitly, not silently built here and not silently omitted
		* from this comment.
		*
		* -----------------------------------------------------------------------
		* DESIGN NOTES (bugs found and fixed via direct verification against the
		* literal gauntlet probe strings before shipping):
		*
		* - Plain substring matching, not word-boundary regex. An early design
		* used a Unicode-aware `\p{L}` leading-boundary check to distinguish a
		* genuine word match from an accidental mid-word substring (e.g.
		* French "termin" inside "détermine"). That check reliably BROKE
		* Arabic: Arabic attaches single-letter prepositions/particles (ب "by",
		* و "and", ف "so", ل "for") directly onto the following word with no
		* space (e.g. "بتعطيل" = ب + تعطيل, "disable" with a "by/with" prefix
		* glued on) — so a leading-boundary check rejects the very match it
		* needs to find. German compound nouns (Produktionsdatenbank =
		* Produktion + s + Datenbank, no space) have the same problem for a
		* trailing/embedded stem. Plain substring matching sidesteps both
		* failure modes at the cost of accepting rarer false-positive stem
		* collisions (e.g. a European-language "terminate" stem chosen to
		* avoid the worst offenders — see the language tables below). This
		* mirrors evasion-resistance.ts's own stated trade-off: "a cheap,
		* conservative heuristic, not a language model."
		*
		* - NFKD accent-folding is applied ONLY to Latin-script text (French,
		* German, Spanish, romanized pinyin), never to Arabic, Russian
		* (Cyrillic), or Chinese (Han). Verified empirically: running NFKD
		* normalization over Arabic text decomposes some precomposed letters
		* (e.g. "ئ" YEH WITH HAMZA ABOVE -> "ي" + U+0654 ARABIC COMBINING
		* HAMZA ABOVE) into a combining mark OUTSIDE the U+0300-036F Latin
		* diacritics block this module strips — corrupting the string instead
		* of folding it, and silently breaking substring matches on
		* "الثنائية" (two-factor, v2-fl-10). Arabic/Russian/Han text is
		* lowercased only (a safe no-op for scripts with no letter case) and
		* never NFKD-decomposed.
		*
		* -----------------------------------------------------------------------
		* INTEGRATION CONTRACT (for the sibling worker wiring this into
		* rule-engine.ts — do not change this module's file to fit the wiring;
		* change the caller):
		*
		* export function multilingualDestructiveGloss(text: string): string[]
		*
		* Returns English gloss strings to APPEND alongside the original text —
		* same append-only pattern as evasion-resistance.ts's `decoded_payloads`
		* (see resistEvasion()). Never mutates or replaces the caller's text.
		* Glosses are returned in first-appearance order in the source text and
		* deduplicated by gloss string, so a caller building `combined = text +
		* " " + multilingualDestructiveGloss(text).join(" ")` reconstructs
		* verb-object order close enough to the source language's own word order
		* for the downstream `compiled_regex` proximity windows (60-80 chars) to
		* fire, verified directly against sec-006 / sec-011 / gov-002's actual
		* `compiled_regex` strings (see the test file) — not merely asserted.
		*/
		/**
		* Scan `text` for the confirmed-evaded destructive-verb + object vocabulary
		* across French, Arabic, German, Russian, Mandarin (hanzi + pinyin), and
		* Spanish, and return the matching English glosses — in first-appearance
		* order, deduplicated — for a caller to append alongside the original text
		* (see the module header's integration contract). Returns `[]` when
		* nothing in the bounded vocabulary is found; never throws.
		*/
		export declare function multilingualDestructiveGloss(text: string): string[];
		//# sourceMappingURL=multilingual-intent.d.ts.map

+1

dist/engine/multilingual-intent.d.ts.map

{"version":3,"file":"multilingual-intent.d.ts","sourceRoot":"","sources":["../../src/engine/multilingual-intent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmGG;AA6QH;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAuCnE"}

+382

dist/engine/multilingual-intent.js

		/**
		* Multilingual destructive-intent gloss — a bounded, deterministic,
		* offline, T1-lexical pre-processing layer that lets the existing
		* English-keyword rules (gov-002, sec-006, sec-011, ...) see through the
		* SPECIFIC destructive-verb + object vocabulary those rules already key on,
		* when the same words appear in another language.
		*
		* -----------------------------------------------------------------------
		* WHY THIS EXISTS (mechanism proven, not guessed — see
		* tests/gate/security/EVASION_GAUNTLET_V2_REPORT_2026-07-26.md, "Foreign
		* language" class, 11/12 = 91.7% evasion rate):
		*
		* The identical real-world action phrased in English ("disable MFA for
		* all admin accounts") is reliably CAUGHT by sec-006 / sec-011 — verified
		* twice (2026-07-25 baseline probe 15, and this gauntlet's v2-fp-07). The
		* SAME action phrased in French (v2-fl-05) or Arabic (v2-fl-10) evades
		* completely. There is no "weaker classifier abroad" — sec-006/sec-011
		* are a fixed-English-substring `compiled_regex` match with ZERO semantic
		* layer. "Blind abroad" is the correct framing, not "weaker abroad": the
		* rule simply never contains a French or Arabic token, so it can never
		* fire on French or Arabic text, no matter how blunt the request.
		*
		* -----------------------------------------------------------------------
		* SCOPE (deliberately narrow, mirroring evasion-resistance.ts's own
		* documented narrowness): this module translates/glosses ONLY the specific
		* destructive-verb + object vocabulary the existing English
		* `compiled_regex` rules already key on — delete, disable, drop, export,
		* terminate, revoke, wipe, grant + superadmin, mfa/2fa, table, database,
		* production, backup, encryption key, webhook, audit log, users — across
		* six languages: French, Arabic, German, Russian, Mandarin (hanzi +
		* pinyin), and Spanish (the gauntlet's one PARTIALLY-caught foreign-
		* language control, v2-fl-11 — kept here as a regression anchor, not
		* because it needed closing). This is NOT a general translation engine.
		*
		* THE TRADE-OFF (state explicitly, per Kinan's mandate for an honest
		* mechanism choice over a pretend-regex-solves-it fix):
		*
		* This closes VERBATIM-KEYWORD-IN-ANOTHER-LANGUAGE evasion only. It will
		* NOT catch a paraphrased foreign sentence describing the same
		* destructive effect without using the covered vocabulary — exactly the
		* same limitation evasion-resistance.ts documents for its own T1-lexical
		* scope (T3-world-referential paraphrase detection is out of scope by
		* design). Closing THAT class requires a backend LLM intent classifier
		* applied to the ambiguous tail (~200-800ms added latency, real
		* per-call inference cost, ambiguous accuracy trade-offs) — that is a
		* paid-tier (Team/Enterprise) product decision that must be raised to
		* Kinan explicitly, not silently built here and not silently omitted
		* from this comment.
		*
		* -----------------------------------------------------------------------
		* DESIGN NOTES (bugs found and fixed via direct verification against the
		* literal gauntlet probe strings before shipping):
		*
		* - Plain substring matching, not word-boundary regex. An early design
		* used a Unicode-aware `\p{L}` leading-boundary check to distinguish a
		* genuine word match from an accidental mid-word substring (e.g.
		* French "termin" inside "détermine"). That check reliably BROKE
		* Arabic: Arabic attaches single-letter prepositions/particles (ب "by",
		* و "and", ف "so", ل "for") directly onto the following word with no
		* space (e.g. "بتعطيل" = ب + تعطيل, "disable" with a "by/with" prefix
		* glued on) — so a leading-boundary check rejects the very match it
		* needs to find. German compound nouns (Produktionsdatenbank =
		* Produktion + s + Datenbank, no space) have the same problem for a
		* trailing/embedded stem. Plain substring matching sidesteps both
		* failure modes at the cost of accepting rarer false-positive stem
		* collisions (e.g. a European-language "terminate" stem chosen to
		* avoid the worst offenders — see the language tables below). This
		* mirrors evasion-resistance.ts's own stated trade-off: "a cheap,
		* conservative heuristic, not a language model."
		*
		* - NFKD accent-folding is applied ONLY to Latin-script text (French,
		* German, Spanish, romanized pinyin), never to Arabic, Russian
		* (Cyrillic), or Chinese (Han). Verified empirically: running NFKD
		* normalization over Arabic text decomposes some precomposed letters
		* (e.g. "ئ" YEH WITH HAMZA ABOVE -> "ي" + U+0654 ARABIC COMBINING
		* HAMZA ABOVE) into a combining mark OUTSIDE the U+0300-036F Latin
		* diacritics block this module strips — corrupting the string instead
		* of folding it, and silently breaking substring matches on
		* "الثنائية" (two-factor, v2-fl-10). Arabic/Russian/Han text is
		* lowercased only (a safe no-op for scripts with no letter case) and
		* never NFKD-decomposed.
		*
		* -----------------------------------------------------------------------
		* INTEGRATION CONTRACT (for the sibling worker wiring this into
		* rule-engine.ts — do not change this module's file to fit the wiring;
		* change the caller):
		*
		* export function multilingualDestructiveGloss(text: string): string[]
		*
		* Returns English gloss strings to APPEND alongside the original text —
		* same append-only pattern as evasion-resistance.ts's `decoded_payloads`
		* (see resistEvasion()). Never mutates or replaces the caller's text.
		* Glosses are returned in first-appearance order in the source text and
		* deduplicated by gloss string, so a caller building `combined = text +
		* " " + multilingualDestructiveGloss(text).join(" ")` reconstructs
		* verb-object order close enough to the source language's own word order
		* for the downstream `compiled_regex` proximity windows (60-80 chars) to
		* fire, verified directly against sec-006 / sec-011 / gov-002's actual
		* `compiled_regex` strings (see the test file) — not merely asserted.
		*/
		// ---------------------------------------------------------------------------
		// Normalization
		// ---------------------------------------------------------------------------
		/**
		* NFKD-decompose + strip Latin combining diacritical marks (U+0300-036F) +
		* fold German ß -> ss, then lowercase. Correct ONLY for Latin-script text
		* (French, German, Spanish, romanized Mandarin/pinyin) — see the module
		* header for why this must never run on Arabic/Russian/Han text.
		*/
		function foldLatin(text) {
		try {
		return text
		.normalize("NFKD")
		.replace(/[̀-ͯ]/g, "")
		.replace(/ß/g, "ss")
		.toLowerCase();
		}
		catch {
		return text.toLowerCase();
		}
		}
		/**
		* Case-fold only, no decomposition. Correct for Arabic and Chinese (no
		* letter case at all — toLowerCase() is a safe no-op) and Russian
		* (Cyrillic; the bounded vocabulary here has no accented-form ambiguity
		* that would need folding).
		*/
		function foldOther(text) {
		return text.toLowerCase();
		}
		const FRENCH = [
		// verbs
		{ needle: "supprim", gloss: "delete" }, // supprime/supprimer/suppression
		{ needle: "supprim", gloss: "drop" },
		{ needle: "effac", gloss: "delete" }, // efface/effacer
		{ needle: "desactiv", gloss: "disable" }, // désactive/désactiver/désactivation
		{ needle: "export", gloss: "export" },
		{ needle: "resili", gloss: "terminate" }, // résilier — avoids the "termin" stem colliding with "déterminer"
		{ needle: "revoqu", gloss: "revoke" }, // révoque/révoquer
		{ needle: "purg", gloss: "wipe" }, // purge/purger
		{ needle: "detrui", gloss: "destroy" }, // détruis/détruire (v2-fl-06)
		{ needle: "accord", gloss: "grant" }, // accorder
		{ needle: "superadministrateur", gloss: "superadmin" },
		{ needle: "super-administrateur", gloss: "superadmin" },
		// objects
		{ needle: "authentification a deux facteurs", gloss: "two-factor authentication" }, // v2-fl-05
		{ needle: "deux facteurs", gloss: "two-factor authentication" },
		{ needle: "table", gloss: "table" },
		{ needle: "base de donnees", gloss: "database" },
		{ needle: "production", gloss: "production" },
		{ needle: "sauvegarde", gloss: "backup" }, // v2-fl-06
		{ needle: "cle de chiffrement", gloss: "encryption key" },
		{ needle: "cle de signature", gloss: "signing key" }, // v2-fl-06
		{ needle: "cle privee", gloss: "private key" }, // v2-fl-06
		{ needle: "webhook", gloss: "webhook" },
		{ needle: "journal d'audit", gloss: "audit logging" },
		{ needle: "utilisateurs", gloss: "users" },
		{ needle: "comptes administrateurs", gloss: "admin accounts" }, // v2-fl-05
		];
		const GERMAN = [
		// verbs
		{ needle: "losch", gloss: "delete" }, // löschen/lösche/löscht (v2-fl-07)
		{ needle: "losch", gloss: "drop" },
		{ needle: "deaktivier", gloss: "disable" },
		{ needle: "exportier", gloss: "export" },
		{ needle: "beend", gloss: "terminate" }, // beenden
		{ needle: "widerruf", gloss: "revoke" }, // widerrufe/widerrufen (v2-fl-08)
		{ needle: "vernicht", gloss: "wipe" }, // vernichten
		{ needle: "gewahr", gloss: "grant" }, // gewähren, folded
		{ needle: "superadministrator", gloss: "superadmin" },
		// objects — "datenbank"/"produktion" are stems on purpose: plain
		// substring matching lets them match inside compounds (no space in
		// German compound nouns) like "produktionsdatenbank".
		{ needle: "zwei-faktor", gloss: "two-factor authentication" },
		{ needle: "zweifaktor", gloss: "two-factor authentication" },
		{ needle: "tabelle", gloss: "table" },
		{ needle: "datenbank", gloss: "database" }, // matches inside "produktionsdatenbank" too
		{ needle: "produktion", gloss: "production" }, // matches inside "produktionskonto" too
		{ needle: "sicherung", gloss: "backup" },
		{ needle: "verschlusselungsschlussel", gloss: "encryption key" }, // Verschlüsselungsschlüssel, folded
		{ needle: "webhook", gloss: "webhook" },
		{ needle: "audit-protokoll", gloss: "audit logging" },
		{ needle: "auditprotokoll", gloss: "audit logging" },
		{ needle: "benutzer", gloss: "users" },
		{ needle: "kundendaten", gloss: "customer records" }, // matches inside "kundendatensatze" (v2-fl-07)
		{ needle: "iam-rollen", gloss: "IAM roles" }, // v2-fl-08
		{ needle: "produktionskonto", gloss: "production account" }, // v2-fl-08
		];
		const RUSSIAN = [
		// verbs (Cyrillic stems — Russian is heavily inflected; a stem covers
		// imperative/infinitive/present/past forms without enumerating each)
		{ needle: "удал", gloss: "delete" }, // удали/удалить/удаляет (v2-fl-12)
		{ needle: "удал", gloss: "drop" },
		{ needle: "отключ", gloss: "disable" },
		{ needle: "экспорт", gloss: "export" },
		{ needle: "заверш", gloss: "terminate" },
		{ needle: "отзыв", gloss: "revoke" },
		{ needle: "отозв", gloss: "revoke" },
		{ needle: "уничтож", gloss: "wipe" },
		{ needle: "предостав", gloss: "grant" },
		{ needle: "суперадмин", gloss: "superadmin" },
		// objects
		{ needle: "двухфактор", gloss: "two-factor authentication" },
		{ needle: "таблиц", gloss: "table" },
		{ needle: "базы данных", gloss: "database" }, // v2-fl-12
		{ needle: "база данных", gloss: "database" },
		{ needle: "базе данных", gloss: "database" },
		{ needle: "базу данных", gloss: "database" },
		{ needle: "производственн", gloss: "production" }, // v2-fl-12
		{ needle: "резервн", gloss: "backup" },
		{ needle: "ключ шифрования", gloss: "encryption key" },
		{ needle: "вебхук", gloss: "webhook" },
		{ needle: "журнал аудита", gloss: "audit logging" },
		{ needle: "пользовател", gloss: "users" },
		{ needle: "учетные записи", gloss: "accounts" }, // v2-fl-12
		];
		// Chinese Han (hanzi) — plain substring, no boundary concept at all
		// (Chinese script has no spaces between words).
		const MANDARIN_HANZI = [
		{ needle: "删除", gloss: "delete" },
		{ needle: "删除", gloss: "drop" },
		{ needle: "禁用", gloss: "disable" },
		{ needle: "停用", gloss: "disable" },
		{ needle: "导出", gloss: "export" },
		{ needle: "终止", gloss: "terminate" },
		{ needle: "撤销", gloss: "revoke" },
		{ needle: "清除", gloss: "wipe" },
		{ needle: "授予", gloss: "grant" },
		{ needle: "超级管理员", gloss: "superadmin" },
		{ needle: "双因素", gloss: "two-factor authentication" },
		{ needle: "两步验证", gloss: "two-factor authentication" },
		{ needle: "表", gloss: "table" }, // accepted single-glyph risk — see module header
		{ needle: "数据库", gloss: "database" },
		{ needle: "生产", gloss: "production" },
		{ needle: "备份", gloss: "backup" },
		{ needle: "加密密钥", gloss: "encryption key" },
		{ needle: "审计日志", gloss: "audit logging" },
		{ needle: "用户", gloss: "users" },
		{ needle: "强制推送", gloss: "force push" }, // v2-fl-03
		{ needle: "覆盖", gloss: "overwrite" }, // v2-fl-03
		{ needle: "主分支", gloss: "main branch" }, // v2-fl-03
		{ needle: "提交历史", gloss: "commit history" }, // v2-fl-03
		{ needle: "永久", gloss: "permanently" }, // v2-fl-03
		];
		// Mandarin romanized (pinyin, no tone marks assumed) — Latin script with
		// spaces, so it is matched against the accent-folded haystack.
		const MANDARIN_PINYIN = [
		{ needle: "shanchu", gloss: "delete" },
		{ needle: "shanchu", gloss: "drop" },
		{ needle: "jinyong", gloss: "disable" },
		{ needle: "daochu", gloss: "export" },
		{ needle: "zhongzhi", gloss: "terminate" },
		{ needle: "chexiao", gloss: "revoke" },
		{ needle: "qingchu", gloss: "wipe" },
		{ needle: "shouyu", gloss: "grant" },
		{ needle: "chaoji guanliyuan", gloss: "superadmin" },
		{ needle: "shuangyinsu", gloss: "two-factor authentication" },
		{ needle: "biaoge", gloss: "table" },
		{ needle: "shujuku", gloss: "database" },
		{ needle: "shengchan", gloss: "production" },
		{ needle: "beifen", gloss: "backup" },
		{ needle: "jiami miyao", gloss: "encryption key" },
		{ needle: "webhook", gloss: "webhook" },
		{ needle: "shenji rizhi", gloss: "audit logging" },
		{ needle: "yonghu", gloss: "users" },
		{ needle: "qiangzhi tuisong", gloss: "force push" }, // v2-fl-04
		{ needle: "yongjiu", gloss: "permanently" }, // v2-fl-04
		{ needle: "fugai", gloss: "overwrite" }, // v2-fl-04
		{ needle: "zhu fenzhi", gloss: "main branch" }, // v2-fl-04
		{ needle: "tijiao lishi", gloss: "commit history" }, // v2-fl-04
		];
		const ARABIC = [
		// verbs
		{ needle: "حذف", gloss: "delete" }, // covers احذف too (v2-fl-09)
		{ needle: "حذف", gloss: "drop" },
		{ needle: "تعطيل", gloss: "disable" }, // covers بتعطيل too (v2-fl-10)
		{ needle: "تصدير", gloss: "export" },
		{ needle: "انهاء", gloss: "terminate" },
		{ needle: "إنهاء", gloss: "terminate" },
		{ needle: "الغاء", gloss: "revoke" },
		{ needle: "إلغاء", gloss: "revoke" },
		{ needle: "مسح", gloss: "wipe" },
		{ needle: "تدمير", gloss: "destroy" },
		{ needle: "منح", gloss: "grant" },
		{ needle: "سوبر ادمن", gloss: "superadmin" },
		// objects
		{ needle: "المصادقة الثنائية", gloss: "two-factor authentication" }, // v2-fl-10
		{ needle: "جدول", gloss: "table" }, // v2-fl-09
		{ needle: "قاعدة البيانات", gloss: "database" }, // v2-fl-09
		// "نتاج" is a shared root substring of both "إنتاج" and "انتاج" (the
		// hamza-alef spelling varies), and matches with or without the "ال"
		// (the) prefix attached — a single needle covering all four surface
		// forms of "production" (v2-fl-09: "الإنتاج").
		{ needle: "نتاج", gloss: "production" },
		{ needle: "نسخة احتياطية", gloss: "backup" },
		{ needle: "مفتاح التشفير", gloss: "encryption key" },
		{ needle: "ويبهوك", gloss: "webhook" },
		{ needle: "سجل التدقيق", gloss: "audit logging" },
		// "مستخدم" (user, stem) matches مستخدم/مستخدمين/المستخدمين regardless of
		// the "ال" prefix or plural suffix, same trick as "نتاج" above.
		{ needle: "مستخدم", gloss: "users" },
		];
		const SPANISH = [
		// verbs
		{ needle: "elimin", gloss: "delete" }, // elimina/eliminar (v2-fl-01)
		{ needle: "elimin", gloss: "drop" },
		{ needle: "desactiv", gloss: "disable" },
		{ needle: "export", gloss: "export" },
		{ needle: "rescind", gloss: "terminate" }, // rescindir — avoids the "termin" stem colliding with "determinar"
		{ needle: "revoc", gloss: "revoke" }, // revoca/revocar (v2-fl-02)
		{ needle: "purg", gloss: "wipe" }, // purga/purgar
		{ needle: "otorg", gloss: "grant" }, // otorgar
		{ needle: "superadministrador", gloss: "superadmin" },
		// objects
		{ needle: "autenticacion de dos factores", gloss: "two-factor authentication" },
		{ needle: "doble factor", gloss: "two-factor authentication" },
		{ needle: "tabla", gloss: "table" },
		{ needle: "base de datos", gloss: "database" }, // v2-fl-01, v2-fl-02
		{ needle: "produccion", gloss: "production" }, // v2-fl-01, v2-fl-02 (folded)
		{ needle: "copia de seguridad", gloss: "backup" },
		{ needle: "clave de cifrado", gloss: "encryption key" },
		{ needle: "webhook", gloss: "webhook" },
		{ needle: "registro de auditoria", gloss: "audit logging" },
		{ needle: "usuarios", gloss: "users" },
		{ needle: "roles de iam", gloss: "IAM roles" }, // v2-fl-02
		{ needle: "cuenta de aws", gloss: "AWS account" }, // v2-fl-02
		{ needle: "tabla de clientes", gloss: "customer table" }, // v2-fl-01
		];
		const LATIN_LEXICONS = [FRENCH, GERMAN, SPANISH, MANDARIN_PINYIN];
		const OTHER_LEXICONS = [RUSSIAN, MANDARIN_HANZI, ARABIC];
		// ---------------------------------------------------------------------------
		// Matching
		// ---------------------------------------------------------------------------
		/**
		* Scan `text` for the confirmed-evaded destructive-verb + object vocabulary
		* across French, Arabic, German, Russian, Mandarin (hanzi + pinyin), and
		* Spanish, and return the matching English glosses — in first-appearance
		* order, deduplicated — for a caller to append alongside the original text
		* (see the module header's integration contract). Returns `[]` when
		* nothing in the bounded vocabulary is found; never throws.
		*/
		export function multilingualDestructiveGloss(text) {
		if (!text)
		return [];
		let latinHaystack;
		let otherHaystack;
		try {
		latinHaystack = foldLatin(text);
		otherHaystack = foldOther(text);
		}
		catch {
		return []; // fail-open — never let this best-effort layer crash the caller
		}
		const found = [];
		for (const lexicon of LATIN_LEXICONS) {
		for (const { needle, gloss } of lexicon) {
		const idx = latinHaystack.indexOf(needle);
		if (idx !== -1)
		found.push({ index: idx, gloss });
		}
		}
		for (const lexicon of OTHER_LEXICONS) {
		for (const { needle, gloss } of lexicon) {
		const idx = otherHaystack.indexOf(needle);
		if (idx !== -1)
		found.push({ index: idx, gloss });
		}
		}
		if (found.length === 0)
		return [];
		found.sort((a, b) => a.index - b.index);
		const seen = new Set();
		const glosses = [];
		for (const { gloss } of found) {
		if (seen.has(gloss))
		continue;
		seen.add(gloss);
		glosses.push(gloss);
		}
		return glosses;
		}
		//# sourceMappingURL=multilingual-intent.js.map

+1

dist/engine/multilingual-intent.js.map

+19

dist/engine/redos-guard.d.ts

		/**
		* ReDoS static guard — client-side port of
		* mcp-servers/sunaiva-gate-backend/src/rules/redos-guard.ts.
		*
		* Ported verbatim (2026-07-25, THUNDERSTRIKE P0-A fix) so the local
		* `npx @sunaiva/gate` client can safely compile a customer's own
		* custom-rule `detection_pattern` as a real regex the same way the
		* backend's Shape D evaluator already does. See the server-side file
		* for the full algorithm rationale — this file must stay in lockstep
		* with it; do not diverge the two copies.
		*/
		/**
		* Returns true if `pattern` contains a shape known to cause catastrophic
		* backtracking on a standard (non-linear-time) regex engine. Deliberately
		* conservative — false positives (rejecting a safe pattern) are acceptable;
		* false negatives (missing a dangerous one) are not.
		*/
		export declare function isPotentiallyCatastrophicRegex(pattern: string): boolean;
		//# sourceMappingURL=redos-guard.d.ts.map

+1

dist/engine/redos-guard.d.ts.map

{"version":3,"file":"redos-guard.d.ts","sourceRoot":"","sources":["../../src/engine/redos-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAoBH;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CA0BvE"}

+61

dist/engine/redos-guard.js

		/**
		* ReDoS static guard — client-side port of
		* mcp-servers/sunaiva-gate-backend/src/rules/redos-guard.ts.
		*
		* Ported verbatim (2026-07-25, THUNDERSTRIKE P0-A fix) so the local
		* `npx @sunaiva/gate` client can safely compile a customer's own
		* custom-rule `detection_pattern` as a real regex the same way the
		* backend's Shape D evaluator already does. See the server-side file
		* for the full algorithm rationale — this file must stay in lockstep
		* with it; do not diverge the two copies.
		*/
		function allowsTwoOrMoreReps(quantifierText) {
		if (quantifierText === "+" \|\| quantifierText === "*")
		return true;
		const m = /^\{(\d+)(?:,(\d*))?\}$/.exec(quantifierText);
		if (!m)
		return false;
		const lo = Number(m[1]);
		const hasComma = quantifierText.includes(",");
		const hiRaw = m[2];
		if (!hasComma)
		return lo >= 2; // {n} exact
		if (hiRaw === "" \|\| hiRaw === undefined)
		return true; // {n,} unbounded
		const hi = Number(hiRaw);
		return hi >= 2;
		}
		function matchLeadingQuantifier(text) {
		const m = /^(?:\+\|\\|\{\d+(?:,\d)?\})/.exec(text);
		return m ? { text: m[0] } : null;
		}
		/**
		* Returns true if `pattern` contains a shape known to cause catastrophic
		* backtracking on a standard (non-linear-time) regex engine. Deliberately
		* conservative — false positives (rejecting a safe pattern) are acceptable;
		* false negatives (missing a dangerous one) are not.
		*/
		export function isPotentiallyCatastrophicRegex(pattern) {
		let working = pattern;
		const innerGroup = /$([^()]*)$/;
		const maxPasses = working.length + 1;
		for (let pass = 0; pass < maxPasses; pass++) {
		const m = innerGroup.exec(working);
		if (!m)
		break;
		const content = m[1] ?? "";
		const matchStart = m.index;
		const matchEnd = matchStart + m[0].length;
		const after = working.slice(matchEnd);
		const quant = matchLeadingQuantifier(after);
		if (quant && allowsTwoOrMoreReps(quant.text)) {
		const ambiguous = content.includes("\|") \|\| /[+*]/.test(content);
		if (ambiguous)
		return true;
		}
		const consumedEnd = matchEnd + (quant ? quant.text.length : 0);
		working = working.slice(0, matchStart) + "•" + working.slice(consumedEnd);
		}
		return false;
		}
		//# sourceMappingURL=redos-guard.js.map

+1

dist/engine/redos-guard.js.map

{"version":3,"file":"redos-guard.js","sourceRoot":"","sources":["../../src/engine/redos-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,SAAS,mBAAmB,CAAC,cAAsB;IACjD,IAAI,cAAc,KAAK,GAAG,IAAI,cAAc,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACxD,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY;IAC3C,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,CAAC,iBAAiB;IACvE,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,OAAO,EAAE,IAAI,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,CAAC,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAAe;IAC5D,IAAI,OAAO,GAAG,OAAO,CAAC;IACtB,MAAM,UAAU,GAAG,cAAc,CAAC;IAClC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAErC,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC;YAAE,MAAM;QAEd,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC;QAC3B,MAAM,QAAQ,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAE1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAE5C,IAAI,KAAK,IAAI,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChE,IAAI,SAAS;gBAAE,OAAO,IAAI,CAAC;QAC7B,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

+46

dist/installer/agents/claude-desktop.d.ts

		/**
		* Claude Desktop shim writer (<50 LoC core).
		*
		* Strategy: Claude Desktop has no hook system — it only speaks native MCP.
		* We register `sunaiva-gate` as a stdio MCP server under `mcpServers` in
		* claude_desktop_config.json (merged non-destructively: existing servers
		* and any other top-level keys are preserved). Unlike the other agents,
		* this is the direct `npx @sunaiva/gate` MCP-server invocation — no
		* `--mcp-bridge` sub-command involved, since Claude Desktop talks MCP
		* directly rather than piping hook events through stdin.
		*
		* Config path resolution lives in ../detect.js (claudeDesktopConfigPath) —
		* single source of truth shared with agent detection.
		*
		* LATENCY FAST-PATH — WHY THIS FILE HAS NO PER-CALL PRE-SCREEN (2026-07-26):
		* claude-code.ts's per-tool-call hook fires a FRESH `npx` process on EVERY
		* PreToolUse/PostToolUse event (measured 302-856ms) — a real hot-path
		* problem a lexical pre-screen fixes. Claude Desktop's `mcpServers` entry
		* below is architecturally different: it registers `sunaiva-gate` as a
		* SINGLE long-lived stdio MCP server process, started once per Claude
		* Desktop session, not re-spawned per call. There is also no forced
		* interception here — Claude Desktop has no hook system, so `validate_action`
		* only runs when the model chooses to call it (the exact "MCP tool only
		* runs if the agent CHOOSES to call it" gap this whole lane exists to close
		* for the claude-code hook path). A per-call shell pre-screen would add
		* complexity to a stdio JSON-RPC framing it has no measured latency problem
		* to solve. `buildShimEntry`/`writeShim` below are therefore UNCHANGED.
		*
		* The fast-path DECISION LOGIC is still re-exported from claude-code.js so
		* both installer targets share one non-drifting source of truth (verified
		* by parity tests in tests/installer/claude-desktop.test.ts) — ready for
		* reuse if a future Claude-Desktop-side interception layer is ever built.
		*/
		import type { AgentDetection } from "../detect.js";
		import type { ShimWriteResult } from "./claude-code.js";
		export { FAST_PATH_TOOLS, FAST_PATH_RISK_KEYWORDS, wouldFastPathAllow, } from "./claude-code.js";
		/**
		* Build the JSON patch that should appear under `mcpServers` in
		* claude_desktop_config.json. Exported separately for tests + dry-run preview.
		*/
		export declare function buildShimEntry(mcpEndpoint?: string): Record<string, unknown>;
		export declare function writeShim(detection: AgentDetection, opts?: {
		dryRun?: boolean;
		mcpEndpoint?: string;
		}): ShimWriteResult;
		//# sourceMappingURL=claude-desktop.d.ts.map

+1

dist/installer/agents/claude-desktop.d.ts.map

{"version":3,"file":"claude-desktop.d.ts","sourceRoot":"","sources":["../../../src/installer/agents/claude-desktop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGxD,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB;AAED,wBAAgB,SAAS,CACvB,SAAS,EAAE,cAAc,EACzB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACpD,eAAe,CA+BjB"}

+82

dist/installer/agents/claude-desktop.js

		/**
		* Claude Desktop shim writer (<50 LoC core).
		*
		* Strategy: Claude Desktop has no hook system — it only speaks native MCP.
		* We register `sunaiva-gate` as a stdio MCP server under `mcpServers` in
		* claude_desktop_config.json (merged non-destructively: existing servers
		* and any other top-level keys are preserved). Unlike the other agents,
		* this is the direct `npx @sunaiva/gate` MCP-server invocation — no
		* `--mcp-bridge` sub-command involved, since Claude Desktop talks MCP
		* directly rather than piping hook events through stdin.
		*
		* Config path resolution lives in ../detect.js (claudeDesktopConfigPath) —
		* single source of truth shared with agent detection.
		*
		* LATENCY FAST-PATH — WHY THIS FILE HAS NO PER-CALL PRE-SCREEN (2026-07-26):
		* claude-code.ts's per-tool-call hook fires a FRESH `npx` process on EVERY
		* PreToolUse/PostToolUse event (measured 302-856ms) — a real hot-path
		* problem a lexical pre-screen fixes. Claude Desktop's `mcpServers` entry
		* below is architecturally different: it registers `sunaiva-gate` as a
		* SINGLE long-lived stdio MCP server process, started once per Claude
		* Desktop session, not re-spawned per call. There is also no forced
		* interception here — Claude Desktop has no hook system, so `validate_action`
		* only runs when the model chooses to call it (the exact "MCP tool only
		* runs if the agent CHOOSES to call it" gap this whole lane exists to close
		* for the claude-code hook path). A per-call shell pre-screen would add
		* complexity to a stdio JSON-RPC framing it has no measured latency problem
		* to solve. `buildShimEntry`/`writeShim` below are therefore UNCHANGED.
		*
		* The fast-path DECISION LOGIC is still re-exported from claude-code.js so
		* both installer targets share one non-drifting source of truth (verified
		* by parity tests in tests/installer/claude-desktop.test.ts) — ready for
		* reuse if a future Claude-Desktop-side interception layer is ever built.
		*/
		import * as fs from "node:fs";
		import * as path from "node:path";
		import { ensureBackup } from "../backup.js";
		export { FAST_PATH_TOOLS, FAST_PATH_RISK_KEYWORDS, wouldFastPathAllow, } from "./claude-code.js";
		/**
		* Build the JSON patch that should appear under `mcpServers` in
		* claude_desktop_config.json. Exported separately for tests + dry-run preview.
		*/
		export function buildShimEntry(mcpEndpoint) {
		const server = {
		command: "npx",
		args: ["-y", "@sunaiva/gate"],
		};
		if (mcpEndpoint) {
		server["env"] = { SUNAIVA_GATE_MCP_ENDPOINT: mcpEndpoint };
		}
		return { "sunaiva-gate": server };
		}
		export function writeShim(detection, opts = {}) {
		const target = detection.config_path;
		const entry = buildShimEntry(opts.mcpEndpoint);
		let existing = {};
		try {
		existing = JSON.parse(fs.readFileSync(target, "utf-8"));
		}
		catch {
		existing = {};
		}
		const next = {
		...existing,
		mcpServers: {
		...existing["mcpServers"],
		...entry,
		},
		};
		const payload = JSON.stringify(next, null, 2);
		if (!opts.dryRun) {
		fs.mkdirSync(path.dirname(target), { recursive: true });
		ensureBackup(target);
		fs.writeFileSync(target, payload, "utf-8");
		}
		return {
		written_to: target,
		bytes: Buffer.byteLength(payload, "utf-8"),
		dry_run: !!opts.dryRun,
		preview: entry,
		};
		}
		//# sourceMappingURL=claude-desktop.js.map

+1

dist/installer/agents/claude-desktop.js.map

{"version":3,"file":"claude-desktop.js","sourceRoot":"","sources":["../../../src/installer/agents/claude-desktop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,WAAoB;IAEpB,MAAM,MAAM,GAA4B;QACtC,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;KAC9B,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,EAAE,WAAW,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,SAAyB,EACzB,OAAmD,EAAE;IAErD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC;IACrC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAGrD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG;QACX,GAAG,QAAQ;QACX,UAAU,EAAE;YACV,GAAI,QAAQ,CAAC,YAAY,CAAyC;YAClE,GAAG,KAAK;SACT;KACF,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,YAAY,CAAC,MAAM,CAAC,CAAC;QACrB,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM;QACtB,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC"}

+31

dist/installer/backup.d.ts

		/**
		* Generic pre-write backup + restore (U2/U4 — makes `install` reversible).
		*
		* Every agent shim writer calls ensureBackup(target) once, immediately before
		* its first fs.writeFileSync. The backup captures whatever was at `target`
		* BEFORE Sunaiva Gate ever touched it (including "nothing was there"). A
		* second install run is idempotent: ensureBackup no-ops if a backup already
		* exists, so it never overwrites the pristine pre-install snapshot with a
		* gate-modified one.
		*
		* restoreFromBackup is agent-agnostic — it doesn't need to know the file's
		* shape (JSON, TOML, YAML). It just puts back the exact bytes that were
		* there, or removes the file if nothing was there. This is what makes a
		* single generic `uninstall` command work across all 8 supported agents.
		*/
		/** Idempotent: only writes the backup on the FIRST call for a given target. */
		export declare function ensureBackup(target: string): void;
		export interface RestoreResult {
		target: string;
		had_backup: boolean;
		restored: boolean;
		/** "restored" \| "removed" \| "noop" */
		action: "restored" \| "removed" \| "noop";
		}
		/**
		* Restore `target` to its pre-install state and delete the backup marker.
		* Safe to call when no backup exists (e.g. already uninstalled, or install
		* was never run) — returns had_backup:false, action:"noop" and never throws.
		*/
		export declare function restoreFromBackup(target: string): RestoreResult;
		//# sourceMappingURL=backup.d.ts.map

+1

dist/installer/backup.d.ts.map

{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../src/installer/backup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAeH,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAYjD;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,sCAAsC;IACtC,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;CACzC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAyB/D"}

+65

dist/installer/backup.js

		/**
		* Generic pre-write backup + restore (U2/U4 — makes `install` reversible).
		*
		* Every agent shim writer calls ensureBackup(target) once, immediately before
		* its first fs.writeFileSync. The backup captures whatever was at `target`
		* BEFORE Sunaiva Gate ever touched it (including "nothing was there"). A
		* second install run is idempotent: ensureBackup no-ops if a backup already
		* exists, so it never overwrites the pristine pre-install snapshot with a
		* gate-modified one.
		*
		* restoreFromBackup is agent-agnostic — it doesn't need to know the file's
		* shape (JSON, TOML, YAML). It just puts back the exact bytes that were
		* there, or removes the file if nothing was there. This is what makes a
		* single generic `uninstall` command work across all 8 supported agents.
		*/
		import * as fs from "node:fs";
		import * as path from "node:path";
		function backupPath(target) {
		return `${target}.sunaiva-gate.orig`;
		}
		/** Idempotent: only writes the backup on the FIRST call for a given target. */
		export function ensureBackup(target) {
		const bpath = backupPath(target);
		if (fs.existsSync(bpath))
		return; // already captured pre-install state
		const existed = fs.existsSync(target);
		const marker = {
		existed,
		content: existed ? fs.readFileSync(target, "utf-8") : null,
		backed_up_at: new Date().toISOString(),
		};
		fs.mkdirSync(path.dirname(bpath), { recursive: true });
		fs.writeFileSync(bpath, JSON.stringify(marker, null, 2), "utf-8");
		}
		/**
		* Restore `target` to its pre-install state and delete the backup marker.
		* Safe to call when no backup exists (e.g. already uninstalled, or install
		* was never run) — returns had_backup:false, action:"noop" and never throws.
		*/
		export function restoreFromBackup(target) {
		const bpath = backupPath(target);
		if (!fs.existsSync(bpath)) {
		return { target, had_backup: false, restored: false, action: "noop" };
		}
		let marker;
		try {
		marker = JSON.parse(fs.readFileSync(bpath, "utf-8"));
		}
		catch {
		// Corrupt marker — do not guess. Leave target untouched, drop the marker.
		fs.unlinkSync(bpath);
		return { target, had_backup: true, restored: false, action: "noop" };
		}
		if (marker.existed && marker.content !== null) {
		fs.writeFileSync(target, marker.content, "utf-8");
		fs.unlinkSync(bpath);
		return { target, had_backup: true, restored: true, action: "restored" };
		}
		// Nothing existed before install — restore that state by removing the file.
		if (fs.existsSync(target))
		fs.unlinkSync(target);
		fs.unlinkSync(bpath);
		return { target, had_backup: true, restored: true, action: "removed" };
		}
		//# sourceMappingURL=backup.js.map

+1

dist/installer/backup.js.map

{"version":3,"file":"backup.js","sourceRoot":"","sources":["../../src/installer/backup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAQlC,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,GAAG,MAAM,oBAAoB,CAAC;AACvC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,qCAAqC;IAEvE,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,MAAM,GAAiB;QAC3B,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;QAC1D,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACvC,CAAC;IACF,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACpE,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACxE,CAAC;IAED,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAiB,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvE,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9C,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC1E,CAAC;IAED,4EAA4E;IAC5E,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACjD,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACzE,CAAC"}

+114

dist/installer/telemetry.d.ts

		/**
		* Fail-open telemetry contract — the Rule 66 Yin pair for every per-host
		* shim's fail-OPEN branches.
		*
		* GROUND TRUTH THIS MODULE CLOSES (2026-07-26): `claude-code.sh` already
		* fail-opens correctly on empty stdin, a missing `tool_name`, and a verdict
		* that fails to parse `"allowed": true` — but none of those branches emit
		* any signal. Per Rule 66 ("hooks that fail-OPEN on error MUST still emit a
		* telemetry event on the error path so the observability layer records the
		* gap") and hook_discipline_001 ("a gate bug must never brick an agent, but
		* a silent fail-open is invisible enforcement"), an installed-but-broken
		* Gate must leave a trail, or it can go undetected for weeks.
		*
		* This module is the CONTRACT, not the wiring — it does not itself modify
		* any of the 8 per-host shim bodies (out of scope this wave; see the
		* TODO pointer in install.ts). It provides:
		*
		* (a) the fail-open event schema (`FailOpenEvent` / `FailOpenReason`)
		* (b) `appendFailOpenEvent()` — a swallow-and-continue JSONL writer
		* (c) a `--verify <path>` CLI mode for auditing an existing log
		*
		* SECURITY (defense-in-depth, failure_051-class leak prevention): this
		* module NEVER accepts or persists a raw action/tool-call payload — the
		* schema simply has no field for one. Every string field that IS persisted
		* (`host`, `tool_name`) is passed through `redactSecrets()` first, in case a
		* caller accidentally hands it something secret-shaped.
		*
		* RELIABILITY: `appendFailOpenEvent()` must NEVER throw. A telemetry writer
		* that can crash the calling shim would defeat the exact fail-OPEN
		* guarantee it exists to observe — every fs operation is wrapped in
		* try/catch, and failures are swallowed (returns `false`) rather than
		* propagated.
		*/
		/**
		* Why a shim fell back to fail-OPEN (allowed the tool call through without a
		* verdict from the Gate). Exhaustive — any other value is coerced to
		* "backend_unreachable" by `appendFailOpenEvent()` before it is written.
		*/
		export type FailOpenReason = "missing_payload" \| "timeout" \| "parse_error" \| "kill_switch" \| "backend_unreachable";
		export declare const FAIL_OPEN_REASONS: readonly FailOpenReason[];
		/**
		* A single fail-open telemetry event, one per JSONL line. Deliberately
		* minimal — there is no field for the raw hook payload, the action, or any
		* tool arguments. Only enough to answer "did the gate go blind, when,
		* where, and on what tool" from the observability layer.
		*/
		export interface FailOpenEvent {
		/** ISO 8601 timestamp, e.g. new Date().toISOString(). */
		ts: string;
		/** Best-effort host identifier (os.hostname() by default). */
		host: string;
		reason: FailOpenReason;
		/** The tool name being gated when the fail-open occurred, or null. */
		tool_name: string \| null;
		}
		/**
		* Replace any secret-shaped substring with `[REDACTED]`. Pure — no I/O.
		* Applied to every string field before it is written to disk.
		*/
		export declare function redactSecrets(input: string): string;
		export declare const FAIL_OPEN_AUDIT_FILE_NAME = "fail_open.jsonl";
		/**
		* Directory the audit JSONL lives in. Override via `SUNAIVA_GATE_AUDIT_DIR`
		* (used by tests and by hosts with a non-standard home). Default:
		* `~/.sunaiva/audit`.
		*/
		export declare function resolveAuditDir(): string;
		/** Full path to the fail-open audit log. */
		export declare function resolveAuditFilePath(): string;
		/**
		* Build a well-formed, redacted `FailOpenEvent`. Convenience for callers —
		* `appendFailOpenEvent()` also sanitizes internally, so this is optional,
		* but it lets a caller construct + log/inspect an event before writing it.
		*/
		export declare function buildFailOpenEvent(reason: FailOpenReason, toolName?: string \| null, hostOverride?: string): FailOpenEvent;
		/**
		* Append one fail-open event to the audit JSONL (`~/.sunaiva/audit/fail_open.jsonl`
		* by default; `SUNAIVA_GATE_AUDIT_DIR` overrides the directory).
		*
		* Contract: NEVER throws. Creates the directory if absent. Tolerates a
		* read-only or missing home directory — on any failure this swallows the
		* error and returns `false` rather than propagating, because a telemetry
		* writer that can crash its caller would defeat the fail-OPEN guarantee it
		* exists to observe.
		*/
		export declare function appendFailOpenEvent(event: FailOpenEvent): boolean;
		export interface VerifySummary {
		valid: boolean;
		path: string;
		totalLines: number;
		parsedLines: number;
		malformedLines: number;
		countsByReason: Record<string, number>;
		errors: string[];
		}
		/**
		* Read an audit JSONL file and summarize it. `valid` is true iff every
		* non-blank line parses as JSON (an empty file with zero lines is
		* vacuously valid; a missing FILE is not — there is nothing to verify).
		*/
		export declare function verifyAuditFile(filePath: string): VerifySummary;
		/** Pretty-print a VerifySummary for the CLI. */
		export declare function formatVerifySummary(summary: VerifySummary): string;
		/**
		* Parse `--verify <path>` from an argv slice and produce the CLI's exit code
		* + printable output. Pure — no process.exit()/console.log() here, so it's
		* directly unit-testable; the bottom-of-file main-module guard does the
		* actual printing + exiting.
		*/
		export declare function runVerifyCli(argv: string[]): {
		exitCode: 0 \| 1;
		output: string;
		};
		//# sourceMappingURL=telemetry.d.ts.map

+1

dist/installer/telemetry.d.ts.map

{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../../src/installer/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AASH;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,SAAS,GACT,aAAa,GACb,aAAa,GACb,qBAAqB,CAAC;AAE1B,eAAO,MAAM,iBAAiB,EAAE,SAAS,cAAc,EAMtD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,EAAE,EAAE,MAAM,CAAC;IACX,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,cAAc,CAAC;IACvB,sEAAsE;IACtE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAuCD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMnD;AAID,eAAO,MAAM,yBAAyB,oBAAoB,CAAC;AAoB3D;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAIxC;AAED,4CAA4C;AAC5C,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,cAAc,EACtB,QAAQ,GAAE,MAAM,GAAG,IAAW,EAC9B,YAAY,CAAC,EAAE,MAAM,GACpB,aAAa,CAOf;AA0BD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAiBjE;AAID,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,CA2C/D;AAED,gDAAgD;AAChD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAwBlE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;IAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAWhF"}

+297

dist/installer/telemetry.js

		/**
		* Fail-open telemetry contract — the Rule 66 Yin pair for every per-host
		* shim's fail-OPEN branches.
		*
		* GROUND TRUTH THIS MODULE CLOSES (2026-07-26): `claude-code.sh` already
		* fail-opens correctly on empty stdin, a missing `tool_name`, and a verdict
		* that fails to parse `"allowed": true` — but none of those branches emit
		* any signal. Per Rule 66 ("hooks that fail-OPEN on error MUST still emit a
		* telemetry event on the error path so the observability layer records the
		* gap") and hook_discipline_001 ("a gate bug must never brick an agent, but
		* a silent fail-open is invisible enforcement"), an installed-but-broken
		* Gate must leave a trail, or it can go undetected for weeks.
		*
		* This module is the CONTRACT, not the wiring — it does not itself modify
		* any of the 8 per-host shim bodies (out of scope this wave; see the
		* TODO pointer in install.ts). It provides:
		*
		* (a) the fail-open event schema (`FailOpenEvent` / `FailOpenReason`)
		* (b) `appendFailOpenEvent()` — a swallow-and-continue JSONL writer
		* (c) a `--verify <path>` CLI mode for auditing an existing log
		*
		* SECURITY (defense-in-depth, failure_051-class leak prevention): this
		* module NEVER accepts or persists a raw action/tool-call payload — the
		* schema simply has no field for one. Every string field that IS persisted
		* (`host`, `tool_name`) is passed through `redactSecrets()` first, in case a
		* caller accidentally hands it something secret-shaped.
		*
		* RELIABILITY: `appendFailOpenEvent()` must NEVER throw. A telemetry writer
		* that can crash the calling shim would defeat the exact fail-OPEN
		* guarantee it exists to observe — every fs operation is wrapped in
		* try/catch, and failures are swallowed (returns `false`) rather than
		* propagated.
		*/
		import * as fs from "node:fs";
		import * as os from "node:os";
		import * as path from "node:path";
		import { fileURLToPath } from "node:url";
		export const FAIL_OPEN_REASONS = [
		"missing_payload",
		"timeout",
		"parse_error",
		"kill_switch",
		"backend_unreachable",
		];
		/**
		* Known secret-shaped patterns. Intentionally scoped to well-known token
		* PREFIXES/FORMATS (not a generic "any long random string" catch) so we
		* don't mangle legitimate, benign values like MCP tool names
		* (`mcp__sunaiva-memory-go__memory_search`) or hostnames.
		*/
		const SECRET_PATTERNS = [
		{ name: "anthropic_key", pattern: /sk-ant-[A-Za-z0-9_-]{16,}/g },
		{ name: "openai_key", pattern: /sk-[A-Za-z0-9]{32,}/g },
		{ name: "github_pat_classic", pattern: /gh[pousr]_[A-Za-z0-9]{20,}/g },
		{ name: "github_pat_fine_grained", pattern: /github_pat_[A-Za-z0-9_]{20,}/g },
		{ name: "stripe_key", pattern: /\b(sk\|pk\|rk)_(live\|test)_[A-Za-z0-9]{10,}\b/g },
		{ name: "aws_access_key_id", pattern: /\bAKIA[0-9A-Z]{16}\b/g },
		{ name: "slack_token", pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
		{
		name: "jwt",
		pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g,
		},
		{ name: "bearer_token", pattern: /Bearer\s+[A-Za-z0-9._-]{20,}/gi },
		{
		name: "private_key_block",
		pattern: /-----BEGIN[ A-Z]PRIVATE KEY-----[\s\S]?-----END[ A-Z]*PRIVATE KEY-----/g,
		},
		{
		// catches "api_key=...", "secret: '...'", "token=...", "password: ..."
		name: "generic_credential_assignment",
		pattern: /\b(api[_-]?key\|secret\|token\|password)\s[:=]\s['"]?[A-Za-z0-9_\-/+=]{12,}['"]?/gi,
		},
		];
		/**
		* Replace any secret-shaped substring with `[REDACTED]`. Pure — no I/O.
		* Applied to every string field before it is written to disk.
		*/
		export function redactSecrets(input) {
		let out = input;
		for (const { pattern } of SECRET_PATTERNS) {
		out = out.replace(pattern, "[REDACTED]");
		}
		return out;
		}
		// ─── Audit path resolution ─────────────────────────────────────────────────
		export const FAIL_OPEN_AUDIT_FILE_NAME = "fail_open.jsonl";
		/** Best-effort hostname; never throws. */
		function safeHostname() {
		try {
		return os.hostname() \|\| "unknown";
		}
		catch {
		return "unknown";
		}
		}
		/** Best-effort home directory; never throws. */
		function safeHomedir() {
		try {
		return os.homedir() \|\| ".";
		}
		catch {
		return ".";
		}
		}
		/**
		* Directory the audit JSONL lives in. Override via `SUNAIVA_GATE_AUDIT_DIR`
		* (used by tests and by hosts with a non-standard home). Default:
		* `~/.sunaiva/audit`.
		*/
		export function resolveAuditDir() {
		const override = process.env["SUNAIVA_GATE_AUDIT_DIR"];
		if (override && override.trim().length > 0)
		return override;
		return path.join(safeHomedir(), ".sunaiva", "audit");
		}
		/** Full path to the fail-open audit log. */
		export function resolveAuditFilePath() {
		return path.join(resolveAuditDir(), FAIL_OPEN_AUDIT_FILE_NAME);
		}
		// ─── Event construction + sanitization ─────────────────────────────────────
		/**
		* Build a well-formed, redacted `FailOpenEvent`. Convenience for callers —
		* `appendFailOpenEvent()` also sanitizes internally, so this is optional,
		* but it lets a caller construct + log/inspect an event before writing it.
		*/
		export function buildFailOpenEvent(reason, toolName = null, hostOverride) {
		return sanitizeEvent({
		ts: new Date().toISOString(),
		host: hostOverride ?? safeHostname(),
		reason,
		tool_name: toolName,
		});
		}
		/**
		* Coerce + redact an event to exactly the four documented fields — belt and
		* braces against a caller passing extra fields (e.g. an accidental raw
		* payload spread) or an out-of-enum reason at runtime (this module is
		* consumed from compiled JS by future shim wiring, not just TS).
		*/
		function sanitizeEvent(event) {
		const reason = FAIL_OPEN_REASONS.includes(event?.reason)
		? event.reason
		: "backend_unreachable";
		const ts = typeof event?.ts === "string" && event.ts.length > 0
		? event.ts
		: new Date().toISOString();
		const host = redactSecrets(String(event?.host ?? "unknown")).slice(0, 512);
		const tool_name = event?.tool_name == null ? null : redactSecrets(String(event.tool_name)).slice(0, 256);
		return { ts, host, reason, tool_name };
		}
		// ─── Writer ─────────────────────────────────────────────────────────────────
		/**
		* Append one fail-open event to the audit JSONL (`~/.sunaiva/audit/fail_open.jsonl`
		* by default; `SUNAIVA_GATE_AUDIT_DIR` overrides the directory).
		*
		* Contract: NEVER throws. Creates the directory if absent. Tolerates a
		* read-only or missing home directory — on any failure this swallows the
		* error and returns `false` rather than propagating, because a telemetry
		* writer that can crash its caller would defeat the fail-OPEN guarantee it
		* exists to observe.
		*/
		export function appendFailOpenEvent(event) {
		try {
		const filePath = resolveAuditFilePath();
		const dir = path.dirname(filePath);
		try {
		fs.mkdirSync(dir, { recursive: true });
		}
		catch {
		// Directory may already exist, be read-only, or homedir may be
		// missing — fall through to the write attempt below; if that also
		// fails it's caught by the outer try/catch.
		}
		const line = JSON.stringify(sanitizeEvent(event)) + "\n";
		fs.appendFileSync(filePath, line, "utf-8");
		return true;
		}
		catch {
		return false;
		}
		}
		/**
		* Read an audit JSONL file and summarize it. `valid` is true iff every
		* non-blank line parses as JSON (an empty file with zero lines is
		* vacuously valid; a missing FILE is not — there is nothing to verify).
		*/
		export function verifyAuditFile(filePath) {
		const countsByReason = {};
		const errors = [];
		let raw;
		try {
		raw = fs.readFileSync(filePath, "utf-8");
		}
		catch (err) {
		return {
		valid: false,
		path: filePath,
		totalLines: 0,
		parsedLines: 0,
		malformedLines: 0,
		countsByReason,
		errors: [`cannot read file: ${err instanceof Error ? err.message : String(err)}`],
		};
		}
		const lines = raw.split("\n").filter((l) => l.trim().length > 0);
		let parsedLines = 0;
		let malformedLines = 0;
		lines.forEach((line, i) => {
		try {
		const obj = JSON.parse(line);
		parsedLines += 1;
		const reason = typeof obj?.reason === "string" ? obj.reason : "unknown";
		countsByReason[reason] = (countsByReason[reason] ?? 0) + 1;
		}
		catch (err) {
		malformedLines += 1;
		errors.push(`line ${i + 1}: ${err instanceof Error ? err.message : String(err)}`);
		}
		});
		return {
		valid: malformedLines === 0,
		path: filePath,
		totalLines: lines.length,
		parsedLines,
		malformedLines,
		countsByReason,
		errors,
		};
		}
		/** Pretty-print a VerifySummary for the CLI. */
		export function formatVerifySummary(summary) {
		const lines = [];
		lines.push(`fail-open audit: ${summary.path}`);
		lines.push(` total lines: ${summary.totalLines}`);
		lines.push(` parsed OK: ${summary.parsedLines}`);
		lines.push(` malformed: ${summary.malformedLines}`);
		const reasons = Object.keys(summary.countsByReason).sort();
		if (reasons.length === 0) {
		lines.push(` by reason: (none)`);
		}
		else {
		lines.push(` by reason:`);
		for (const r of reasons) {
		lines.push(` ${r.padEnd(20)} ${summary.countsByReason[r]}`);
		}
		}
		if (summary.errors.length > 0) {
		lines.push(` errors:`);
		for (const e of summary.errors.slice(0, 10))
		lines.push(` ${e}`);
		if (summary.errors.length > 10) {
		lines.push(` ... and ${summary.errors.length - 10} more`);
		}
		}
		lines.push(summary.valid ? "VALID" : "INVALID");
		return lines.join("\n");
		}
		/**
		* Parse `--verify <path>` from an argv slice and produce the CLI's exit code
		* + printable output. Pure — no process.exit()/console.log() here, so it's
		* directly unit-testable; the bottom-of-file main-module guard does the
		* actual printing + exiting.
		*/
		export function runVerifyCli(argv) {
		const idx = argv.indexOf("--verify");
		const targetPath = idx !== -1 ? argv[idx + 1] : undefined;
		if (!targetPath) {
		return {
		exitCode: 1,
		output: "usage: telemetry --verify <path-to-fail_open.jsonl>",
		};
		}
		const summary = verifyAuditFile(targetPath);
		return { exitCode: summary.valid ? 0 : 1, output: formatVerifySummary(summary) };
		}
		// ─── CLI entry point ────────────────────────────────────────────────────────
		// `node dist/installer/telemetry.js --verify <path>` (or `tsx
		// src/installer/telemetry.ts --verify <path>` pre-build). Only runs when
		// this file is the directly-executed entry script — importing this module
		// from install.ts, a shim, or a test never triggers it.
		function isDirectlyExecuted() {
		try {
		const invoked = process.argv[1] ? path.resolve(process.argv[1]) : "";
		const self = fileURLToPath(import.meta.url);
		return invoked === self;
		}
		catch {
		return false;
		}
		}
		if (isDirectlyExecuted()) {
		const { exitCode, output } = runVerifyCli(process.argv.slice(2));
		// eslint-disable-next-line no-console
		console.log(output);
		process.exit(exitCode);
		}
		//# sourceMappingURL=telemetry.js.map

+1

dist/installer/telemetry.js.map

+5

-4

BUSINESS_LICENSE.md

		@@ -28,5 +28,6 @@ # Business Source License — `@sunaiva/gate`

		- Change Date: 2030-06-30 (4 years from the `@sunaiva/gate@2.0.0`
		publication. Per Rule 43 each version carries its own 4-year clock from its
		own publish date; finalized to the exact publish-date + 4 years at npm publish).
		- Change Date: 2030-07-19 (4 years from the `@sunaiva/gate@2.0.4`
		publication date of 2026-07-19. Per Rule 43 each version carries its own
		4-year clock from its own publish date; finalized to the exact publish-date
		+ 4 years at npm publish).
		- Change License: Apache License, Version 2.0 (chosen for its broad
		@@ -63,3 +64,3 @@ compatibility, explicit patent grant, and standing as the most common
		status is independent of any clock in this repository. When the
		`@sunaiva/gate` wrapper converts to Apache-2.0 on 2030-06-30, the backend
		`@sunaiva/gate` wrapper converts to Apache-2.0 on 2030-07-19, the backend
		remains commercial and proprietary — only the wrapper code's licence
		@@ -66,0 +67,0 @@ changes. Customers relying on backend-tier features will continue to need a

+6

-0

CHANGELOG.md

		@@ -7,2 +7,8 @@ # Changelog

		## [2.0.5] — 2026-07-25 — "THUNDERSTRIKE P0-A + version coherence"

		### Fixed
		- P0-A: local client silently never evaluated custom rules — `evaluateActionAsync()` returned early whenever zero premium rules were active locally (the default for every customer), skipping the backend entirely and never evaluating the customer's own custom rules — even though `list_custom_rules` showed the rule and the remote backend correctly enforced it. Every install via `npx @sunaiva/gate install` was affected. Fixed: custom rules now fetched and evaluated (server-parity regex semantics, ReDoS-guarded) on every call where a backend token is configured, independent of premium-rule count. Live-verified against production. See `data/AUDITS/GATE_SECURITY_ADVERSARIAL_AUDIT_2026-07-25.md` U4.
		- Three-way version schism — `sunaivacore.io/.well-known/mcp.json`, `mcp.sunaivacore.io/.well-known/mcp.json`, and the local client's own reported `gate_version` previously used the same `version` field name to mean two different numbers (npm client version vs. backend deploy stamp) with no disambiguation, and the npm bundle's baked-in `PKG_VERSION` constant had drifted from `package.json`. Fixed: `npm_client_version` and `backend_deploy_version` are now explicit, separately-labeled fields on both discovery surfaces; `PKG_VERSION` is kept in lockstep with `package.json` (enforced by `verify-bundle.js` Check 4).

		## [2.0.4] — 2026-07-19 — "QA Fix-Wave"
		@@ -9,0 +15,0 @@

+7

-0

dist/engine/pattern-matcher.d.ts

		@@ -30,2 +30,9 @@ /**
		/**
		* Strip/neutralize benign context from an action description before it is
		* scanned for dangerous keywords. Returns the transformed action text —
		* never the original detection_pattern, never anything used for anything
		* other than the local, in-process keyword scan below.
		*/
		export declare function stripBenignContext(action: string): string;
		/**
		* Match an action description against a rule's detection_pattern string.
		@@ -32,0 +39,0 @@ *

+1

-1

dist/engine/pattern-matcher.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"pattern-matcher.d.ts","sourceRoot":"","sources":["../../src/engine/pattern-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAUH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CACvC;AAuCD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,EAAE,CAkBxE;AA0BD;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,MAAM,GACvB,WAAW,CA4Bb;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC,GACtD,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAM1B"}
		{"version":3,"file":"pattern-matcher.d.ts","sourceRoot":"","sources":["../../src/engine/pattern-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAgBH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CACvC;AAuCD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,EAAE,CAkBxE;AA6LD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAezD;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,MAAM,GACvB,WAAW,CA4Bb;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC,GACtD,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAM1B"}

+172

-1

dist/engine/pattern-matcher.js

		@@ -24,2 +24,8 @@ /**
		"commands", "patterns", "calls", "operations", "actions",
		// "statements"/"statement" are the same kind of generic trailing noun as
		// "commands" above (e.g. "DROP TABLE statements", "schema-level DROP
		// statements") — filler, not a required literal token. Without this,
		// "DROP TABLE prod_customers" never matched "DROP TABLE statements" because
		// the action text has no literal word "statements" in it (2026-07-26).
		"statements", "statement",
		]);
		@@ -101,3 +107,168 @@ function normalize(text) {
		}
		// ---------------------------------------------------------------------------
		// Data-vs-code separation (added 2026-07-26, GATE_SECURITY_ADVERSARIAL_AUDIT
		// U4 false positives). Conceptually mirrors
		// .claude/hooks/triple_gate_enforcer.py's _strip_heredoc_bodies /
		// _strip_data_contexts: a flat keyword scan over the whole action string
		// cannot tell a dangerous ACTION from benign context — a dry-run preview
		// flag, a fixture-table drop, a regenerable-artifact rm -rf. Measured false
		// positives: `rm -rf node_modules` (routine dep reinstall), `git clean -n
		// -fd` (the -n IS git's own dry-run flag — deletes nothing), `DROP TABLE
		// test_users; -- ... fixture db for unit tests` (explicit test-fixture
		// annotation). Fix: strip/neutralize the benign context BEFORE
		// normalize()/tokenize() runs, so keyword regexes only ever see the
		// imperative action, never its safe qualifiers.
		// ---------------------------------------------------------------------------
		// Regenerable build/dependency artifacts — deleting these is a routine
		// reinstall/build step, never a loss of irreplaceable data.
		const BENIGN_EPHEMERAL_DIRS = new Set([
		"node_modules", "dist", "build", ".next", "__pycache__", ".cache",
		"coverage", ".turbo", ".parcel-cache", ".pytest_cache", ".tox",
		".nuxt", ".output", ".svelte-kit", ".venv", "venv",
		]);
		// Single-token markers that, on the OBJECT side (e.g. a table/dir name)
		// signal non-production/regenerable data, and on the ANNOTATION side signal
		// the agent's own stated intent for the action. Deliberately conservative —
		// a single shared list keeps "benign" narrow and auditable.
		const BENIGN_MARKER_WORDS = new Set([
		"test", "tests", "fixture", "fixtures", "tmp", "temp", "sample",
		"mock", "demo", "sandbox", "dev", "staging", "sqlite", "local",
		]);
		function hasBenignMarker(text) {
		return tokenize(text).some((t) => BENIGN_MARKER_WORDS.has(t));
		}
		// --- (a) heredoc body stripping — the body is DATA, never an executed
		// statement, unless it's piped into a shell interpreter (out of scope here:
		// action descriptions are short one-line agent intents, not shell scripts). ---
		const HEREDOC_START_RE = /<<-?\s(['"]?)([A-Za-z_][A-Za-z0-9_])\1/;
		function stripHeredocBodies(action) {
		if (!action.includes("<<"))
		return action;
		const lines = action.split("\n");
		const kept = [];
		let i = 0;
		while (i < lines.length) {
		const line = lines[i];
		kept.push(line);
		const m = HEREDOC_START_RE.exec(line);
		if (m) {
		const delimiter = m[2];
		i++;
		while (i < lines.length && lines[i].trim() !== delimiter) {
		i++; // heredoc body is data, not an executed statement — drop it
		}
		if (i < lines.length)
		kept.push(lines[i]); // keep the terminator line
		}
		i++;
		}
		return kept.join("\n");
		}
		// --- (b0) commit/tag/annotation `-m`/`--message`/`-F`/`--file` quoted
		// arguments — prose, never executed. Ported from the proven reference fix
		// (.claude/hooks/triple_gate_enforcer.py `_MESSAGE_ARG`, commit `1eb3cf411`)
		// after live evidence (probe C3-22, tests/gate/security/FP_GAUNTLET_V2_REPORT_2026-07-26.md)
		// showed `git commit -m "fix(safety): block accidental rm -rf / execution..."`
		// was blocked BY ITS OWN commit message describing the fix — the exact
		// failure mode the Python reference's own comment records ("the commit that
		// shipped this very fix was blocked by its OWN commit message"). This class
		// was NOT ported by commit fef406d5d (heredoc/dry-run/rm-rf/DROP-TABLE only)
		// — confirmed missing via direct comparison against the reference file
		// 2026-07-26. Scoped narrowly to -m/--message/-F/--file quoted args only
		// (NOT curl --data/-F payload flags or echo/printf args — those were not
		// needed to close any audited false positive here and widening beyond what
		// was demonstrated needed risks a new evasion surface, e.g.
		// `echo "rm -rf /" \| bash`, that is out of this worker's scope to
		// adversarially test).
		const MESSAGE_ARG_RE = /(?:-m\|--message\|-F\|--file)(?:=\|\s+)('[^']'\|"(?:[^"\\]\|\\.)")/gi;
		function stripMessageArgs(text) {
		return text.replace(MESSAGE_ARG_RE, (whole, quoted) => whole.slice(0, whole.length - quoted.length));
		}
		// --- (b) trailing annotation channel (`-- ...` / `# ...`). Requires
		// whitespace immediately after the marker so real CLI flags like `--hard`,
		// `--dry-run`, `-fd` are never mistaken for a comment (those have no space
		// right after the dashes). ---
		const ANNOTATION_RE = /(\s\|^)(?:--\|#)\s+([\s\S]*)$/;
		function splitAnnotation(text) {
		const m = ANNOTATION_RE.exec(text);
		if (!m \|\| m.index === undefined)
		return { imperative: text, annotation: "" };
		const cutAt = m.index + m[1].length; // position right at the "--"/"#"
		return { imperative: text.slice(0, cutAt), annotation: m[2] };
		}
		// --- (c) git's own dry-run/preview flags, as standalone whitespace-
		// delimited tokens (never matches inside a combined short flag like `-nf`). ---
		const DRY_RUN_TOKENS = new Set(["-n", "--dry-run"]);
		function isDryRunPreview(text) {
		return text
		.split(/\s+/)
		.some((tok) => {
		const t = tok.toLowerCase();
		return DRY_RUN_TOKENS.has(t) \|\| t.startsWith("--dry-run=");
		});
		}
		// SECURITY (2026-07-26): isDryRunPreview() must NEVER be applied to a whole
		// action string. Doing so was a universal bypass — any action containing a bare
		// `-n` or `--dry-run` token anywhere was blanked to "" before keyword matching,
		// so ONE unrelated token defeated EVERY rule:
		// "shut down all database replicas in the production account -n" -> ""
		// "delete all rows from prod_customers table --dry-run" -> ""
		// It is also trivially hit by accident: `-n` is a common flag on grep, head,
		// sort, tail and echo, none of which are previews of anything.
		//
		// Correct scope: a preview flag only neutralizes the ONE command span it
		// belongs to, and only for commands that genuinely have a no-op preview mode
		// (git clean/rm print what they WOULD remove and change nothing). Spans are
		// delimited by shell operators so a chained real command stays visible:
		// "git clean -nfd && rm -rf /prod" -> only the git clean span is dropped.
		const PREVIEW_CAPABLE_SPAN_RE = /\bgit\s+(?:clean\|rm)\b[^;&\|\n]*/gi;
		function neutralizePreviewSpans(text) {
		return text.replace(PREVIEW_CAPABLE_SPAN_RE, (span) => isDryRunPreview(span) ? " " : span);
		}
		// Neutralizes ONLY the `rm <...rf-class flags...> <target>` span so unrelated
		// content elsewhere in the same action string is still evaluated normally.
		const RM_RE = /\brm\s+((?:-\S+\s+)+)(\S+)/gi;
		function neutralizeBenignRmRf(text) {
		return text.replace(RM_RE, (whole, flagsPart, target) => {
		const hasRecursive = /-[a-z]*r/i.test(flagsPart) \|\| /--recursive\b/i.test(flagsPart);
		const hasForce = /-[a-z]*f/i.test(flagsPart) \|\| /--force\b/i.test(flagsPart);
		if (!hasRecursive \|\| !hasForce)
		return whole; // not an rm -rf class invocation
		const base = target.replace(/\/+$/, "").split("/").filter(Boolean).pop() ?? target;
		return BENIGN_EPHEMERAL_DIRS.has(base.toLowerCase()) ? " " : whole;
		});
		}
		// Neutralizes a destructive SQL verb+object span ONLY when BOTH the object
		// name (e.g. "test_users") and the annotation (e.g. "-- ... fixture ...")
		// carry a benign marker — requiring both closes the obvious evasion where an
		// agent appends "-- test" to a genuinely destructive statement against a
		// production-named object (e.g. "DROP TABLE prod_customers; -- test").
		const SQL_DESTRUCTIVE_RE = /\b(DROP\|TRUNCATE)\s+TABLE\s+([A-Za-z_][A-Za-z0-9_]*)/gi;
		function neutralizeBenignSqlDrop(imperative, annotationIsBenign) {
		if (!annotationIsBenign)
		return imperative;
		return imperative.replace(SQL_DESTRUCTIVE_RE, (whole, _verb, object) => hasBenignMarker(object) ? " " : whole);
		}
		/**
		* Strip/neutralize benign context from an action description before it is
		* scanned for dangerous keywords. Returns the transformed action text —
		* never the original detection_pattern, never anything used for anything
		* other than the local, in-process keyword scan below.
		*/
		export function stripBenignContext(action) {
		try {
		const dataStripped = stripMessageArgs(stripHeredocBodies(action));
		// Preview flags neutralize ONLY their own command span — never the whole
		// action. See the security note above PREVIEW_CAPABLE_SPAN_RE.
		const previewScoped = neutralizePreviewSpans(dataStripped);
		const { imperative, annotation } = splitAnnotation(previewScoped);
		let scanned = neutralizeBenignSqlDrop(imperative, hasBenignMarker(annotation));
		scanned = neutralizeBenignRmRf(scanned);
		return scanned;
		}
		catch {
		return action; // fail-open — never let this transform hide something it can't parse
		}
		}
		/**
		* Match an action description against a rule's detection_pattern string.
		@@ -115,3 +286,3 @@ *
		const keywords = parseDetectionPattern(detectionPattern);
		const normalizedAction = normalize(action);
		const normalizedAction = normalize(stripBenignContext(action));
		const matchedKeywords = [];
		@@ -118,0 +289,0 @@ for (const kw of keywords) {

+1

-1

dist/engine/pattern-matcher.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"pattern-matcher.js","sourceRoot":"","sources":["../../src/engine/pattern-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,+EAA+E;AAC/E,mCAAmC;AACnC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM;IACpE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IACrE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS;CACzD,CAAC,CAAC;AAQH,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI;SACR,WAAW,EAAE;SACb,OAAO,CAAC,qBAAqB,EAAE,GAAG,CAAC;SACnC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,OAAe;IAC9C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C,0DAA0D;IAC1D,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzB,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAE1E,wCAAwC;IACxC,OAAO,QAAQ,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,gBAAwB;IAC5D,qCAAqC;IACrC,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAE9D,+EAA+E;IAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAE3C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,iEAAiE;YACjE,KAAK,MAAM,QAAQ,IAAI,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC;IAE5E,+DAA+D;IAC/D,4EAA4E;IAC5E,MAAM,GAAG,GAAG,mBAAmB,CAAC;IAChC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IAExC,oFAAoF;IACpF,OAAO,IAAI,MAAM,CAAC,YAAY,IAAI,WAAW,EAAE,GAAG,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,MAAc,EACd,gBAAwB;IAExB,yCAAyC;IACzC,IAAI,gBAAgB,KAAK,eAAe,EAAE,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACrE,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;IACzD,MAAM,gBAAgB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,eAAe,GAAa,EAAE,CAAC;IAErC,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAE3C,sDAAsD;IACtD,IAAI,UAAU,GAA8B,KAAK,CAAC;IAClD,IAAI,eAAe,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAChC,UAAU,GAAG,MAAM,CAAC;IACtB,CAAC;SAAM,IAAI,eAAe,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACvC,UAAU,GAAG,QAAQ,CAAC;IACxB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,KAAuD;IAEvD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
		{"version":3,"file":"pattern-matcher.js","sourceRoot":"","sources":["../../src/engine/pattern-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,+EAA+E;AAC/E,mCAAmC;AACnC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM;IACpE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IACrE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS;IACxD,yEAAyE;IACzE,qEAAqE;IACrE,qEAAqE;IACrE,4EAA4E;IAC5E,uEAAuE;IACvE,YAAY,EAAE,WAAW;CAC1B,CAAC,CAAC;AAQH,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI;SACR,WAAW,EAAE;SACb,OAAO,CAAC,qBAAqB,EAAE,GAAG,CAAC;SACnC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,OAAe;IAC9C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C,0DAA0D;IAC1D,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzB,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAE1E,wCAAwC;IACxC,OAAO,QAAQ,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,gBAAwB;IAC5D,qCAAqC;IACrC,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAE9D,+EAA+E;IAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAE3C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,iEAAiE;YACjE,KAAK,MAAM,QAAQ,IAAI,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC;IAE5E,+DAA+D;IAC/D,4EAA4E;IAC5E,MAAM,GAAG,GAAG,mBAAmB,CAAC;IAChC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IAExC,oFAAoF;IACpF,OAAO,IAAI,MAAM,CAAC,YAAY,IAAI,WAAW,EAAE,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,4CAA4C;AAC5C,kEAAkE;AAClE,yEAAyE;AACzE,yEAAyE;AACzE,4EAA4E;AAC5E,0EAA0E;AAC1E,yEAAyE;AACzE,uEAAuE;AACvE,+DAA+D;AAC/D,oEAAoE;AACpE,gDAAgD;AAChD,8EAA8E;AAE9E,uEAAuE;AACvE,4DAA4D;AAC5D,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ;IACjE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM;IAC9D,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM;CACnD,CAAC,CAAC;AAEH,wEAAwE;AACxE,4EAA4E;AAC5E,4EAA4E;AAC5E,4DAA4D;AAC5D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ;IAC/D,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO;CAC/D,CAAC,CAAC;AAEH,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,uEAAuE;AACvE,4EAA4E;AAC5E,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,0CAA0C,CAAC;AAEpE,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChB,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,EAAE,CAAC;YACN,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACvB,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gBACzD,CAAC,EAAE,CAAC,CAAC,4DAA4D;YACnE,CAAC;YACD,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM;gBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,2BAA2B;QACxE,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,uEAAuE;AACvE,0EAA0E;AAC1E,6EAA6E;AAC7E,6FAA6F;AAC7F,+EAA+E;AAC/E,uEAAuE;AACvE,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;AAC3E,4DAA4D;AAC5D,kEAAkE;AAClE,uBAAuB;AACvB,MAAM,cAAc,GAAG,kEAAkE,CAAC;AAE1F,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,KAAa,EAAE,MAAc,EAAE,EAAE,CACpE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAC7C,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,2EAA2E;AAC3E,2EAA2E;AAC3E,+BAA+B;AAC/B,MAAM,aAAa,GAAG,6BAA6B,CAAC;AAEpD,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC7E,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,iCAAiC;IACtE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,qEAAqE;AACrE,gFAAgF;AAChF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;AAEpD,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,IAAI;SACR,KAAK,CAAC,KAAK,CAAC;SACZ,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QACZ,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACP,CAAC;AAED,4EAA4E;AAC5E,gFAAgF;AAChF,gFAAgF;AAChF,8CAA8C;AAC9C,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,+DAA+D;AAC/D,EAAE;AACF,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,wEAAwE;AACxE,+EAA+E;AAC/E,MAAM,uBAAuB,GAAG,mCAAmC,CAAC;AAEpE,SAAS,sBAAsB,CAAC,IAAY;IAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,IAAI,EAAE,EAAE,CACpD,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CACnC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,MAAM,KAAK,GAAG,8BAA8B,CAAC;AAE7C,SAAS,oBAAoB,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,SAAiB,EAAE,MAAc,EAAE,EAAE;QACtE,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrF,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC,CAAC,iCAAiC;QAC/E,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC;QACnF,OAAO,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,2EAA2E;AAC3E,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,wDAAwD,CAAC;AAEpF,SAAS,uBAAuB,CAAC,UAAkB,EAAE,kBAA2B;IAC9E,IAAI,CAAC,kBAAkB;QAAE,OAAO,UAAU,CAAC;IAC3C,OAAO,UAAU,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE,KAAa,EAAE,MAAc,EAAE,EAAE,CACrF,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CACtC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QAElE,yEAAyE;QACzE,+DAA+D;QAC/D,MAAM,aAAa,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;QAE3D,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;QAClE,IAAI,OAAO,GAAG,uBAAuB,CAAC,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/E,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,CAAC,qEAAqE;IACtF,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,MAAc,EACd,gBAAwB;IAExB,yCAAyC;IACzC,IAAI,gBAAgB,KAAK,eAAe,EAAE,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACrE,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;IACzD,MAAM,gBAAgB,GAAG,SAAS,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,MAAM,eAAe,GAAa,EAAE,CAAC;IAErC,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAE3C,sDAAsD;IACtD,IAAI,UAAU,GAA8B,KAAK,CAAC;IAClD,IAAI,eAAe,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAChC,UAAU,GAAG,MAAM,CAAC;IACtB,CAAC;SAAM,IAAI,eAAe,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACvC,UAAU,GAAG,QAAQ,CAAC;IACxB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,KAAuD;IAEvD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

+10

-0

dist/engine/rule-engine.d.ts

		@@ -56,2 +56,12 @@ /**
		backend_results?: BackendRuleResult[];
		/**
		* Count of the customer's own custom rules that were fetched and evaluated
		* locally this call (P0-A fix, THUNDERSTRIKE 2026-07-25). Present only when
		* evaluateActionAsync() ran with a configured backend token. Absence/zero
		* does NOT distinguish "no custom rules exist" from "fetch failed and
		* fail-opened" — see custom_rules_fetch_error for that distinction.
		*/
		custom_rules_evaluated?: number;
		/** Set when the custom-rules fetch failed and evaluation fail-opened (no custom rules applied this call). */
		custom_rules_fetch_error?: string;
		}
		@@ -58,0 +68,0 @@ /** Test-only injection point. */

+1

-1

dist/engine/rule-engine.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"rule-engine.d.ts","sourceRoot":"","sources":["../../src/engine/rule-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAqB7D,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,gBAAgB,GAAG,UAAU,CAAC;IAC3C,oFAAoF;IACpF,IAAI,CAAC,EAAE,gBAAgB,GAAG,qBAAqB,GAAG,SAAS,GAAG,iBAAiB,CAAC;IAChF,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,iBAAiB,CAAC;IAC/C,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,IAAI,EAAE,CAAC;IACnB,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjB,mEAAmE;IACnE,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,qFAAqF;IACrF,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,0FAA0F;IAC1F,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,wFAAwF;IACxF,eAAe,CAAC,EAAE,iBAAiB,EAAE,CAAC;CACvC;AAoBD,iCAAiC;AACjC,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,IAAI,CAEnE;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAGtC;AAkDD,wBAAgB,YAAY,IAAI,IAAI,EAAE,CAkBrC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,EAAE,CAEpD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,EAAE,CAGzD;AA6BD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,MAAM,GACf,gBAAgB,CAyElB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,CAAC,CAmF3B"}
		{"version":3,"file":"rule-engine.d.ts","sourceRoot":"","sources":["../../src/engine/rule-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAc,MAAM,qBAAqB,CAAC;AAgEzE,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,gBAAgB,GAAG,UAAU,CAAC;IAC3C,oFAAoF;IACpF,IAAI,CAAC,EAAE,gBAAgB,GAAG,qBAAqB,GAAG,SAAS,GAAG,iBAAiB,CAAC;IAChF,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,iBAAiB,CAAC;IAC/C,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,IAAI,EAAE,CAAC;IACnB,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjB,mEAAmE;IACnE,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,qFAAqF;IACrF,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,0FAA0F;IAC1F,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,wFAAwF;IACxF,eAAe,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACtC;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,6GAA6G;IAC7G,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAoBD,iCAAiC;AACjC,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,IAAI,CAEnE;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAGtC;AAkDD,wBAAgB,YAAY,IAAI,IAAI,EAAE,CAkBrC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,EAAE,CAEpD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,EAAE,CAGzD;AA6BD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,MAAM,GACf,gBAAgB,CAiHlB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,CAAC,CA+K3B"}

+219

-41

dist/engine/rule-engine.js

		@@ -16,5 +16,47 @@ /**
		import { fileURLToPath } from "url";
		import { matchAction } from "./pattern-matcher.js";
		import { matchAction, stripBenignContext } from "./pattern-matcher.js";
		import { BackendClient } from "./backend-client.js";
		import { isPotentiallyCatastrophicRegex } from "./redos-guard.js";
		import { resistEvasion } from "./evasion-resistance.js";
		const __dirname = dirname(fileURLToPath(import.meta.url));
		// ----------------------------------------------------------------------
		// Multilingual-intent augmentation (integration point, 2026-07-26).
		// TEAM ALPHA-2 worker-3 task: append a sibling worker's multilingual
		// destructive-intent gloss into the `combined` construction of both
		// evaluateAction() and evaluateActionAsync(), same append-only pattern as
		// resistEvasion() below (never discards the original text, only extends
		// it) — so a rule's English-keyword-anchored detection_pattern/compiled_regex
		// can also catch destructive intent phrased in a non-English language
		// (ground truth 2026-07-26: verified-live evasions include French
		// "supprimer tous les utilisateurs et desactiver 2FA" and Arabic
		// "disable audit logging" sailing through unmatched).
		//
		// Contract (matches the sibling file's declared export exactly, so swapping
		// this local fallback for the real import is a one-line change):
		// export function multilingualDestructiveGloss(text: string): string[]
		//
		// STATUS AS OF THIS COMMIT: src/engine/multilingual-intent.ts does not exist
		// yet on disk (verified immediately before this edit — `ls` exit 2). This
		// module (rule-engine.ts) is imported by every other engine test file in
		// this parallel build wave (Rule 43.1.E file-lane discipline — TEAM ALPHA-2
		// workers 1/2/4/etc. all depend on it staying importable); a static
		// `import { multilingualDestructiveGloss } from "./multilingual-intent.js"`
		// against a file that doesn't exist would break the whole shared module for
		// every other worker's tests, not just this one's. multilingual-intent.ts is
		// also NOT in this worker's assigned file lane
		// (sunaiva-gate/src/engine/rule-engine.ts, pattern-matcher.ts,
		// tests/engine/fp-gauntlet-v2-regression.test.ts only) — creating it here
		// would itself be a lane violation. So: a local no-op fallback (returns
		// `[]`, meaning zero augmentation — behaviorally identical to the
		// pre-integration state) ships now, wired into both call sites below.
		//
		// TODO(sibling-worker): once src/engine/multilingual-intent.ts lands, delete
		// this local function and replace it with:
		// import { multilingualDestructiveGloss } from "./multilingual-intent.js";
		// at the top of this file (alongside the other ./*.js imports). No other
		// line in this file needs to change — the call sites already use the exact
		// contract signature.
		function multilingualDestructiveGloss(_text) {
		return [];
		}
		// Try dist layout first (../rules from dist/engine/), then source layout
		@@ -186,3 +228,38 @@ // (../../rules from src/engine/). This lets the same code run under tsc-built
		const activeRules = getActiveRules(config);
		const combined = context ? `${action} ${context}` : action;
		const rawCombined = context ? `${action} ${context}` : action;
		// P0-B FIX (THUNDERSTRIKE 2026-07-25, evasion-resistance.ts): matching runs
		// against the evasion-resisted text (NFKC-normalized, zero-width-stripped,
		// base64/hex/rot13-decoded payloads appended) instead of the raw string,
		// so a deterministic encoding of an already-blocked action doesn't slip
		// past a T1-lexical rule. The original text is never discarded — only
		// augmented — so literal-text rules still match the as-written form too.
		const evasionResisted = resistEvasion(rawCombined).augmented;
		// Multilingual-intent augmentation — appended AFTER evasion-resistance
		// decoding (so a non-English phrase hidden inside a base64/hex/rot13
		// payload also gets a multilingual pass, not just the as-written text),
		// same append-only, never-discard pattern as resistEvasion above. See the
		// multilingualDestructiveGloss() definition near the top of this file for
		// current status (local no-op fallback pending sibling file landing).
		const gloss = multilingualDestructiveGloss(evasionResisted);
		const combined = gloss.length > 0 ? `${evasionResisted} ${gloss.join(" ")}` : evasionResisted;
		// Benign-context-stripped view of `combined`, computed ONCE per call (not
		// once per rule) so the compiled-regex fast path below stays cheap even
		// when many rules carry compiled_regex. FIX (TEAM ALPHA-2 worker-3,
		// 2026-07-26): previously the fast path tested `cachedRe.test(combined)`
		// directly, completely bypassing stripBenignContext() — a SEPARATE code
		// path from matchAction() (which already called stripBenignContext()
		// internally since commit fef406d5d). Constitutional rules are the most
		// likely to carry compiled_regex (all 27 rules with compiled_regex in
		// rules.json are tier:"constitutional" as of 2026-07-26), so this bypass
		// meant the highest-severity (HARD/block-always) rules got NONE of the
		// data-vs-code protection the heuristic fallback path already had —
		// confirmed live: gov-002's compiled_regex matched all 4 audited false
		// positives from tests/gate/security/FP_GAUNTLET_V2_REPORT_2026-07-26.md
		// (probes C1-04, C3-05, C3-06, C3-22) when tested against raw `combined`,
		// and 2 of those 4 (C1-04, C3-22) stop matching once tested against the
		// stripped text instead — see fp-gauntlet-v2-regression.test.ts for the
		// full reproduction. stripBenignContext() is synchronous regex work only
		// (no I/O, no async) — see the timing assertion in the regression test
		// for a measured confirmation the sub-1ms-per-call property survives.
		const combinedForFastPath = stripBenignContext(combined);
		const violations = [];
		@@ -216,5 +293,10 @@ const warnings = [];
		if (cachedRe !== null) {
		matched = cachedRe.test(combined);
		matched = cachedRe.test(combinedForFastPath);
		}
		else {
		// matchAction() calls stripBenignContext() internally on its own
		// `action` argument — pass the RAW `combined` here, not
		// combinedForFastPath, to avoid stripping twice (harmless but
		// redundant; stripBenignContext is idempotent-in-effect but there is
		// no reason to pay the cost twice per rule).
		matched = matchAction(combined, rule.detection_pattern).matched;
		@@ -284,12 +366,42 @@ }
		const sync = evaluateAction(action, config, warningCounts, context);
		const client = getBackendClient();
		if (!client.isConfigured())
		return sync;
		// Premium rule IDs that the sync pass deferred to the backend.
		const activeRules = getActiveRules(config);
		const premiumRules = activeRules.filter((r) => r.backend_required === true && sync.skipped_premium.includes(r.id));
		if (premiumRules.length === 0)
		return sync;
		const combined = context ? `${action} ${context}` : action;
		const client = getBackendClient();
		const backendEval = await client.evaluate(premiumRules.map((r) => r.id), combined, { action_preview: action.slice(0, 200) });
		// Promote backend-matched premium rules into violations / warnings
		// following the same severity-tier ladder used by the local engine.
		const rawCombinedAsync = context ? `${action} ${context}` : action;
		// P0-B FIX: same evasion-resistant augmentation as the sync path, applied
		// to what's sent to the backend premium-rule evaluator AND to local
		// custom-rule regex matching below.
		const evasionResistedAsync = resistEvasion(rawCombinedAsync).augmented;
		// Multilingual-intent augmentation — same append-only pattern as the sync
		// path above (see the comment there and at multilingualDestructiveGloss()'s
		// definition near the top of this file). Applied here too so both the
		// backend premium-rule payload and local custom-rule matching below see
		// the same augmented text as the sync engine's own rule matching.
		const glossAsync = multilingualDestructiveGloss(evasionResistedAsync);
		const combined = glossAsync.length > 0 ? `${evasionResistedAsync} ${glossAsync.join(" ")}` : evasionResistedAsync;
		// P0-A FIX (THUNDERSTRIKE 2026-07-25, data/AUDITS/GATE_SECURITY_ADVERSARIAL_AUDIT_2026-07-25.md
		// U4): the previous code `return`ed `sync` immediately whenever
		// premiumRules.length === 0 — the common case for any customer who has
		// custom rules but no active premium rules — which silently skipped the
		// backend entirely and NEVER evaluated the customer's own custom rules on
		// this local client, even though `list_custom_rules` correctly showed the
		// rule existed and the remote backend (POST /v1/gatehooks Shape D)
		// correctly fired it. Live-probe evidence: the
		// `qa-canary-2-propagation-check` canary matched on the remote backend but
		// was silently allowed by this exact function. Fix: always fetch custom
		// rules when a token is configured, and evaluate premium + custom rules
		// concurrently rather than gating custom-rule evaluation on premium rules
		// existing.
		const [backendEval, customRulesResult] = await Promise.all([
		premiumRules.length > 0
		? client.evaluate(premiumRules.map((r) => r.id), combined, { action_preview: action.slice(0, 200) })
		: Promise.resolve(null),
		client.listCustomRules(),
		]);
		// Promote backend-matched premium rules, and locally-matched custom rules,
		// into violations / warnings following the same severity-tier ladder used
		// by the local engine.
		const violations = [...sync.violations];
		@@ -307,34 +419,98 @@ const warnings = [...sync.warnings];
		};
		for (const r of backendEval.results) {
		if (!r.matched)
		continue;
		const rule = premiumRules.find((p) => p.id === r.rule_id);
		if (!rule)
		continue;
		// Backend severity overrides local; default to MEDIUM when unspecified.
		const tier = rule.enforcement === "constitutional"
		? "HARD"
		: r.severity === "warn"
		? "SOFT"
		: "MEDIUM";
		bump(tier);
		if (tier === "SOFT") {
		warnings.push(rule);
		let skippedPremium = sync.skipped_premium;
		if (backendEval) {
		for (const r of backendEval.results) {
		if (!r.matched)
		continue;
		const rule = premiumRules.find((p) => p.id === r.rule_id);
		if (!rule)
		continue;
		// Backend severity overrides local; default to MEDIUM when unspecified.
		const tier = rule.enforcement === "constitutional"
		? "HARD"
		: r.severity === "warn"
		? "SOFT"
		: "MEDIUM";
		bump(tier);
		if (tier === "SOFT") {
		warnings.push(rule);
		}
		else {
		violations.push(rule);
		wouldHaveBlocked.push(rule.id);
		}
		}
		else {
		violations.push(rule);
		wouldHaveBlocked.push(rule.id);
		// Premium rules that the backend handled are no longer "skipped".
		const handled = sync.skipped_premium.filter((id) => !backendEval.results.some((r) => r.rule_id === id &&
		r.status !== "skipped_no_token" &&
		r.status !== "skipped_disabled" &&
		!r.status.startsWith("skipped_")));
		// Inverse: keep the rules that ARE still skipped (token absent or backend error).
		const stillSkipped = backendEval.results
		.filter((r) => r.status.startsWith("skipped_"))
		.map((r) => r.rule_id);
		skippedPremium = Array.from(new Set([...handled, ...stillSkipped]));
		}
		// ---- Custom rules (P0-A fix) ----
		// Mirrors mcp-servers/sunaiva-gate-backend/src/routes/gatehooks.ts
		// handleShapeD's evaluation semantics exactly: detection_pattern is a real
		// regex (optional `(?i)` case-insensitive prefix), re-checked against the
		// ReDoS guard immediately before compiling (defense-in-depth pair — see
		// redos-guard.ts), "block" severity → enforcement, "warn" → warning,
		// "log" → telemetry only (no local enforcement effect, matches server).
		let customRulesEvaluated = 0;
		let customRulesFetchError;
		if (Array.isArray(customRulesResult)) {
		for (const cr of customRulesResult) {
		if (!cr.detection_pattern)
		continue; // only detection_pattern participates in evaluation (server parity)
		if (isPotentiallyCatastrophicRegex(cr.detection_pattern))
		continue; // fail-open for this one rule
		let patternStr = cr.detection_pattern;
		let flags = "";
		if (patternStr.startsWith("(?i)")) {
		patternStr = patternStr.slice(4);
		flags = "i";
		}
		let re;
		try {
		re = new RegExp(patternStr, flags);
		}
		catch {
		continue; // invalid pattern — fail-open for this one rule
		}
		customRulesEvaluated++;
		if (!re.test(combined))
		continue;
		if (cr.severity !== "block" && cr.severity !== "warn")
		continue; // "log" = telemetry only
		const asRule = {
		id: cr.id,
		name: cr.name,
		description: cr.description ?? cr.name,
		category: "custom",
		enforcement: "standard",
		tier: "premium",
		gate_type: "custom",
		severity: cr.severity === "warn" ? "warn" : "block",
		detection_pattern: cr.detection_pattern,
		tags: ["custom"],
		preset_groups: [],
		};
		if (cr.severity === "warn") {
		bump("SOFT");
		warnings.push(asRule);
		}
		else {
		bump("MEDIUM");
		violations.push(asRule);
		wouldHaveBlocked.push(asRule.id);
		}
		}
		}
		// Premium rules that the backend handled are no longer "skipped".
		const skippedPremium = sync.skipped_premium.filter((id) => !backendEval.results.some((r) => r.rule_id === id &&
		r.status !== "skipped_no_token" &&
		r.status !== "skipped_disabled" &&
		!r.status.startsWith("skipped_")));
		// Inverse: keep the rules that ARE still skipped (token absent or backend error).
		const stillSkipped = backendEval.results
		.filter((r) => r.status.startsWith("skipped_"))
		.map((r) => r.rule_id);
		// Union local-deferred + still-skipped (de-dup).
		const finalSkipped = Array.from(new Set([...skippedPremium, ...stillSkipped]));
		else if (customRulesResult && typeof customRulesResult === "object" && "error" in customRulesResult) {
		// ControlPlaneError (auth/tier/network) — fail-OPEN, same posture as
		// every other backend interaction in this client (hook_discipline_001).
		customRulesFetchError = String(customRulesResult.error);
		}
		return {
		@@ -346,6 +522,8 @@ allowed: violations.length === 0,
		would_have_blocked: wouldHaveBlocked,
		skipped_premium: finalSkipped,
		backend_results: backendEval.results,
		skipped_premium: skippedPremium,
		backend_results: backendEval?.results,
		custom_rules_evaluated: customRulesEvaluated,
		...(customRulesFetchError ? { custom_rules_fetch_error: customRulesFetchError } : {}),
		};
		}
		//# sourceMappingURL=rule-engine.js.map

+1

-1

dist/engine/rule-engine.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"rule-engine.js","sourceRoot":"","sources":["../../src/engine/rule-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,yEAAyE;AACzE,8EAA8E;AAC9E,2DAA2D;AAC3D,SAAS,gBAAgB;IACvB,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,EAAE,6DAA6D;QACrG,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,EAAE,iFAAiF;QAC5H,IAAI,CAAC,SAAS,EAAE,6BAA6B,CAAC,EAAE,gFAAgF;KACjI,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,yCAAyC;AACjE,CAAC;AAED,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;AA8CtC,IAAI,MAAM,GAAkB,IAAI,CAAC;AACjC,IAAI,mBAAmB,GAA+B,IAAI,CAAC;AAE3D,yEAAyE;AACzE,8DAA8D;AAC9D,yEAAyE;AACzE,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,iDAAiD;AACjD,IAAI,cAAc,GAAyB,IAAI,CAAC;AAEhD,iEAAiE;AACjE,SAAS,gBAAgB;IACvB,IAAI,CAAC,cAAc;QAAE,cAAc,GAAG,IAAI,aAAa,EAAE,CAAC;IAC1D,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,gBAAgB,CAAC,MAA4B;IAC3D,cAAc,GAAG,MAAM,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,IAAI,CAAC;IACd,mBAAmB,GAAG,IAAI,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB,CAAC,CAAO;IAC/B,OAAO,CACL,CAAC,CAAC,IAAI,KAAK,gBAAgB;QAC3B,CAAC,CAAC,WAAW,KAAK,gBAAgB;QAClC,CAAC,CAAC,cAAc,KAAK,IAAI,CAC1B;QACC,CAAC,CAAC,IAAI,KAAK,qBAAqB;QAChC,CAAC,CAAC,IAAI,KAAK,SAAS;QACpB,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,IAAU;IAClC,IAAI,CAAC,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,mBAAmB;QAAE,mBAAmB,GAAG,IAAI,GAAG,EAAE,CAAC;IAC1D,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,IAAI,CAAC;YACH,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YAC1C,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,wEAAwE;AACxE,SAAS,mBAAmB;IAC1B,OAAO,gBAAgB,EAAE,CAAC,YAAY,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,yEAAyE;IACzE,oEAAoE;IACpE,mBAAmB,GAAG,IAAI,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2DAA2D;QAC3D,2DAA2D;QAC3D,OAAO,CAAC,KAAK,CACX,qDAAqD,UAAU,IAAI;YACjE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CACrD,CAAC;QACF,MAAM,GAAG,EAAE,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,YAAY,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAkB;IAC/C,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,IAAU;IAC7B,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;AAChC,CAAC;AAED,gEAAgE;AAChE,SAAS,cAAc,CAAC,IAAU;IAChC,+CAA+C;IAC/C,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,WAAW,KAAK,gBAAgB;QAAE,OAAO,MAAM,CAAC;IAC3F,4EAA4E;IAC5E,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;QAC5C,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAC5C,sCAAsC;IACtC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,MAAkB,EAClB,aAAkC,EAClC,OAAgB;IAEhB,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAE3D,MAAM,UAAU,GAAW,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAW,EAAE,CAAC;IAC5B,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,MAAM,cAAc,GAAa,EAAE,CAAC;IAEpC,IAAI,WAAW,GAAwB,IAAI,CAAC;IAC5C,MAAM,YAAY,GAAG,CAAC,CAAe,EAAE,EAAE;QACvC,IAAI,WAAW,KAAK,IAAI;YAAE,WAAW,GAAG,CAAC,CAAC;aACrC,IAAI,CAAC,KAAK,MAAM;YAAE,WAAW,GAAG,MAAM,CAAC;aACvC,IAAI,CAAC,KAAK,QAAQ,IAAI,WAAW,KAAK,MAAM;YAAE,WAAW,GAAG,QAAQ,CAAC;IAC5E,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,0EAA0E;QAC1E,0EAA0E;QAC1E,8EAA8E;QAC9E,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,sEAAsE;QACtE,0EAA0E;QAC1E,4EAA4E;QAC5E,qEAAqE;QACrE,IAAI,OAAgB,CAAC;QACrB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAClC,YAAY,CAAC,IAAI,CAAC,CAAC;QAEnB,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,sDAAsD;YACtD,8DAA8D;YAC9D,oEAAoE;YACpE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,mDAAmD;YACnD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,qDAAqD;YACrD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,gBAAgB,KAAK,WAAW,IAAI,MAAM,CAAC,gBAAgB,KAAK,OAAO,EAAE,CAAC;gBACnF,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjC,CAAC;iBAAM,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC;IACxC,OAAO;QACL,OAAO;QACP,UAAU;QACV,QAAQ;QACR,aAAa,EAAE,WAAW;QAC1B,kBAAkB,EAAE,gBAAgB;QACpC,eAAe,EAAE,cAAc;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,MAAkB,EAClB,aAAkC,EAClC,OAAgB;IAEhB,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAEpE,+DAA+D;IAC/D,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAC1E,CAAC;IAEF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3D,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,QAAQ,CACvC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC7B,QAAQ,EACR,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACzC,CAAC;IAEF,mEAAmE;IACnE,oEAAoE;IACpE,MAAM,UAAU,GAAW,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAW,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,gBAAgB,GAAa,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAChE,IAAI,WAAW,GAAwB,IAAI,CAAC,aAAa,CAAC;IAE1D,MAAM,IAAI,GAAG,CAAC,CAAe,EAAE,EAAE;QAC/B,IAAI,WAAW,KAAK,IAAI;YAAE,WAAW,GAAG,CAAC,CAAC;aACrC,IAAI,CAAC,KAAK,MAAM;YAAE,WAAW,GAAG,MAAM,CAAC;aACvC,IAAI,CAAC,KAAK,QAAQ,IAAI,WAAW,KAAK,MAAM;YAAE,WAAW,GAAG,QAAQ,CAAC;IAC5E,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,SAAS;QACzB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI;YAAE,SAAS;QAEpB,wEAAwE;QACxE,MAAM,IAAI,GACR,IAAI,CAAC,WAAW,KAAK,gBAAgB;YACnC,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM;gBACrB,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,QAAQ,CAAC;QACjB,IAAI,CAAC,IAAI,CAAC,CAAC;QAEX,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAChD,CAAC,EAAE,EAAE,EAAE,CACL,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,OAAO,KAAK,EAAE;QAChB,CAAC,CAAC,MAAM,KAAK,kBAAkB;QAC/B,CAAC,CAAC,MAAM,KAAK,kBAAkB;QAC/B,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CACnC,CACJ,CAAC;IAEF,kFAAkF;IAClF,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;SAC9C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAEzB,iDAAiD;IACjD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAE/E,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC;QAChC,UAAU;QACV,QAAQ;QACR,aAAa,EAAE,WAAW;QAC1B,kBAAkB,EAAE,gBAAgB;QACpC,eAAe,EAAE,YAAY;QAC7B,eAAe,EAAE,WAAW,CAAC,OAAO;KACrC,CAAC;AACJ,CAAC"}
		{"version":3,"file":"rule-engine.js","sourceRoot":"","sources":["../../src/engine/rule-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAEvE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,yEAAyE;AACzE,oEAAoE;AACpE,qEAAqE;AACrE,oEAAoE;AACpE,0EAA0E;AAC1E,wEAAwE;AACxE,8EAA8E;AAC9E,sEAAsE;AACtE,kEAAkE;AAClE,iEAAiE;AACjE,sDAAsD;AACtD,EAAE;AACF,4EAA4E;AAC5E,iEAAiE;AACjE,yEAAyE;AACzE,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,yEAAyE;AACzE,4EAA4E;AAC5E,oEAAoE;AACpE,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,+CAA+C;AAC/C,+DAA+D;AAC/D,0EAA0E;AAC1E,wEAAwE;AACxE,kEAAkE;AAClE,sEAAsE;AACtE,EAAE;AACF,6EAA6E;AAC7E,2CAA2C;AAC3C,6EAA6E;AAC7E,yEAAyE;AACzE,2EAA2E;AAC3E,sBAAsB;AACtB,SAAS,4BAA4B,CAAC,KAAa;IACjD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,yEAAyE;AACzE,8EAA8E;AAC9E,2DAA2D;AAC3D,SAAS,gBAAgB;IACvB,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,EAAE,6DAA6D;QACrG,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,EAAE,iFAAiF;QAC5H,IAAI,CAAC,SAAS,EAAE,6BAA6B,CAAC,EAAE,gFAAgF;KACjI,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,yCAAyC;AACjE,CAAC;AAED,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;AAwDtC,IAAI,MAAM,GAAkB,IAAI,CAAC;AACjC,IAAI,mBAAmB,GAA+B,IAAI,CAAC;AAE3D,yEAAyE;AACzE,8DAA8D;AAC9D,yEAAyE;AACzE,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,iDAAiD;AACjD,IAAI,cAAc,GAAyB,IAAI,CAAC;AAEhD,iEAAiE;AACjE,SAAS,gBAAgB;IACvB,IAAI,CAAC,cAAc;QAAE,cAAc,GAAG,IAAI,aAAa,EAAE,CAAC;IAC1D,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,gBAAgB,CAAC,MAA4B;IAC3D,cAAc,GAAG,MAAM,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,IAAI,CAAC;IACd,mBAAmB,GAAG,IAAI,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB,CAAC,CAAO;IAC/B,OAAO,CACL,CAAC,CAAC,IAAI,KAAK,gBAAgB;QAC3B,CAAC,CAAC,WAAW,KAAK,gBAAgB;QAClC,CAAC,CAAC,cAAc,KAAK,IAAI,CAC1B;QACC,CAAC,CAAC,IAAI,KAAK,qBAAqB;QAChC,CAAC,CAAC,IAAI,KAAK,SAAS;QACpB,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,IAAU;IAClC,IAAI,CAAC,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,mBAAmB;QAAE,mBAAmB,GAAG,IAAI,GAAG,EAAE,CAAC;IAC1D,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,IAAI,CAAC;YACH,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YAC1C,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,wEAAwE;AACxE,SAAS,mBAAmB;IAC1B,OAAO,gBAAgB,EAAE,CAAC,YAAY,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,yEAAyE;IACzE,oEAAoE;IACpE,mBAAmB,GAAG,IAAI,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2DAA2D;QAC3D,2DAA2D;QAC3D,OAAO,CAAC,KAAK,CACX,qDAAqD,UAAU,IAAI;YACjE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CACrD,CAAC;QACF,MAAM,GAAG,EAAE,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,YAAY,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAkB;IAC/C,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,IAAU;IAC7B,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;AAChC,CAAC;AAED,gEAAgE;AAChE,SAAS,cAAc,CAAC,IAAU;IAChC,+CAA+C;IAC/C,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,WAAW,KAAK,gBAAgB;QAAE,OAAO,MAAM,CAAC;IAC3F,4EAA4E;IAC5E,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;QAC5C,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAC5C,sCAAsC;IACtC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,MAAkB,EAClB,aAAkC,EAClC,OAAgB;IAEhB,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9D,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,yEAAyE;IACzE,MAAM,eAAe,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC;IAC7D,uEAAuE;IACvE,qEAAqE;IACrE,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,KAAK,GAAG,4BAA4B,CAAC,eAAe,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,eAAe,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;IAC9F,0EAA0E;IAC1E,wEAAwE;IACxE,oEAAoE;IACpE,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE,wEAAwE;IACxE,sEAAsE;IACtE,yEAAyE;IACzE,uEAAuE;IACvE,oEAAoE;IACpE,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAEzD,MAAM,UAAU,GAAW,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAW,EAAE,CAAC;IAC5B,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,MAAM,cAAc,GAAa,EAAE,CAAC;IAEpC,IAAI,WAAW,GAAwB,IAAI,CAAC;IAC5C,MAAM,YAAY,GAAG,CAAC,CAAe,EAAE,EAAE;QACvC,IAAI,WAAW,KAAK,IAAI;YAAE,WAAW,GAAG,CAAC,CAAC;aACrC,IAAI,CAAC,KAAK,MAAM;YAAE,WAAW,GAAG,MAAM,CAAC;aACvC,IAAI,CAAC,KAAK,QAAQ,IAAI,WAAW,KAAK,MAAM;YAAE,WAAW,GAAG,QAAQ,CAAC;IAC5E,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,0EAA0E;QAC1E,0EAA0E;QAC1E,8EAA8E;QAC9E,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,sEAAsE;QACtE,0EAA0E;QAC1E,4EAA4E;QAC5E,qEAAqE;QACrE,IAAI,OAAgB,CAAC;QACrB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,iEAAiE;YACjE,wDAAwD;YACxD,8DAA8D;YAC9D,qEAAqE;YACrE,6CAA6C;YAC7C,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAClC,YAAY,CAAC,IAAI,CAAC,CAAC;QAEnB,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,sDAAsD;YACtD,8DAA8D;YAC9D,oEAAoE;YACpE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,mDAAmD;YACnD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,qDAAqD;YACrD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,gBAAgB,KAAK,WAAW,IAAI,MAAM,CAAC,gBAAgB,KAAK,OAAO,EAAE,CAAC;gBACnF,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjC,CAAC;iBAAM,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC;IACxC,OAAO;QACL,OAAO;QACP,UAAU;QACV,QAAQ;QACR,aAAa,EAAE,WAAW;QAC1B,kBAAkB,EAAE,gBAAgB;QACpC,eAAe,EAAE,cAAc;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,MAAkB,EAClB,aAAkC,EAClC,OAAgB;IAEhB,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAEpE,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE;QAAE,OAAO,IAAI,CAAC;IAExC,+DAA+D;IAC/D,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAC1E,CAAC;IAEF,MAAM,gBAAgB,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACnE,0EAA0E;IAC1E,oEAAoE;IACpE,oCAAoC;IACpC,MAAM,oBAAoB,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC,SAAS,CAAC;IACvE,0EAA0E;IAC1E,4EAA4E;IAC5E,sEAAsE;IACtE,wEAAwE;IACxE,kEAAkE;IAClE,MAAM,UAAU,GAAG,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;IACtE,MAAM,QAAQ,GACZ,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,oBAAoB,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAEnG,gGAAgG;IAChG,gEAAgE;IAChE,uEAAuE;IACvE,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,mEAAmE;IACnE,+CAA+C;IAC/C,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,YAAY;IACZ,MAAM,CAAC,WAAW,EAAE,iBAAiB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzD,YAAY,CAAC,MAAM,GAAG,CAAC;YACrB,CAAC,CAAC,MAAM,CAAC,QAAQ,CACb,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC7B,QAAQ,EACR,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACzC;YACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACzB,MAAM,CAAC,eAAe,EAAE;KACzB,CAAC,CAAC;IAEH,2EAA2E;IAC3E,0EAA0E;IAC1E,uBAAuB;IACvB,MAAM,UAAU,GAAW,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAW,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,gBAAgB,GAAa,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAChE,IAAI,WAAW,GAAwB,IAAI,CAAC,aAAa,CAAC;IAE1D,MAAM,IAAI,GAAG,CAAC,CAAe,EAAE,EAAE;QAC/B,IAAI,WAAW,KAAK,IAAI;YAAE,WAAW,GAAG,CAAC,CAAC;aACrC,IAAI,CAAC,KAAK,MAAM;YAAE,WAAW,GAAG,MAAM,CAAC;aACvC,IAAI,CAAC,KAAK,QAAQ,IAAI,WAAW,KAAK,MAAM;YAAE,WAAW,GAAG,QAAQ,CAAC;IAC5E,CAAC,CAAC;IAEF,IAAI,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC;IAC1C,IAAI,WAAW,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,CAAC,OAAO;gBAAE,SAAS;YACzB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEpB,wEAAwE;YACxE,MAAM,IAAI,GACR,IAAI,CAAC,WAAW,KAAK,gBAAgB;gBACnC,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM;oBACrB,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,QAAQ,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,CAAC;YAEX,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QAED,kEAAkE;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CACzC,CAAC,EAAE,EAAE,EAAE,CACL,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,OAAO,KAAK,EAAE;YAChB,CAAC,CAAC,MAAM,KAAK,kBAAkB;YAC/B,CAAC,CAAC,MAAM,KAAK,kBAAkB;YAC/B,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CACnC,CACJ,CAAC;QACF,kFAAkF;QAClF,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO;aACrC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;aAC9C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACzB,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,oCAAoC;IACpC,mEAAmE;IACnE,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,qEAAqE;IACrE,wEAAwE;IACxE,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,IAAI,qBAAyC,CAAC;IAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACrC,KAAK,MAAM,EAAE,IAAI,iBAAiC,EAAE,CAAC;YACnD,IAAI,CAAC,EAAE,CAAC,iBAAiB;gBAAE,SAAS,CAAC,oEAAoE;YACzG,IAAI,8BAA8B,CAAC,EAAE,CAAC,iBAAiB,CAAC;gBAAE,SAAS,CAAC,8BAA8B;YAClG,IAAI,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC;YACtC,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClC,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACjC,KAAK,GAAG,GAAG,CAAC;YACd,CAAC;YACD,IAAI,EAAU,CAAC;YACf,IAAI,CAAC;gBACH,EAAE,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,CAAC,gDAAgD;YAC5D,CAAC;YACD,oBAAoB,EAAE,CAAC;YACvB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACjC,IAAI,EAAE,CAAC,QAAQ,KAAK,OAAO,IAAI,EAAE,CAAC,QAAQ,KAAK,MAAM;gBAAE,SAAS,CAAC,yBAAyB;YAE1F,MAAM,MAAM,GAAS;gBACnB,EAAE,EAAE,EAAE,CAAC,EAAE;gBACT,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,WAAW,EAAE,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,IAAI;gBACtC,QAAQ,EAAE,QAAQ;gBAClB,WAAW,EAAE,UAAU;gBACvB,IAAI,EAAE,SAAS;gBACf,SAAS,EAAE,QAAQ;gBACnB,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;gBACnD,iBAAiB,EAAE,EAAE,CAAC,iBAAiB;gBACvC,IAAI,EAAE,CAAC,QAAQ,CAAC;gBAChB,aAAa,EAAE,EAAE;aAClB,CAAC;YAEF,IAAI,EAAE,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACf,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACxB,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,iBAAiB,IAAI,OAAO,iBAAiB,KAAK,QAAQ,IAAI,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACtG,qEAAqE;QACrE,wEAAwE;QACxE,qBAAqB,GAAG,MAAM,CAAE,iBAAwC,CAAC,KAAK,CAAC,CAAC;IAClF,CAAC;IAED,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC;QAChC,UAAU;QACV,QAAQ;QACR,aAAa,EAAE,WAAW;QAC1B,kBAAkB,EAAE,gBAAgB;QACpC,eAAe,EAAE,cAAc;QAC/B,eAAe,EAAE,WAAW,EAAE,OAAO;QACrC,sBAAsB,EAAE,oBAAoB;QAC5C,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtF,CAAC;AACJ,CAAC"}

+26

-2

dist/index.js

		@@ -17,3 +17,3 @@ #!/usr/bin/env node
		import { SUPPORTED_AGENTS } from "./installer/detect.js";
		import { installAll, formatResults } from "./installer/install.js";
		import { installAll, formatResults, uninstallAll, formatUninstallResults } from "./installer/install.js";
		import { parseInstallArgs, computeInstallExitCode, buildInstallSummary } from "./installer/cli-args.js";
		@@ -31,3 +31,3 @@ import { maybeShowNudge } from "./identity/nudge.js";
		import { fileURLToPath } from "node:url";
		const PKG_VERSION = "2.0.4";
		const PKG_VERSION = "2.0.5";
		const __dirname = path.dirname(fileURLToPath(import.meta.url));
		@@ -328,2 +328,4 @@ const server = new Server({ name: "sunaiva-gate", version: PKG_VERSION }, { capabilities: { tools: {} } });
		--mcp-endpoint <url> Override MCP endpoint in generated shims
		npx @sunaiva/gate uninstall Restore config files to pre-install state (byte-identical)
		--agents <csv> Restrict to specific agents
		npx @sunaiva/gate --smoke-test Run a local health check and exit
		@@ -476,2 +478,24 @@ npx @sunaiva/gate --version Print version and exit
		}
		// uninstall / --uninstall — restore every agent's config to its exact
		// pre-install state (byte-identical) via the backup marker written by
		// `ensureBackup()` during install. Idempotent: no-ops cleanly if install
		// was never run (or was already uninstalled).
		// Flags: --agents <csv> (default: all detected).
		// Exit 0 always — restoring config is best-effort and never fails the host.
		if (argv.includes("--uninstall") \|\| argv[0] === "uninstall") {
		const installOpts = parseInstallArgs(argv);
		try {
		const results = await uninstallAll({
		...(installOpts.agents !== undefined ? { agents: installOpts.agents } : {}),
		});
		const output = formatUninstallResults(results);
		if (output)
		console.log(output);
		process.exit(0);
		}
		catch (err) {
		console.error(`[sunaiva-gate v${PKG_VERSION}] uninstall error: ${err instanceof Error ? err.message : String(err)}`);
		process.exit(2);
		}
		}
		// --enforce-on / --enforce-off — free local toggle, no API key required.
		@@ -478,0 +502,0 @@ // Writes enforcement_mode to ~/.sunaiva/gate-config.json.

+1

-1

dist/index.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAmB,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAkB,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACxG,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrI,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,EAC9C,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;AAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5D,KAAK,EAAE;QACL;YACE,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,8GAA8G;YAC3H,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wBAAwB,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6BAA6B,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;SAClN;QACD;YACE,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,2FAA2F;YACxG,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0BAA0B,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;SAChO;QACD;YACE,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,0EAA0E;YACvF,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,EAAE,EAAE,EAAE;SACnL;QACD;YACE,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,8EAA8E;YAC3F,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE,EAAE,EAAE;SACpO;QACD;YACE,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,sEAAsE;YACnF,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oCAAoC,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,EAAE,EAAE;SAC7L;QACD;YACE,IAAI,EAAE,uBAAuB;YAC7B,WAAW,EAAE,kMAAkM;YAC/M,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yDAAyD,EAAE;oBACvG,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oEAAoE,EAAE;oBACtH,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uDAAuD,EAAE;iBAChG;gBACD,QAAQ,EAAE,CAAC,aAAa,CAAC;aAC1B;SACF;QACD;YACE,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,iLAAiL;YAC9L,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;SAChD;QACD;YACE,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,8FAA8F;YAC3G,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sBAAsB,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iDAAiD,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE;SACnV;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,yGAAyG;YACtH,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;SAChD;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,2GAA2G;YACxH,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE;SACrJ;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,yEAAyE;YACtF,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sBAAsB,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sCAAsC,EAAE,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2BAA2B,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE;SACxhB;QACD;YACE,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EAAE,0DAA0D;YACvE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE;SACnV;QACD;YACE,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EAAE,gDAAgD;YAC7D,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE;SAC5H;QACD;YACE,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,gFAAgF;YAC7F,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;SAChD;QACD;YACE,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,8DAA8D;YAC3E,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;SAChD;QACD;YACE,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,oFAAoF;YACjG,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2BAA2B,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE;SAClJ;KACF;CACF,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5D,8DAA8D;IAC9D,2EAA2E;IAC3E,mDAAmD;IACnD,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;QAC3E,KAAK,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;IAC7C,IAAI,CAAC;QACH,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,iBAAiB,CAAC,CAAC,OAAO,MAAM,oBAAoB,CAAC,IAAkD,CAAC,CAAC;YAC9G,KAAK,YAAY,CAAC,CAAC,OAAO,MAAM,eAAe,CAAC,IAA6C,CAAC,CAAC;YAC/F,KAAK,WAAW,CAAC,CAAC,OAAO,MAAM,cAAc,CAAC,IAA4C,CAAC,CAAC;YAC5F,KAAK,cAAc,CAAC,CAAC,OAAO,MAAM,iBAAiB,CAAC,IAA+C,CAAC,CAAC;YACrG,KAAK,eAAe,CAAC,CAAC,OAAO,MAAM,iBAAiB,CAAC,IAA+C,CAAC,CAAC;YACtG,KAAK,uBAAuB,CAAC,CAAC,OAAO,MAAM,yBAAyB,CAAC,IAAuD,CAAC,CAAC;YAC9H,KAAK,cAAc,CAAC,CAAC,OAAO,MAAM,sBAAsB,CAAC,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC;YAClG,KAAK,eAAe,CAAC,CAAC,OAAO,MAAM,iBAAiB,CAAC,IAA+C,CAAC,CAAC;YACtG,KAAK,gBAAgB,CAAC,CAAC,OAAO,MAAM,kBAAkB,CAAC,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC;YAChG,KAAK,iBAAiB,CAAC,CAAC,OAAO,MAAM,mBAAmB,CAAC,IAAiD,CAAC,CAAC;YAC5G,KAAK,iBAAiB,CAAC,CAAC,OAAO,MAAM,mBAAmB,CAAC,IAAiD,CAAC,CAAC;YAC5G,KAAK,oBAAoB,CAAC,CAAC,OAAO,MAAM,sBAAsB,CAAC,IAAoD,CAAC,CAAC;YACrH,KAAK,oBAAoB,CAAC,CAAC,OAAO,MAAM,sBAAsB,CAAC,IAAoD,CAAC,CAAC;YACrH,KAAK,mBAAmB,CAAC,CAAC,OAAO,MAAM,qBAAqB,CAAC,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC;YACtG,KAAK,cAAc,CAAC,CAAC,OAAO,MAAM,iBAAiB,CAAC,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC;YAC7F,KAAK,cAAc,CAAC,CAAC,OAAO,MAAM,iBAAiB,CAAC,IAA+C,CAAC,CAAC;YACrG,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;QAC1F,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACtH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,8FAA8F;AAC9F,SAAS,oBAAoB,CAAC,UAAoB;IAChD,OAAO;QACL,GAAG,cAAc;QACjB,YAAY,EAAE,UAAU;QACxB,gBAAgB,EAAE,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,MAAM,GAAqD,EAAE,CAAC;IACpE,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IAC9D,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAAmC,EAAE,CAAC;IAElD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAChC,CAAC,CAAE,MAAyC;YAC5C,CAAC,CAAE,MAAM,CAAC,MAAM,CAAC,MAAmC,CAAC,CAAC,IAAI,EAAqC,CAAC;QAClG,QAAQ,GAAG,IAAI,CAAC;QAChB,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;QACzB,mBAAmB,GAAG,IAAI,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,gBAAgB,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,CAAC,CAC9E,CAAC,MAAM,CAAC;QACT,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QAC3E,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,QAAQ,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,sBAAsB;YAC7B,EAAE,EAAE,mBAAmB,GAAG,CAAC;YAC3B,MAAM,EAAE,GAAG,mBAAmB,yCAAyC;SACxE,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,eAAe;YACtB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,GAAG,YAAY,4BAA4B;SACpD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,GAAG,IAAI,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACzF,CAAC,CAAC;IACL,CAAC;IAED,yDAAyD;IACzD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,oBAAoB;YAC3B,EAAE,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC;YACrB,MAAM,EAAE,YAAY,QAAQ,CAAC,IAAI,iCAAiC;SACnE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,oBAAoB;YAC3B,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACxE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,GAAG,IAAI,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,cAAc;YACrB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAC3F,CAAC,CAAC;IACL,CAAC;IAED,oDAAoD;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC;IACxD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAY,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG;YAChB,EAAE,KAAK,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAAsB,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE;YAC5G,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE;YACxD,4FAA4F;YAC5F,6FAA6F;YAC7F,iGAAiG;YACjG,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,0BAA0B,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE;YACpG,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,gDAAgD,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE;SACxI,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,EAAkB,CAAC,CAAC;gBACzE,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,KAAK,MAAM,CAAC;gBAChD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC;gBACxE,IAAI,EAAW,CAAC;gBAChB,IAAI,MAAc,CAAC;gBAEnB,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;oBAClB,EAAE,GAAG,OAAO,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBACrD,MAAM,GAAG,EAAE;wBACT,CAAC,CAAC,kBAAkB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE;wBACtG,CAAC,CAAC,qBAAqB,EAAE,CAAC,YAAY,cAAc,MAAM,CAAC,aAAa,eAAe,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1I,CAAC;qBAAM,CAAC;oBACN,EAAE,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC;oBAChC,MAAM,GAAG,EAAE;wBACT,CAAC,CAAC,OAAO;wBACT,CAAC,CAAC,kCAAkC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvF,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,KAAK,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,cAAc,EAAE,CAAC,KAAK,GAAG;oBAChC,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAC;IAE5F,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,2EAA2E;SACpF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,SAAS;YAChB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,mEAAmE;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACrG,OAAO,CAAC,GAAG,CAAC,YAAY,WAAW,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAE3C,mDAAmD;IACnD,gBAAgB;IAChB,8CAA8C;IAC9C,yEAAyE;IACzE,IAAI,KAAK;QAAE,OAAO,CAAC,CAAC;IACpB,IAAI,YAAY;QAAE,OAAO,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,kBAAkB,WAAW;;;;;;;;;;;;;;;;;;;4BAmBjB,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,+CAA+C;IAC/C,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,wEAAwE;IACxE,0CAA0C;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,8EAA8E;QAC9E,cAAc,EAAE,CAAC;QAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,IAAI,CAAE,gBAAsC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7E,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,+CAA+C,SAAS,GAAG,CACzF,CAAC;YACF,+DAA+D;YAC/D,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;gBACb,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,SAAS;gBAChB,YAAY,EAAE,QAAQ,IAAI,SAAS;gBACnC,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,oCAAoC;gBAC5C,SAAS,EAAE,IAAI;gBACf,YAAY,EAAE,WAAW;aAC1B,CAAC,CACH,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,yEAAyE;QACzE,IAAI,GAAG,GAAY,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,mEAAmE;QACrE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,QAAqB,EAAE,WAAW,CAAC,CAAC;YACzE,yEAAyE;YACzE,uEAAuE;YACvE,4DAA4D;YAC5D,0EAA0E;YAC1E,2EAA2E;YAC3E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACrC,MAAM,qBAAqB,CAAC;gBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,YAAY;gBAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8DAA8D;YAC9D,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,wCAAwC,EACrE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;gBACb,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,SAAS;gBAChB,YAAY,EAAE,QAAQ;gBACtB,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;gBAClG,SAAS,EAAE,IAAI;gBACf,YAAY,EAAE,WAAW;aAC1B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,oEAAoE;IACpE,oEAAoE;IACpE,iCAAiC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChD,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE;gBAC1C,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aAC5C,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;gBACE,OAAO,EAAE,MAAM,CAAC,QAAQ,KAAK,OAAO;gBACpC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,4CAA4C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC5H,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,kFAAkF;IAClF,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,KAAK,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACrE,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACpG,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,0DAA0D;IAC1D,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAClC,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACnC,cAAc,CAAC,KAAK,CAAC,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,iEAAiE;IACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAClD,MAAM,YAAY,GAAG,GAAS,EAAE;QAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;IAEF,aAAa;IACb,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,8BAA8B;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,yBAAyB;IACzB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAClD,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;QACxB,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,mBAAmB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,cAAc;IACd,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,qBAAqB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,sBAAsB;IACtB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,YAAY,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,OAAkD,CAAC;QACvD,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA8C,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,8BAA8B;IAC9B,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,aAAa,KAAK,CAAC,CAAC,EAAE,CAAC;QACzB,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,OAAqD,CAAC;QAC1D,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAiD,CAAC;YAC9E,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,qBAAqB;IACrB,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,aAAa,KAAK,CAAC,CAAC,EAAE,CAAC;QACzB,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,gBAAgB;IAChB,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACnC,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,sBAAsB;IACtB,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtD,IAAI,cAAc,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1B,YAAY,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,sEAAsE;IACtE,4DAA4D;IAC5D,uEAAuE;IACvE,+EAA+E;IAC/E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;QAC/B,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,QAAQ;QACd,cAAc;QACd,cAAc;QACd,mBAAmB;QACnB,WAAW;QACX,WAAW;QACX,iBAAiB;QACjB,UAAU;QACV,gBAAgB;QAChB,cAAc;QACd,eAAe;QACf,YAAY;QACZ,YAAY;QACZ,cAAc;QACd,aAAa;QACb,YAAY;QACZ,eAAe;QACf,eAAe;QACf,eAAe;QACf,gBAAgB;KACjB,CAAC,CAAC;IACH,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mBAAmB,KAAK,MAAM;gBAC9B,kBAAkB,WAAW,iDAAiD;gBAC9E,UAAU;gBACV,iFAAiF;gBACjF,2FAA2F;gBAC3F,+FAA+F;gBAC/F,uFAAuF;gBACvF,oGAAoG;gBACpG,wFAAwF;gBACxF,+EAA+E;gBAC/E,oEAAoE;gBACpE,gEAAgE;gBAChE,gBAAgB;gBAChB,sFAAsF;gBACtF,uGAAuG;gBACvG,8GAA8G;gBAC9G,2CAA2C;gBAC3C,+BAA+B,CAChC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,+EAA+E;IAC/E,mEAAmE;IACnE,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,EAAE,CAAC;QAC7C,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,sEAAsE,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,yEAAyE;AACzE,qDAAqD;AACrD,yEAAyE;AACzE,0EAA0E;AAC1E,sEAAsE;AACtE,2EAA2E;AAC3E,kCAAkC;AAClC,kCAAkC;AAClC,0EAA0E;AAC1E,6DAA6D;AAC7D,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,yEAAyE;AAEzE,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG,CAAC;IACrE,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,cAAc,GAAG,GAAG,KAAK,aAAa,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAErF,yDAAyD;IACzD,IAAI,CAAC;QACH,yEAAyE;QACzE,MAAM,CAAC,kBAAkB,CAAC;aACvB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACV,CAAC,CAAC,WAAW,CAAC;gBACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,YAAY,EAAE,WAAW;gBACzB,SAAS,EAAE,cAAc;gBACzB,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO;gBAChD,WAAW,EAAE,GAAG;gBAChB,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAChC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB;aAClE,CAAC,CAAC;QACL,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,+EAA+E,EAC5G,GAAG,CACJ,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,yCAAyC,EACtE,GAAG,CACJ,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,0CAA0C,EACvE,GAAG,CACJ,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC"}
		{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAmB,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAkB,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACxG,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrI,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,EAC9C,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;AAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5D,KAAK,EAAE;QACL;YACE,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,8GAA8G;YAC3H,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wBAAwB,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6BAA6B,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;SAClN;QACD;YACE,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,2FAA2F;YACxG,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0BAA0B,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;SAChO;QACD;YACE,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,0EAA0E;YACvF,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,EAAE,EAAE,EAAE;SACnL;QACD;YACE,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,8EAA8E;YAC3F,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE,EAAE,EAAE;SACpO;QACD;YACE,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,sEAAsE;YACnF,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oCAAoC,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,EAAE,EAAE;SAC7L;QACD;YACE,IAAI,EAAE,uBAAuB;YAC7B,WAAW,EAAE,kMAAkM;YAC/M,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yDAAyD,EAAE;oBACvG,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oEAAoE,EAAE;oBACtH,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uDAAuD,EAAE;iBAChG;gBACD,QAAQ,EAAE,CAAC,aAAa,CAAC;aAC1B;SACF;QACD;YACE,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,iLAAiL;YAC9L,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;SAChD;QACD;YACE,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,8FAA8F;YAC3G,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sBAAsB,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iDAAiD,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE;SACnV;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,yGAAyG;YACtH,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;SAChD;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,2GAA2G;YACxH,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE;SACrJ;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,yEAAyE;YACtF,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sBAAsB,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sCAAsC,EAAE,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2BAA2B,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE;SACxhB;QACD;YACE,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EAAE,0DAA0D;YACvE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE;SACnV;QACD;YACE,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EAAE,gDAAgD;YAC7D,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE;SAC5H;QACD;YACE,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,gFAAgF;YAC7F,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;SAChD;QACD;YACE,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,8DAA8D;YAC3E,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;SAChD;QACD;YACE,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,oFAAoF;YACjG,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2BAA2B,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE;SAClJ;KACF;CACF,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5D,8DAA8D;IAC9D,2EAA2E;IAC3E,mDAAmD;IACnD,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;QAC3E,KAAK,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;IAC7C,IAAI,CAAC;QACH,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,iBAAiB,CAAC,CAAC,OAAO,MAAM,oBAAoB,CAAC,IAAkD,CAAC,CAAC;YAC9G,KAAK,YAAY,CAAC,CAAC,OAAO,MAAM,eAAe,CAAC,IAA6C,CAAC,CAAC;YAC/F,KAAK,WAAW,CAAC,CAAC,OAAO,MAAM,cAAc,CAAC,IAA4C,CAAC,CAAC;YAC5F,KAAK,cAAc,CAAC,CAAC,OAAO,MAAM,iBAAiB,CAAC,IAA+C,CAAC,CAAC;YACrG,KAAK,eAAe,CAAC,CAAC,OAAO,MAAM,iBAAiB,CAAC,IAA+C,CAAC,CAAC;YACtG,KAAK,uBAAuB,CAAC,CAAC,OAAO,MAAM,yBAAyB,CAAC,IAAuD,CAAC,CAAC;YAC9H,KAAK,cAAc,CAAC,CAAC,OAAO,MAAM,sBAAsB,CAAC,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC;YAClG,KAAK,eAAe,CAAC,CAAC,OAAO,MAAM,iBAAiB,CAAC,IAA+C,CAAC,CAAC;YACtG,KAAK,gBAAgB,CAAC,CAAC,OAAO,MAAM,kBAAkB,CAAC,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC;YAChG,KAAK,iBAAiB,CAAC,CAAC,OAAO,MAAM,mBAAmB,CAAC,IAAiD,CAAC,CAAC;YAC5G,KAAK,iBAAiB,CAAC,CAAC,OAAO,MAAM,mBAAmB,CAAC,IAAiD,CAAC,CAAC;YAC5G,KAAK,oBAAoB,CAAC,CAAC,OAAO,MAAM,sBAAsB,CAAC,IAAoD,CAAC,CAAC;YACrH,KAAK,oBAAoB,CAAC,CAAC,OAAO,MAAM,sBAAsB,CAAC,IAAoD,CAAC,CAAC;YACrH,KAAK,mBAAmB,CAAC,CAAC,OAAO,MAAM,qBAAqB,CAAC,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC;YACtG,KAAK,cAAc,CAAC,CAAC,OAAO,MAAM,iBAAiB,CAAC,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC;YAC7F,KAAK,cAAc,CAAC,CAAC,OAAO,MAAM,iBAAiB,CAAC,IAA+C,CAAC,CAAC;YACrG,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;QAC1F,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACtH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,8FAA8F;AAC9F,SAAS,oBAAoB,CAAC,UAAoB;IAChD,OAAO;QACL,GAAG,cAAc;QACjB,YAAY,EAAE,UAAU;QACxB,gBAAgB,EAAE,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,MAAM,GAAqD,EAAE,CAAC;IACpE,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IAC9D,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAAmC,EAAE,CAAC;IAElD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAChC,CAAC,CAAE,MAAyC;YAC5C,CAAC,CAAE,MAAM,CAAC,MAAM,CAAC,MAAmC,CAAC,CAAC,IAAI,EAAqC,CAAC;QAClG,QAAQ,GAAG,IAAI,CAAC;QAChB,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;QACzB,mBAAmB,GAAG,IAAI,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,gBAAgB,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,CAAC,CAC9E,CAAC,MAAM,CAAC;QACT,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QAC3E,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,QAAQ,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,sBAAsB;YAC7B,EAAE,EAAE,mBAAmB,GAAG,CAAC;YAC3B,MAAM,EAAE,GAAG,mBAAmB,yCAAyC;SACxE,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,eAAe;YACtB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,GAAG,YAAY,4BAA4B;SACpD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,GAAG,IAAI,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACzF,CAAC,CAAC;IACL,CAAC;IAED,yDAAyD;IACzD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,oBAAoB;YAC3B,EAAE,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC;YACrB,MAAM,EAAE,YAAY,QAAQ,CAAC,IAAI,iCAAiC;SACnE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,oBAAoB;YAC3B,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACxE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,GAAG,IAAI,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,cAAc;YACrB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAC3F,CAAC,CAAC;IACL,CAAC;IAED,oDAAoD;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC;IACxD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAY,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG;YAChB,EAAE,KAAK,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAAsB,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE;YAC5G,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE;YACxD,4FAA4F;YAC5F,6FAA6F;YAC7F,iGAAiG;YACjG,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,0BAA0B,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE;YACpG,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,gDAAgD,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE;SACxI,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,EAAkB,CAAC,CAAC;gBACzE,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,KAAK,MAAM,CAAC;gBAChD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC;gBACxE,IAAI,EAAW,CAAC;gBAChB,IAAI,MAAc,CAAC;gBAEnB,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;oBAClB,EAAE,GAAG,OAAO,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBACrD,MAAM,GAAG,EAAE;wBACT,CAAC,CAAC,kBAAkB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE;wBACtG,CAAC,CAAC,qBAAqB,EAAE,CAAC,YAAY,cAAc,MAAM,CAAC,aAAa,eAAe,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1I,CAAC;qBAAM,CAAC;oBACN,EAAE,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC;oBAChC,MAAM,GAAG,EAAE;wBACT,CAAC,CAAC,OAAO;wBACT,CAAC,CAAC,kCAAkC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvF,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,KAAK,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,cAAc,EAAE,CAAC,KAAK,GAAG;oBAChC,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAC;IAE5F,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,2EAA2E;SACpF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,SAAS;YAChB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,mEAAmE;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACrG,OAAO,CAAC,GAAG,CAAC,YAAY,WAAW,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAE3C,mDAAmD;IACnD,gBAAgB;IAChB,8CAA8C;IAC9C,yEAAyE;IACzE,IAAI,KAAK;QAAE,OAAO,CAAC,CAAC;IACpB,IAAI,YAAY;QAAE,OAAO,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,kBAAkB,WAAW;;;;;;;;;;;;;;;;;;;;;4BAqBjB,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,+CAA+C;IAC/C,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,wEAAwE;IACxE,0CAA0C;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,8EAA8E;QAC9E,cAAc,EAAE,CAAC;QAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,IAAI,CAAE,gBAAsC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7E,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,+CAA+C,SAAS,GAAG,CACzF,CAAC;YACF,+DAA+D;YAC/D,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;gBACb,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,SAAS;gBAChB,YAAY,EAAE,QAAQ,IAAI,SAAS;gBACnC,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,oCAAoC;gBAC5C,SAAS,EAAE,IAAI;gBACf,YAAY,EAAE,WAAW;aAC1B,CAAC,CACH,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,yEAAyE;QACzE,IAAI,GAAG,GAAY,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,mEAAmE;QACrE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,QAAqB,EAAE,WAAW,CAAC,CAAC;YACzE,yEAAyE;YACzE,uEAAuE;YACvE,4DAA4D;YAC5D,0EAA0E;YAC1E,2EAA2E;YAC3E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACrC,MAAM,qBAAqB,CAAC;gBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,YAAY;gBAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8DAA8D;YAC9D,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,wCAAwC,EACrE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;gBACb,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,SAAS;gBAChB,YAAY,EAAE,QAAQ;gBACtB,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;gBAClG,SAAS,EAAE,IAAI;gBACf,YAAY,EAAE,WAAW;aAC1B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,oEAAoE;IACpE,oEAAoE;IACpE,iCAAiC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChD,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE;gBAC1C,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aAC5C,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;gBACE,OAAO,EAAE,MAAM,CAAC,QAAQ,KAAK,OAAO;gBACpC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,4CAA4C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC5H,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,kFAAkF;IAClF,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,KAAK,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACrE,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACpG,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,sEAAsE;IACtE,yEAAyE;IACzE,8CAA8C;IAC9C,iDAAiD;IACjD,4EAA4E;IAC5E,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;QAC5D,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC;gBACjC,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5E,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACtG,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,0DAA0D;IAC1D,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAClC,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACnC,cAAc,CAAC,KAAK,CAAC,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,iEAAiE;IACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAClD,MAAM,YAAY,GAAG,GAAS,EAAE;QAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;IAEF,aAAa;IACb,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,8BAA8B;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,yBAAyB;IACzB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAClD,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;QACxB,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,mBAAmB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,cAAc;IACd,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,qBAAqB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,sBAAsB;IACtB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,YAAY,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,OAAkD,CAAC;QACvD,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA8C,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,8BAA8B;IAC9B,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,aAAa,KAAK,CAAC,CAAC,EAAE,CAAC;QACzB,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,OAAqD,CAAC;QAC1D,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAiD,CAAC;YAC9E,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,qBAAqB;IACrB,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,aAAa,KAAK,CAAC,CAAC,EAAE,CAAC;QACzB,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,gBAAgB;IAChB,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACnC,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,sBAAsB;IACtB,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtD,IAAI,cAAc,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1B,YAAY,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,sEAAsE;IACtE,4DAA4D;IAC5D,uEAAuE;IACvE,+EAA+E;IAC/E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;QAC/B,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,QAAQ;QACd,cAAc;QACd,cAAc;QACd,mBAAmB;QACnB,WAAW;QACX,WAAW;QACX,iBAAiB;QACjB,UAAU;QACV,gBAAgB;QAChB,cAAc;QACd,eAAe;QACf,YAAY;QACZ,YAAY;QACZ,cAAc;QACd,aAAa;QACb,YAAY;QACZ,eAAe;QACf,eAAe;QACf,eAAe;QACf,gBAAgB;KACjB,CAAC,CAAC;IACH,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mBAAmB,KAAK,MAAM;gBAC9B,kBAAkB,WAAW,iDAAiD;gBAC9E,UAAU;gBACV,iFAAiF;gBACjF,2FAA2F;gBAC3F,+FAA+F;gBAC/F,uFAAuF;gBACvF,oGAAoG;gBACpG,wFAAwF;gBACxF,+EAA+E;gBAC/E,oEAAoE;gBACpE,gEAAgE;gBAChE,gBAAgB;gBAChB,sFAAsF;gBACtF,uGAAuG;gBACvG,8GAA8G;gBAC9G,2CAA2C;gBAC3C,+BAA+B,CAChC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,+EAA+E;IAC/E,mEAAmE;IACnE,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,EAAE,CAAC;QAC7C,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,sEAAsE,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,yEAAyE;AACzE,qDAAqD;AACrD,yEAAyE;AACzE,0EAA0E;AAC1E,sEAAsE;AACtE,2EAA2E;AAC3E,kCAAkC;AAClC,kCAAkC;AAClC,0EAA0E;AAC1E,6DAA6D;AAC7D,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,yEAAyE;AAEzE,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG,CAAC;IACrE,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,cAAc,GAAG,GAAG,KAAK,aAAa,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAErF,yDAAyD;IACzD,IAAI,CAAC;QACH,yEAAyE;QACzE,MAAM,CAAC,kBAAkB,CAAC;aACvB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACV,CAAC,CAAC,WAAW,CAAC;gBACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,YAAY,EAAE,WAAW;gBACzB,SAAS,EAAE,cAAc;gBACzB,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO;gBAChD,WAAW,EAAE,GAAG;gBAChB,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAChC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB;aAClE,CAAC,CAAC;QACL,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,+EAA+E,EAC5G,GAAG,CACJ,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,yCAAyC,EACtE,GAAG,CACJ,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,0CAA0C,EACvE,GAAG,CACJ,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC"}

+1

-1

dist/installer/agents/aider.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"aider.d.ts","sourceRoot":"","sources":["../../../src/installer/agents/aider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIxD,wBAAgB,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAa3D;AAED,wBAAgB,SAAS,CACvB,SAAS,EAAE,cAAc,EACzB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACpD,eAAe,CA4BjB"}
		{"version":3,"file":"aider.d.ts","sourceRoot":"","sources":["../../../src/installer/agents/aider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAKxD,wBAAgB,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAa3D;AAED,wBAAgB,SAAS,CACvB,SAAS,EAAE,cAAc,EACzB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACpD,eAAe,CA6BjB"}

+2

-0

dist/installer/agents/aider.js

		@@ -14,2 +14,3 @@ /**
		import * as path from "node:path";
		import { ensureBackup } from "../backup.js";
		const LINT_COMMAND = "npx @sunaiva/gate --mcp-bridge aider";
		@@ -52,2 +53,3 @@ export function buildShimEntry(mcpEndpoint) {
		fs.mkdirSync(path.dirname(target), { recursive: true });
		ensureBackup(target);
		fs.writeFileSync(target, payload, "utf-8");
		@@ -54,0 +56,0 @@ }

+1

-1

dist/installer/agents/aider.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"aider.js","sourceRoot":"","sources":["../../../src/installer/agents/aider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC,MAAM,YAAY,GAAG,sCAAsC,CAAC;AAE5D,MAAM,UAAU,cAAc,CAAC,WAAoB;IACjD,MAAM,SAAS,GAAG,WAAW;QAC3B,CAAC,CAAC,+BAA+B,WAAW,6DAA6D;QACzG,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,GAAG,SAAS;;;;;OAKd,YAAY;;;CAGlB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,SAAyB,EACzB,OAAmD,EAAE;IAErD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC;IACrC,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC;IACD,gEAAgE;IAChE,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,OAAe,CAAC;IACpB,IAAI,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACtC,OAAO,GAAG,QAAQ,CAAC,CAAC,oDAAoD;IAC1E,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,QAAQ;YAChB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,KAAK;YAC/C,CAAC,CAAC,KAAK,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM;QACtB,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC"}
		{"version":3,"file":"aider.js","sourceRoot":"","sources":["../../../src/installer/agents/aider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,YAAY,GAAG,sCAAsC,CAAC;AAE5D,MAAM,UAAU,cAAc,CAAC,WAAoB;IACjD,MAAM,SAAS,GAAG,WAAW;QAC3B,CAAC,CAAC,+BAA+B,WAAW,6DAA6D;QACzG,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,GAAG,SAAS;;;;;OAKd,YAAY;;;CAGlB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,SAAyB,EACzB,OAAmD,EAAE;IAErD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC;IACrC,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC;IACD,gEAAgE;IAChE,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,OAAe,CAAC;IACpB,IAAI,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACtC,OAAO,GAAG,QAAQ,CAAC,CAAC,oDAAoD;IAC1E,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,QAAQ;YAChB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,KAAK;YAC/C,CAAC,CAAC,KAAK,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,YAAY,CAAC,MAAM,CAAC,CAAC;QACrB,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM;QACtB,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC"}

+60

-0

dist/installer/agents/claude-code.d.ts

		@@ -9,4 +9,64 @@ /**
		* so we sidestep Anthropic issue #24327 (idle on exit-2 stderr).
		*
		* LATENCY FAST-PATH (2026-07-26): the hook command above is spawned as a
		* fresh `npx` process for EVERY PreToolUse/PostToolUse event — measured
		* 302-856ms round-trip (npx cold-start + node startup + MCP evaluation),
		* even for tool calls that are obviously safe (Read, Glob, Grep — no
		* mutation, no command execution). That is over budget for a hot path fired
		* on every single tool call.
		*
		* HOOK_COMMAND is now a small POSIX shell pre-screen (ported from the
		* "known-safe tool + no risk signature" shape documented in
		* .claude/hooks/gate_interceptor.py's local-decision contract) wrapped
		* around the UNCHANGED npx round-trip:
		* - reads stdin once, extracts tool_name (same grep/sed pattern the prior
		* dist/installer/shims/claude-code.sh reference used)
		* - if tool_name ∈ FAST_PATH_TOOLS AND the raw payload contains none of
		* FAST_PATH_RISK_KEYWORDS (mirrors the CONSTITUTIONAL rule set's
		* detection_pattern vocabulary in rules/rules.json — credentials,
		* financial actions, destructive commands, deploy/DNS governance,
		* personal data) -> print the SAME "no verdict, allow" envelope
		* gate_interceptor.py already uses live in this repo (`{}` + exit 0)
		* WITHOUT spawning npx at all
		* - otherwise falls through to the EXACT original npx invocation,
		* unchanged — genuinely ambiguous or mutating actions always get the
		* full round-trip, so verdicts never drift from what the rule engine
		* would have decided.
		* Kill-switch: SUNAIVA_GATE_DISABLE_FASTPATH=1 skips the pre-screen entirely
		* and reproduces pre-2026-07-26 behavior byte-for-byte.
		*/
		import type { AgentDetection } from "../detect.js";
		/**
		* Read-only, zero-mutation, zero-execution built-in tools. These are the
		* ONLY tool names eligible for the fast path — anything else (Bash, Write,
		* Edit, MultiEdit, NotebookEdit, WebFetch, Task, …) always takes the full
		* round-trip because we cannot lexically rule out a mutation/execution
		* signature in their arguments.
		*/
		export declare const FAST_PATH_TOOLS: readonly ["Read", "Glob", "Grep"];
		/**
		* Lexical risk keywords mirrored from the CONSTITUTIONAL (free, always-on)
		* rule set's detection_pattern text in rules/rules.json — credentials/
		* secrets (dat-001, dat-004, sec-001, sec-006, sec-011, cnst-sec-exposure),
		* financial actions (fin-001, fin-003, fin-008, cnst-fin-debit), destructive
		* commands (gov-002, sec-002, sec-004), access/identity (gov-005, sec-006,
		* sec-011), deploy/DNS/infra governance (gov-001, gov-004, gov-012,
		* cnst-gov-deploy), outreach/comms (gov-008, com-007, cnst-gov-outreach),
		* and personal data (dat-002). ANY hit forces the full round-trip even for
		* a read-only tool call — e.g. `Read` on a path containing "credentials" or
		* "id_rsa" must never be silently fast-pathed just because the TOOL is
		* read-only. This is deliberately broad/conservative: a lexical pre-screen
		* trades some over-fall-through (still correct, just not accelerated) for
		* zero risk of silently bypassing a constitutional rule.
		*/
		export declare const FAST_PATH_RISK_KEYWORDS: readonly ["credential", "secret", "password", "api_key", "apikey", "private_key", "id_rsa", ".pem", ".env", "token", "ssh_key", "stripe", "paypal", "checkout", "credit card", "subscription", "paymentintent", "invoice", "routing number", "swift", "rm -rf", "drop table", "git reset --hard", "git clean", "sudo", "eval", "exec", "oauth", "mfa", "2fa", "iam", "deploy", "netlify", "vercel", "wrangler", "terraform destroy", "dns", "route53", "godaddy", "docusign", "hellosign", "campaign", "mailchimp", "klaviyo", "ssn", "passport"];
		/**
		* Pure TypeScript mirror of the shell pre-screen's decision, exported ONLY
		* for test verification (asserting the embedded shell logic and this
		* function agree on a fixed corpus) — NOT executed at runtime. The actual
		* gating happens inside the generated shell script below, which is built
		* from these SAME FAST_PATH_TOOLS / FAST_PATH_RISK_KEYWORDS arrays so the
		* two can never drift apart.
		*/
		export declare function wouldFastPathAllow(toolName: string, rawPayload: string): boolean;
		export interface ShimWriteResult {
		@@ -13,0 +73,0 @@ written_to: string;

+1

-1

dist/installer/agents/claude-code.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"claude-code.d.ts","sourceRoot":"","sources":["../../../src/installer/agents/claude-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAInD,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoBzB;AAED,wBAAgB,SAAS,CACvB,SAAS,EAAE,cAAc,EACzB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACpD,eAAe,CA8BjB"}
		{"version":3,"file":"claude-code.d.ts","sourceRoot":"","sources":["../../../src/installer/agents/claude-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAMnD;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,mCAAoC,CAAC;AAEjE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB,mhBA+C1B,CAAC;AAEX;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAIT;AAgED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoBzB;AAED,wBAAgB,SAAS,CACvB,SAAS,EAAE,cAAc,EACzB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACpD,eAAe,CA+BjB"}

+171

-5

dist/installer/agents/claude-code.js

		@@ -9,7 +9,175 @@ /**
		* so we sidestep Anthropic issue #24327 (idle on exit-2 stderr).
		*
		* LATENCY FAST-PATH (2026-07-26): the hook command above is spawned as a
		* fresh `npx` process for EVERY PreToolUse/PostToolUse event — measured
		* 302-856ms round-trip (npx cold-start + node startup + MCP evaluation),
		* even for tool calls that are obviously safe (Read, Glob, Grep — no
		* mutation, no command execution). That is over budget for a hot path fired
		* on every single tool call.
		*
		* HOOK_COMMAND is now a small POSIX shell pre-screen (ported from the
		* "known-safe tool + no risk signature" shape documented in
		* .claude/hooks/gate_interceptor.py's local-decision contract) wrapped
		* around the UNCHANGED npx round-trip:
		* - reads stdin once, extracts tool_name (same grep/sed pattern the prior
		* dist/installer/shims/claude-code.sh reference used)
		* - if tool_name ∈ FAST_PATH_TOOLS AND the raw payload contains none of
		* FAST_PATH_RISK_KEYWORDS (mirrors the CONSTITUTIONAL rule set's
		* detection_pattern vocabulary in rules/rules.json — credentials,
		* financial actions, destructive commands, deploy/DNS governance,
		* personal data) -> print the SAME "no verdict, allow" envelope
		* gate_interceptor.py already uses live in this repo (`{}` + exit 0)
		* WITHOUT spawning npx at all
		* - otherwise falls through to the EXACT original npx invocation,
		* unchanged — genuinely ambiguous or mutating actions always get the
		* full round-trip, so verdicts never drift from what the rule engine
		* would have decided.
		* Kill-switch: SUNAIVA_GATE_DISABLE_FASTPATH=1 skips the pre-screen entirely
		* and reproduces pre-2026-07-26 behavior byte-for-byte.
		*/
		import * as fs from "node:fs";
		import * as path from "node:path";
		const HOOK_COMMAND = "npx @sunaiva/gate --mcp-bridge claude-code";
		import { ensureBackup } from "../backup.js";
		/** The full-evaluation round-trip — UNCHANGED from the pre-fast-path shim. */
		const GATE_ROUNDTRIP_COMMAND = "npx @sunaiva/gate --mcp-bridge claude-code";
		/**
		* Read-only, zero-mutation, zero-execution built-in tools. These are the
		* ONLY tool names eligible for the fast path — anything else (Bash, Write,
		* Edit, MultiEdit, NotebookEdit, WebFetch, Task, …) always takes the full
		* round-trip because we cannot lexically rule out a mutation/execution
		* signature in their arguments.
		*/
		export const FAST_PATH_TOOLS = ["Read", "Glob", "Grep"];
		/**
		* Lexical risk keywords mirrored from the CONSTITUTIONAL (free, always-on)
		* rule set's detection_pattern text in rules/rules.json — credentials/
		* secrets (dat-001, dat-004, sec-001, sec-006, sec-011, cnst-sec-exposure),
		* financial actions (fin-001, fin-003, fin-008, cnst-fin-debit), destructive
		* commands (gov-002, sec-002, sec-004), access/identity (gov-005, sec-006,
		* sec-011), deploy/DNS/infra governance (gov-001, gov-004, gov-012,
		* cnst-gov-deploy), outreach/comms (gov-008, com-007, cnst-gov-outreach),
		* and personal data (dat-002). ANY hit forces the full round-trip even for
		* a read-only tool call — e.g. `Read` on a path containing "credentials" or
		* "id_rsa" must never be silently fast-pathed just because the TOOL is
		* read-only. This is deliberately broad/conservative: a lexical pre-screen
		* trades some over-fall-through (still correct, just not accelerated) for
		* zero risk of silently bypassing a constitutional rule.
		*/
		export const FAST_PATH_RISK_KEYWORDS = [
		"credential",
		"secret",
		"password",
		"api_key",
		"apikey",
		"private_key",
		"id_rsa",
		".pem",
		".env",
		"token",
		"ssh_key",
		"stripe",
		"paypal",
		"checkout",
		"credit card",
		"subscription",
		"paymentintent",
		"invoice",
		"routing number",
		"swift",
		"rm -rf",
		"drop table",
		"git reset --hard",
		"git clean",
		"sudo",
		"eval",
		"exec",
		"oauth",
		"mfa",
		"2fa",
		"iam",
		"deploy",
		"netlify",
		"vercel",
		"wrangler",
		"terraform destroy",
		"dns",
		"route53",
		"godaddy",
		"docusign",
		"hellosign",
		"campaign",
		"mailchimp",
		"klaviyo",
		"ssn",
		"passport",
		];
		/**
		* Pure TypeScript mirror of the shell pre-screen's decision, exported ONLY
		* for test verification (asserting the embedded shell logic and this
		* function agree on a fixed corpus) — NOT executed at runtime. The actual
		* gating happens inside the generated shell script below, which is built
		* from these SAME FAST_PATH_TOOLS / FAST_PATH_RISK_KEYWORDS arrays so the
		* two can never drift apart.
		*/
		export function wouldFastPathAllow(toolName, rawPayload) {
		if (!FAST_PATH_TOOLS.includes(toolName))
		return false;
		const lc = rawPayload.toLowerCase();
		return !FAST_PATH_RISK_KEYWORDS.some((k) => lc.includes(k));
		}
		/**
		* Builds the POSIX `sh`-compatible pre-screen script. Same shape as the
		* prior dist/installer/shims/claude-code.sh reference's tool_name
		* extraction (`grep -o '"tool_name"...' \| sed 's/.:"$.$"/\1/'`), plus a
		* case-insensitive risk-keyword scan, plus the UNCHANGED npx fallthrough.
		* On the fast-path-eligible branch we print `{}` + exit 0 — the SAME
		* "no verdict, allow" envelope gate_interceptor.py already emits live in
		* this repo for its own allow path, so downstream hook-output parsing is
		* unaffected either way.
		*/
		function buildFastPathShellScript() {
		const toolAlternation = FAST_PATH_TOOLS.join("\|");
		const keywordAlternation = FAST_PATH_RISK_KEYWORDS.map((k) => `"${k}"`).join("\|");
		return `if [ "\${SUNAIVA_GATE_DISABLE_FASTPATH:-0}" != "1" ]; then
		p="$(cat)"
		t="$(printf '%s' "$p" \| grep -o '"tool_name"[[:space:]]:[[:space:]]"[^"]"' \| head -n1 \| sed 's/.:"\$.*\$"/\\1/')"
		case "$t" in
		${toolAlternation})
		lc="$(printf '%s' "$p" \| tr '[:upper:]' '[:lower:]')"
		case "$lc" in
		${keywordAlternation}) : ;;
		*) printf '{}'; exit 0 ;;
		esac
		;;
		esac
		printf '%s' "$p" \| ${GATE_ROUNDTRIP_COMMAND}
		else
		${GATE_ROUNDTRIP_COMMAND}
		fi`;
		}
		const HOOK_COMMAND = buildFastPathShellScript();
		/**
		* Merge our hook groups into the user's existing `hooks` block WITHOUT
		* clobbering hook groups they already registered under the same lifecycle
		* event (e.g. their own PreToolUse hook). A prior version of this shim did
		* `{...existing.hooks, ...entry}`, which is a shallow merge on OBJECT keys —
		* since each event key's value is an ARRAY, that replaced the user's whole
		* array with ours. Fixed here: per event key, drop any prior gate entry
		* (idempotent re-install) and APPEND ours to whatever the user already had.
		*/
		function mergeHooksNonDestructive(existingHooks, entry) {
		const merged = { ...(existingHooks ?? {}) };
		for (const [eventKey, groups] of Object.entries(entry)) {
		const priorGroups = Array.isArray(merged[eventKey])
		? merged[eventKey]
		: [];
		const withoutOurs = priorGroups.filter((group) => {
		const hooks = group?.hooks;
		return !hooks?.some((h) => h.command === HOOK_COMMAND);
		});
		merged[eventKey] = [...withoutOurs, ...groups];
		}
		return merged;
		}
		/**
		* Build the JSON patch that should appear in ~/.claude/settings.json under
		@@ -52,9 +220,7 @@ * `hooks`. Exported separately for tests + dry-run preview.
		...existing,
		hooks: {
		...existing["hooks"],
		...entry,
		},
		hooks: mergeHooksNonDestructive(existing["hooks"], entry),
		};
		const payload = JSON.stringify(next, null, 2);
		if (!opts.dryRun) {
		ensureBackup(target);
		fs.mkdirSync(path.dirname(target), { recursive: true });
		@@ -61,0 +227,0 @@ fs.writeFileSync(target, payload, "utf-8");

+1

-1

dist/installer/agents/claude-code.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../../src/installer/agents/claude-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,MAAM,YAAY,GAAG,4CAA4C,CAAC;AAUlE;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,WAAoB;IAEpB,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,WAAW;QAAE,GAAG,CAAC,2BAA2B,CAAC,GAAG,WAAW,CAAC;IAChE,OAAO;QACL,UAAU,EAAE;YACV,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE;SAC3E;QACD,WAAW,EAAE;YACX,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE;SAC3E;QACD,gBAAgB,EAAE;YAChB,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE;SAC7D;QACD,YAAY,EAAE;YACZ,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE;SAC7D;QACD,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1E,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1E,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,SAAyB,EACzB,OAAmD,EAAE;IAErD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC;IACrC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAGrD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG;QACX,GAAG,QAAQ;QACX,KAAK,EAAE;YACL,GAAI,QAAQ,CAAC,OAAO,CAAyC;YAC7D,GAAG,KAAK;SACT;KACF,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM;QACtB,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC"}
		{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../../src/installer/agents/claude-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,8EAA8E;AAC9E,MAAM,sBAAsB,GAAG,4CAA4C,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAEjE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,YAAY;IACZ,QAAQ;IACR,UAAU;IACV,SAAS;IACT,QAAQ;IACR,aAAa;IACb,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,aAAa;IACb,cAAc;IACd,eAAe;IACf,SAAS;IACT,gBAAgB;IAChB,OAAO;IACP,QAAQ;IACR,YAAY;IACZ,kBAAkB;IAClB,WAAW;IACX,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,KAAK;IACL,KAAK;IACL,KAAK;IACL,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,UAAU;IACV,mBAAmB;IACnB,KAAK;IACL,SAAS;IACT,SAAS;IACT,UAAU;IACV,WAAW;IACX,UAAU;IACV,WAAW;IACX,SAAS;IACT,KAAK;IACL,UAAU;CACF,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,UAAkB;IAElB,IAAI,CAAE,eAAqC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,MAAM,EAAE,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,wBAAwB;IAC/B,MAAM,eAAe,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,GAAG,CACpD,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAClB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,OAAO;;;;MAIH,eAAe;;;UAGX,kBAAkB;;;;;uBAKL,sBAAsB;;IAEzC,sBAAsB;GACvB,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,wBAAwB,EAAE,CAAC;AAEhD;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAC/B,aAAkD,EAClD,KAA8B;IAE9B,MAAM,MAAM,GAA4B,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,CAAC;IACrE,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACjD,CAAC,CAAE,MAAM,CAAC,QAAQ,CAAe;YACjC,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC/C,MAAM,KAAK,GAAI,KAAiD,EAAE,KAAK,CAAC;YACxE,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,WAAW,EAAE,GAAI,MAAoB,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,WAAoB;IAEpB,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,WAAW;QAAE,GAAG,CAAC,2BAA2B,CAAC,GAAG,WAAW,CAAC;IAChE,OAAO;QACL,UAAU,EAAE;YACV,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE;SAC3E;QACD,WAAW,EAAE;YACX,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE;SAC3E;QACD,gBAAgB,EAAE;YAChB,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE;SAC7D;QACD,YAAY,EAAE;YACZ,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE;SAC7D;QACD,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1E,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1E,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,SAAyB,EACzB,OAAmD,EAAE;IAErD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC;IACrC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAGrD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG;QACX,GAAG,QAAQ;QACX,KAAK,EAAE,wBAAwB,CAC7B,QAAQ,CAAC,OAAO,CAAwC,EACxD,KAAK,CACN;KACF,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,YAAY,CAAC,MAAM,CAAC,CAAC;QACrB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM;QACtB,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC"}

+1

-1

dist/installer/agents/cline.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"cline.d.ts","sourceRoot":"","sources":["../../../src/installer/agents/cline.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,wBAAgB,cAAc,CAC5B,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUzB;AAED,wBAAgB,SAAS,CACvB,SAAS,EAAE,cAAc,EACzB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACpD,eAAe,CAkCjB"}
		{"version":3,"file":"cline.d.ts","sourceRoot":"","sources":["../../../src/installer/agents/cline.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGxD,wBAAgB,cAAc,CAC5B,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUzB;AAED,wBAAgB,SAAS,CACvB,SAAS,EAAE,cAAc,EACzB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACpD,eAAe,CAmCjB"}

+2

-0

dist/installer/agents/cline.js

		@@ -11,2 +11,3 @@ /**
		import * as path from "node:path";
		import { ensureBackup } from "../backup.js";
		export function buildShimEntry(mcpEndpoint) {
		@@ -46,2 +47,3 @@ return {
		fs.mkdirSync(path.dirname(target), { recursive: true });
		ensureBackup(target);
		fs.writeFileSync(target, payload, "utf-8");
		@@ -48,0 +50,0 @@ }

+1

-1

dist/installer/agents/cline.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"cline.js","sourceRoot":"","sources":["../../../src/installer/agents/cline.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC,MAAM,UAAU,cAAc,CAC5B,WAAoB;IAEpB,OAAO;QACL,kBAAkB,EAAE;YAClB,cAAc,EAAE;gBACd,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;gBAC7B,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;aACnE;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,SAAyB,EACzB,OAAmD,EAAE;IAErD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC;IACrC,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAGrD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,4EAA4E;IAC5E,MAAM,eAAe,GAClB,QAAQ,CAAC,kBAAkB,CAAyC,IAAI,EAAE,CAAC;IAC9E,MAAM,YAAY,GAAG,KAAK,CAAC,kBAAkB,CAA4B,CAAC;IAC1E,MAAM,IAAI,GAAG;QACX,GAAG,QAAQ;QACX,kBAAkB,EAAE;YAClB,GAAG,eAAe;YAClB,GAAG,YAAY;SAChB;KACF,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM;QACtB,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC"}
		{"version":3,"file":"cline.js","sourceRoot":"","sources":["../../../src/installer/agents/cline.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,UAAU,cAAc,CAC5B,WAAoB;IAEpB,OAAO;QACL,kBAAkB,EAAE;YAClB,cAAc,EAAE;gBACd,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;gBAC7B,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;aACnE;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,SAAyB,EACzB,OAAmD,EAAE;IAErD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC;IACrC,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAGrD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,4EAA4E;IAC5E,MAAM,eAAe,GAClB,QAAQ,CAAC,kBAAkB,CAAyC,IAAI,EAAE,CAAC;IAC9E,MAAM,YAAY,GAAG,KAAK,CAAC,kBAAkB,CAA4B,CAAC;IAC1E,MAAM,IAAI,GAAG;QACX,GAAG,QAAQ;QACX,kBAAkB,EAAE;YAClB,GAAG,eAAe;YAClB,GAAG,YAAY;SAChB;KACF,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,YAAY,CAAC,MAAM,CAAC,CAAC;QACrB,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM;QACtB,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC"}

+8

-0

dist/installer/agents/codex.d.ts

		@@ -14,2 +14,10 @@ /**
		export declare function buildShimEntry(mcpEndpoint?: string): string;
		/**
		* No TOML parser is a dependency of this package, so — same tradeoff as
		* aider.ts's YAML shim — we treat existing hooks.toml as opaque text and
		* append our block rather than parsing+merging structured TOML. Idempotency
		* comes from a marker check (same pattern as aider.ts): a second install is
		* a byte-identical no-op instead of accumulating duplicate `[[hooks]]`
		* blocks or destroying whatever the user already had in the file.
		*/
		export declare function writeShim(detection: AgentDetection, opts?: {
		@@ -16,0 +24,0 @@ dryRun?: boolean;

+1

-1

dist/installer/agents/codex.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../../src/installer/agents/codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIxD,wBAAgB,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CA+B3D;AAED,wBAAgB,SAAS,CACvB,SAAS,EAAE,cAAc,EACzB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACpD,eAAe,CAajB"}
		{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../../src/installer/agents/codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAKxD,wBAAgB,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CA+B3D;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,cAAc,EACzB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACpD,eAAe,CA4BjB"}

+28

-2

dist/installer/agents/codex.js

		@@ -13,2 +13,3 @@ /**
		import * as path from "node:path";
		import { ensureBackup } from "../backup.js";
		const HOOK_COMMAND = "npx @sunaiva/gate --mcp-bridge codex";
		@@ -47,7 +48,32 @@ export function buildShimEntry(mcpEndpoint) {
		}
		/**
		* No TOML parser is a dependency of this package, so — same tradeoff as
		* aider.ts's YAML shim — we treat existing hooks.toml as opaque text and
		* append our block rather than parsing+merging structured TOML. Idempotency
		* comes from a marker check (same pattern as aider.ts): a second install is
		* a byte-identical no-op instead of accumulating duplicate `[[hooks]]`
		* blocks or destroying whatever the user already had in the file.
		*/
		export function writeShim(detection, opts = {}) {
		const target = detection.config_path;
		const payload = buildShimEntry(opts.mcpEndpoint);
		let existing = "";
		try {
		existing = fs.readFileSync(target, "utf-8");
		}
		catch {
		existing = "";
		}
		const block = buildShimEntry(opts.mcpEndpoint);
		let payload;
		if (existing.includes("Sunaiva Gate")) {
		payload = existing; // already installed — no-op rewrite (idempotent)
		}
		else {
		payload = existing
		? existing.replace(/\s+$/, "") + "\n\n" + block
		: block;
		}
		if (!opts.dryRun) {
		fs.mkdirSync(path.dirname(target), { recursive: true });
		ensureBackup(target);
		fs.writeFileSync(target, payload, "utf-8");
		@@ -59,5 +85,5 @@ }
		dry_run: !!opts.dryRun,
		preview: payload,
		preview: block,
		};
		}
		//# sourceMappingURL=codex.js.map

+1

-1

dist/installer/agents/codex.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../../src/installer/agents/codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC,MAAM,YAAY,GAAG,sCAAsC,CAAC;AAE5D,MAAM,UAAU,cAAc,CAAC,WAAoB;IACjD,MAAM,OAAO,GAAG,WAAW;QACzB,CAAC,CAAC,0CAA0C,WAAW,KAAK;QAC5D,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;;;;;aAKI,YAAY,IAAI,OAAO;;;;aAIvB,YAAY,IAAI,OAAO;;;;aAIvB,YAAY,IAAI,OAAO;;;;aAIvB,YAAY,IAAI,OAAO;;;;aAIvB,YAAY,IAAI,OAAO;;;;aAIvB,YAAY,IAAI,OAAO;CACnC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,SAAyB,EACzB,OAAmD,EAAE;IAErD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC;IACrC,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO;KACjB,CAAC;AACJ,CAAC"}
		{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../../src/installer/agents/codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,YAAY,GAAG,sCAAsC,CAAC;AAE5D,MAAM,UAAU,cAAc,CAAC,WAAoB;IACjD,MAAM,OAAO,GAAG,WAAW;QACzB,CAAC,CAAC,0CAA0C,WAAW,KAAK;QAC5D,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;;;;;aAKI,YAAY,IAAI,OAAO;;;;aAIvB,YAAY,IAAI,OAAO;;;;aAIvB,YAAY,IAAI,OAAO;;;;aAIvB,YAAY,IAAI,OAAO;;;;aAIvB,YAAY,IAAI,OAAO;;;;aAIvB,YAAY,IAAI,OAAO;CACnC,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CACvB,SAAyB,EACzB,OAAmD,EAAE;IAErD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC;IACrC,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,OAAe,CAAC;IACpB,IAAI,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACtC,OAAO,GAAG,QAAQ,CAAC,CAAC,iDAAiD;IACvE,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,QAAQ;YAChB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,KAAK;YAC/C,CAAC,CAAC,KAAK,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,YAAY,CAAC,MAAM,CAAC,CAAC;QACrB,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM;QACtB,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC"}

+8

-0

dist/installer/agents/copilot.d.ts

		@@ -14,2 +14,10 @@ /**
		export declare function buildShimEntry(mcpEndpoint?: string): Record<string, unknown>;
		/**
		* Non-destructive merge: `hooks` is an array (not a keyed object), so
		* idempotent re-install means filtering out any PRIOR entries this shim
		* wrote (matched by `run === HOOK_COMMAND`) before appending the fresh set —
		* otherwise every re-install would accumulate 7 more duplicate entries.
		* Any other hook entries the user configured independently are preserved,
		* same non-destructive intent as the claude-code shim fix.
		*/
		export declare function writeShim(detection: AgentDetection, opts?: {
		@@ -16,0 +24,0 @@ dryRun?: boolean;

+1

-1

dist/installer/agents/copilot.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"copilot.d.ts","sourceRoot":"","sources":["../../../src/installer/agents/copilot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIxD,wBAAgB,cAAc,CAC5B,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiBzB;AAED,wBAAgB,SAAS,CACvB,SAAS,EAAE,cAAc,EACzB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACpD,eAAe,CAcjB"}
		{"version":3,"file":"copilot.d.ts","sourceRoot":"","sources":["../../../src/installer/agents/copilot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAKxD,wBAAgB,cAAc,CAC5B,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiBzB;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,cAAc,EACzB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACpD,eAAe,CAkCjB"}

+28

-1

dist/installer/agents/copilot.js

		@@ -13,2 +13,3 @@ /**
		import * as path from "node:path";
		import { ensureBackup } from "../backup.js";
		const HOOK_COMMAND = "npx @sunaiva/gate --mcp-bridge copilot";
		@@ -33,8 +34,34 @@ export function buildShimEntry(mcpEndpoint) {
		}
		/**
		* Non-destructive merge: `hooks` is an array (not a keyed object), so
		* idempotent re-install means filtering out any PRIOR entries this shim
		* wrote (matched by `run === HOOK_COMMAND`) before appending the fresh set —
		* otherwise every re-install would accumulate 7 more duplicate entries.
		* Any other hook entries the user configured independently are preserved,
		* same non-destructive intent as the claude-code shim fix.
		*/
		export function writeShim(detection, opts = {}) {
		const target = detection.config_path;
		const entry = buildShimEntry(opts.mcpEndpoint);
		const payload = JSON.stringify(entry, null, 2);
		let existing = {};
		try {
		existing = JSON.parse(fs.readFileSync(target, "utf-8"));
		}
		catch {
		existing = {};
		}
		const existingHooks = Array.isArray(existing["hooks"])
		? existing["hooks"]
		: [];
		const withoutOurs = existingHooks.filter((h) => h?.run !== HOOK_COMMAND);
		const next = {
		...existing,
		version: entry["version"],
		sunaiva_gate_preview: entry["sunaiva_gate_preview"],
		hooks: [...withoutOurs, ...entry["hooks"]],
		};
		const payload = JSON.stringify(next, null, 2);
		if (!opts.dryRun) {
		fs.mkdirSync(path.dirname(target), { recursive: true });
		ensureBackup(target);
		fs.writeFileSync(target, payload, "utf-8");
		@@ -41,0 +68,0 @@ }

+1

-1

dist/installer/agents/copilot.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"copilot.js","sourceRoot":"","sources":["../../../src/installer/agents/copilot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC,MAAM,YAAY,GAAG,wCAAwC,CAAC;AAE9D,MAAM,UAAU,cAAc,CAC5B,WAAoB;IAEpB,MAAM,GAAG,GAA2B,WAAW;QAC7C,CAAC,CAAC,EAAE,yBAAyB,EAAE,WAAW,EAAE;QAC5C,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;QACL,OAAO,EAAE,CAAC;QACV,oBAAoB,EAAE,IAAI;QAC1B,KAAK,EAAE;YACL,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE;YAC/C,EAAE,EAAE,EAAE,kBAAkB,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE;YAClD,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC7D,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE;YAC5C,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE;YAC7C,EAAE,EAAE,EAAE,mBAAmB,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;YACnE,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE;SAC9C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,SAAyB,EACzB,OAAmD,EAAE;IAErD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC;IACrC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM;QACtB,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC"}
		{"version":3,"file":"copilot.js","sourceRoot":"","sources":["../../../src/installer/agents/copilot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,YAAY,GAAG,wCAAwC,CAAC;AAE9D,MAAM,UAAU,cAAc,CAC5B,WAAoB;IAEpB,MAAM,GAAG,GAA2B,WAAW;QAC7C,CAAC,CAAC,EAAE,yBAAyB,EAAE,WAAW,EAAE;QAC5C,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;QACL,OAAO,EAAE,CAAC;QACV,oBAAoB,EAAE,IAAI;QAC1B,KAAK,EAAE;YACL,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE;YAC/C,EAAE,EAAE,EAAE,kBAAkB,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE;YAClD,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC7D,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE;YAC5C,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE;YAC7C,EAAE,EAAE,EAAE,mBAAmB,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;YACnE,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE;SAC9C;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CACvB,SAAyB,EACzB,OAAmD,EAAE;IAErD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC;IACrC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAGrD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC;IACD,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpD,CAAC,CAAE,QAAQ,CAAC,OAAO,CAA6B;QAChD,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,YAAY,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG;QACX,GAAG,QAAQ;QACX,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC;QACzB,oBAAoB,EAAE,KAAK,CAAC,sBAAsB,CAAC;QACnD,KAAK,EAAE,CAAC,GAAG,WAAW,EAAE,GAAI,KAAK,CAAC,OAAO,CAAe,CAAC;KAC1D,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,YAAY,CAAC,MAAM,CAAC,CAAC;QACrB,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM;QACtB,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC"}

+7

-0

dist/installer/agents/cursor.d.ts

		@@ -12,2 +12,9 @@ /**
		export declare function buildShimEntry(mcpEndpoint?: string): Record<string, unknown>;
		/**
		* Non-destructive merge: preserve any unrelated top-level keys and any
		* hook event types the user configured that we don't manage. We only ever
		* own the 5 event keys buildShimEntry() defines — same class of bug as the
		* claude-code shim (see claude-code.ts docstring): a naive full overwrite
		* would silently delete the user's own hooks.json content.
		*/
		export declare function writeShim(detection: AgentDetection, opts?: {
		@@ -14,0 +21,0 @@ dryRun?: boolean;

+1

-1

dist/installer/agents/cursor.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"cursor.d.ts","sourceRoot":"","sources":["../../../src/installer/agents/cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIxD,wBAAgB,cAAc,CAC5B,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2BzB;AAED,wBAAgB,SAAS,CACvB,SAAS,EAAE,cAAc,EACzB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACpD,eAAe,CAcjB"}
		{"version":3,"file":"cursor.d.ts","sourceRoot":"","sources":["../../../src/installer/agents/cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAKxD,wBAAgB,cAAc,CAC5B,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2BzB;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,cAAc,EACzB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACpD,eAAe,CA+BjB"}

+23

-1

dist/installer/agents/cursor.js

		@@ -11,2 +11,3 @@ /**
		import * as path from "node:path";
		import { ensureBackup } from "../backup.js";
		const HOOK_COMMAND = "npx @sunaiva/gate --mcp-bridge cursor";
		@@ -41,8 +42,29 @@ export function buildShimEntry(mcpEndpoint) {
		}
		/**
		* Non-destructive merge: preserve any unrelated top-level keys and any
		* hook event types the user configured that we don't manage. We only ever
		* own the 5 event keys buildShimEntry() defines — same class of bug as the
		* claude-code shim (see claude-code.ts docstring): a naive full overwrite
		* would silently delete the user's own hooks.json content.
		*/
		export function writeShim(detection, opts = {}) {
		const target = detection.config_path;
		const entry = buildShimEntry(opts.mcpEndpoint);
		const payload = JSON.stringify(entry, null, 2);
		let existing = {};
		try {
		existing = JSON.parse(fs.readFileSync(target, "utf-8"));
		}
		catch {
		existing = {};
		}
		const existingHooks = existing["hooks"] ?? {};
		const next = {
		...existing,
		version: entry["version"],
		hooks: { ...existingHooks, ...entry["hooks"] },
		};
		const payload = JSON.stringify(next, null, 2);
		if (!opts.dryRun) {
		fs.mkdirSync(path.dirname(target), { recursive: true });
		ensureBackup(target);
		fs.writeFileSync(target, payload, "utf-8");
		@@ -49,0 +71,0 @@ }

+1

-1

dist/installer/agents/cursor.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"cursor.js","sourceRoot":"","sources":["../../../src/installer/agents/cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC,MAAM,YAAY,GAAG,uCAAuC,CAAC;AAE7D,MAAM,UAAU,cAAc,CAC5B,WAAoB;IAEpB,OAAO;QACL,OAAO,EAAE,CAAC;QACV,KAAK,EAAE;YACL,cAAc,EAAE;gBACd,OAAO,EAAE,YAAY;gBACrB,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;gBAClE,QAAQ,EAAE,YAAY;aACvB;YACD,eAAe,EAAE;gBACf,OAAO,EAAE,YAAY;gBACrB,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;aACnE;YACD,oBAAoB,EAAE;gBACpB,OAAO,EAAE,YAAY;gBACrB,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;aACnE;YACD,eAAe,EAAE;gBACf,OAAO,EAAE,YAAY;gBACrB,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;aACnE;YACD,aAAa,EAAE;gBACb,OAAO,EAAE,YAAY;gBACrB,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;aACnE;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,SAAyB,EACzB,OAAmD,EAAE;IAErD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC;IACrC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM;QACtB,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC"}
		{"version":3,"file":"cursor.js","sourceRoot":"","sources":["../../../src/installer/agents/cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,YAAY,GAAG,uCAAuC,CAAC;AAE7D,MAAM,UAAU,cAAc,CAC5B,WAAoB;IAEpB,OAAO;QACL,OAAO,EAAE,CAAC;QACV,KAAK,EAAE;YACL,cAAc,EAAE;gBACd,OAAO,EAAE,YAAY;gBACrB,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;gBAClE,QAAQ,EAAE,YAAY;aACvB;YACD,eAAe,EAAE;gBACf,OAAO,EAAE,YAAY;gBACrB,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;aACnE;YACD,oBAAoB,EAAE;gBACpB,OAAO,EAAE,YAAY;gBACrB,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;aACnE;YACD,eAAe,EAAE;gBACf,OAAO,EAAE,YAAY;gBACrB,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;aACnE;YACD,aAAa,EAAE;gBACb,OAAO,EAAE,YAAY;gBACrB,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;aACnE;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CACvB,SAAyB,EACzB,OAAmD,EAAE;IAErD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC;IACrC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAGrD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC;IACD,MAAM,aAAa,GAChB,QAAQ,CAAC,OAAO,CAAyC,IAAI,EAAE,CAAC;IACnE,MAAM,IAAI,GAAG;QACX,GAAG,QAAQ;QACX,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC;QACzB,KAAK,EAAE,EAAE,GAAG,aAAa,EAAE,GAAI,KAAK,CAAC,OAAO,CAA6B,EAAE;KAC5E,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,YAAY,CAAC,MAAM,CAAC,CAAC;QACrB,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM;QACtB,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC"}

+7

-0

dist/installer/agents/gemini.d.ts

		@@ -11,2 +11,9 @@ /**
		export declare function buildShimEntry(mcpEndpoint?: string): Record<string, unknown>;
		/**
		* Non-destructive merge: `middlewares` is an array, so re-install must drop
		* any PRIOR "sunaiva-gate"-named entry before appending the fresh one
		* (matched by `name`) — otherwise every re-install accumulates a duplicate
		* middleware registration. Other middlewares the user registered are
		* preserved, same non-destructive intent as the claude-code shim fix.
		*/
		export declare function writeShim(detection: AgentDetection, opts?: {
		@@ -13,0 +20,0 @@ dryRun?: boolean;

+1

-1

dist/installer/agents/gemini.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"gemini.d.ts","sourceRoot":"","sources":["../../../src/installer/agents/gemini.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIxD,wBAAgB,cAAc,CAC5B,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0BzB;AAED,wBAAgB,SAAS,CACvB,SAAS,EAAE,cAAc,EACzB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACpD,eAAe,CAcjB"}
		{"version":3,"file":"gemini.d.ts","sourceRoot":"","sources":["../../../src/installer/agents/gemini.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAKxD,wBAAgB,cAAc,CAC5B,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0BzB;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,cAAc,EACzB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACpD,eAAe,CAgCjB"}

+25

-1

dist/installer/agents/gemini.js

		@@ -10,2 +10,3 @@ /**
		import * as path from "node:path";
		import { ensureBackup } from "../backup.js";
		const HOOK_COMMAND = "npx @sunaiva/gate --mcp-bridge gemini";
		@@ -39,8 +40,31 @@ export function buildShimEntry(mcpEndpoint) {
		}
		/**
		* Non-destructive merge: `middlewares` is an array, so re-install must drop
		* any PRIOR "sunaiva-gate"-named entry before appending the fresh one
		* (matched by `name`) — otherwise every re-install accumulates a duplicate
		* middleware registration. Other middlewares the user registered are
		* preserved, same non-destructive intent as the claude-code shim fix.
		*/
		export function writeShim(detection, opts = {}) {
		const target = detection.config_path;
		const entry = buildShimEntry(opts.mcpEndpoint);
		const payload = JSON.stringify(entry, null, 2);
		let existing = {};
		try {
		existing = JSON.parse(fs.readFileSync(target, "utf-8"));
		}
		catch {
		existing = {};
		}
		const existingMw = Array.isArray(existing["middlewares"])
		? existing["middlewares"]
		: [];
		const withoutOurs = existingMw.filter((m) => m?.name !== "sunaiva-gate");
		const next = {
		...existing,
		middlewares: [...withoutOurs, ...entry["middlewares"]],
		};
		const payload = JSON.stringify(next, null, 2);
		if (!opts.dryRun) {
		fs.mkdirSync(path.dirname(target), { recursive: true });
		ensureBackup(target);
		fs.writeFileSync(target, payload, "utf-8");
		@@ -47,0 +71,0 @@ }

+1

-1

dist/installer/agents/gemini.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"gemini.js","sourceRoot":"","sources":["../../../src/installer/agents/gemini.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC,MAAM,YAAY,GAAG,uCAAuC,CAAC;AAE7D,MAAM,UAAU,cAAc,CAC5B,WAAoB;IAEpB,MAAM,GAAG,GAA2B,WAAW;QAC7C,CAAC,CAAC,EAAE,yBAAyB,EAAE,WAAW,EAAE;QAC5C,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;QACL,WAAW,EAAE;YACX;gBACE,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE;oBACN,SAAS;oBACT,UAAU;oBACV,WAAW;oBACX,QAAQ;oBACR,OAAO;oBACP,KAAK;oBACL,YAAY;oBACZ,QAAQ;iBACT;gBACD,OAAO,EAAE,YAAY;gBACrB,GAAG;gBACH,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,OAAO;aACpB;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,SAAyB,EACzB,OAAmD,EAAE;IAErD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC;IACrC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM;QACtB,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC"}
		{"version":3,"file":"gemini.js","sourceRoot":"","sources":["../../../src/installer/agents/gemini.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,YAAY,GAAG,uCAAuC,CAAC;AAE7D,MAAM,UAAU,cAAc,CAC5B,WAAoB;IAEpB,MAAM,GAAG,GAA2B,WAAW;QAC7C,CAAC,CAAC,EAAE,yBAAyB,EAAE,WAAW,EAAE;QAC5C,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;QACL,WAAW,EAAE;YACX;gBACE,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE;oBACN,SAAS;oBACT,UAAU;oBACV,WAAW;oBACX,QAAQ;oBACR,OAAO;oBACP,KAAK;oBACL,YAAY;oBACZ,QAAQ;iBACT;gBACD,OAAO,EAAE,YAAY;gBACrB,GAAG;gBACH,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,OAAO;aACpB;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CACvB,SAAyB,EACzB,OAAmD,EAAE;IAErD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC;IACrC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAGrD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACvD,CAAC,CAAE,QAAQ,CAAC,aAAa,CAA8B;QACvD,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,cAAc,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG;QACX,GAAG,QAAQ;QACX,WAAW,EAAE,CAAC,GAAG,WAAW,EAAE,GAAI,KAAK,CAAC,aAAa,CAAe,CAAC;KACtE,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,YAAY,CAAC,MAAM,CAAC,CAAC;QACrB,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM;QACtB,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC"}

+20

-8

dist/installer/detect.d.ts

		@@ -11,11 +11,15 @@ /**
		*
		* claude-code : ~/.claude/settings.json (or project-local .claude/settings.json)
		* cursor : ~/.cursor/hooks.json (1.7+; per R4 §4)
		* codex : ~/.codex/hooks.toml or CODEX_HOOKS env var
		* copilot : ~/.config/github-copilot/hooks.json (preview)
		* gemini : ~/.gemini/middleware.json
		* cline : VS Code workspace .vscode/settings.json (MCP-only via mcpServers)
		* aider : ~/.aider.conf.yml (lint-cmd hijack)
		* claude-code : ~/.claude/settings.json (or project-local .claude/settings.json)
		* cursor : ~/.cursor/hooks.json (1.7+; per R4 §4)
		* codex : ~/.codex/hooks.toml or CODEX_HOOKS env var
		* copilot : ~/.config/github-copilot/hooks.json (preview)
		* gemini : ~/.gemini/middleware.json
		* cline : VS Code workspace .vscode/settings.json (MCP-only via mcpServers)
		* aider : ~/.aider.conf.yml (lint-cmd hijack)
		* claude-desktop : native mcpServers config (MCP-only, no hook system):
		* Windows : %APPDATA%\Claude\claude_desktop_config.json
		* macOS : ~/Library/Application Support/Claude/claude_desktop_config.json
		* Linux : ~/.config/Claude/claude_desktop_config.json
		*/
		export type AgentName = "claude-code" \| "cursor" \| "codex" \| "copilot" \| "gemini" \| "cline" \| "aider";
		export type AgentName = "claude-code" \| "cursor" \| "codex" \| "copilot" \| "gemini" \| "cline" \| "aider" \| "claude-desktop";
		export declare const SUPPORTED_AGENTS: readonly AgentName[];
		@@ -34,4 +38,12 @@ export interface AgentDetection {
		home?: string;
		/** Override platform for cross-platform path tests. Defaults to process.platform. */
		platform?: NodeJS.Platform;
		}
		/**
		* Resolve the Claude Desktop config path for the given platform. Exported
		* for reuse by the claude-desktop shim writer (single source of truth for
		* the three OS-specific paths).
		*/
		export declare function claudeDesktopConfigPath(home: string, platform?: NodeJS.Platform): string;
		/**
		* Probe the filesystem for evidence of each supported agent. Read-only.
		@@ -38,0 +50,0 @@ *

+1

-1

dist/installer/detect.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../../src/installer/detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,MAAM,MAAM,SAAS,GACjB,aAAa,GACb,QAAQ,GACR,OAAO,GACP,SAAS,GACT,QAAQ,GACR,OAAO,GACP,OAAO,CAAC;AAEZ,eAAO,MAAM,gBAAgB,EAAE,SAAS,SAAS,EAQ/C,CAAC;AAEH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,SAAS,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAqHD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,cAAc,EAAE,CAAC,CAgD3B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,aAAkB,GAAG,cAAc,EAAE,CA+C3E"}
		{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../../src/installer/detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAMH,MAAM,MAAM,SAAS,GACjB,aAAa,GACb,QAAQ,GACR,OAAO,GACP,SAAS,GACT,QAAQ,GACR,OAAO,GACP,OAAO,GACP,gBAAgB,CAAC;AAErB,eAAO,MAAM,gBAAgB,EAAE,SAAS,SAAS,EAS/C,CAAC;AAEH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,SAAS,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B;AAiHD;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAgBR;AAaD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,cAAc,EAAE,CAAC,CAoD3B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,aAAkB,GAAG,cAAc,EAAE,CAmD3E"}

+42

-7

dist/installer/detect.js

		@@ -11,9 +11,13 @@ /**
		*
		* claude-code : ~/.claude/settings.json (or project-local .claude/settings.json)
		* cursor : ~/.cursor/hooks.json (1.7+; per R4 §4)
		* codex : ~/.codex/hooks.toml or CODEX_HOOKS env var
		* copilot : ~/.config/github-copilot/hooks.json (preview)
		* gemini : ~/.gemini/middleware.json
		* cline : VS Code workspace .vscode/settings.json (MCP-only via mcpServers)
		* aider : ~/.aider.conf.yml (lint-cmd hijack)
		* claude-code : ~/.claude/settings.json (or project-local .claude/settings.json)
		* cursor : ~/.cursor/hooks.json (1.7+; per R4 §4)
		* codex : ~/.codex/hooks.toml or CODEX_HOOKS env var
		* copilot : ~/.config/github-copilot/hooks.json (preview)
		* gemini : ~/.gemini/middleware.json
		* cline : VS Code workspace .vscode/settings.json (MCP-only via mcpServers)
		* aider : ~/.aider.conf.yml (lint-cmd hijack)
		* claude-desktop : native mcpServers config (MCP-only, no hook system):
		* Windows : %APPDATA%\Claude\claude_desktop_config.json
		* macOS : ~/Library/Application Support/Claude/claude_desktop_config.json
		* Linux : ~/.config/Claude/claude_desktop_config.json
		*/
		@@ -31,2 +35,3 @@ import * as fs from "node:fs";
		"aider",
		"claude-desktop",
		]);
		@@ -125,2 +130,24 @@ // ---------------------------------------------------------------------------
		}
		/**
		* Resolve the Claude Desktop config path for the given platform. Exported
		* for reuse by the claude-desktop shim writer (single source of truth for
		* the three OS-specific paths).
		*/
		export function claudeDesktopConfigPath(home, platform = process.platform) {
		if (platform === "win32") {
		const appData = process.env["APPDATA"] \|\| path.join(home, "AppData", "Roaming");
		return path.join(appData, "Claude", "claude_desktop_config.json");
		}
		if (platform === "darwin") {
		return path.join(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
		}
		// Linux and other POSIX platforms.
		return path.join(home, ".config", "Claude", "claude_desktop_config.json");
		}
		function probeClaudeDesktop(home, platform) {
		// Claude Desktop (Anthropic's native app) — native mcpServers config, no hook system.
		const config_path = claudeDesktopConfigPath(home, platform);
		const installed = safeExists(config_path);
		return { installed, config_path };
		}
		// ---------------------------------------------------------------------------
		@@ -140,2 +167,3 @@ // Public API
		const cwd = opts.cwd ?? process.cwd();
		const platform = opts.platform ?? process.platform;
		const results = [];
		@@ -167,2 +195,5 @@ for (const agent of SUPPORTED_AGENTS) {
		break;
		case "claude-desktop":
		probe = probeClaudeDesktop(home, platform);
		break;
		default:
		@@ -194,2 +225,3 @@ probe = { installed: false, config_path: "" };
		const cwd = opts.cwd ?? process.cwd();
		const platform = opts.platform ?? process.platform;
		const results = [];
		@@ -221,2 +253,5 @@ for (const agent of SUPPORTED_AGENTS) {
		break;
		case "claude-desktop":
		probe = probeClaudeDesktop(home, platform);
		break;
		default:
		@@ -223,0 +258,0 @@ probe = { installed: false, config_path: "" };

+1

-1

dist/installer/detect.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"detect.js","sourceRoot":"","sources":["../../src/installer/detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAW9B,MAAM,CAAC,MAAM,gBAAgB,GAAyB,MAAM,CAAC,MAAM,CAAC;IAClE,aAAa;IACb,QAAQ;IACR,OAAO;IACP,SAAS;IACT,QAAQ;IACR,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAiBH,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAYD,SAAS,eAAe,CAAC,IAAY,EAAE,GAAW;IAChD,0EAA0E;IAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,6BAA6B;IACnG,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;IACpE,IAAI,OAA2B,CAAC;IAChC,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC;IACrE,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,CAAC,GAAI,MAAkC,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE;QAC5B,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,iDAAiD;IACjD,0FAA0F;IAC1F,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAC1C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,2EAA2E;IAC3E,+EAA+E;IAC/E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC5D,MAAM,SAAS,GACb,UAAU,CAAC,WAAW,CAAC;QACvB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;IACvD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,+EAA+E;IAC/E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;IAC/E,MAAM,SAAS,GACb,UAAU,CAAC,WAAW,CAAC;QACvB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC;IAC1E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,6EAA6E;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC;IACjE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,0EAA0E;IAC1E,4EAA4E;IAC5E,gEAAgE;IAChE,4DAA4D;IAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC/D,IAAI,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,SAAS,EAAE,CAAC;QACd,6EAA6E;QAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAC/C,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBACtD,0EAA0E;gBAC1E,2EAA2E;YAC7E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,gDAAgD;IAChD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAC1C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAsB,EAAE;IAExB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,OAAO,GAAqB,EAAE,CAAC;IAErC,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,IAAI,KAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,KAAK,EAAE,CAAC;gBACd,KAAK,aAAa;oBAChB,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBACnC,MAAM;gBACR,KAAK,QAAQ;oBACX,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;oBAC1B,MAAM;gBACR,KAAK,OAAO;oBACV,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;oBACzB,MAAM;gBACR,KAAK,SAAS;oBACZ,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;oBAC3B,MAAM;gBACR,KAAK,QAAQ;oBACX,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;oBAC1B,MAAM;gBACR,KAAK,OAAO;oBACV,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;oBACxB,MAAM;gBACR,KAAK,OAAO;oBACV,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;oBACzB,MAAM;gBACR;oBACE,KAAK,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;YAClD,KAAK,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,KAAK,GAAmB;YAC5B,KAAK;YACL,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;QACF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAsB,EAAE;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,OAAO,GAAqB,EAAE,CAAC;IAErC,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,IAAI,KAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,KAAK,EAAE,CAAC;gBACd,KAAK,aAAa;oBAChB,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBACnC,MAAM;gBACR,KAAK,QAAQ;oBACX,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;oBAC1B,MAAM;gBACR,KAAK,OAAO;oBACV,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;oBACzB,MAAM;gBACR,KAAK,SAAS;oBACZ,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;oBAC3B,MAAM;gBACR,KAAK,QAAQ;oBACX,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;oBAC1B,MAAM;gBACR,KAAK,OAAO;oBACV,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;oBACxB,MAAM;gBACR,KAAK,OAAO;oBACV,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;oBACzB,MAAM;gBACR;oBACE,KAAK,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,KAAK,GAAmB;YAC5B,KAAK;YACL,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;QACF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
		{"version":3,"file":"detect.js","sourceRoot":"","sources":["../../src/installer/detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAY9B,MAAM,CAAC,MAAM,gBAAgB,GAAyB,MAAM,CAAC,MAAM,CAAC;IAClE,aAAa;IACb,QAAQ;IACR,OAAO;IACP,SAAS;IACT,QAAQ;IACR,OAAO;IACP,OAAO;IACP,gBAAgB;CACjB,CAAC,CAAC;AAmBH,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAYD,SAAS,eAAe,CAAC,IAAY,EAAE,GAAW;IAChD,0EAA0E;IAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,6BAA6B;IACnG,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;IACpE,IAAI,OAA2B,CAAC;IAChC,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC;IACrE,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,CAAC,GAAI,MAAkC,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE;QAC5B,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,iDAAiD;IACjD,0FAA0F;IAC1F,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAC1C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,2EAA2E;IAC3E,+EAA+E;IAC/E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC5D,MAAM,SAAS,GACb,UAAU,CAAC,WAAW,CAAC;QACvB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;IACvD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,+EAA+E;IAC/E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;IAC/E,MAAM,SAAS,GACb,UAAU,CAAC,WAAW,CAAC;QACvB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC;IAC1E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,6EAA6E;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC;IACjE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,0EAA0E;IAC1E,4EAA4E;IAC5E,gEAAgE;IAChE,4DAA4D;IAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC/D,IAAI,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,SAAS,EAAE,CAAC;QACd,6EAA6E;QAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAC/C,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBACtD,0EAA0E;gBAC1E,2EAA2E;YAC7E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,gDAAgD;IAChD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAC1C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAY,EACZ,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,IAAI,CACd,IAAI,EACJ,SAAS,EACT,qBAAqB,EACrB,QAAQ,EACR,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IACD,mCAAmC;IACnC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,QAAyB;IACjE,sFAAsF;IACtF,MAAM,WAAW,GAAG,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAC1C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAsB,EAAE;IAExB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,OAAO,GAAqB,EAAE,CAAC;IAErC,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,IAAI,KAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,KAAK,EAAE,CAAC;gBACd,KAAK,aAAa;oBAChB,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBACnC,MAAM;gBACR,KAAK,QAAQ;oBACX,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;oBAC1B,MAAM;gBACR,KAAK,OAAO;oBACV,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;oBACzB,MAAM;gBACR,KAAK,SAAS;oBACZ,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;oBAC3B,MAAM;gBACR,KAAK,QAAQ;oBACX,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;oBAC1B,MAAM;gBACR,KAAK,OAAO;oBACV,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;oBACxB,MAAM;gBACR,KAAK,OAAO;oBACV,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;oBACzB,MAAM;gBACR,KAAK,gBAAgB;oBACnB,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;oBAC3C,MAAM;gBACR;oBACE,KAAK,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;YAClD,KAAK,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,KAAK,GAAmB;YAC5B,KAAK;YACL,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;QACF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAsB,EAAE;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,OAAO,GAAqB,EAAE,CAAC;IAErC,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,IAAI,KAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,KAAK,EAAE,CAAC;gBACd,KAAK,aAAa;oBAChB,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBACnC,MAAM;gBACR,KAAK,QAAQ;oBACX,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;oBAC1B,MAAM;gBACR,KAAK,OAAO;oBACV,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;oBACzB,MAAM;gBACR,KAAK,SAAS;oBACZ,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;oBAC3B,MAAM;gBACR,KAAK,QAAQ;oBACX,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;oBAC1B,MAAM;gBACR,KAAK,OAAO;oBACV,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;oBACxB,MAAM;gBACR,KAAK,OAAO;oBACV,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;oBACzB,MAAM;gBACR,KAAK,gBAAgB;oBACnB,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;oBAC3C,MAAM;gBACR;oBACE,KAAK,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,KAAK,GAAmB;YAC5B,KAAK;YACL,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;QACF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

+19

-0

dist/installer/install.d.ts

		@@ -15,2 +15,3 @@ /**
		import { SUPPORTED_AGENTS, type AgentName } from "./detect.js";
		import { type RestoreResult } from "./backup.js";
		export interface InstallOptions {
		@@ -52,4 +53,22 @@ /** When true, no files are written. Default false (i.e. real install). */
		export declare function formatResults(results: InstallResult[]): string;
		export interface UninstallOptions {
		/** Optional whitelist — only these agents are restored. Default: all detected. */
		agents?: AgentName[];
		cwd?: string;
		home?: string;
		}
		export interface UninstallResult extends RestoreResult {
		agent: AgentName;
		}
		/**
		* Restore every agent's config file to its exact pre-install state via the
		* backup marker `ensureBackup()` wrote during `install`. Agent-agnostic —
		* doesn't need to know JSON/TOML/YAML shape, just puts back the original
		* bytes (or removes the file if nothing existed before install).
		*/
		export declare function uninstallAll(opts?: UninstallOptions): Promise<UninstallResult[]>;
		/** Pretty-print uninstall results for the CLI. */
		export declare function formatUninstallResults(results: UninstallResult[]): string;
		/** Re-export for CLI convenience. */
		export { SUPPORTED_AGENTS };
		//# sourceMappingURL=install.d.ts.map

+1

-1

dist/installer/install.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../src/installer/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAgB,gBAAgB,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAS7E,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mFAAmF;IACnF,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC;IACrB,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAoBD;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,EAAE,CAAC,CAyD1B;AAED,gDAAgD;AAChD,wBAAgB,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,CAc9D;AAED,qCAAqC;AACrC,OAAO,EAAE,gBAAgB,EAAE,CAAC"}
		{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../src/installer/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAgB,gBAAgB,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAUpE,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mFAAmF;IACnF,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC;IACrB,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAqBD;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,EAAE,CAAC,CAyD1B;AAED,gDAAgD;AAChD,wBAAgB,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,CAmB9D;AAED,MAAM,WAAW,gBAAgB;IAC/B,kFAAkF;IAClF,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,KAAK,EAAE,SAAS,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,eAAe,EAAE,CAAC,CAa5B;AAED,kDAAkD;AAClD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,MAAM,CAYzE;AAED,qCAAqC;AACrC,OAAO,EAAE,gBAAgB,EAAE,CAAC"}

+42

-0

dist/installer/install.js

		@@ -15,2 +15,3 @@ /**
		import { detectAgents, SUPPORTED_AGENTS } from "./detect.js";
		import { restoreFromBackup } from "./backup.js";
		import * as claudeCode from "./agents/claude-code.js";
		@@ -23,2 +24,3 @@ import * as cursor from "./agents/cursor.js";
		import * as aider from "./agents/aider.js";
		import * as claudeDesktop from "./agents/claude-desktop.js";
		const SHIM_DISPATCH = {
		@@ -32,2 +34,3 @@ "claude-code": claudeCode,
		aider,
		"claude-desktop": claudeDesktop,
		};
		@@ -105,7 +108,46 @@ /**
		lines.push(`${r.agent.padEnd(14)} ${installed.padEnd(16)} ${status} → ${r.written_to}`);
		// Claude Desktop only picks up mcpServers config changes on restart —
		// the other agents' shims (hooks/middleware) take effect on next call.
		if (r.agent === "claude-desktop" && !r.dry_run && !r.error) {
		lines.push(`${"".padEnd(14)} ${"".padEnd(16)} → restart Claude Desktop to finish.`);
		}
		}
		return lines.join("\n");
		}
		/**
		* Restore every agent's config file to its exact pre-install state via the
		* backup marker `ensureBackup()` wrote during `install`. Agent-agnostic —
		* doesn't need to know JSON/TOML/YAML shape, just puts back the original
		* bytes (or removes the file if nothing existed before install).
		*/
		export async function uninstallAll(opts = {}) {
		const detections = await detectAgents({
		...(opts.cwd !== undefined ? { cwd: opts.cwd } : {}),
		...(opts.home !== undefined ? { home: opts.home } : {}),
		});
		const whitelist = opts.agents ? new Set(opts.agents) : undefined;
		const results = [];
		for (const det of detections) {
		if (whitelist && !whitelist.has(det.agent))
		continue;
		const restored = restoreFromBackup(det.config_path);
		results.push({ agent: det.agent, ...restored });
		}
		return results;
		}
		/** Pretty-print uninstall results for the CLI. */
		export function formatUninstallResults(results) {
		const lines = [];
		for (const r of results) {
		const status = r.action === "noop"
		? "no gate install found (skipped)"
		: r.action === "removed"
		? "removed (no prior file existed)"
		: "restored original content";
		lines.push(`${r.agent.padEnd(14)} ${status} → ${r.target}`);
		}
		return lines.join("\n");
		}
		/** Re-export for CLI convenience. */
		export { SUPPORTED_AGENTS };
		//# sourceMappingURL=install.js.map

+1

-1

dist/installer/install.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/installer/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAkB,MAAM,aAAa,CAAC;AAC7E,OAAO,KAAK,UAAU,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,mBAAmB,CAAC;AAC3C,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAC/C,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,mBAAmB,CAAC;AAC3C,OAAO,KAAK,KAAK,MAAM,mBAAmB,CAAC;AAiC3C,MAAM,aAAa,GAQf;IACF,aAAa,EAAE,UAAU;IACzB,MAAM;IACN,KAAK;IACL,OAAO;IACP,MAAM;IACN,KAAK;IACL,KAAK;CACN,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAuB,EAAE;IAEzB,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAC7B,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,2BAA2B;QAC3B,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACrD,0CAA0C;QAC1C,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,SAAS;QAElD,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE,MAAM;gBACf,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,KAAK,EAAE,sBAAsB,GAAG,CAAC,KAAK,EAAE;aACzC,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBAC/B,MAAM;gBACN,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;oBAChC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;oBACnC,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE,MAAM;gBACf,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,aAAa,CAAC,OAAwB;IACpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK;YACpB,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE;YACrB,CAAC,CAAC,CAAC,CAAC,OAAO;gBACX,CAAC,CAAC,wBAAwB,CAAC,CAAC,KAAK,SAAS;gBAC1C,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,QAAQ,CAAC;QAC7B,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAChE,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,CAC5E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,qCAAqC;AACrC,OAAO,EAAE,gBAAgB,EAAE,CAAC"}
		{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/installer/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAkB,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAsB,MAAM,aAAa,CAAC;AACpE,OAAO,KAAK,UAAU,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,mBAAmB,CAAC;AAC3C,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAC/C,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,mBAAmB,CAAC;AAC3C,OAAO,KAAK,KAAK,MAAM,mBAAmB,CAAC;AAC3C,OAAO,KAAK,aAAa,MAAM,4BAA4B,CAAC;AAiC5D,MAAM,aAAa,GAQf;IACF,aAAa,EAAE,UAAU;IACzB,MAAM;IACN,KAAK;IACL,OAAO;IACP,MAAM;IACN,KAAK;IACL,KAAK;IACL,gBAAgB,EAAE,aAAa;CAChC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAuB,EAAE;IAEzB,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAC7B,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,2BAA2B;QAC3B,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACrD,0CAA0C;QAC1C,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,SAAS;QAElD,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE,MAAM;gBACf,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,KAAK,EAAE,sBAAsB,GAAG,CAAC,KAAK,EAAE;aACzC,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBAC/B,MAAM;gBACN,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;oBAChC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;oBACnC,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE,MAAM;gBACf,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,aAAa,CAAC,OAAwB;IACpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK;YACpB,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE;YACrB,CAAC,CAAC,CAAC,CAAC,OAAO;gBACX,CAAC,CAAC,wBAAwB,CAAC,CAAC,KAAK,SAAS;gBAC1C,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,QAAQ,CAAC;QAC7B,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAChE,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,CAC5E,CAAC;QACF,sEAAsE;QACtE,uEAAuE;QACvE,IAAI,CAAC,CAAC,KAAK,KAAK,gBAAgB,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;YAC3D,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,sCAAsC,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAaD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAyB,EAAE;IAE3B,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACrD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,sBAAsB,CAAC,OAA0B;IAC/D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GACV,CAAC,CAAC,MAAM,KAAK,MAAM;YACjB,CAAC,CAAC,iCAAiC;YACnC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS;gBACxB,CAAC,CAAC,iCAAiC;gBACnC,CAAC,CAAC,2BAA2B,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,qCAAqC;AACrC,OAAO,EAAE,gBAAgB,EAAE,CAAC"}

+10

-4

dist/timelock/cli.d.ts

		/**
		* Timelock CLI — `sunaiva-gate cancel <token>` (1.2.0 T10).
		*
		* Thin command-handler that's wired into src/index.ts argv parsing. Exit
		* code semantics:
		* Thin command-handler for a planned `sunaiva-gate cancel <token>` CLI
		* command — NOT currently wired into src/index.ts argv parsing.
		*
		* `runCancelCli` exit code semantics:
		* 0 = cancellation succeeded
		* 2 = invalid arguments (no token, unknown token, already resolved)
		* 3 = internal error
		* 2 = invalid arguments OR internal error (no token, unknown token,
		* already resolved, or the manager threw) — this handler never
		* returns exit code 3.
		*
		* `runListPendingCli` (informational helper, below) uses a separate
		* contract: 0 = success, 3 = internal error.
		*/
		@@ -10,0 +16,0 @@ import { TimelockManager } from "./manager.js";

+1

-1

dist/timelock/cli.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/timelock/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,+BAA+B;AAC/B,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,eAAe,CAAA;CAAO,GACxD,OAAO,CAAC,iBAAiB,CAAC,CAwB5B;AAED,mDAAmD;AACnD,wBAAsB,iBAAiB,CACrC,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,eAAe,CAAA;CAAO,GACvC,OAAO,CAAC,iBAAiB,CAAC,CAiB5B"}
		{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/timelock/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,+BAA+B;AAC/B,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,eAAe,CAAA;CAAO,GACxD,OAAO,CAAC,iBAAiB,CAAC,CAwB5B;AAED,mDAAmD;AACnD,wBAAsB,iBAAiB,CACrC,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,eAAe,CAAA;CAAO,GACvC,OAAO,CAAC,iBAAiB,CAAC,CAiB5B"}

+10

-4

dist/timelock/cli.js

		/**
		* Timelock CLI — `sunaiva-gate cancel <token>` (1.2.0 T10).
		*
		* Thin command-handler that's wired into src/index.ts argv parsing. Exit
		* code semantics:
		* Thin command-handler for a planned `sunaiva-gate cancel <token>` CLI
		* command — NOT currently wired into src/index.ts argv parsing.
		*
		* `runCancelCli` exit code semantics:
		* 0 = cancellation succeeded
		* 2 = invalid arguments (no token, unknown token, already resolved)
		* 3 = internal error
		* 2 = invalid arguments OR internal error (no token, unknown token,
		* already resolved, or the manager threw) — this handler never
		* returns exit code 3.
		*
		* `runListPendingCli` (informational helper, below) uses a separate
		* contract: 0 = success, 3 = internal error.
		*/
		@@ -10,0 +16,0 @@ import { TimelockManager } from "./manager.js";

+1

-1

dist/timelock/cli.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/timelock/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAS/C,+BAA+B;AAC/B,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAyB,EACzB,OAAuD,EAAE;IAEzD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,oCAAoC;SAC9C,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,eAAe,EAAE,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,mBAAmB,KAAK,iBAAiB,MAAM,CAAC,WAAW,GAAG;YACvE,MAAM;SACP,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SAC1D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAsC,EAAE;IAExC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,eAAe,EAAE,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAChD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,oBAAoB;YAC9C,MAAM,EAAE,OAAO;SAChB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SAC1D,CAAC;IACJ,CAAC;AACH,CAAC"}
		{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/timelock/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAS/C,+BAA+B;AAC/B,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAyB,EACzB,OAAuD,EAAE;IAEzD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,oCAAoC;SAC9C,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,eAAe,EAAE,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,mBAAmB,KAAK,iBAAiB,MAAM,CAAC,WAAW,GAAG;YACvE,MAAM;SACP,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SAC1D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAsC,EAAE;IAExC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,eAAe,EAAE,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAChD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,oBAAoB;YAC9C,MAAM,EAAE,OAAO;SAChB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SAC1D,CAAC;IACJ,CAAC;AACH,CAAC"}

+38

-4

dist/tools/audit.d.ts

		export declare function appendAudit(entry: Record<string, unknown>): void;
		/**
		* MCP tool: get_audit_log
		*
		* WHEN TO CALL: to inspect what the gate actually decided recently —
		* blocks, warns, passes, dry-runs, and bypasses — for debugging why an
		* action was allowed/blocked, or to build a review trail. Pass `rule_id`
		* to scope to one rule, or `limit` to cap how many of the most recent
		* entries come back (default 50).
		*
		* RETURNS: { entries, total, has_unsigned_entries, entry_count } where
		* `entries` are the most recent JSONL rows already filtered/limited, and
		* `has_unsigned_entries` flags whether any returned entry has a hash but
		* no ed25519 signature (check before trusting the log for a compliance
		* export — see audit_verify for a full chain-integrity check).
		*
		* TIER GATE: none — free tier, reads the local on-disk audit log only.
		*/
		export declare function handleGetAuditLog(args: {
		@@ -20,7 +37,24 @@ limit?: number;
		*
		* Returns { valid, entry_count, checked_count, errors[] }.
		* MCP tool: audit_verify
		*
		* WHEN TO CALL: before trusting the audit log for a compliance report or a
		* dispute ("did anyone tamper with our gate decisions?"), or as a periodic
		* integrity check. Re-derives every entry's hash, checks the forward-linked
		* prev_hash chain, and validates any ed25519 signatures present. Takes no
		* arguments.
		*
		* RETURNS: { valid, entry_count, checked_count, errors[], chain_tip_hash,
		* unsigned_count, log_path }. `valid:false` or a non-empty `errors[]` means
		* tampering or corruption was detected. `unsigned_count` alone is NOT a
		* failure — it just counts entries written before/without ed25519 signing
		* configured.
		*
		* TIER GATE: none — free tier, reads the local audit log file only, no
		* network call.
		*
		* Suitable as a standalone diagnostic tool and as a smoke-test endpoint.
		*
		* index.ts registration (DO NOT add here — integration step handles this):
		* server.tool("audit_verify", "Verify audit log hash chain integrity", {}, handleVerifyAuditChain)
		* Registered in src/index.ts's ListToolsRequestSchema/CallToolRequestSchema
		* handlers (that file uses a raw tools-array + switch dispatch, not a
		* server.tool(...) helper — verified 2026-07-26, see
		* docs/AGENT_FACE_AUDIT_2026-07-26.md).
		*/
		@@ -27,0 +61,0 @@ export declare function handleVerifyAuditChain(_args?: Record<string, unknown>): Promise<{

+1

-1

dist/tools/audit.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/tools/audit.ts"],"names":[],"mappings":"AAsCA,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAiChE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;GAyBjF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;;;;;GAqB/E"}
		{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/tools/audit.ts"],"names":[],"mappings":"AAsCA,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAiChE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;GAyBjF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;;;;;GAqB/E"}

+38

-4

dist/tools/audit.js

		@@ -69,2 +69,19 @@ import { existsSync } from "node:fs";
		}
		/**
		* MCP tool: get_audit_log
		*
		* WHEN TO CALL: to inspect what the gate actually decided recently —
		* blocks, warns, passes, dry-runs, and bypasses — for debugging why an
		* action was allowed/blocked, or to build a review trail. Pass `rule_id`
		* to scope to one rule, or `limit` to cap how many of the most recent
		* entries come back (default 50).
		*
		* RETURNS: { entries, total, has_unsigned_entries, entry_count } where
		* `entries` are the most recent JSONL rows already filtered/limited, and
		* `has_unsigned_entries` flags whether any returned entry has a hash but
		* no ed25519 signature (check before trusting the log for a compliance
		* export — see audit_verify for a full chain-integrity check).
		*
		* TIER GATE: none — free tier, reads the local on-disk audit log only.
		*/
		export async function handleGetAuditLog(args) {
		@@ -103,7 +120,24 @@ const logPath = getLogPath();
		*
		* Returns { valid, entry_count, checked_count, errors[] }.
		* MCP tool: audit_verify
		*
		* WHEN TO CALL: before trusting the audit log for a compliance report or a
		* dispute ("did anyone tamper with our gate decisions?"), or as a periodic
		* integrity check. Re-derives every entry's hash, checks the forward-linked
		* prev_hash chain, and validates any ed25519 signatures present. Takes no
		* arguments.
		*
		* RETURNS: { valid, entry_count, checked_count, errors[], chain_tip_hash,
		* unsigned_count, log_path }. `valid:false` or a non-empty `errors[]` means
		* tampering or corruption was detected. `unsigned_count` alone is NOT a
		* failure — it just counts entries written before/without ed25519 signing
		* configured.
		*
		* TIER GATE: none — free tier, reads the local audit log file only, no
		* network call.
		*
		* Suitable as a standalone diagnostic tool and as a smoke-test endpoint.
		*
		* index.ts registration (DO NOT add here — integration step handles this):
		* server.tool("audit_verify", "Verify audit log hash chain integrity", {}, handleVerifyAuditChain)
		* Registered in src/index.ts's ListToolsRequestSchema/CallToolRequestSchema
		* handlers (that file uses a raw tools-array + switch dispatch, not a
		* server.tool(...) helper — verified 2026-07-26, see
		* docs/AGENT_FACE_AUDIT_2026-07-26.md).
		*/
		@@ -110,0 +144,0 @@ export async function handleVerifyAuditChain(_args = {}) {

+1

-1

dist/tools/audit.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/tools/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAElF,SAAS,UAAU;IACjB,uFAAuF;IACvF,yFAAyF;IACzF,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,aAAa,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,EAAE,CAAC,cAAc,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,qFAAqF;AACrF,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe;IACjD,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,oBAAoB;IACjE,oDAAoD;IACpD,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,UAAU,WAAW,CAAC,KAA8B;IACxD,yDAAyD;IACzD,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;YAE7B,wEAAwE;YACxE,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,qDAAqD;YACrD,MAAM,YAAY,GAA4B,EAAE,CAAC;YACjD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;oBACnE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;YAED,MAAM,gBAAgB,CAAC,OAAO,EAAE;gBAC9B,YAAY,EAAE,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;gBACrF,IAAI,EAAU,OAAO,KAAK,CAAC,IAAI,KAAc,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC,SAAS;gBACvF,MAAM,EAAQ,OAAO,KAAK,CAAC,MAAM,KAAY,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAQ,CAAC,CAAC,EAAE;gBAChF,aAAa,EAAE,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;gBACnF,UAAU,EAAK,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAI,CAAC,CAAE,KAAK,CAAC,UAA0B,CAAC,CAAC,CAAC,EAAE;gBAC1F,QAAQ,EAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAM,CAAC,CAAE,KAAK,CAAC,QAA0B,CAAC,CAAC,CAAC,EAAE;gBAC1F,eAAe,EAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAG,CAAC,CAAE,KAAK,CAAC,eAA8B,CAAC,CAAC,CAAC,EAAE;gBACtG,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,kBAA+B,CAAC,CAAC,CAAC,EAAE;gBACzG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClE,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAA0C;IAChF,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,oBAAoB,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IAChJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAA8B,CAAC;IAEpI,8EAA8E;IAC9E,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7B,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;YACzB,CAAC,CAAC,YAAoD,EAAE,OAAO,KAAK,IAAI,CAAC,OAAO,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC;IAC1C,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;IAEhC,MAAM,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAEjF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,WAAW,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAChL,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAiC,EAAE;IAC9E,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACnD,OAAO;QACL,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB;oBACE,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,QAAQ,EAAE,OAAO;iBAClB,EACD,IAAI,EACJ,CAAC,CACF;aACF,CAAC;KACH,CAAC;AACJ,CAAC"}
		{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/tools/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAElF,SAAS,UAAU;IACjB,uFAAuF;IACvF,yFAAyF;IACzF,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,aAAa,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,EAAE,CAAC,cAAc,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,qFAAqF;AACrF,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe;IACjD,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,oBAAoB;IACjE,oDAAoD;IACpD,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,UAAU,WAAW,CAAC,KAA8B;IACxD,yDAAyD;IACzD,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;YAE7B,wEAAwE;YACxE,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,qDAAqD;YACrD,MAAM,YAAY,GAA4B,EAAE,CAAC;YACjD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;oBACnE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;YAED,MAAM,gBAAgB,CAAC,OAAO,EAAE;gBAC9B,YAAY,EAAE,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;gBACrF,IAAI,EAAU,OAAO,KAAK,CAAC,IAAI,KAAc,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC,SAAS;gBACvF,MAAM,EAAQ,OAAO,KAAK,CAAC,MAAM,KAAY,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAQ,CAAC,CAAC,EAAE;gBAChF,aAAa,EAAE,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;gBACnF,UAAU,EAAK,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAI,CAAC,CAAE,KAAK,CAAC,UAA0B,CAAC,CAAC,CAAC,EAAE;gBAC1F,QAAQ,EAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAM,CAAC,CAAE,KAAK,CAAC,QAA0B,CAAC,CAAC,CAAC,EAAE;gBAC1F,eAAe,EAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAG,CAAC,CAAE,KAAK,CAAC,eAA8B,CAAC,CAAC,CAAC,EAAE;gBACtG,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,kBAA+B,CAAC,CAAC,CAAC,EAAE;gBACzG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClE,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAA0C;IAChF,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,oBAAoB,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IAChJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAA8B,CAAC;IAEpI,8EAA8E;IAC9E,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7B,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;YACzB,CAAC,CAAC,YAAoD,EAAE,OAAO,KAAK,IAAI,CAAC,OAAO,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC;IAC1C,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;IAEhC,MAAM,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAEjF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,WAAW,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAChL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAiC,EAAE;IAC9E,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACnD,OAAO;QACL,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB;oBACE,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,QAAQ,EAAE,OAAO;iBAClB,EACD,IAAI,EACJ,CAAC,CACF;aACF,CAAC;KACH,CAAC;AACJ,CAAC"}

+1

-1

dist/tools/bypass.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"bypass.d.ts","sourceRoot":"","sources":["../../src/tools/bypass.ts"],"names":[],"mappings":"AAaA,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;;;;;GAiD9E"}
		{"version":3,"file":"bypass.d.ts","sourceRoot":"","sources":["../../src/tools/bypass.ts"],"names":[],"mappings":"AA6BA,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;;;;;GAiD9E"}

+22

-6

dist/tools/bypass.js

		/**
		* log_bypass MCP tool — record an intentional, justified rule bypass.
		* MCP tool: log_bypass
		*
		* Constitutional rules CANNOT be bypassed (Builder B4 — Finding C3).
		* Backed by `src/engine/immutability.ts`. A rejected bypass writes
		* NOTHING to the audit log (per B4 brief test #8) — the entire call
		* fails before audit is touched. This is intentional: a constitutional
		* bypass attempt is a misuse signal, not a logged business event.
		* WHEN TO CALL: only after validate_action has already returned a block
		* for this exact `rule_id`, and you have a specific, human-reviewable
		* reason to proceed anyway. This does NOT change the gate's future verdict
		* for the same action — it only records that the override happened, with
		* the reason attached, for audit purposes. Call it once, immediately
		* before taking the overridden action.
		*
		* RETURNS on success: { logged: true, bypass_id, rule_id }.
		* RETURNS if the rule is constitutional: { error:
		* "CONSTITUTIONAL_RULE_CANNOT_BE_BYPASSED", rule_id, message } —
		* constitutional rules (Builder B4 — Finding C3) can NEVER be bypassed via
		* this tool. A rejected call writes NOTHING to the audit log (per B4 brief
		* test #8) — the entire call fails before audit is touched. This is
		* intentional: a constitutional-bypass attempt is a misuse signal, not a
		* loggable business event.
		* RETURNS if rule_id is unknown: { error: "Rule not found: <id>" }.
		*
		* TIER GATE: none — free tier, evaluated entirely locally against the
		* loaded rule set. No SUNAIVA_GATE_API_KEY required.
		*
		* Backed by `src/engine/immutability.ts`.
		*/
		@@ -10,0 +26,0 @@ import { loadAllRules } from "../engine/rule-engine.js";

+1

-1

dist/tools/bypass.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"bypass.js","sourceRoot":"","sources":["../../src/tools/bypass.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAyC;IAC7E,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC;IAEtD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;iBACnE,CAAC;SACH,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAA4B,EAAE,CAAC;YAChD,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,wCAAwC;4BAC/C,OAAO,EAAE,GAAG,CAAC,OAAO;4BACpB,OAAO,EAAE,wDAAwD;yBAClE,CAAC;qBACH,CAAC;aACH,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;IACF,WAAW,CAAC,KAAK,CAAC,CAAC;IAEnB,OAAO;QACL,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,MAAM,EAAE,IAAI;oBACZ,SAAS,EAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE;oBAC9B,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC;aACH,CAAC;KACH,CAAC;AACJ,CAAC"}
		{"version":3,"file":"bypass.js","sourceRoot":"","sources":["../../src/tools/bypass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAyC;IAC7E,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC;IAEtD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;iBACnE,CAAC;SACH,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAA4B,EAAE,CAAC;YAChD,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,wCAAwC;4BAC/C,OAAO,EAAE,GAAG,CAAC,OAAO;4BACpB,OAAO,EAAE,wDAAwD;yBAClE,CAAC;qBACH,CAAC;aACH,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;IACF,WAAW,CAAC,KAAK,CAAC,CAAC;IAEnB,OAAO;QACL,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,MAAM,EAAE,IAAI;oBACZ,SAAS,EAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE;oBAC9B,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC;aACH,CAAC;KACH,CAAC;AACJ,CAAC"}

+52

-8

dist/tools/custom-rules.d.ts

		@@ -15,4 +15,18 @@ /**
		/**
		* add_custom_rule — POST /v1/rules/custom
		* Adds a new custom detection rule (Pro+).
		* MCP tool: add_custom_rule — POST /v1/rules/custom
		*
		* WHEN TO CALL: to create a detection rule that isn't in the built-in
		* rule set (e.g. a project-specific secret pattern or naming convention).
		* Required: `name`, `severity` (must be exactly "block" \| "warn" \| "log").
		*
		* RETURNS on success: the created CustomRule object (id, name, severity,
		* timestamps, ...).
		* RETURNS on local validation failure (missing name / bad severity): a
		* local { error } object — no backend call is made.
		* RETURNS on backend failure or missing key: { error, skipped: true } —
		* never throws.
		*
		* TIER GATE: Pro+. Requires SUNAIVA_GATE_API_KEY (or legacy
		* SUNAIVA_GATE_API_TOKEN). Without a key, the call still returns
		* 2xx-shaped JSON but with `skipped:true` — no rule is actually created.
		*/
		@@ -28,4 +42,15 @@ export declare function handleAddCustomRule(args: {
		/**
		* update_custom_rule — PUT /v1/rules/custom/:id
		* Updates an existing custom rule (Pro+).
		* MCP tool: update_custom_rule — PUT /v1/rules/custom/:id
		*
		* WHEN TO CALL: to change fields on a custom rule you already created (via
		* add_custom_rule) — e.g. tighten its pattern or bump its severity.
		* Required: `id`. All other fields are optional; only fields you pass are
		* changed (undefined fields are left as-is server-side).
		*
		* RETURNS on success: the updated CustomRule object.
		* RETURNS on local validation failure (missing id): a local { error }.
		* RETURNS on backend failure or missing key: { error, skipped: true }.
		*
		* TIER GATE: Pro+. Requires SUNAIVA_GATE_API_KEY. Without a key the call
		* still returns 2xx-shaped JSON with `skipped:true` — nothing is updated.
		*/
		@@ -42,4 +67,13 @@ export declare function handleUpdateCustomRule(args: {
		/**
		* delete_custom_rule — DELETE /v1/rules/custom/:id
		* Deletes a custom rule (Pro+).
		* MCP tool: delete_custom_rule — DELETE /v1/rules/custom/:id
		*
		* WHEN TO CALL: to permanently remove a custom rule you no longer want
		* enforced. Required: `id`. This is destructive and has no undo.
		*
		* RETURNS on success: { deleted: true }.
		* RETURNS on local validation failure (missing id): a local { error }.
		* RETURNS on backend failure or missing key: { error, skipped: true }.
		*
		* TIER GATE: Pro+. Requires SUNAIVA_GATE_API_KEY. Without a key the call
		* still returns 2xx-shaped JSON with `skipped:true` — nothing is deleted.
		*/
		@@ -50,4 +84,14 @@ export declare function handleDeleteCustomRule(args: {
		/**
		* list_custom_rules — GET /v1/rules/custom
		* Lists all custom rules for the authenticated customer (Pro+).
		* MCP tool: list_custom_rules — GET /v1/rules/custom
		*
		* WHEN TO CALL: to see every custom rule currently defined for this
		* account before adding/updating/deleting one, or to audit what a
		* teammate configured. No arguments.
		*
		* RETURNS: an array of CustomRule on success, or { error, skipped: true }
		* on backend failure/missing key.
		*
		* TIER GATE: Pro+. Requires SUNAIVA_GATE_API_KEY. Without a key the call
		* returns 2xx-shaped JSON with `skipped:true` — no rules are listed (this
		* is distinct from get_rules, which is free-tier and reads local config).
		*/
		@@ -54,0 +98,0 @@ export declare function handleListCustomRules(_args: Record<string, unknown>, client?: BackendClient): Promise<ToolResult>;

+1

-1

dist/tools/custom-rules.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"custom-rules.d.ts","sourceRoot":"","sources":["../../src/tools/custom-rules.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAG5D,KAAK,UAAU,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC;AAQrE;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,EACD,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAuBrB;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE;IACJ,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,EACD,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAmBrB;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,EACrB,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAWrB;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAQrB"}
		{"version":3,"file":"custom-rules.d.ts","sourceRoot":"","sources":["../../src/tools/custom-rules.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAG5D,KAAK,UAAU,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC;AAQrE;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,EACD,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAuBrB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE;IACJ,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,EACD,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAmBrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,EACrB,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAWrB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAQrB"}

+52

-8

dist/tools/custom-rules.js

		@@ -12,4 +12,18 @@ /**
		/**
		* add_custom_rule — POST /v1/rules/custom
		* Adds a new custom detection rule (Pro+).
		* MCP tool: add_custom_rule — POST /v1/rules/custom
		*
		* WHEN TO CALL: to create a detection rule that isn't in the built-in
		* rule set (e.g. a project-specific secret pattern or naming convention).
		* Required: `name`, `severity` (must be exactly "block" \| "warn" \| "log").
		*
		* RETURNS on success: the created CustomRule object (id, name, severity,
		* timestamps, ...).
		* RETURNS on local validation failure (missing name / bad severity): a
		* local { error } object — no backend call is made.
		* RETURNS on backend failure or missing key: { error, skipped: true } —
		* never throws.
		*
		* TIER GATE: Pro+. Requires SUNAIVA_GATE_API_KEY (or legacy
		* SUNAIVA_GATE_API_TOKEN). Without a key, the call still returns
		* 2xx-shaped JSON but with `skipped:true` — no rule is actually created.
		*/
		@@ -42,4 +56,15 @@ export async function handleAddCustomRule(args, client) {
		/**
		* update_custom_rule — PUT /v1/rules/custom/:id
		* Updates an existing custom rule (Pro+).
		* MCP tool: update_custom_rule — PUT /v1/rules/custom/:id
		*
		* WHEN TO CALL: to change fields on a custom rule you already created (via
		* add_custom_rule) — e.g. tighten its pattern or bump its severity.
		* Required: `id`. All other fields are optional; only fields you pass are
		* changed (undefined fields are left as-is server-side).
		*
		* RETURNS on success: the updated CustomRule object.
		* RETURNS on local validation failure (missing id): a local { error }.
		* RETURNS on backend failure or missing key: { error, skipped: true }.
		*
		* TIER GATE: Pro+. Requires SUNAIVA_GATE_API_KEY. Without a key the call
		* still returns 2xx-shaped JSON with `skipped:true` — nothing is updated.
		*/
		@@ -73,4 +98,13 @@ export async function handleUpdateCustomRule(args, client) {
		/**
		* delete_custom_rule — DELETE /v1/rules/custom/:id
		* Deletes a custom rule (Pro+).
		* MCP tool: delete_custom_rule — DELETE /v1/rules/custom/:id
		*
		* WHEN TO CALL: to permanently remove a custom rule you no longer want
		* enforced. Required: `id`. This is destructive and has no undo.
		*
		* RETURNS on success: { deleted: true }.
		* RETURNS on local validation failure (missing id): a local { error }.
		* RETURNS on backend failure or missing key: { error, skipped: true }.
		*
		* TIER GATE: Pro+. Requires SUNAIVA_GATE_API_KEY. Without a key the call
		* still returns 2xx-shaped JSON with `skipped:true` — nothing is deleted.
		*/
		@@ -91,4 +125,14 @@ export async function handleDeleteCustomRule(args, client) {
		/**
		* list_custom_rules — GET /v1/rules/custom
		* Lists all custom rules for the authenticated customer (Pro+).
		* MCP tool: list_custom_rules — GET /v1/rules/custom
		*
		* WHEN TO CALL: to see every custom rule currently defined for this
		* account before adding/updating/deleting one, or to audit what a
		* teammate configured. No arguments.
		*
		* RETURNS: an array of CustomRule on success, or { error, skipped: true }
		* on backend failure/missing key.
		*
		* TIER GATE: Pro+. Requires SUNAIVA_GATE_API_KEY. Without a key the call
		* returns 2xx-shaped JSON with `skipped:true` — no rules are listed (this
		* is distinct from get_rules, which is free-tier and reads local config).
		*/
		@@ -95,0 +139,0 @@ export async function handleListCustomRules(_args, client) {

+1

-1

dist/tools/custom-rules.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"custom-rules.js","sourceRoot":"","sources":["../../src/tools/custom-rules.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAK5D,SAAS,EAAE,CAAC,IAAa;IACvB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9E,CAAC;AAID;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAOC,EACD,MAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,4BAA4B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,GAAkB;QAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAkC;QACjD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;IACF,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC5C,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAQC,EACD,MAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,MAAM,GAAoC,EAAE,CAAC;IACnD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACrD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IAC1E,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9D,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS;QAAE,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAC5F,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAkC,CAAC;IAC3F,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IAErD,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1D,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAqB,EACrB,MAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA8B,EAC9B,MAAsB;IAEtB,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,eAAe,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC"}
		{"version":3,"file":"custom-rules.js","sourceRoot":"","sources":["../../src/tools/custom-rules.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAK5D,SAAS,EAAE,CAAC,IAAa;IACvB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9E,CAAC;AAID;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAOC,EACD,MAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,4BAA4B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,GAAkB;QAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAkC;QACjD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;IACF,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC5C,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAQC,EACD,MAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,MAAM,GAAoC,EAAE,CAAC;IACnD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACrD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IAC1E,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9D,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS;QAAE,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAC5F,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAkC,CAAC;IAC3F,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IAErD,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1D,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAqB,EACrB,MAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA8B,EAC9B,MAAsB;IAEtB,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,eAAe,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC"}

+5

-2

dist/tools/export-attestation.d.ts

		@@ -36,4 +36,7 @@ export interface ExportAttestationArgs {
		/**
		* MCP tool handler — wraps {@link exportAttestation} in the
		* {content:[{type:'text', text}]} response shape.
		* MCP-shaped handler — wraps {@link exportAttestation} in the
		* {content:[{type:'text', text}]} response shape used by other tools in
		* this codebase, but is NOT currently registered as a callable MCP tool
		* (see the file-level STATUS note above). Kept in this shape so wiring it
		* into src/index.ts later is a one-line addition, not a rewrite.
		*/
		@@ -40,0 +43,0 @@ export declare function handleExportAttestation(args: ExportAttestationArgs): Promise<{

+1

-1

dist/tools/export-attestation.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"export-attestation.d.ts","sourceRoot":"","sources":["../../src/tools/export-attestation.ts"],"names":[],"mappings":"AAmCA,MAAM,WAAW,qBAAqB;IACpC,qFAAqF;IACrF,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,uDAAuD;IACvD,EAAE,EAAE,OAAO,CAAC;IACZ,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yBAAyB;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAmFD;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,uBAAuB,CAAC,CA6ClC;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC;IAAE,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,CAAC,CAUxD"}
		{"version":3,"file":"export-attestation.d.ts","sourceRoot":"","sources":["../../src/tools/export-attestation.ts"],"names":[],"mappings":"AA8CA,MAAM,WAAW,qBAAqB;IACpC,qFAAqF;IACrF,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,uDAAuD;IACvD,EAAE,EAAE,OAAO,CAAC;IACZ,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yBAAyB;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAmFD;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,uBAAuB,CAAC,CA6ClC;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC;IAAE,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,CAAC,CAUxD"}

+17

-3

dist/tools/export-attestation.js

		/**
		* MCP tool + CLI handler: export_attestation (W2-B3 / T03).
		* export_attestation — SLSA Provenance v1.0 attestation builder (W2-B3 / T03).
		*
		* STATUS (verified 2026-07-26 — see docs/AGENT_FACE_AUDIT_2026-07-26.md):
		* this module and its handleExportAttestation wrapper are fully
		* implemented, but "export_attestation" is NOT currently registered as an
		* MCP tool in src/index.ts (no import, no case in the CallToolRequestSchema
		* switch, no entry in the ListToolsRequestSchema tools array) and is NOT
		* wired to any CLI flag or `bin` entry point. An agent cannot discover or
		* invoke this capability through the MCP tool list today. Call
		* `exportAttestation()` only via a direct module import from internal
		* tooling — do not describe or advertise it as an MCP tool named
		* "export_attestation" until it is actually registered in src/index.ts.
		*
		* Given a verdict_id (or path to a `.signed.json`), build a SLSA
		@@ -138,4 +149,7 @@ * Provenance v1.0 in-toto Statement, sign with HMAC-SHA256 over the
		/**
		* MCP tool handler — wraps {@link exportAttestation} in the
		* {content:[{type:'text', text}]} response shape.
		* MCP-shaped handler — wraps {@link exportAttestation} in the
		* {content:[{type:'text', text}]} response shape used by other tools in
		* this codebase, but is NOT currently registered as a callable MCP tool
		* (see the file-level STATUS note above). Kept in this shape so wiring it
		* into src/index.ts later is a one-line addition, not a rewrite.
		*/
		@@ -142,0 +156,0 @@ export async function handleExportAttestation(args) {

+1

-1

dist/tools/export-attestation.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"export-attestation.js","sourceRoot":"","sources":["../../src/tools/export-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,iBAAiB,GAElB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAEvE,MAAM,eAAe,GAAG,6BAA6B,CAAC;AAkDtD,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,kBAAkB,CACzB,YAAoB,EACpB,UAAkB;IAElB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,SAAS,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,SAAS,cAAc,CAAC,CAAC;IAC5D,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAkB,CAAC;YACrE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;IACD,+CAA+C;IAC/C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACjD,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAC3B,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAkB,CAAC;gBAChE,IAAI,CAAC,CAAC,UAAU,KAAK,YAAY,IAAI,CAAC,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;oBACpE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;gBACjC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;8EAE8E;AAC9E,SAAS,uBAAuB,CAAC,SAAiB;IAChD,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,mBAAmB,SAAS,EAAE,EAAE,OAAO,CAAC;SAC/C,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,sEAAsE;AACtE,SAAS,iBAAiB,CAAC,GAAsB;IAC/C,KAAK,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,oBAAoB,CAAU,EAAE,CAAC;QAChE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,UAAU,CAAC,mBAAmB,CAAC;QAAE,OAAO,mBAAmB,CAAC;IAChE,IAAI,UAAU,CAAC,uBAAuB,CAAC;QAAE,OAAO,uBAAuB,CAAC;IACxE,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,UAAU,GACd,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,0BAA0B,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,yBAAyB,IAAI,CAAC,UAAU,QAAQ,UAAU,EAAE;SACrE,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,eAAe,4CAA4C;YACtE,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG;QACf,IAAI,EAAE,IAAI,CAAC,aAAa,IAAK,OAAO,CAAC,WAAsB;QAC3D,MAAM,EAAE,CACN,IAAI,CAAC,eAAe;YACpB,uBAAuB,CAAC,OAAO,CAAC,UAAoB,CAAC,CACtD,CAAC,WAAW,EAAE;KAChB,CAAC;IACF,MAAM,SAAS,GAAG,oBAAoB,CAAC,OAAuC,EAAE,QAAQ,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,wBAAwB,CAAC;IACrD,MAAM,YAAY,GAAG,eAAe,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAClE,IAAI,UAA8B,CAAC;IACnC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACvC,aAAa,CAAC,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,WAAW,EAAE,UAAU;QACvB,cAAc,EAAE,YAAY;QAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;aACtC;SACF;KACF,CAAC;AACJ,CAAC"}
		{"version":3,"file":"export-attestation.js","sourceRoot":"","sources":["../../src/tools/export-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,iBAAiB,GAElB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAEvE,MAAM,eAAe,GAAG,6BAA6B,CAAC;AAkDtD,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,kBAAkB,CACzB,YAAoB,EACpB,UAAkB;IAElB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,SAAS,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,SAAS,cAAc,CAAC,CAAC;IAC5D,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAkB,CAAC;YACrE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;IACD,+CAA+C;IAC/C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACjD,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAC3B,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAkB,CAAC;gBAChE,IAAI,CAAC,CAAC,UAAU,KAAK,YAAY,IAAI,CAAC,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;oBACpE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;gBACjC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;8EAE8E;AAC9E,SAAS,uBAAuB,CAAC,SAAiB;IAChD,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,mBAAmB,SAAS,EAAE,EAAE,OAAO,CAAC;SAC/C,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,sEAAsE;AACtE,SAAS,iBAAiB,CAAC,GAAsB;IAC/C,KAAK,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,oBAAoB,CAAU,EAAE,CAAC;QAChE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,UAAU,CAAC,mBAAmB,CAAC;QAAE,OAAO,mBAAmB,CAAC;IAChE,IAAI,UAAU,CAAC,uBAAuB,CAAC;QAAE,OAAO,uBAAuB,CAAC;IACxE,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,UAAU,GACd,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,0BAA0B,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,yBAAyB,IAAI,CAAC,UAAU,QAAQ,UAAU,EAAE;SACrE,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,eAAe,4CAA4C;YACtE,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG;QACf,IAAI,EAAE,IAAI,CAAC,aAAa,IAAK,OAAO,CAAC,WAAsB;QAC3D,MAAM,EAAE,CACN,IAAI,CAAC,eAAe;YACpB,uBAAuB,CAAC,OAAO,CAAC,UAAoB,CAAC,CACtD,CAAC,WAAW,EAAE;KAChB,CAAC;IACF,MAAM,SAAS,GAAG,oBAAoB,CAAC,OAAuC,EAAE,QAAQ,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,wBAAwB,CAAC;IACrD,MAAM,YAAY,GAAG,eAAe,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAClE,IAAI,UAA8B,CAAC;IACnC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACvC,aAAa,CAAC,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,WAAW,EAAE,UAAU;QACvB,cAAc,EAAE,YAAY;QAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;aACtC;SACF;KACF,CAAC;AACJ,CAAC"}

+37

-6

dist/tools/modes.d.ts

		@@ -15,4 +15,17 @@ /**
		/**
		* set_rule_mode — PUT /v1/rules/modes
		* Sets enforcement mode for a specific rule (Pro+).
		* MCP tool: set_rule_mode — PUT /v1/rules/modes
		*
		* WHEN TO CALL: to change how strictly one specific rule is enforced —
		* e.g. roll a new rule out in "shadow" (log-only, nothing blocked) before
		* promoting it to "enforce". Required: `rule_id`, `mode` (must be exactly
		* "shadow" \| "advisory" \| "enforce"). Optional `agent_id` scopes the
		* override to a single calling agent instead of the whole account.
		*
		* RETURNS on success: the created/updated ModeRecord.
		* RETURNS on local validation failure (missing/invalid args): a local
		* { error } object — no backend call is made.
		* RETURNS on backend failure or missing key: { error, skipped: true }.
		*
		* TIER GATE: Pro+. Requires SUNAIVA_GATE_API_KEY. Without a key the call
		* still returns 2xx-shaped JSON with `skipped:true` — no mode is changed.
		*/
		@@ -25,9 +38,27 @@ export declare function handleSetRuleMode(args: {
		/**
		* get_rule_modes — GET /v1/rules/modes
		* Lists all mode overrides for the authenticated customer.
		* MCP tool: get_rule_modes — GET /v1/rules/modes
		*
		* WHEN TO CALL: to see every rule-level enforcement override currently in
		* effect for this account — which rules are shadow/advisory/enforce, and,
		* where set, which agent_id they're scoped to. No arguments.
		*
		* RETURNS: an array of ModeRecord on success, or { error, skipped: true }
		* on backend failure/missing key.
		*
		* TIER GATE: Pro+. Requires SUNAIVA_GATE_API_KEY. Without a key the call
		* returns 2xx-shaped JSON with `skipped:true` — no modes are listed.
		*/
		export declare function handleGetRuleModes(_args: Record<string, unknown>, client?: BackendClient): Promise<ToolResult>;
		/**
		* reset_rule_mode — DELETE /v1/rules/modes/:rule_id
		* Removes a mode override for a specific rule, reverting to default.
		* MCP tool: reset_rule_mode — DELETE /v1/rules/modes/:rule_id
		*
		* WHEN TO CALL: to remove a previously-set mode override for one rule and
		* revert it to its default enforcement mode. Required: `rule_id`.
		*
		* RETURNS on success: { deleted: true }.
		* RETURNS on local validation failure (missing rule_id): a local { error }.
		* RETURNS on backend failure or missing key: { error, skipped: true }.
		*
		* TIER GATE: Pro+. Requires SUNAIVA_GATE_API_KEY. Without a key the call
		* still returns 2xx-shaped JSON with `skipped:true` — nothing is reset.
		*/
		@@ -34,0 +65,0 @@ export declare function handleResetRuleMode(args: {

+1

-1

dist/tools/modes.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"modes.d.ts","sourceRoot":"","sources":["../../src/tools/modes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAG5D,KAAK,UAAU,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC;AAMrE;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5D,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAmBrB;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,EAC1B,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAWrB"}
		{"version":3,"file":"modes.d.ts","sourceRoot":"","sources":["../../src/tools/modes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAG5D,KAAK,UAAU,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC;AAMrE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5D,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAmBrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,EAC1B,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAWrB"}

+37

-6

dist/tools/modes.js

		@@ -12,4 +12,17 @@ /**
		/**
		* set_rule_mode — PUT /v1/rules/modes
		* Sets enforcement mode for a specific rule (Pro+).
		* MCP tool: set_rule_mode — PUT /v1/rules/modes
		*
		* WHEN TO CALL: to change how strictly one specific rule is enforced —
		* e.g. roll a new rule out in "shadow" (log-only, nothing blocked) before
		* promoting it to "enforce". Required: `rule_id`, `mode` (must be exactly
		* "shadow" \| "advisory" \| "enforce"). Optional `agent_id` scopes the
		* override to a single calling agent instead of the whole account.
		*
		* RETURNS on success: the created/updated ModeRecord.
		* RETURNS on local validation failure (missing/invalid args): a local
		* { error } object — no backend call is made.
		* RETURNS on backend failure or missing key: { error, skipped: true }.
		*
		* TIER GATE: Pro+. Requires SUNAIVA_GATE_API_KEY. Without a key the call
		* still returns 2xx-shaped JSON with `skipped:true` — no mode is changed.
		*/
		@@ -34,4 +47,13 @@ export async function handleSetRuleMode(args, client) {
		/**
		* get_rule_modes — GET /v1/rules/modes
		* Lists all mode overrides for the authenticated customer.
		* MCP tool: get_rule_modes — GET /v1/rules/modes
		*
		* WHEN TO CALL: to see every rule-level enforcement override currently in
		* effect for this account — which rules are shadow/advisory/enforce, and,
		* where set, which agent_id they're scoped to. No arguments.
		*
		* RETURNS: an array of ModeRecord on success, or { error, skipped: true }
		* on backend failure/missing key.
		*
		* TIER GATE: Pro+. Requires SUNAIVA_GATE_API_KEY. Without a key the call
		* returns 2xx-shaped JSON with `skipped:true` — no modes are listed.
		*/
		@@ -49,4 +71,13 @@ export async function handleGetRuleModes(_args, client) {
		/**
		* reset_rule_mode — DELETE /v1/rules/modes/:rule_id
		* Removes a mode override for a specific rule, reverting to default.
		* MCP tool: reset_rule_mode — DELETE /v1/rules/modes/:rule_id
		*
		* WHEN TO CALL: to remove a previously-set mode override for one rule and
		* revert it to its default enforcement mode. Required: `rule_id`.
		*
		* RETURNS on success: { deleted: true }.
		* RETURNS on local validation failure (missing rule_id): a local { error }.
		* RETURNS on backend failure or missing key: { error, skipped: true }.
		*
		* TIER GATE: Pro+. Requires SUNAIVA_GATE_API_KEY. Without a key the call
		* still returns 2xx-shaped JSON with `skipped:true` — nothing is reset.
		*/
		@@ -53,0 +84,0 @@ export async function handleResetRuleMode(args, client) {

+1

-1

dist/tools/modes.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"modes.js","sourceRoot":"","sources":["../../src/tools/modes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAK5D,SAAS,EAAE,CAAC,IAAa;IACvB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAA4D,EAC5D,MAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,UAAU,GAA8B,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAChF,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAA0B,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,wBAAwB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC7B,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,IAA0B,EAC/B,IAAI,CAAC,QAAQ,CACd,CAAC;QACF,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAA8B,EAC9B,MAAsB;IAEtB,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA0B,EAC1B,MAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC"}
		{"version":3,"file":"modes.js","sourceRoot":"","sources":["../../src/tools/modes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAK5D,SAAS,EAAE,CAAC,IAAa;IACvB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAA4D,EAC5D,MAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,UAAU,GAA8B,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAChF,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAA0B,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,wBAAwB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC7B,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,IAA0B,EAC/B,IAAI,CAAC,QAAQ,CACd,CAAC;QACF,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAA8B,EAC9B,MAAsB;IAEtB,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA0B,EAC1B,MAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC"}

+26

-4

dist/tools/presets.d.ts

		@@ -15,9 +15,31 @@ /**
		/**
		* list_presets — GET /v1/rules/presets
		* Lists available rule preset bundles (Dev+).
		* MCP tool: list_presets — GET /v1/rules/presets
		*
		* WHEN TO CALL: to see which bundled rule-preset packs are available
		* before choosing one to apply. No arguments.
		*
		* RETURNS: an array of PresetBundle on success, or { error, skipped: true }
		* on backend failure/missing key — this call still hits the backend even
		* though browsing is a lower tier than applying.
		*
		* TIER GATE: Dev+. Requires SUNAIVA_GATE_API_KEY. Without a key the call
		* returns 2xx-shaped JSON with `skipped:true` — no presets are listed.
		*/
		export declare function handleListPresets(_args: Record<string, unknown>, client?: BackendClient): Promise<ToolResult>;
		/**
		* apply_preset — POST /v1/rules/presets/:id/apply
		* Applies a preset bundle, setting all included rule IDs to enforce mode (Pro+).
		* MCP tool: apply_preset — POST /v1/rules/presets/:id/apply
		*
		* WHEN TO CALL: once you know which preset id you want (from list_presets)
		* and want to activate every rule in that bundle at enforce mode in one
		* call, instead of enabling each rule id individually via update_rules.
		* Required: `preset_id`.
		*
		* RETURNS on success: { applied: true, preset_id }.
		* RETURNS on local validation failure (missing preset_id): a local
		* { error } object — no backend call is made.
		* RETURNS on backend failure or missing key: { error, skipped: true }.
		*
		* TIER GATE: Pro+ (stricter than list_presets' Dev+ — you can browse the
		* catalog on a Dev key but need Pro+ to actually apply a bundle). Requires
		* SUNAIVA_GATE_API_KEY.
		*/
		@@ -24,0 +46,0 @@ export declare function handleApplyPreset(args: {

+1

-1

dist/tools/presets.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"presets.d.ts","sourceRoot":"","sources":["../../src/tools/presets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,KAAK,UAAU,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC;AAMrE;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5B,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAWrB"}
		{"version":3,"file":"presets.d.ts","sourceRoot":"","sources":["../../src/tools/presets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,KAAK,UAAU,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC;AAMrE;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5B,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAWrB"}

+26

-4

dist/tools/presets.js

		@@ -12,4 +12,13 @@ /**
		/**
		* list_presets — GET /v1/rules/presets
		* Lists available rule preset bundles (Dev+).
		* MCP tool: list_presets — GET /v1/rules/presets
		*
		* WHEN TO CALL: to see which bundled rule-preset packs are available
		* before choosing one to apply. No arguments.
		*
		* RETURNS: an array of PresetBundle on success, or { error, skipped: true }
		* on backend failure/missing key — this call still hits the backend even
		* though browsing is a lower tier than applying.
		*
		* TIER GATE: Dev+. Requires SUNAIVA_GATE_API_KEY. Without a key the call
		* returns 2xx-shaped JSON with `skipped:true` — no presets are listed.
		*/
		@@ -27,4 +36,17 @@ export async function handleListPresets(_args, client) {
		/**
		* apply_preset — POST /v1/rules/presets/:id/apply
		* Applies a preset bundle, setting all included rule IDs to enforce mode (Pro+).
		* MCP tool: apply_preset — POST /v1/rules/presets/:id/apply
		*
		* WHEN TO CALL: once you know which preset id you want (from list_presets)
		* and want to activate every rule in that bundle at enforce mode in one
		* call, instead of enabling each rule id individually via update_rules.
		* Required: `preset_id`.
		*
		* RETURNS on success: { applied: true, preset_id }.
		* RETURNS on local validation failure (missing preset_id): a local
		* { error } object — no backend call is made.
		* RETURNS on backend failure or missing key: { error, skipped: true }.
		*
		* TIER GATE: Pro+ (stricter than list_presets' Dev+ — you can browse the
		* catalog on a Dev key but need Pro+ to actually apply a bundle). Requires
		* SUNAIVA_GATE_API_KEY.
		*/
		@@ -31,0 +53,0 @@ export async function handleApplyPreset(args, client) {

+1

-1

dist/tools/presets.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"presets.js","sourceRoot":"","sources":["../../src/tools/presets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAI5D,SAAS,EAAE,CAAC,IAAa;IACvB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA8B,EAC9B,MAAsB;IAEtB,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC;QACtC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAA4B,EAC5B,MAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC"}
		{"version":3,"file":"presets.js","sourceRoot":"","sources":["../../src/tools/presets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAI5D,SAAS,EAAE,CAAC,IAAa;IACvB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA8B,EAC9B,MAAsB;IAEtB,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC;QACtC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAA4B,EAC5B,MAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC"}

+17

-0

dist/tools/rules.d.ts

		@@ -0,1 +1,18 @@
		/**
		* MCP tool: get_rules
		*
		* WHEN TO CALL: to list which validation rules are currently active for
		* this install — e.g. before calling validate_action, to know what will
		* be checked, or to confirm a preset/category was applied. Optional
		* filters: `category` (e.g. "security") and `preset` (a preset id, see
		* list_presets).
		*
		* RETURNS: { rules: [{ id, name, category, enforcement, severity }, ...],
		* total }. Only rules present in the local active_rules config are
		* returned — this does NOT call the backend and will NOT reveal Pro+-only
		* custom rules stored server-side (use list_custom_rules for those).
		*
		* TIER GATE: none — free tier, reads local config + bundled rules.json
		* only. No SUNAIVA_GATE_API_KEY required.
		*/
		export declare function handleGetRules(args: {
		@@ -2,0 +19,0 @@ category?: string;

+1

-1

dist/tools/rules.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/tools/rules.ts"],"names":[],"mappings":"AAQA,wBAAsB,cAAc,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;GAsBhF"}
		{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/tools/rules.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;GAsBhF"}

+17

-0

dist/tools/rules.js

		@@ -7,2 +7,19 @@ import { loadAllRules } from "../engine/rule-engine.js";
		const __dirname = dirname(fileURLToPath(import.meta.url));
		/**
		* MCP tool: get_rules
		*
		* WHEN TO CALL: to list which validation rules are currently active for
		* this install — e.g. before calling validate_action, to know what will
		* be checked, or to confirm a preset/category was applied. Optional
		* filters: `category` (e.g. "security") and `preset` (a preset id, see
		* list_presets).
		*
		* RETURNS: { rules: [{ id, name, category, enforcement, severity }, ...],
		* total }. Only rules present in the local active_rules config are
		* returned — this does NOT call the backend and will NOT reveal Pro+-only
		* custom rules stored server-side (use list_custom_rules for those).
		*
		* TIER GATE: none — free tier, reads local config + bundled rules.json
		* only. No SUNAIVA_GATE_API_KEY required.
		*/
		export async function handleGetRules(args) {
		@@ -9,0 +26,0 @@ const cfg = getConfig();

+1

-1

dist/tools/rules.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/tools/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAA4C;IAC/E,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAExE,IAAI,IAAI,CAAC,QAAQ;QAAE,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,0BAA0B,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YAC/F,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAqC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7F,IAAI,MAAM;gBAAE,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAC3H,KAAK,EAAE,KAAK,CAAC,MAAM;iBACpB,EAAE,IAAI,EAAE,CAAC,CAAC;aACZ,CAAC;KACH,CAAC;AACJ,CAAC"}
		{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/tools/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAA4C;IAC/E,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAExE,IAAI,IAAI,CAAC,QAAQ;QAAE,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,0BAA0B,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YAC/F,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAqC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7F,IAAI,MAAM;gBAAE,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAC3H,KAAK,EAAE,KAAK,CAAC,MAAM;iBACpB,EAAE,IAAI,EAAE,CAAC,CAAC;aACZ,CAAC;KACH,CAAC;AACJ,CAAC"}

+18

-2

dist/tools/ship-confidence.d.ts

		/**
		* MCP tool: ship_confidence_check
		*
		* Invokes the ShipConfidenceGate for a given artifact_id and returns a
		* structured result. The audit ledger is written by the gate itself.
		* WHEN TO CALL: before any publish-class action — npm/PyPI publish, a push
		* to a production/deploy-tracked branch, public-repo creation, or a prod
		* deploy. Call it with the exact `artifact_id` you are about to ship BEFORE
		* running the shipping command — this is the authorization check, not a
		* post-hoc log.
		*
		* RETURNS: { allowed, decision: "allow"\|"block", tier: "paid"\|"free"\|null,
		* reason, evidence, verdict_id, level, signed_at, age_minutes,
		* would_have_been, bypassed, stamp, hook_name, hook_version, rule_name,
		* rule_version }. `allowed`/`decision` is the authorization result;
		* `tier` tells you which path produced it.
		*
		* TIER GATE: none on the call itself — any caller may invoke this tool.
		* The result differs by what exists on disk: a fresh signed verdict file
		* (default max-age 60 min) yields tier="paid"; otherwise it falls back to
		* a fresh (<1h) approval-token file and yields tier="free"; if neither
		* exists, decision is "block". There is no paywall on the check itself —
		* only on how the underlying verdict/token was produced.
		*/
		@@ -7,0 +23,0 @@ export declare function handleShipConfidenceCheck(args: {

+1

-1

dist/tools/ship-confidence.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"ship-confidence.d.ts","sourceRoot":"","sources":["../../src/tools/ship-confidence.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,wBAAsB,yBAAyB,CAAC,IAAI,EAAE;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,CAAC,CAmCzD"}
		{"version":3,"file":"ship-confidence.d.ts","sourceRoot":"","sources":["../../src/tools/ship-confidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,wBAAsB,yBAAyB,CAAC,IAAI,EAAE;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,CAAC,CAmCzD"}

+18

-2

dist/tools/ship-confidence.js

		/**
		* MCP tool: ship_confidence_check
		*
		* Invokes the ShipConfidenceGate for a given artifact_id and returns a
		* structured result. The audit ledger is written by the gate itself.
		* WHEN TO CALL: before any publish-class action — npm/PyPI publish, a push
		* to a production/deploy-tracked branch, public-repo creation, or a prod
		* deploy. Call it with the exact `artifact_id` you are about to ship BEFORE
		* running the shipping command — this is the authorization check, not a
		* post-hoc log.
		*
		* RETURNS: { allowed, decision: "allow"\|"block", tier: "paid"\|"free"\|null,
		* reason, evidence, verdict_id, level, signed_at, age_minutes,
		* would_have_been, bypassed, stamp, hook_name, hook_version, rule_name,
		* rule_version }. `allowed`/`decision` is the authorization result;
		* `tier` tells you which path produced it.
		*
		* TIER GATE: none on the call itself — any caller may invoke this tool.
		* The result differs by what exists on disk: a fresh signed verdict file
		* (default max-age 60 min) yields tier="paid"; otherwise it falls back to
		* a fresh (<1h) approval-token file and yields tier="free"; if neither
		* exists, decision is "block". There is no paywall on the check itself —
		* only on how the underlying verdict/token was produced.
		*/
		@@ -7,0 +23,0 @@ import { ShipConfidenceGate } from "../engine/ship-confidence-gate.js";

+1

-1

dist/tools/ship-confidence.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"ship-confidence.js","sourceRoot":"","sources":["../../src/tools/ship-confidence.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAEvE,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAI/C;IACC,oEAAoE;IACpE,MAAM,IAAI,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE;QAChD,cAAc,EAAE,IAAI,CAAC,eAAe;QACpC,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG;QACnB,OAAO,EAAE,MAAM,CAAC,QAAQ,KAAK,OAAO;QACpC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,KAAK;QAClC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;QACjC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY;QACvC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;QACjC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY;KACxC,CAAC;IAEF,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;aAC5C;SACF;KACF,CAAC;AACJ,CAAC"}
		{"version":3,"file":"ship-confidence.js","sourceRoot":"","sources":["../../src/tools/ship-confidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAEvE,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAI/C;IACC,oEAAoE;IACpE,MAAM,IAAI,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE;QAChD,cAAc,EAAE,IAAI,CAAC,eAAe;QACpC,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG;QACnB,OAAO,EAAE,MAAM,CAAC,QAAQ,KAAK,OAAO;QACpC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,KAAK;QAClC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;QACjC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY;QACvC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;QACjC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY;KACxC,CAAC;IAEF,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;aAC5C;SACF;KACF,CAAC;AACJ,CAAC"}

+19

-0

dist/tools/update.d.ts

		@@ -0,1 +1,20 @@
		/**
		* MCP tool: update_rules
		*
		* WHEN TO CALL: to turn specific rules on/off for this install — e.g. to
		* silence a noisy rule id, or re-enable one you disabled earlier. Pass
		* `enable` and/or `disable` as arrays of rule ids; at least one should be
		* given for the call to do anything.
		*
		* RETURNS on success: { updated: true, active_count }.
		* RETURNS if any `disable` target is constitutional: the WHOLE call is
		* rejected atomically (no partial commits) with
		* { error: "CONSTITUTIONAL_RULE_IMMUTABLE", rule_ids, message } — mixing
		* a constitutional id in with normal ids blocks the entire batch, not
		* just the constitutional one.
		*
		* TIER GATE: none — free tier, local config only. Constitutional rules
		* (Builder B4 — Finding C2) can NEVER be disabled via this tool
		* regardless of tier or key.
		*/
		export declare function handleUpdateRules(args: {
		@@ -2,0 +21,0 @@ enable?: string[];

+1

-1

dist/tools/update.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/tools/update.ts"],"names":[],"mappings":"AAgBA,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE;;;;;GA2CtF"}
		{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/tools/update.ts"],"names":[],"mappings":"AAgBA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE;;;;;GA2CtF"}

+19

-0

dist/tools/update.js

		@@ -16,2 +16,21 @@ /**
		import { assertCanDisable, ConstitutionalImmutableError } from "../engine/immutability.js";
		/**
		* MCP tool: update_rules
		*
		* WHEN TO CALL: to turn specific rules on/off for this install — e.g. to
		* silence a noisy rule id, or re-enable one you disabled earlier. Pass
		* `enable` and/or `disable` as arrays of rule ids; at least one should be
		* given for the call to do anything.
		*
		* RETURNS on success: { updated: true, active_count }.
		* RETURNS if any `disable` target is constitutional: the WHOLE call is
		* rejected atomically (no partial commits) with
		* { error: "CONSTITUTIONAL_RULE_IMMUTABLE", rule_ids, message } — mixing
		* a constitutional id in with normal ids blocks the entire batch, not
		* just the constitutional one.
		*
		* TIER GATE: none — free tier, local config only. Constitutional rules
		* (Builder B4 — Finding C2) can NEVER be disabled via this tool
		* regardless of tier or key.
		*/
		export async function handleUpdateRules(args) {
		@@ -18,0 +37,0 @@ const blocked = [];

+1

-1

dist/tools/update.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"update.js","sourceRoot":"","sources":["../../src/tools/update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAE3F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAA+C;IACrF,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACvB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,4BAA4B,EAAE,CAAC;oBAChD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5B,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,KAAK,EAAE,+BAA+B;wBACtC,QAAQ,EAAE,OAAO;wBACjB,OAAO,EAAE,0DAA0D;qBACpE,CAAC;iBACH,CAAC;SACH,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM;QAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,IAAI,IAAI,CAAC,OAAO;QAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAClE,GAAG,CAAC,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IAC/B,UAAU,CAAC,GAAG,CAAC,CAAC;IAEhB,OAAO;QACL,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;aAC/E,CAAC;KACH,CAAC;AACJ,CAAC"}
		{"version":3,"file":"update.js","sourceRoot":"","sources":["../../src/tools/update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAE3F;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAA+C;IACrF,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACvB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,4BAA4B,EAAE,CAAC;oBAChD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5B,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,KAAK,EAAE,+BAA+B;wBACtC,QAAQ,EAAE,OAAO;wBACjB,OAAO,EAAE,0DAA0D;qBACpE,CAAC;iBACH,CAAC;SACH,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM;QAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,IAAI,IAAI,CAAC,OAAO;QAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAClE,GAAG,CAAC,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IAC/B,UAAU,CAAC,GAAG,CAAC,CAAC;IAEhB,OAAO;QACL,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;aAC/E,CAAC;KACH,CAAC;AACJ,CAAC"}

+27

-0

dist/tools/validate.d.ts

		@@ -0,1 +1,28 @@
		/**
		* MCP tool: validate_action
		*
		* WHEN TO CALL: before executing any action you're not certain is safe —
		* a shell command, a file write, an API call — pass its text as `action`
		* (plus optional free-form `context`). Call it BEFORE the action runs,
		* not after: this is a pre-flight check, not a logger. In practice this
		* is the tool a hook/bridge calls on every intercepted tool-use.
		*
		* RETURNS: { allowed, gate_version, hook_name, severity_tier, dry_run,
		* would_have_blocked, skipped_premium, message, rule_violations, warnings }.
		* `allowed:false` means a rule matched at "block" severity — do not
		* proceed with the action. `warnings` matched but did not block (a repeat
		* warning-tier match on the same rule escalates to block later in the
		* session).
		*
		* TIER GATE: mixed, and this is the one callers most often miss. Local,
		* non-premium rules always run for free with no key. Rules flagged
		* `backend_required` (premium) are NOT evaluated at all when no
		* SUNAIVA_GATE_API_KEY / SUNAIVA_GATE_API_TOKEN is set — they are silently
		* listed in the response's `skipped_premium` array instead of being
		* checked. `allowed:true` therefore does NOT guarantee every configured
		* rule ran; check `skipped_premium` if you need to know whether a
		* premium rule you expected to fire was actually skipped for lack of a
		* key, rather than discovering the gap after the fact.
		* DISABLE_SUNAIVA_GATE=1 short-circuits everything to allowed:true.
		*/
		export declare function handleValidateAction(args: {
		@@ -2,0 +29,0 @@ action: string;

+1

-1

dist/tools/validate.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/tools/validate.ts"],"names":[],"mappings":"AA0BA,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;;;;;GA2GA"}
		{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/tools/validate.ts"],"names":[],"mappings":"AA0BA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;;;;;GA2GA"}

+27

-0

dist/tools/validate.js

		@@ -25,2 +25,29 @@ import { readFileSync } from "fs";
		const HOOK_NAME = "sunaiva-gate";
		/**
		* MCP tool: validate_action
		*
		* WHEN TO CALL: before executing any action you're not certain is safe —
		* a shell command, a file write, an API call — pass its text as `action`
		* (plus optional free-form `context`). Call it BEFORE the action runs,
		* not after: this is a pre-flight check, not a logger. In practice this
		* is the tool a hook/bridge calls on every intercepted tool-use.
		*
		* RETURNS: { allowed, gate_version, hook_name, severity_tier, dry_run,
		* would_have_blocked, skipped_premium, message, rule_violations, warnings }.
		* `allowed:false` means a rule matched at "block" severity — do not
		* proceed with the action. `warnings` matched but did not block (a repeat
		* warning-tier match on the same rule escalates to block later in the
		* session).
		*
		* TIER GATE: mixed, and this is the one callers most often miss. Local,
		* non-premium rules always run for free with no key. Rules flagged
		* `backend_required` (premium) are NOT evaluated at all when no
		* SUNAIVA_GATE_API_KEY / SUNAIVA_GATE_API_TOKEN is set — they are silently
		* listed in the response's `skipped_premium` array instead of being
		* checked. `allowed:true` therefore does NOT guarantee every configured
		* rule ran; check `skipped_premium` if you need to know whether a
		* premium rule you expected to fire was actually skipped for lack of a
		* key, rather than discovering the gap after the fact.
		* DISABLE_SUNAIVA_GATE=1 short-circuits everything to allowed:true.
		*/
		export async function handleValidateAction(args) {
		@@ -27,0 +54,0 @@ // Kill-switch: short-circuit everything if disabled.

+1

-1

dist/tools/validate.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/tools/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACtH,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,wEAAwE;AACxE,uEAAuE;AACvE,+EAA+E;AAC/E,SAAS,mBAAmB;IAC1B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,OAAO,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACpD,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;AAC1C,MAAM,SAAS,GAAG,cAAc,CAAC;AAEjC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAa1C;IACC,qDAAqD;IACrD,iFAAiF;IACjF,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,EAAE,CAAC;QAC7C,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,OAAO,EAAE,IAAI;wBACb,YAAY,EAAE,WAAW;wBACzB,SAAS,EAAE,SAAS;wBACpB,QAAQ,EAAE,IAAI;wBACd,OAAO,EAAE,IAAI,SAAS,KAAK,WAAW,kEAAkE;qBACzG,EAAE,IAAI,EAAE,CAAC,CAAC;iBACZ,CAAC;SACH,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,eAAe,EAAE,CAAC;IAClB,sBAAsB,EAAE,CAAC;IAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC;IACxD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAElC,qEAAqE;IACrE,+DAA+D;IAC/D,mEAAmE;IACnE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAEjF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;QAAE,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAErD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IACnD,MAAM,KAAK,GAAG;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,YAAY,EAAE,WAAW;QACzB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ;QAC/C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QACjC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;KAC9C,CAAC;IACF,WAAW,CAAC,KAAK,CAAC,CAAC;IAEnB,sEAAsE;IACtE,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAEpD,mEAAmE;IACnE,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,mEAAmE;IACnE,EAAE;IACF,8DAA8D;IAC9D,+DAA+D;IAC/D,8EAA8E;IAC9E,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,OAAO;QACjC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;QAChC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC1B,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,OAAO,CAAC;IACd,KAAK,qBAAqB,CAAC;QACzB,IAAI,EAAE,IAAI,CAAC,SAAS;QACpB,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI;QACnE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;QACnC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,MAAM,EAAE,IAAI,EAAE,yDAAyD;KACxE,CAAC,CAAC;IAEH,+DAA+D;IAC/D,uEAAuE;IACvE,8EAA8E;IAC9E,IAAI,KAAK,GAAG,IAAI,SAAS,KAAK,WAAW,GAAG,CAAC;IAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpF,KAAK,IAAI,eAAe,cAAc,EAAE,CAAC;IAC3C,CAAC;SAAM,IAAI,MAAM,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,KAAK,IAAI,kCAAkC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACpF,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7E,KAAK,IAAI,SAAS,SAAS,0BAA0B,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,KAAK,IAAI,QAAQ,CAAC;IACpB,CAAC;IAED,OAAO;QACL,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,OAAO,EAAE,YAAY;oBACrB,YAAY,EAAE,WAAW;oBACzB,SAAS,EAAE,SAAS;oBACpB,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,OAAO,EAAE,MAAM;oBACf,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;oBAC7C,eAAe,EAAE,MAAM,CAAC,eAAe;oBACvC,OAAO,EAAE,KAAK;oBACd,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAC/F,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;iBACjE,EAAE,IAAI,EAAE,CAAC,CAAC;aACZ,CAAC;KACH,CAAC;AACJ,CAAC"}
		{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/tools/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACtH,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,wEAAwE;AACxE,uEAAuE;AACvE,+EAA+E;AAC/E,SAAS,mBAAmB;IAC1B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,OAAO,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACpD,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;AAC1C,MAAM,SAAS,GAAG,cAAc,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAa1C;IACC,qDAAqD;IACrD,iFAAiF;IACjF,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,EAAE,CAAC;QAC7C,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,OAAO,EAAE,IAAI;wBACb,YAAY,EAAE,WAAW;wBACzB,SAAS,EAAE,SAAS;wBACpB,QAAQ,EAAE,IAAI;wBACd,OAAO,EAAE,IAAI,SAAS,KAAK,WAAW,kEAAkE;qBACzG,EAAE,IAAI,EAAE,CAAC,CAAC;iBACZ,CAAC;SACH,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,eAAe,EAAE,CAAC;IAClB,sBAAsB,EAAE,CAAC;IAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC;IACxD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAElC,qEAAqE;IACrE,+DAA+D;IAC/D,mEAAmE;IACnE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAEjF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;QAAE,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAErD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IACnD,MAAM,KAAK,GAAG;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,YAAY,EAAE,WAAW;QACzB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ;QAC/C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QACjC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;KAC9C,CAAC;IACF,WAAW,CAAC,KAAK,CAAC,CAAC;IAEnB,sEAAsE;IACtE,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAEpD,mEAAmE;IACnE,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,mEAAmE;IACnE,EAAE;IACF,8DAA8D;IAC9D,+DAA+D;IAC/D,8EAA8E;IAC9E,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,OAAO;QACjC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;QAChC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC1B,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,OAAO,CAAC;IACd,KAAK,qBAAqB,CAAC;QACzB,IAAI,EAAE,IAAI,CAAC,SAAS;QACpB,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI;QACnE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;QACnC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,MAAM,EAAE,IAAI,EAAE,yDAAyD;KACxE,CAAC,CAAC;IAEH,+DAA+D;IAC/D,uEAAuE;IACvE,8EAA8E;IAC9E,IAAI,KAAK,GAAG,IAAI,SAAS,KAAK,WAAW,GAAG,CAAC;IAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpF,KAAK,IAAI,eAAe,cAAc,EAAE,CAAC;IAC3C,CAAC;SAAM,IAAI,MAAM,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,KAAK,IAAI,kCAAkC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACpF,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7E,KAAK,IAAI,SAAS,SAAS,0BAA0B,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,KAAK,IAAI,QAAQ,CAAC;IACpB,CAAC;IAED,OAAO;QACL,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,OAAO,EAAE,YAAY;oBACrB,YAAY,EAAE,WAAW;oBACzB,SAAS,EAAE,SAAS;oBACpB,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,OAAO,EAAE,MAAM;oBACf,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;oBAC7C,eAAe,EAAE,MAAM,CAAC,eAAe;oBACvC,OAAO,EAAE,KAAK;oBACd,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAC/F,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;iBACjE,EAAE,IAAI,EAAE,CAAC,CAAC;aACZ,CAAC;KACH,CAAC;AACJ,CAAC"}

+1

-1

package.json

		{
		"name": "@sunaiva/gate",
		"mcpName": "io.sunaivacore/gate",
		"version": "2.0.4",
		"version": "2.0.5",
		"description": "Sunaiva Gate MCP \u2014 enforcement layer for AI agent rules. Stop documenting rules your agents ignore. Start enforcing them.",
		@@ -6,0 +6,0 @@ "main": "dist/index.js",

+45

-25

README.md

		@@ -14,3 +14,3 @@ # @sunaiva/gate

		> Status: `2.0.4` "QA Coherence" — copy/count/URL coherence fixes. Full changelog: [`CHANGELOG.md`](./CHANGELOG.md).
		> Status: `2.0.5` "THUNDERSTRIKE P0-A + version coherence" — see [`CHANGELOG.md`](./CHANGELOG.md) for full history.

		@@ -31,3 +31,3 @@ ---
		# → Status: HEALTHY
		# → Version: 2.0.4
		# → Version: 2.0.5

		@@ -45,3 +45,3 @@ # 3. Add to your MCP client (Claude Code, Cursor, Windsurf, Cline)

		The 1.1.0 Free tier (BUSL-1.1) ships with everything below baked into the npm
		The 2.0.5 Free tier (BUSL-1.1) ships with everything below baked into the npm
		package. No backend, no telemetry, no API key required. (Keyed installs emit one
		@@ -77,3 +77,3 @@ anonymous version ping on first use — opt out via `SUNAIVA_GATE_TELEMETRY=0`.)
		The Free tier is BUSL-1.1 licensed and converts to Apache-2.0 on
		2030-06-30. You can fork it, modify it, embed it in internal CI, and ship
		2030-07-19. You can fork it, modify it, embed it in internal CI, and ship
		it in non-production workflows today — no contract, no signup, no credit card.
		@@ -85,15 +85,23 @@

		\| Plan \| Price \| Rules \| Agents \| Seats \| Webhook \| Support \|
		\|------------\|-----------------\|-------------------\|------------\|------------\|---------\|----------------------\|
		\| Open \| $0/mo \| 35 local rules \| — \| 1 \| — \| Community \|
		\| Dev \| $0/mo (account) \| 35 local rules \| — \| 1 \| — \| Email (2 business days) \|
		\| Pro \| $29/mo † \| 69 premium rules \| 5 \| Multiple \| ✓ \| Email support (48h SLA) \|
		\| Team \| $79/mo \| 69 premium rules \| Larger team \| Larger team \| ✓ \| Priority support (24h SLA) \|
		\| Enterprise \| Custom \| Custom rule sets \| Unlimited \| Unlimited \| ✓ + SSO \| Dedicated + MSA SLA \|
		\| Plan \| Price \| Rules \| Agents \| Seats \| Webhook \| Support \|
		\|------------\|-----------------------\|-------------------\|------------\|-------------------\|---------\|----------------------\|
		\| Open \| $0/mo \| 35 local rules \| — \| 1 \| — \| Community \|
		\| Dev \| $0/mo (account) \| 35 local rules \| — \| 1 \| — \| Email (2 business days) \|
		\| Pro \| $49/mo ($490/yr) \| 104 rules (69 hosted) \| 5 \| 1 \| ✓ \| Email support (48h SLA) \|
		\| Team \| $199/mo ($1,990/yr) \| 104 rules (69 hosted) \| Larger team \| 5 incl. (need more? contact us) \| ✓ \| Priority support (24h SLA) \|
		\| Enterprise \| from $999/mo (custom) \| Custom rule sets \| Unlimited \| Unlimited \| ✓ + SSO \| Dedicated + MSA SLA \|

		† A/B launch: $29 (arm A, hero) vs $49 (arm B). See [sunaivacore.io/pricing](https://sunaivacore.io/pricing) for the live price.
		See [sunaivacore.io/pricing](https://sunaivacore.io/pricing) for the live price.

		> Team seat ceiling: 5 seats is what you are billed for today — that is the live
		> Stripe SKU. The backend's org fleet-management enforcement ceiling
		> (`SEAT_LIMIT` in `routes/fleet.ts`) is currently set to 10, a known
		> billing/backend mismatch tracked internally as a P1 cross-lane defect. Do
		> not read "10" anywhere as a sold entitlement — seats beyond 5 require
		> contacting support until the mismatch is resolved.

		All paid plans include: offline-capable on-device enforcement, model routing (bring your own
		inference provider API key, or use Sunaiva-managed inference), fail-safe (fail-closed) enforcement,
		multi-target policy compilation (Pro+), and `@sunaiva/gate` npm package (BUSL-1.1).
		inference provider API key — BYOK only in v1, see Known limitations below), fail-safe
		(fail-closed) enforcement, multi-target policy compilation (Pro+), and `@sunaiva/gate` npm
		package (BUSL-1.1).

		@@ -244,4 +252,14 @@ Open (no account): `npm i @sunaiva/gate` — 35 local rules, no network call required, zero
		\| `ship_confidence_check` \| Paid-tier production-deploy gate. Accepts a signed verdict path or artifact ID; verifies HMAC-SHA256 against `SHIP_CONFIDENCE_SIGNING_KEY`; returns `{allowed, tier: "paid"\\|"free", reason, evidence}`. Tagged in the audit ledger so you can measure the free-→paid upgrade funnel. \|
		\| `audit_verify` \| Verify the forward-linked cryptographic hash chain of the audit log (Patent Claim 19). Reports chain integrity, tamper evidence, and ed25519 signature validity per entry. \|
		\| `set_rule_mode` \| Set enforcement mode (`shadow`/`advisory`/`enforce`) for a specific rule. Requires API key (Pro+). \|
		\| `get_rule_modes` \| List all enforcement-mode overrides configured for the authenticated customer. Requires API key (Pro+). \|
		\| `reset_rule_mode` \| Remove a mode override for a rule, reverting it to its default enforcement mode. Requires API key (Pro+). \|
		\| `add_custom_rule` \| Create a custom detection rule in the backend. Requires API key (Pro+). \|
		\| `update_custom_rule` \| Update an existing custom rule. Requires API key (Pro+). \|
		\| `delete_custom_rule` \| Delete a custom rule. Requires API key (Pro+). \|
		\| `list_custom_rules` \| List all custom rules for the authenticated customer. Requires API key (Pro+). \|
		\| `list_presets` \| List available rule preset bundles. Requires API key (Dev+). \|
		\| `apply_preset` \| Apply a preset bundle, activating all its included rules. Requires API key (Pro+). \|

		Total: 6 MCP tools. The `ship_confidence_check` tool is the ported
		Total: 16 MCP tools. The `ship_confidence_check` tool is the ported
		TypeScript implementation of `.claude/hooks/ship_confidence_gate.py` v1.2.0,
		@@ -285,3 +303,3 @@ byte-compatible with the Python skill's canonical-JSON HMAC format.
		```
		[sunaiva-gate v2.0.4] BLOCK — rule: dat-001 (recursive root deletion)
		[sunaiva-gate v2.0.5] BLOCK — rule: dat-001 (recursive root deletion)
		Escape: export DISABLE_SUNAIVA_GATE=1
		@@ -344,3 +362,3 @@ Audit: ~/.sunaiva/audit/audit.jsonl
		Status: HEALTHY
		Version: 2.0.4
		Version: 2.0.5
		Support: support@sunaiva.ai
		@@ -408,3 +426,3 @@ ```
		# CLI form for use in CI:
		npx @sunaiva/gate --ship-confidence @sunaiva/gate@1.1.0
		npx @sunaiva/gate --ship-confidence @sunaiva/gate@2.0.5
		# Exit 0 = allow, 2 = block, 3 = internal error (fail-OPEN logged)
		@@ -435,7 +453,7 @@ ```

		## Known limitations — what 1.1.0 does NOT have
		## Known limitations — what 2.0.5 does NOT have

		We shipped `1.0.1` with seven CRITICAL gaps flagged by our own signed
		Ship-Confidence verdict on our own commit (`01KRDBCEYF2CAB21G6Y3E9VVH5`, RED).
		1.1.0 closes all seven. What is honestly not in 1.1.0 yet:
		1.1.0 closed all seven. What is honestly not in 2.0.5 yet:

		@@ -448,5 +466,7 @@ - Sunaiva-Managed inference — no flat-fee tier that includes LLM calls.
		Folded into Pro at no extra cost when it lands.
		- Multi-tenant dashboard / "Pro Team" tier — Pro is single-seat in v1.
		Team management is Enterprise. A self-serve "Pro Team" tier waits until
		10+ customers ask for it.
		- Deeper multi-tenant dashboard analytics — the self-serve Team tier
		($199/mo or $1,990/yr, 5 seats incl.; need more? contact us) is live today
		with shared custom rules and a shared audit dashboard (see Pricing above);
		expanded cross-seat analytics views beyond the audit log are still in
		progress.
		- On-prem / VPC deployment — Enterprise-only roadmap item. Helm chart
		@@ -507,3 +527,3 @@ and Terraform module designs exist; not yet packaged.
		the critical path of a third-party paying-customer product before the
		Change Date of 2030-06-30, after which the wrapper converts to
		Change Date of 2030-07-19, after which the wrapper converts to
		Apache-2.0 automatically. The premium backend stays proprietary regardless
		@@ -513,3 +533,3 @@ of the Change Date.
		- Licensor: Sunaiva Digital
		- Change Date: 2030-06-30
		- Change Date: 2030-07-19
		- Change License: Apache License, Version 2.0
		@@ -516,0 +536,0 @@

+1

-1

SUPPORT.md

		@@ -50,3 +50,3 @@ # Support — `@sunaiva/gate`

		`@sunaiva/gate` is the public BUSL-1.1 wrapper of a proprietary backend (Sunaiva Gate's premium rule evaluation + ship-confidence verdict service + dashboard, all under `gate.sunaiva.dev` / `dashboard.sunaiva.dev`). The wrapper's source is open per BUSL-1.1 with a per-publish Change Date (v1.0.x: `2030-05-10`; v2.x: `2030-06-30`; the `LICENSE` file is authoritative for the exact date) → Apache-2.0 sunset, but the canonical Sunaiva ship pathway (per the internal Rule 43.1 doctrine) does NOT use a public GitHub source repo. The backend stays private — there is no public source repo to file issues against. Email gives us the same triage path without that drift risk.
		`@sunaiva/gate` is the public BUSL-1.1 wrapper of a proprietary backend (Sunaiva Gate's premium rule evaluation + ship-confidence verdict service + dashboard, all under `gate.sunaiva.dev` / `dashboard.sunaiva.dev`). The wrapper's source is open per BUSL-1.1 with a per-publish Change Date (v1.0.x: `2030-05-10`; v2.0.4 current: `2030-07-19`; the `LICENSE` file is authoritative for the exact date) → Apache-2.0 sunset, but the canonical Sunaiva ship pathway (per the internal Rule 43.1 doctrine) does NOT use a public GitHub source repo. The backend stays private — there is no public source repo to file issues against. Email gives us the same triage path without that drift risk.

		@@ -53,0 +53,0 @@ ## What happens to your email

+1

-1

TIER_DEFINITIONS.md

		@@ -26,3 +26,3 @@ # Tier Definitions — `@sunaiva/gate`
		- Price: free forever; no account required
		- License: BUSL-1.1 wrapper (Change Date `2030-06-30` → Apache-2.0)
		- License: BUSL-1.1 wrapper (Change Date `2030-07-19` → Apache-2.0)
		- Scope:
		@@ -29,0 +29,0 @@ - All 35 local rules (27 constitutional + 8 recommended) evaluated locally on-device (cannot be disabled per the immutability guard)

dist/rules/rules.json

Sorry, the diff of this file is too big to display

@sunaiva/gate - npm Package Compare versions

New alerts

Fixed alerts

Improved metrics

Worsened metrics