@getmarrow/mcp 3.9.102 → 3.9.103

package/dist/seatbelt/record.d.ts

@@ -0,0 +1,94 @@
+import * as nodeFs from 'node:fs';
+export interface SeatbeltRecord {
+    v: 1;
+    mode: 'seatbelt' | 'claimed_no_key' | 'account';
+    /** `enforce`: the decision was the hook's answer. `watch`: computed for the record only (account floor). */
+    enforcement: 'enforce' | 'watch';
+    harness: string;
+    decision: 'pass' | 'stop' | 'skipped';
+    category: string;
+    rule: string;
+    reasons: string[];
+    flags: string[];
+    parse: string;
+    latency_ms: number;
+}
+/**
+ * What the hook knew about the event. It is used only to derive enums and keyed hashes and is never
+ * stored. `home` is the trusted home (passwd, or the hook's baked --home), never the agent's $HOME.
+ */
+export interface SeatbeltRecordContext {
+    tool_name?: unknown;
+    tool_input?: unknown;
+    cwd?: unknown;
+    session?: unknown;
+    truncated?: boolean;
+    home?: string | null;
+}
+type Fs = typeof nodeFs;
+/** Test seams (host, owner, clock, file system, caps). The hook passes none of them. */
+export interface ReceiptOptions {
+    home?: string | null;
+    uid?: number | null;
+    now?: number;
+    fs?: Fs;
+    maxTotalBytes?: number;
+    retentionDays?: number;
+    lockWaitMs?: number;
+}
+export declare const MAX_RECEIPT_BYTES: number;
+export declare const MAX_TOTAL_BYTES: number;
+export declare const RETENTION_DAYS = 90;
+export type DropReason = 'unsafe_store' | 'lock_timeout' | 'write_failed' | 'cap_full' | 'oversize' | 'platform' | 'error';
+/** Flags the mapper emits (test/seatbelt-u6-receipts reads the source to prove it) plus the two the receipt adds for the account floor. */
+export declare const FLAG_CODES: ReadonlySet<string>;
+export interface SeatbeltReceipt {
+    v: 1;
+    id: string;
+    seq: number;
+    prev: string;
+    ts: number;
+    ts_label: 'client_time';
+    mode: string;
+    enforcement: string;
+    harness: string;
+    event: 'pre_tool';
+    tool_kind: string;
+    tool: string;
+    decision: string;
+    category: string;
+    rule: string;
+    reasons: string[];
+    programs: string[];
+    subcommand: string;
+    flags: string[];
+    target_class: string;
+    parse: string;
+    action_key: string;
+    workspace_key: string;
+    session_key: string;
+    engine: {
+        pkg: string;
+        contract: string;
+        source_commit: string;
+        rules: string;
+        tables: string;
+    };
+    latency_ms: number;
+}
+/** The problems with a receipt object (an empty list means valid). Used by the writer and by every consumer of the fields. */
+export declare function validateReceipt(value: unknown): string[];
+/** Write one receipt. Never throws; says what happened. The hook calls recordSeatbeltDecision; tests call this with options. */
+export declare function writeSeatbeltReceipt(record: SeatbeltRecord, context?: SeatbeltRecordContext, options?: ReceiptOptions): 'written' | 'dropped';
+/**
+ * This machine's private salt: the receipts store's (~/.marrow/seatbelt/salt under the passwd home, 32 random
+ * bytes, 0600, owned by this uid, read with O_NOFOLLOW, created once), with every check openStore makes. It keys
+ * hashes that leave the machine only as a MAC (normalized-action exact_hmac); the salt itself is never sent,
+ * printed or logged. null when the store is missing, unsafe, not ours or unreadable: the caller then fails closed.
+ * Cached per process. The options are test seams (home, uid, fs) and bypass the cache.
+ */
+export declare function deviceSalt(options?: Pick<ReceiptOptions, 'home' | 'uid' | 'fs'>): Buffer | null;
+/** The record hook U5 calls once per decision. It never throws, writes no output and never changes a decision. */
+export declare function recordSeatbeltDecision(record: SeatbeltRecord, context?: SeatbeltRecordContext): void;
+export {};
+//# sourceMappingURL=record.d.ts.map

package/dist/seatbelt/record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record.d.ts","sourceRoot":"","sources":["../../src/seatbelt/record.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AASlC,MAAM,WAAW,cAAc;IAC7B,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,UAAU,GAAG,gBAAgB,GAAG,SAAS,CAAC;IAChD,4GAA4G;IAC5G,WAAW,EAAE,SAAS,GAAG,OAAO,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,KAAK,EAAE,GAAG,OAAO,MAAM,CAAC;AAExB,wFAAwF;AACxF,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,iBAAiB,QAAY,CAAC;AAC3C,eAAO,MAAM,eAAe,QAAmB,CAAC;AAChD,eAAO,MAAM,cAAc,KAAK,CAAC;AAQjC,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,cAAc,GAAG,cAAc,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;AAkC3H,2IAA2I;AAC3I,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,MAAM,CAGzC,CAAC;AAgBH,MAAM,WAAW,eAAe;IAC9B,CAAC,EAAE,CAAC,CAAC;IACL,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAChG,UAAU,EAAE,MAAM,CAAC;CACpB;AAYD,8HAA8H;AAC9H,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CA0CxD;AA4bD,gIAAgI;AAChI,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,GAAE,qBAA0B,EAAE,OAAO,GAAE,cAAmB,GAAG,SAAS,GAAG,SAAS,CAmBrJ;AAID;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,OAAO,GAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI,CAAM,GAAG,MAAM,GAAG,IAAI,CAiBnG;AAED,kHAAkH;AAClH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAIpG"}