@intutic/clawde 2.1.0 → 2.3.0

package/README.md

@@ -10,13 +10,15 @@ npm install @intutic/clawde
 
 ## Features
 
-- **Governed chat:** `chat()` sends a request through the proxy and resolves with `verdict: 'allow'`. A governance refusal (policy block, reask, loop run held for review, spend cap, DLP block) throws `ClawdeBlockedError` with the proxy's `verdict`, `code` and reason, and is never retried; transport failures and 5xx answers are retried.
-- **Verdict Events:** `client.on('kill' | 'reask' | 'hold', ...)` fires on a refusal, before `chat()` throws. See the [SDK reference](https://docs.intutic.ai/reference/clawde-sdk#_5-verdicts-and-errors) for every refusal code.
+- **Governed chat:** `chat()` sends a request through the proxy and resolves with `verdict: 'allow'`. A governance refusal (policy block, reask, loop run held for review, spend cap, DLP block) throws `ClawdeBlockedError` with the proxy's `verdict`, `code`, `ruleId` (when the proxy names the rule) and reason, and is never retried; transport failures and 5xx answers are retried.
+- **Withheld tool calls:** when the proxy withholds a tool call from the model's answer (a tool an SOP denies, the SSO group policy, destructive SQL, sensitive output), the answer arrives as a 200 that names the refusal in the `x-intutic-refusal` and `x-intutic-refusal-rule` headers. `chat()` reads them and throws `ClawdeBlockedError` too. For a stream you read yourself, pass each line to `streamRefusal()`, which finds the `: intutic-refusal` marker the proxy writes before the refusal text. See [Verdicts and Errors](https://docs.intutic.ai/reference/clawde-sdk#_5-verdicts-and-errors) for every refusal code.
+- **Verdict Events:** `client.on('kill' | 'reask' | 'hold', ...)` fires on a refusal, before `chat()` throws.
 - **Anthropic requests:** `provider: 'anthropic'` translates OpenAI-style parameters to an Anthropic Messages body, sends it to the proxy's `/v1/messages` route, and translates the reply back.
 - **Budget Check:** `checkBudget()` reports whether the workspace has budget left, from the control plane's `GET /api/v1/budget`.
 - **Circuit Breaker:** `client.circuitBreaker(toolName, options)(fn)` runs `fn`, after a workspace budget check when `requireBudget` is set, failing closed unless `failOpen` is set.
 - **Context Resolution:** `resolveContext()` reads the sync daemon's `~/.intutic/config.json` (git branch, Jira ticket, PagerDuty incident, CI pipeline, workspace, session), falling back to environment variables.
-- **Control-Plane Management (`ControlPlaneClient`):** Org signup, team/workspace creation, gateway registration and assignment, and provider-credential provisioning — the CLI's management surface, callable programmatically. See the [SDK reference](https://docs.intutic.ai/reference/clawde-sdk#control-plane-management-controlplaneclient).
+- **Git context (`autoContext`, on by default):** with an Intutic virtual key, in a git repository, the first `chat()` registers a session with the control plane carrying the repository (the `origin` remote as `host/path`, credentials removed), the branch and the HEAD commit, so the calls count in cost per branch, commit and pull request. Pass `autoContext: false` to send none of it. See [Git context and cost attribution](https://docs.intutic.ai/reference/clawde-sdk#_1a-git-context-and-cost-attribution).
+- **Control-Plane Management (`ControlPlaneClient`):** org signup and creation, teams and workspaces, gateway registration, assignment and live config (`getGatewayConfig`, `setGatewayConfig`), workspace settings (`getWorkspaceSettings`, `updateWorkspaceSettings`) and provider credentials. See [Control-Plane Management](https://docs.intutic.ai/reference/clawde-sdk#control-plane-management-controlplaneclient).
 
 ## License
 

package/dist/circuit-breaker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"circuit-breaker.d.ts","sourceRoot":"","sources":["../src/circuit-breaker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA;AAG/C,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAK;gBAEP,MAAM,EAAE,GAAG;IAIhB,IAAI,CAAC,CAAC,EACX,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,qBAA0B,GAClC,CAAC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;CAoCxC"}
+{"version":3,"file":"circuit-breaker.d.ts","sourceRoot":"","sources":["../src/circuit-breaker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA;AAG/C,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAK;gBAEP,MAAM,EAAE,GAAG;IAIhB,IAAI,CAAC,CAAC,EACX,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,qBAA0B,GAClC,CAAC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;CAwCxC"}

package/dist/circuit-breaker.js

@@ -10,13 +10,14 @@ class CircuitBreaker {
     wrap(toolName, options = {}) {
         const failOpen = options.failOpen ?? false;
         return async (fn) => {
-            // 1. Pre-check: workspace budget, when asked for
+            // 1. Pre-check: workspace budget, when asked for. `failOpen` covers a
+            // check that could not be made; a check that answered "no budget" is a
+            // verdict and refuses either way, or the breaker would let every call
+            // through exactly when the budget is gone.
             if (options.requireBudget || options.maxCostUsd !== undefined) {
+                let budget = null;
                 try {
-                    const budget = await this.client.checkBudget('default', 1);
-                    if (!budget.allowed) {
-                        throw new errors_1.ClawdeVerdictError('kill', `Circuit breaker tripped for tool '${toolName}': budget exceeded. Remaining: $${budget.remaining_usd}`);
-                    }
+                    budget = await this.client.checkBudget('default', 1);
                 }
                 catch (err) {
                     if (!failOpen) {
@@ -26,6 +27,9 @@ class CircuitBreaker {
                         console.warn(`[Clawde SDK] Circuit breaker pre-check failed (failing open): ${err.message}`);
                     }
                 }
+                if (budget && !budget.allowed) {
+                    throw new errors_1.ClawdeVerdictError('kill', `Circuit breaker tripped for tool '${toolName}': budget exceeded. Remaining: $${budget.remaining_usd}`);
+                }
             }
             // 2. Run the function. A refusal from chat() arrives as a thrown
             // ClawdeBlockedError, so fail-closed needs nothing beyond rethrowing.

package/dist/circuit-breaker.js.map

@@ -1 +1 @@
-{"version":3,"file":"circuit-breaker.js","sourceRoot":"","sources":["../src/circuit-breaker.ts"],"names":[],"mappings":";;;AACA,qCAA6C;AAE7C,MAAa,cAAc;IACjB,MAAM,CAAK;IAEnB,YAAY,MAAW;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAEM,IAAI,CACT,QAAgB,EAChB,UAAiC,EAAE;QAEnC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAA;QAE1C,OAAO,KAAK,EAAE,EAAoB,EAAc,EAAE;YAChD,iDAAiD;YACjD,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC9D,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;oBAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;wBACpB,MAAM,IAAI,2BAAkB,CAAC,MAAM,EAAE,qCAAqC,QAAQ,mCAAmC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAA;oBAC9I,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,MAAM,GAAG,CAAA;oBACX,CAAC;oBACD,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;wBACzC,OAAO,CAAC,IAAI,CAAC,iEAAiE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;oBAC9F,CAAC;gBACH,CAAC;YACH,CAAC;YAED,iEAAiE;YACjE,sEAAsE;YACtE,IAAI,CAAC;gBACH,OAAO,MAAM,EAAE,EAAE,CAAA;YACnB,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,GAAG,CAAA;gBACX,CAAC;gBACD,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;oBACzC,OAAO,CAAC,IAAI,CAAC,iEAAiE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC9F,CAAC;gBACD,OAAO,IAAW,CAAA,CAAC,kCAAkC;YACvD,CAAC;QACH,CAAC,CAAA;IACH,CAAC;CACF;AA9CD,wCA8CC"}
+{"version":3,"file":"circuit-breaker.js","sourceRoot":"","sources":["../src/circuit-breaker.ts"],"names":[],"mappings":";;;AACA,qCAA6C;AAE7C,MAAa,cAAc;IACjB,MAAM,CAAK;IAEnB,YAAY,MAAW;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAEM,IAAI,CACT,QAAgB,EAChB,UAAiC,EAAE;QAEnC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAA;QAE1C,OAAO,KAAK,EAAE,EAAoB,EAAc,EAAE;YAChD,sEAAsE;YACtE,uEAAuE;YACvE,sEAAsE;YACtE,2CAA2C;YAC3C,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC9D,IAAI,MAAM,GAAwD,IAAI,CAAA;gBACtE,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;gBACtD,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,MAAM,GAAG,CAAA;oBACX,CAAC;oBACD,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;wBACzC,OAAO,CAAC,IAAI,CAAC,iEAAiE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;oBAC9F,CAAC;gBACH,CAAC;gBACD,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC9B,MAAM,IAAI,2BAAkB,CAAC,MAAM,EAAE,qCAAqC,QAAQ,mCAAmC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAA;gBAC9I,CAAC;YACH,CAAC;YAED,iEAAiE;YACjE,sEAAsE;YACtE,IAAI,CAAC;gBACH,OAAO,MAAM,EAAE,EAAE,CAAA;YACnB,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,GAAG,CAAA;gBACX,CAAC;gBACD,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;oBACzC,OAAO,CAAC,IAAI,CAAC,iEAAiE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC9F,CAAC;gBACD,OAAO,IAAW,CAAA,CAAC,kCAAkC;YACvD,CAAC;QACH,CAAC,CAAA;IACH,CAAC;CACF;AAlDD,wCAkDC"}

package/dist/client.d.ts

@@ -1,4 +1,6 @@
 import { ClawdeClientOptions, ChatParams, ChatResponse, ResolvedContext, BudgetCheckResult, EventCallback, CircuitBreakerOptions, VerdictEvent } from './types';
+/** The harness a session this SDK registers is recorded under. */
+export declare const SDK_HARNESS = "clawde_sdk";
 export declare class ClawdeClient {
     private apiKey;
     private baseUrl;
@@ -12,6 +14,8 @@ export declare class ClawdeClient {
     private budgetChecker;
     private circuitBreakerWrapper;
     private eventEmitter;
+    /** The session this client's requests are filed under, resolved once, on the first `chat()`. */
+    private session?;
     constructor(options: ClawdeClientOptions);
     on(event: VerdictEvent, callback: EventCallback): void;
     off(event: string, callback: EventCallback): void;
@@ -22,10 +26,30 @@ export declare class ClawdeClient {
      * Send a chat request through the proxy.
      *
      * Resolves with `verdict: 'allow'` when the proxy let the request through. A
-     * governance refusal fires the matching event and rejects with
-     * `ClawdeBlockedError`, unretried. Transport failures, timeouts and 5xx
-     * answers are retried; anything else rejects with `ClawdeConnectionError`.
+     * governance refusal, including one the proxy answers with a 200 and names in
+     * `x-intutic-refusal` (or, on a stream, in its `: intutic-refusal` line),
+     * fires the matching event and rejects with `ClawdeBlockedError`, unretried.
+     * Transport failures, timeouts and 5xx answers are retried; anything else
+     * rejects with `ClawdeConnectionError`.
      */
     chat(params: ChatParams): Promise<ChatResponse>;
+    /**
+     * The session to send as `x-session-id`, or null to send none.
+     *
+     * A session id from the environment (`INTUTIC_SESSION_ID`, or the sync
+     * daemon's config) is the session that started this process, and its owner
+     * reports its context, so it is used as is. Otherwise, when the working
+     * directory is a git repository, this registers a session carrying its
+     * repository, branch and commit (`POST /api/v1/sessions`, as the sync
+     * daemon does), so cost per branch, commit and pull request includes this
+     * client's calls. Only with an Intutic virtual key: any other key is a
+     * provider's, and it is never sent to the control plane. `autoContext:
+     * false` turns this off. Best effort: a control plane that cannot be
+     * reached or refuses costs the attribution, never the call.
+     */
+    private openSession;
+    private controlPlane;
+    /** Fires the refusal's event, then throws it. */
+    private refuse;
 }
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,UAAU,EACV,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,YAAY,EACb,MAAM,SAAS,CAAA;AAUhB,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,eAAe,CAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,CAAmC;IACpD,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,OAAO,CAAQ;IAEvB,wEAAwE;IACxE,OAAO,CAAC,QAAQ,CAAe;IAE/B,OAAO,CAAC,aAAa,CAAe;IACpC,OAAO,CAAC,qBAAqB,CAAgB;IAC7C,OAAO,CAAC,YAAY,CAAoB;gBAE5B,OAAO,EAAE,mBAAmB;IAuBjC,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,GAAG,IAAI;IAItD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,IAAI;IAK3C,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAK/E,cAAc,IAAI,OAAO,CAAC,eAAe,CAAC;IAQhD,cAAc,CAAC,CAAC,EACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,qBAA0B,GAClC,CAAC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;IAIvC;;;;;;;OAOG;IACU,IAAI,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC;CAqE7D"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,UAAU,EACV,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,YAAY,EACb,MAAM,SAAS,CAAA;AAWhB,kEAAkE;AAClE,eAAO,MAAM,WAAW,eAAe,CAAA;AAEvC,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,eAAe,CAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,CAAmC;IACpD,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,OAAO,CAAQ;IAEvB,wEAAwE;IACxE,OAAO,CAAC,QAAQ,CAAe;IAE/B,OAAO,CAAC,aAAa,CAAe;IACpC,OAAO,CAAC,qBAAqB,CAAgB;IAC7C,OAAO,CAAC,YAAY,CAAoB;IAExC,gGAAgG;IAChG,OAAO,CAAC,OAAO,CAAC,CAAwB;gBAE5B,OAAO,EAAE,mBAAmB;IAuBjC,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,GAAG,IAAI;IAItD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,IAAI;IAK3C,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAK/E,cAAc,IAAI,OAAO,CAAC,eAAe,CAAC;IAQhD,cAAc,CAAC,CAAC,EACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,qBAA0B,GAClC,CAAC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;IAIvC;;;;;;;;;OASG;IACU,IAAI,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC;IAsF5D;;;;;;;;;;;;;OAaG;YACW,WAAW;YA0BX,YAAY;IAW1B,iDAAiD;IACjD,OAAO,CAAC,MAAM;CAIf"}

package/dist/client.js

@@ -1,14 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ClawdeClient = void 0;
+exports.ClawdeClient = exports.SDK_HARNESS = void 0;
 const errors_1 = require("./errors");
 const refusals_1 = require("./refusals");
 const schema_enforcer_1 = require("./schema-enforcer");
 const context_resolver_1 = require("./context-resolver");
+const git_context_1 = require("./git-context");
 const budget_checker_1 = require("./budget-checker");
 const circuit_breaker_1 = require("./circuit-breaker");
 const event_emitter_1 = require("./event-emitter");
 const graph_identity_1 = require("./graph-identity");
+/** The harness a session this SDK registers is recorded under. */
+exports.SDK_HARNESS = 'clawde_sdk';
 class ClawdeClient {
     apiKey;
     baseUrl;
@@ -22,6 +25,8 @@ class ClawdeClient {
     budgetChecker;
     circuitBreakerWrapper;
     eventEmitter;
+    /** The session this client's requests are filed under, resolved once, on the first `chat()`. */
+    session;
     constructor(options) {
         if (!options.apiKey) {
             throw new Error('API key is required to initialize ClawdeClient.');
@@ -67,11 +72,15 @@ class ClawdeClient {
      * Send a chat request through the proxy.
      *
      * Resolves with `verdict: 'allow'` when the proxy let the request through. A
-     * governance refusal fires the matching event and rejects with
-     * `ClawdeBlockedError`, unretried. Transport failures, timeouts and 5xx
-     * answers are retried; anything else rejects with `ClawdeConnectionError`.
+     * governance refusal, including one the proxy answers with a 200 and names in
+     * `x-intutic-refusal` (or, on a stream, in its `: intutic-refusal` line),
+     * fires the matching event and rejects with `ClawdeBlockedError`, unretried.
+     * Transport failures, timeouts and 5xx answers are retried; anything else
+     * rejects with `ClawdeConnectionError`.
      */
     async chat(params) {
+        this.session ??= this.openSession();
+        const sessionId = await this.session;
         const anthropic = this.provider === 'anthropic';
         // The proxy picks the wire format by route: an Anthropic Messages body
         // sent to /v1/chat/completions is parsed as an OpenAI one.
@@ -85,6 +94,9 @@ class ClawdeClient {
             // request as a graph of one, and skips membership, fleet spend and
             // node counting entirely.
             ...(0, graph_identity_1.identityHeaders)(this.identity),
+            // The proxy files the trace under this session, and the control plane
+            // copies the session's repository, branch and commit onto it.
+            ...(sessionId ? { 'x-session-id': sessionId } : {}),
         };
         const body = JSON.stringify((0, schema_enforcer_1.normalizeRequest)(params, this.provider));
         let lastError = '';
@@ -100,9 +112,13 @@ class ClawdeClient {
             const timer = setTimeout(() => controller.abort(), this.timeout);
             let status;
             let text;
+            let refusedBy;
+            let refusedRule;
             try {
                 const response = await fetch(url, { method: 'POST', headers, body, signal: controller.signal });
                 status = response.status;
+                refusedBy = response.headers.get(refusals_1.REFUSAL_HEADER);
+                refusedRule = response.headers.get(refusals_1.REFUSAL_RULE_HEADER);
                 text = await response.text();
             }
             catch (err) {
@@ -118,17 +134,27 @@ class ClawdeClient {
                     json = JSON.parse(text);
                 }
                 catch {
+                    // A `stream: true` request comes back as an event stream, which
+                    // `chat()` does not parse; it still must not pass off a refusal
+                    // the stream names as a transport failure.
+                    const streamed = (0, refusals_1.streamRefusal)(text);
+                    if (streamed)
+                        this.refuse(streamed, status);
                     throw new errors_1.ClawdeConnectionError(`Proxy answered ${status} with a body that is not JSON: ${text}`);
                 }
                 const normalized = (0, schema_enforcer_1.normalizeResponse)(json, this.provider);
+                // A refusal answered as an assistant turn: a withheld tool call, a
+                // withheld body, or the cost-prediction gate.
+                const content = normalized.choices?.[0]?.message?.content;
+                const answered = (0, refusals_1.headerRefusal)(refusedBy, refusedRule, typeof content === 'string' ? content : '');
+                if (answered)
+                    this.refuse(answered, status);
                 normalized.verdict = 'allow';
                 return normalized;
             }
             const refusal = (0, refusals_1.parseRefusal)(status, text);
-            if (refusal) {
-                this.eventEmitter.emit(refusal.verdict, { ...refusal, status });
-                throw new errors_1.ClawdeBlockedError(refusal.verdict, refusal.code, status, refusal.message);
-            }
+            if (refusal)
+                this.refuse(refusal, status);
             lastError = `HTTP error ${status}: ${text}`;
             // A 4xx that is not a refusal (bad key, malformed body) fails the same
             // way every time; only a 5xx is worth another attempt.
@@ -137,6 +163,66 @@ class ClawdeClient {
         }
         throw new errors_1.ClawdeConnectionError(`Request failed after ${maxAttempts} attempts. Last error: ${lastError}`);
     }
+    /**
+     * The session to send as `x-session-id`, or null to send none.
+     *
+     * A session id from the environment (`INTUTIC_SESSION_ID`, or the sync
+     * daemon's config) is the session that started this process, and its owner
+     * reports its context, so it is used as is. Otherwise, when the working
+     * directory is a git repository, this registers a session carrying its
+     * repository, branch and commit (`POST /api/v1/sessions`, as the sync
+     * daemon does), so cost per branch, commit and pull request includes this
+     * client's calls. Only with an Intutic virtual key: any other key is a
+     * provider's, and it is never sent to the control plane. `autoContext:
+     * false` turns this off. Best effort: a control plane that cannot be
+     * reached or refuses costs the attribution, never the call.
+     */
+    async openSession() {
+        if (!this.autoContext)
+            return null;
+        const context = await (0, context_resolver_1.resolveContext)();
+        if (context.sessionId)
+            return context.sessionId;
+        if (!this.apiKey.startsWith('vk_'))
+            return null;
+        const git = await (0, git_context_1.resolveGitContext)(context.workingDirectory ?? process.cwd(), context.gitBranch);
+        if (Object.keys(git).length === 0)
+            return null;
+        try {
+            // whoami first, always: the repository goes only to a control plane
+            // that accepted the key. A workspace id from the environment proves
+            // nothing about the key, and the session route only takes the key's own.
+            const { workspaceId } = await this.controlPlane('GET', '/api/v1/auth/me');
+            const session = await this.controlPlane('POST', '/api/v1/sessions', {
+                workspaceId,
+                harnessType: exports.SDK_HARNESS,
+                ...git,
+            });
+            return session.sessionId ?? null;
+        }
+        catch (err) {
+            if (process.env.INTUTIC_DEBUG === 'true') {
+                console.warn(`[Clawde SDK] No session registered; calls carry no git context: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            return null;
+        }
+    }
+    async controlPlane(method, path, body) {
+        const res = await fetch(`${this.controlPlaneUrl}${path}`, {
+            method,
+            headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${this.apiKey}` },
+            body: body === undefined ? undefined : JSON.stringify(body),
+            signal: AbortSignal.timeout(5_000),
+        });
+        if (!res.ok)
+            throw new Error(`${method} ${path} answered ${res.status}`);
+        return (await res.json());
+    }
+    /** Fires the refusal's event, then throws it. */
+    refuse(refusal, status) {
+        this.eventEmitter.emit(refusal.verdict, { ...refusal, status });
+        throw new errors_1.ClawdeBlockedError(refusal.verdict, refusal.code, status, refusal.message, refusal.ruleId);
+    }
 }
 exports.ClawdeClient = ClawdeClient;
 //# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";;;AAUA,qCAAoE;AACpE,yCAAyC;AACzC,uDAAuE;AACvE,yDAAmD;AACnD,qDAAgD;AAChD,uDAAkD;AAClD,mDAAoD;AACpD,qDAAsF;AAEtF,MAAa,YAAY;IACf,MAAM,CAAQ;IACd,OAAO,CAAQ;IACf,eAAe,CAAQ;IACvB,QAAQ,CAAoC;IAC5C,WAAW,CAAS;IACpB,OAAO,CAAQ;IACf,OAAO,CAAQ;IAEvB,wEAAwE;IAChE,QAAQ,CAAe;IAEvB,aAAa,CAAe;IAC5B,qBAAqB,CAAgB;IACrC,YAAY,CAAoB;IAExC,YAAY,OAA4B;QACtC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,uBAAuB,CAAA;QACzF,IAAI,CAAC,eAAe;YAClB,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,wBAAwB,CAAA;QAC9F,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QAChC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAA;QAC9C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAA;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAA;QAEnC,0EAA0E;QAC1E,6EAA6E;QAC7E,IAAI,CAAC,QAAQ,GAAG,IAAA,+BAAc,EAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QAErD,IAAI,CAAC,aAAa,GAAG,IAAI,8BAAa,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QACzE,IAAI,CAAC,qBAAqB,GAAG,IAAI,gCAAc,CAAC,IAAI,CAAC,CAAA;QACrD,IAAI,CAAC,YAAY,GAAG,IAAI,kCAAkB,EAAE,CAAA;IAC9C,CAAC;IAED,0BAA0B;IACnB,EAAE,CAAC,KAAmB,EAAE,QAAuB;QACpD,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACvC,CAAC;IAEM,GAAG,CAAC,KAAa,EAAE,QAAuB;QAC/C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACxC,CAAC;IAED,0BAA0B;IACnB,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,eAAuB;QAC7D,OAAO,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,KAAK,EAAE,eAAe,CAAC,CAAA;IAC/D,CAAC;IAED,8BAA8B;IACvB,KAAK,CAAC,cAAc;QACzB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,IAAA,iCAAc,GAAE,CAAA;IACzB,CAAC;IAED,mCAAmC;IAC5B,cAAc,CACnB,QAAgB,EAChB,UAAiC,EAAE;QAEnC,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAI,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC9D,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,IAAI,CAAC,MAAkB;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,KAAK,WAAW,CAAA;QAC/C,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAA;QACnF,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,SAAS;gBACX,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,mBAAmB,EAAE,YAAY,EAAE;gBACjE,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACjD,oEAAoE;YACpE,mEAAmE;YACnE,0BAA0B;YAC1B,GAAG,IAAA,gCAAe,EAAC,IAAI,CAAC,QAAQ,CAAC;SAClC,CAAA;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAA,kCAAgB,EAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;QAEpE,IAAI,SAAS,GAAG,EAAE,CAAA;QAClB,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC,CAAA;QAEpC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;YACxD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;oBACzC,OAAO,CAAC,IAAI,CAAC,wBAAwB,OAAO,GAAG,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAA;gBAC7F,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,OAAO,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;YAC1E,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;YACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;YAChE,IAAI,MAAc,CAAA;YAClB,IAAI,IAAY,CAAA;YAChB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;gBAC/F,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;gBACxB,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YAC9B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC5D,SAAQ;YACV,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAA;YACrB,CAAC;YAED,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;gBAClC,IAAI,IAAa,CAAA;gBACjB,IAAI,CAAC;oBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBACzB,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,8BAAqB,CAAC,kBAAkB,MAAM,kCAAkC,IAAI,EAAE,CAAC,CAAA;gBACnG,CAAC;gBACD,MAAM,UAAU,GAAG,IAAA,mCAAiB,EAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;gBACzD,UAAU,CAAC,OAAO,GAAG,OAAO,CAAA;gBAC5B,OAAO,UAAU,CAAA;YACnB,CAAC;YAED,MAAM,OAAO,GAAG,IAAA,uBAAY,EAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;gBAC/D,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;YACtF,CAAC;YAED,SAAS,GAAG,cAAc,MAAM,KAAK,IAAI,EAAE,CAAA;YAC3C,uEAAuE;YACvE,uDAAuD;YACvD,IAAI,MAAM,GAAG,GAAG;gBAAE,MAAM,IAAI,8BAAqB,CAAC,SAAS,CAAC,CAAA;QAC9D,CAAC;QAED,MAAM,IAAI,8BAAqB,CAAC,wBAAwB,WAAW,0BAA0B,SAAS,EAAE,CAAC,CAAA;IAC3G,CAAC;CACF;AAjJD,oCAiJC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";;;AAUA,qCAAoE;AACpE,yCAA+H;AAC/H,uDAAuE;AACvE,yDAAmD;AACnD,+CAAiD;AACjD,qDAAgD;AAChD,uDAAkD;AAClD,mDAAoD;AACpD,qDAAsF;AAEtF,kEAAkE;AACrD,QAAA,WAAW,GAAG,YAAY,CAAA;AAEvC,MAAa,YAAY;IACf,MAAM,CAAQ;IACd,OAAO,CAAQ;IACf,eAAe,CAAQ;IACvB,QAAQ,CAAoC;IAC5C,WAAW,CAAS;IACpB,OAAO,CAAQ;IACf,OAAO,CAAQ;IAEvB,wEAAwE;IAChE,QAAQ,CAAe;IAEvB,aAAa,CAAe;IAC5B,qBAAqB,CAAgB;IACrC,YAAY,CAAoB;IAExC,gGAAgG;IACxF,OAAO,CAAyB;IAExC,YAAY,OAA4B;QACtC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,uBAAuB,CAAA;QACzF,IAAI,CAAC,eAAe;YAClB,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,wBAAwB,CAAA;QAC9F,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QAChC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAA;QAC9C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAA;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAA;QAEnC,0EAA0E;QAC1E,6EAA6E;QAC7E,IAAI,CAAC,QAAQ,GAAG,IAAA,+BAAc,EAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QAErD,IAAI,CAAC,aAAa,GAAG,IAAI,8BAAa,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QACzE,IAAI,CAAC,qBAAqB,GAAG,IAAI,gCAAc,CAAC,IAAI,CAAC,CAAA;QACrD,IAAI,CAAC,YAAY,GAAG,IAAI,kCAAkB,EAAE,CAAA;IAC9C,CAAC;IAED,0BAA0B;IACnB,EAAE,CAAC,KAAmB,EAAE,QAAuB;QACpD,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACvC,CAAC;IAEM,GAAG,CAAC,KAAa,EAAE,QAAuB;QAC/C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACxC,CAAC;IAED,0BAA0B;IACnB,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,eAAuB;QAC7D,OAAO,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,KAAK,EAAE,eAAe,CAAC,CAAA;IAC/D,CAAC;IAED,8BAA8B;IACvB,KAAK,CAAC,cAAc;QACzB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,IAAA,iCAAc,GAAE,CAAA;IACzB,CAAC;IAED,mCAAmC;IAC5B,cAAc,CACnB,QAAgB,EAChB,UAAiC,EAAE;QAEnC,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAI,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC9D,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,IAAI,CAAC,MAAkB;QAClC,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,WAAW,EAAE,CAAA;QACnC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAA;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,KAAK,WAAW,CAAA;QAC/C,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAA;QACnF,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,SAAS;gBACX,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,mBAAmB,EAAE,YAAY,EAAE;gBACjE,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACjD,oEAAoE;YACpE,mEAAmE;YACnE,0BAA0B;YAC1B,GAAG,IAAA,gCAAe,EAAC,IAAI,CAAC,QAAQ,CAAC;YACjC,sEAAsE;YACtE,8DAA8D;YAC9D,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAA;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAA,kCAAgB,EAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;QAEpE,IAAI,SAAS,GAAG,EAAE,CAAA;QAClB,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC,CAAA;QAEpC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;YACxD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;oBACzC,OAAO,CAAC,IAAI,CAAC,wBAAwB,OAAO,GAAG,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAA;gBAC7F,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,OAAO,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;YAC1E,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;YACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;YAChE,IAAI,MAAc,CAAA;YAClB,IAAI,IAAY,CAAA;YAChB,IAAI,SAAwB,CAAA;YAC5B,IAAI,WAA0B,CAAA;YAC9B,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;gBAC/F,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;gBACxB,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAc,CAAC,CAAA;gBAChD,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAAmB,CAAC,CAAA;gBACvD,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YAC9B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC5D,SAAQ;YACV,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAA;YACrB,CAAC;YAED,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;gBAClC,IAAI,IAAa,CAAA;gBACjB,IAAI,CAAC;oBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBACzB,CAAC;gBAAC,MAAM,CAAC;oBACP,gEAAgE;oBAChE,gEAAgE;oBAChE,2CAA2C;oBAC3C,MAAM,QAAQ,GAAG,IAAA,wBAAa,EAAC,IAAI,CAAC,CAAA;oBACpC,IAAI,QAAQ;wBAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;oBAC3C,MAAM,IAAI,8BAAqB,CAAC,kBAAkB,MAAM,kCAAkC,IAAI,EAAE,CAAC,CAAA;gBACnG,CAAC;gBACD,MAAM,UAAU,GAAG,IAAA,mCAAiB,EAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;gBACzD,mEAAmE;gBACnE,8CAA8C;gBAC9C,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAA;gBACzD,MAAM,QAAQ,GAAG,IAAA,wBAAa,EAAC,SAAS,EAAE,WAAW,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;gBAClG,IAAI,QAAQ;oBAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;gBAC3C,UAAU,CAAC,OAAO,GAAG,OAAO,CAAA;gBAC5B,OAAO,UAAU,CAAA;YACnB,CAAC;YAED,MAAM,OAAO,GAAG,IAAA,uBAAY,EAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,OAAO;gBAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAEzC,SAAS,GAAG,cAAc,MAAM,KAAK,IAAI,EAAE,CAAA;YAC3C,uEAAuE;YACvE,uDAAuD;YACvD,IAAI,MAAM,GAAG,GAAG;gBAAE,MAAM,IAAI,8BAAqB,CAAC,SAAS,CAAC,CAAA;QAC9D,CAAC;QAED,MAAM,IAAI,8BAAqB,CAAC,wBAAwB,WAAW,0BAA0B,SAAS,EAAE,CAAC,CAAA;IAC3G,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,KAAK,CAAC,WAAW;QACvB,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAA;QAClC,MAAM,OAAO,GAAG,MAAM,IAAA,iCAAc,GAAE,CAAA;QACtC,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,OAAO,CAAC,SAAS,CAAA;QAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAC/C,MAAM,GAAG,GAAG,MAAM,IAAA,+BAAiB,EAAC,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QACjG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAC9C,IAAI,CAAC;YACH,oEAAoE;YACpE,oEAAoE;YACpE,yEAAyE;YACzE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAA0B,KAAK,EAAE,iBAAiB,CAAC,CAAA;YAClG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAyB,MAAM,EAAE,kBAAkB,EAAE;gBAC1F,WAAW;gBACX,WAAW,EAAE,mBAAW;gBACxB,GAAG,GAAG;aACP,CAAC,CAAA;YACF,OAAO,OAAO,CAAC,SAAS,IAAI,IAAI,CAAA;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,mEAAmE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACrI,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACxE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,eAAe,GAAG,IAAI,EAAE,EAAE;YACxD,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;YACvF,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC3D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,IAAI,IAAI,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QACxE,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAA;IAChC,CAAC;IAED,iDAAiD;IACzC,MAAM,CAAC,OAAqB,EAAE,MAAc;QAClD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;QAC/D,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;IACtG,CAAC;CACF;AA/ND,oCA+NC"}

package/dist/control-plane.d.ts

@@ -1,6 +1,6 @@
-import type { ControlPlaneClientOptions, WhoamiResult, OrgSignupParams, OrgSignupResult, StartDomainVerificationResult, CheckDomainVerificationResult, CreateOrgParams, CreateOrgResult, Team, Workspace, GatewayRegisterParams, GatewayRegisterResult, Gateway, GatewayRotateResult, GatewayStatus, GatewayConfigUpdate, GatewayConfigResult, GatewayResolution, ProviderCredentialStatus } from './types';
+import type { ControlPlaneClientOptions, WhoamiResult, OrgSignupParams, OrgSignupResult, StartDomainVerificationResult, CheckDomainVerificationResult, CreateOrgParams, CreateOrgResult, Team, Workspace, GatewayRegisterParams, GatewayRegisterResult, Gateway, GatewayRotateResult, GatewayStatus, GatewayConfigUpdate, GatewayConfigResult, GatewayResolution, ProviderCredentialStatus, WorkspaceSettings, WorkspaceSettingsUpdateResult } from './types';
 /**
- * Control-plane management client (LLD #69) — org/team/gateway/credentials
+ * Control-plane management client — org/team/gateway/credentials
  * administration, as distinct from `ClawdeClient`'s data-plane chat calls.
  *
  * Deliberately a separate class, not new methods on `ClawdeClient`:
@@ -11,7 +11,7 @@ import type { ControlPlaneClientOptions, WhoamiResult, OrgSignupParams, OrgSignu
  * on a class whose whole contract today is "one client, one proxy."
  *
  * Every endpoint here is mirrored 1:1 from `tools/cli/src/commands/{org,
- * team,gateway,credentials,whoami}.ts` — the CLI's own already-tested
+ * team,gateway,credentials,settings,whoami}.ts` — the CLI's own already-tested
  * contracts, not re-derived. Endpoints deliberately NOT included: session
  * establishment (`login`/`logout` — an SDK caller supplies `apiKey`
  * directly), and local-environment/terminal concerns (`init`, `doctor`,
@@ -91,6 +91,8 @@ export declare class ControlPlaneClient {
     rotateGatewayToken(gatewayId: string): Promise<GatewayRotateResult>;
     /** DELETE /api/v1/gateways/:id */
     revokeGateway(gatewayId: string, reason?: string): Promise<void>;
+    /** GET /api/v1/gateways/:id/config — the flags set on the gateway and their version, as the gateway pulls them. */
+    getGatewayConfig(gatewayId: string): Promise<GatewayConfigResult>;
     /** PATCH /api/v1/gateways/:id/config */
     setGatewayConfig(gatewayId: string, config: GatewayConfigUpdate): Promise<GatewayConfigResult>;
     /** PATCH /api/v1/workspace/gateway — pass null to clear the override. */
@@ -103,6 +105,20 @@ export declare class ControlPlaneClient {
     }>;
     /** GET /api/v1/workspace/gateway-resolution */
     resolveGateway(): Promise<GatewayResolution>;
+    /** GET /api/v1/workspace/settings — every setting, resolved with its default. */
+    getWorkspaceSettings(): Promise<WorkspaceSettings>;
+    /**
+     * PUT /api/v1/workspace/settings — the route `intutic settings set` calls.
+     *
+     * Only the keys given change; the rest are kept (`featureFlags` merges one
+     * level deeper, so one flag does not switch the others off). The control
+     * plane is the authority on which keys exist and what each accepts: an
+     * unknown key or a bad value is refused with a 400 naming it, a setting the
+     * workspace's plan does not include (the group policy below Biz Org) with a
+     * 403 "Upgrade required", and a member below OWNER or ADMIN with a 403. Each
+     * refusal throws `ClawdeConnectionError` carrying the server's answer.
+     */
+    updateWorkspaceSettings(settings: Record<string, unknown>): Promise<WorkspaceSettingsUpdateResult>;
     /** GET /api/v1/workspace/provider-credentials */
     listProviderCredentials(): Promise<ProviderCredentialStatus[]>;
     /** PUT /api/v1/workspace/provider-credentials/:provider */

package/dist/control-plane.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,yBAAyB,EACzB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,6BAA6B,EAC7B,6BAA6B,EAC7B,eAAe,EACf,eAAe,EACf,IAAI,EACJ,SAAS,EACT,qBAAqB,EACrB,qBAAqB,EACrB,OAAO,EACP,mBAAmB,EACnB,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,wBAAwB,EACzB,MAAM,SAAS,CAAA;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,OAAO,CAAQ;gBAEX,OAAO,EAAE,yBAAyB;YAShC,OAAO;IAuBrB,0BAA0B;IACb,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC;IAI5C;;;;;;;;;;;;OAYG;IACU,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAIzE;;;;;OAKG;IACU,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAI5F;;;OAGG;IACU,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAIpG;;;;;OAKG;IACU,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAIzE,oCAAoC;IACvB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAKtD,qCAAqC;IACxB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE,2CAA2C;IAC9B,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAQrE,4CAA4C;IAC/B,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAI9E,4BAA4B;IACf,eAAe,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAI3F,2BAA2B;IACd,YAAY,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAK/C,sCAAsC;IACzB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAIxE,uCAAuC;IAC1B,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAIhF,kCAAkC;IACrB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7E,wCAAwC;IAC3B,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAI3G,yEAAyE;IAC5D,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAIpG,8EAA8E;IACjE,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAI7G,+CAA+C;IAClC,cAAc,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAIzD,iDAAiD;IACpC,uBAAuB,IAAI,OAAO,CAAC,wBAAwB,EAAE,CAAC;IAQ3E,2DAA2D;IAC9C,qBAAqB,CAChC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,OAAO,CAAC,wBAAwB,CAAC;IAIpC,8DAA8D;IACjD,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGtE"}
+{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,yBAAyB,EACzB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,6BAA6B,EAC7B,6BAA6B,EAC7B,eAAe,EACf,eAAe,EACf,IAAI,EACJ,SAAS,EACT,qBAAqB,EACrB,qBAAqB,EACrB,OAAO,EACP,mBAAmB,EACnB,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,wBAAwB,EACxB,iBAAiB,EACjB,6BAA6B,EAC9B,MAAM,SAAS,CAAA;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,OAAO,CAAQ;gBAEX,OAAO,EAAE,yBAAyB;YAShC,OAAO;IAuBrB,0BAA0B;IACb,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC;IAI5C;;;;;;;;;;;;OAYG;IACU,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAIzE;;;;;OAKG;IACU,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAI5F;;;OAGG;IACU,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAIpG;;;;;OAKG;IACU,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAIzE,oCAAoC;IACvB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAKtD,qCAAqC;IACxB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE,2CAA2C;IAC9B,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAQrE,4CAA4C;IAC/B,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAI9E,4BAA4B;IACf,eAAe,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAI3F,2BAA2B;IACd,YAAY,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAK/C,sCAAsC;IACzB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAIxE,uCAAuC;IAC1B,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAIhF,kCAAkC;IACrB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7E,mHAAmH;IACtG,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAI9E,wCAAwC;IAC3B,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAI3G,yEAAyE;IAC5D,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAIpG,8EAA8E;IACjE,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAI7G,+CAA+C;IAClC,cAAc,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAIzD,iFAAiF;IACpE,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAI/D;;;;;;;;;;OAUG;IACU,uBAAuB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAI/G,iDAAiD;IACpC,uBAAuB,IAAI,OAAO,CAAC,wBAAwB,EAAE,CAAC;IAQ3E,2DAA2D;IAC9C,qBAAqB,CAChC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,OAAO,CAAC,wBAAwB,CAAC;IAIpC,8DAA8D;IACjD,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGtE"}

package/dist/control-plane.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ControlPlaneClient = void 0;
 const errors_1 = require("./errors");
 /**
- * Control-plane management client (LLD #69) — org/team/gateway/credentials
+ * Control-plane management client — org/team/gateway/credentials
  * administration, as distinct from `ClawdeClient`'s data-plane chat calls.
  *
  * Deliberately a separate class, not new methods on `ClawdeClient`:
@@ -14,7 +14,7 @@ const errors_1 = require("./errors");
  * on a class whose whole contract today is "one client, one proxy."
  *
  * Every endpoint here is mirrored 1:1 from `tools/cli/src/commands/{org,
- * team,gateway,credentials,whoami}.ts` — the CLI's own already-tested
+ * team,gateway,credentials,settings,whoami}.ts` — the CLI's own already-tested
  * contracts, not re-derived. Endpoints deliberately NOT included: session
  * establishment (`login`/`logout` — an SDK caller supplies `apiKey`
  * directly), and local-environment/terminal concerns (`init`, `doctor`,
@@ -152,6 +152,10 @@ class ControlPlaneClient {
     async revokeGateway(gatewayId, reason) {
         await this.request('DELETE', `/api/v1/gateways/${encodeURIComponent(gatewayId)}`, { reason });
     }
+    /** GET /api/v1/gateways/:id/config — the flags set on the gateway and their version, as the gateway pulls them. */
+    async getGatewayConfig(gatewayId) {
+        return this.request('GET', `/api/v1/gateways/${encodeURIComponent(gatewayId)}/config`);
+    }
     /** PATCH /api/v1/gateways/:id/config */
     async setGatewayConfig(gatewayId, config) {
         return this.request('PATCH', `/api/v1/gateways/${encodeURIComponent(gatewayId)}/config`, config);
@@ -168,6 +172,24 @@ class ControlPlaneClient {
     async resolveGateway() {
         return this.request('GET', '/api/v1/workspace/gateway-resolution');
     }
+    /** GET /api/v1/workspace/settings — every setting, resolved with its default. */
+    async getWorkspaceSettings() {
+        return this.request('GET', '/api/v1/workspace/settings');
+    }
+    /**
+     * PUT /api/v1/workspace/settings — the route `intutic settings set` calls.
+     *
+     * Only the keys given change; the rest are kept (`featureFlags` merges one
+     * level deeper, so one flag does not switch the others off). The control
+     * plane is the authority on which keys exist and what each accepts: an
+     * unknown key or a bad value is refused with a 400 naming it, a setting the
+     * workspace's plan does not include (the group policy below Biz Org) with a
+     * 403 "Upgrade required", and a member below OWNER or ADMIN with a 403. Each
+     * refusal throws `ClawdeConnectionError` carrying the server's answer.
+     */
+    async updateWorkspaceSettings(settings) {
+        return this.request('PUT', '/api/v1/workspace/settings', settings);
+    }
     /** GET /api/v1/workspace/provider-credentials */
     async listProviderCredentials() {
         const res = await this.request('GET', '/api/v1/workspace/provider-credentials');

package/dist/control-plane.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":";;;AAAA,qCAAgD;AAuBhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAa,kBAAkB;IACrB,MAAM,CAAQ;IACd,OAAO,CAAQ;IAEvB,YAAY,OAAkC;QAC5C,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QAC1E,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,OAAO;YACV,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,wBAAwB,CAAA;IACxF,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc,EAAE,IAAI,GAAG,IAAI;QAChF,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAA;QAC9E,IAAI,IAAI;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,CAAA;QAE5D,IAAI,GAAa,CAAA;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;gBAC1C,MAAM;gBACN,OAAO;gBACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;aAC5D,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,8BAAqB,CAAC,oCAAoC,IAAI,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;QACrG,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAA;YAC1D,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,MAAM,IAAI,IAAI,YAAY,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAA;QACpG,CAAC;QAED,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAA;IAChC,CAAC;IAED,0BAA0B;IACnB,KAAK,CAAC,MAAM;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAA;IAC/C,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,SAAS,CAAC,MAAuB;QAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IACvE,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,uBAAuB,CAAC,MAAc;QACjD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,mCAAmC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,uBAAuB,CAAC,cAAsB;QACzD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,+BAA+B,kBAAkB,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;IACjG,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,SAAS,CAAC,MAAuB;QAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,CAAA;IACrD,CAAC;IAED,oCAAoC;IAC7B,KAAK,CAAC,SAAS,CAAC,KAAa;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAmB,KAAK,EAAE,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC1G,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;IACvB,CAAC;IAED,qCAAqC;IAC9B,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,IAAY;QACjD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1F,CAAC;IAED,2CAA2C;IACpC,KAAK,CAAC,kBAAkB,CAAC,MAAc;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAC5B,KAAK,EACL,iBAAiB,kBAAkB,CAAC,MAAM,CAAC,aAAa,CACzD,CAAA;QACD,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;IACvB,CAAC;IAED,4CAA4C;IACrC,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,IAAY;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,iBAAiB,kBAAkB,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IACjG,CAAC;IAED,4BAA4B;IACrB,KAAK,CAAC,eAAe,CAAC,MAA6B;QACxD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAA;IACzD,CAAC;IAED,2BAA2B;IACpB,KAAK,CAAC,YAAY;QACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAsB,KAAK,EAAE,kBAAkB,CAAC,CAAA;QAC9E,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;IACvB,CAAC;IAED,sCAAsC;IAC/B,KAAK,CAAC,gBAAgB,CAAC,SAAiB;QAC7C,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,oBAAoB,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IACxF,CAAC;IAED,uCAAuC;IAChC,KAAK,CAAC,kBAAkB,CAAC,SAAiB;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,kBAAkB,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IAC7F,CAAC;IAED,kCAAkC;IAC3B,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,MAAe;QAC3D,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,oBAAoB,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/F,CAAC;IAED,wCAAwC;IACjC,KAAK,CAAC,gBAAgB,CAAC,SAAiB,EAAE,MAA2B;QAC1E,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,kBAAkB,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAClG,CAAC;IAED,yEAAyE;IAClE,KAAK,CAAC,sBAAsB,CAAC,SAAwB;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,2BAA2B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,8EAA8E;IACvE,KAAK,CAAC,gBAAgB,CAAC,KAAa,EAAE,SAAwB;QACnE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;IAClG,CAAC;IAED,+CAA+C;IACxC,KAAK,CAAC,cAAc;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,sCAAsC,CAAC,CAAA;IACpE,CAAC;IAED,iDAAiD;IAC1C,KAAK,CAAC,uBAAuB;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAC5B,KAAK,EACL,wCAAwC,CACzC,CAAA;QACD,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;IACvB,CAAC;IAED,2DAA2D;IACpD,KAAK,CAAC,qBAAqB,CAChC,QAAgB,EAChB,MAA8B;QAE9B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,0CAA0C,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IAC9G,CAAC;IAED,8DAA8D;IACvD,KAAK,CAAC,uBAAuB,CAAC,QAAgB;QACnD,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,0CAA0C,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACxG,CAAC;CACF;AAlLD,gDAkLC"}
+{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":";;;AAAA,qCAAgD;AAyBhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAa,kBAAkB;IACrB,MAAM,CAAQ;IACd,OAAO,CAAQ;IAEvB,YAAY,OAAkC;QAC5C,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QAC1E,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,OAAO;YACV,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,wBAAwB,CAAA;IACxF,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc,EAAE,IAAI,GAAG,IAAI;QAChF,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAA;QAC9E,IAAI,IAAI;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,CAAA;QAE5D,IAAI,GAAa,CAAA;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;gBAC1C,MAAM;gBACN,OAAO;gBACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;aAC5D,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,8BAAqB,CAAC,oCAAoC,IAAI,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;QACrG,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAA;YAC1D,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,MAAM,IAAI,IAAI,YAAY,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAA;QACpG,CAAC;QAED,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAA;IAChC,CAAC;IAED,0BAA0B;IACnB,KAAK,CAAC,MAAM;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAA;IAC/C,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,SAAS,CAAC,MAAuB;QAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IACvE,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,uBAAuB,CAAC,MAAc;QACjD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,mCAAmC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,uBAAuB,CAAC,cAAsB;QACzD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,+BAA+B,kBAAkB,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;IACjG,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,SAAS,CAAC,MAAuB;QAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,CAAA;IACrD,CAAC;IAED,oCAAoC;IAC7B,KAAK,CAAC,SAAS,CAAC,KAAa;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAmB,KAAK,EAAE,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC1G,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;IACvB,CAAC;IAED,qCAAqC;IAC9B,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,IAAY;QACjD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1F,CAAC;IAED,2CAA2C;IACpC,KAAK,CAAC,kBAAkB,CAAC,MAAc;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAC5B,KAAK,EACL,iBAAiB,kBAAkB,CAAC,MAAM,CAAC,aAAa,CACzD,CAAA;QACD,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;IACvB,CAAC;IAED,4CAA4C;IACrC,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,IAAY;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,iBAAiB,kBAAkB,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IACjG,CAAC;IAED,4BAA4B;IACrB,KAAK,CAAC,eAAe,CAAC,MAA6B;QACxD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAA;IACzD,CAAC;IAED,2BAA2B;IACpB,KAAK,CAAC,YAAY;QACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAsB,KAAK,EAAE,kBAAkB,CAAC,CAAA;QAC9E,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;IACvB,CAAC;IAED,sCAAsC;IAC/B,KAAK,CAAC,gBAAgB,CAAC,SAAiB;QAC7C,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,oBAAoB,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IACxF,CAAC;IAED,uCAAuC;IAChC,KAAK,CAAC,kBAAkB,CAAC,SAAiB;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,kBAAkB,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IAC7F,CAAC;IAED,kCAAkC;IAC3B,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,MAAe;QAC3D,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,oBAAoB,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/F,CAAC;IAED,mHAAmH;IAC5G,KAAK,CAAC,gBAAgB,CAAC,SAAiB;QAC7C,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,oBAAoB,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IACxF,CAAC;IAED,wCAAwC;IACjC,KAAK,CAAC,gBAAgB,CAAC,SAAiB,EAAE,MAA2B;QAC1E,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,kBAAkB,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAClG,CAAC;IAED,yEAAyE;IAClE,KAAK,CAAC,sBAAsB,CAAC,SAAwB;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,2BAA2B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,8EAA8E;IACvE,KAAK,CAAC,gBAAgB,CAAC,KAAa,EAAE,SAAwB;QACnE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;IAClG,CAAC;IAED,+CAA+C;IACxC,KAAK,CAAC,cAAc;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,sCAAsC,CAAC,CAAA;IACpE,CAAC;IAED,iFAAiF;IAC1E,KAAK,CAAC,oBAAoB;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAA;IAC1D,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,uBAAuB,CAAC,QAAiC;QACpE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,4BAA4B,EAAE,QAAQ,CAAC,CAAA;IACpE,CAAC;IAED,iDAAiD;IAC1C,KAAK,CAAC,uBAAuB;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAC5B,KAAK,EACL,wCAAwC,CACzC,CAAA;QACD,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;IACvB,CAAC;IAED,2DAA2D;IACpD,KAAK,CAAC,qBAAqB,CAChC,QAAgB,EAChB,MAA8B;QAE9B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,0CAA0C,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IAC9G,CAAC;IAED,8DAA8D;IACvD,KAAK,CAAC,uBAAuB,CAAC,QAAgB;QACnD,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,0CAA0C,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACxG,CAAC;CACF;AA3MD,gDA2MC"}

package/dist/errors.d.ts

@@ -16,13 +16,17 @@ export declare class ClawdeVerdictError extends ClawdeError {
 }
 /**
  * The proxy refused the request: a policy block, a reask, a loop run held for
- * review, a spend cap or a DLP block. Never retried — the same request would be
- * refused again. `code` is the proxy's error code and `message` its reason.
+ * review, a spend cap, a DLP block, or a tool call the model made that the
+ * proxy withheld. Never retried — the same request would be refused again.
+ * `code` is the proxy's refusal code, `message` its reason, and `ruleId` the
+ * rule that decided, when the proxy names one (every refusal it answers with
+ * a 200 does).
  */
 export declare class ClawdeBlockedError extends ClawdeVerdictError {
     verdict: RefusalVerdict;
     readonly code: string;
     readonly status: number;
-    constructor(verdict: RefusalVerdict, code: string, status: number, message: string);
+    readonly ruleId: string | undefined;
+    constructor(verdict: RefusalVerdict, code: string, status: number, message: string, ruleId?: string);
 }
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE7C,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,EAAE,MAAM;CAI5B;AAED,uGAAuG;AACvG,qBAAa,qBAAsB,SAAQ,WAAW;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,yBAA0B,SAAQ,WAAW;gBAC5C,OAAO,EAAE,MAAM;CAI5B;AAED,2HAA2H;AAC3H,qBAAa,kBAAmB,SAAQ,WAAW;IAC1C,OAAO,EAAE,MAAM,CAAA;gBAEV,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK7C;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,kBAAkB;IACzC,OAAO,EAAE,cAAc,CAAA;IACtC,SAAgB,IAAI,EAAE,MAAM,CAAA;IAC5B,SAAgB,MAAM,EAAE,MAAM,CAAA;gBAElB,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAMnF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE7C,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,EAAE,MAAM;CAI5B;AAED,uGAAuG;AACvG,qBAAa,qBAAsB,SAAQ,WAAW;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,yBAA0B,SAAQ,WAAW;gBAC5C,OAAO,EAAE,MAAM;CAI5B;AAED,2HAA2H;AAC3H,qBAAa,kBAAmB,SAAQ,WAAW;IAC1C,OAAO,EAAE,MAAM,CAAA;gBAEV,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK7C;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAmB,SAAQ,kBAAkB;IACzC,OAAO,EAAE,cAAc,CAAA;IACtC,SAAgB,IAAI,EAAE,MAAM,CAAA;IAC5B,SAAgB,MAAM,EAAE,MAAM,CAAA;IAC9B,SAAgB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;gBAE9B,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAOpG"}

package/dist/errors.js

@@ -35,17 +35,22 @@ class ClawdeVerdictError extends ClawdeError {
 exports.ClawdeVerdictError = ClawdeVerdictError;
 /**
  * The proxy refused the request: a policy block, a reask, a loop run held for
- * review, a spend cap or a DLP block. Never retried — the same request would be
- * refused again. `code` is the proxy's error code and `message` its reason.
+ * review, a spend cap, a DLP block, or a tool call the model made that the
+ * proxy withheld. Never retried — the same request would be refused again.
+ * `code` is the proxy's refusal code, `message` its reason, and `ruleId` the
+ * rule that decided, when the proxy names one (every refusal it answers with
+ * a 200 does).
  */
 class ClawdeBlockedError extends ClawdeVerdictError {
     code;
     status;
-    constructor(verdict, code, status, message) {
+    ruleId;
+    constructor(verdict, code, status, message, ruleId) {
         super(verdict, message);
         this.name = 'ClawdeBlockedError';
         this.code = code;
         this.status = status;
+        this.ruleId = ruleId;
     }
 }
 exports.ClawdeBlockedError = ClawdeBlockedError;

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";;;AAEA,MAAa,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,aAAa,CAAA;IAC3B,CAAC;CACF;AALD,kCAKC;AAED,uGAAuG;AACvG,MAAa,qBAAsB,SAAQ,WAAW;IACpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAA;IACrC,CAAC;CACF;AALD,sDAKC;AAED,MAAa,yBAA0B,SAAQ,WAAW;IACxD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF;AALD,8DAKC;AAED,2HAA2H;AAC3H,MAAa,kBAAmB,SAAQ,WAAW;IAC1C,OAAO,CAAQ;IAEtB,YAAY,OAAe,EAAE,OAAe;QAC1C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;CACF;AARD,gDAQC;AAED;;;;GAIG;AACH,MAAa,kBAAmB,SAAQ,kBAAkB;IAExC,IAAI,CAAQ;IACZ,MAAM,CAAQ;IAE9B,YAAY,OAAuB,EAAE,IAAY,EAAE,MAAc,EAAE,OAAe;QAChF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAXD,gDAWC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";;;AAEA,MAAa,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,aAAa,CAAA;IAC3B,CAAC;CACF;AALD,kCAKC;AAED,uGAAuG;AACvG,MAAa,qBAAsB,SAAQ,WAAW;IACpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAA;IACrC,CAAC;CACF;AALD,sDAKC;AAED,MAAa,yBAA0B,SAAQ,WAAW;IACxD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF;AALD,8DAKC;AAED,2HAA2H;AAC3H,MAAa,kBAAmB,SAAQ,WAAW;IAC1C,OAAO,CAAQ;IAEtB,YAAY,OAAe,EAAE,OAAe;QAC1C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;CACF;AARD,gDAQC;AAED;;;;;;;GAOG;AACH,MAAa,kBAAmB,SAAQ,kBAAkB;IAExC,IAAI,CAAQ;IACZ,MAAM,CAAQ;IACd,MAAM,CAAoB;IAE1C,YAAY,OAAuB,EAAE,IAAY,EAAE,MAAc,EAAE,OAAe,EAAE,MAAe;QACjG,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAbD,gDAaC"}

package/dist/git-context.d.ts

@@ -0,0 +1,27 @@
+export interface GitContext {
+    /** The `origin` remote as `host/path`, never with credentials. */
+    repoUrl?: string;
+    branchName?: string;
+    commitHash?: string;
+}
+/**
+ * A remote reduced to `host/path`: lower-cased host, no scheme, user, password,
+ * port, query, fragment or `.git` suffix; null for anything that is not a
+ * network remote. A copy of `normalizeGitRemote` in `@intutic/shared-types`
+ * (this package has no dependencies), held to the same vectors in
+ * `packages/shared-types/fixtures/git-remote-vectors.json`. Normalised here,
+ * before it leaves the machine: a CI checkout's remote embeds a token.
+ */
+export declare function normalizeGitRemote(remote: string): string | null;
+/**
+ * The git context of `cwd`, best effort: a directory that is not a
+ * repository, or a machine without git, gives an empty object.
+ *
+ * A detached HEAD names no branch. That is how CI checks out a pull request,
+ * so the branch then comes from `GITHUB_HEAD_REF` (GitHub Actions' pull
+ * request head branch), else `fallbackBranch` (`resolveContext().gitBranch`).
+ * Values the control plane's session route would refuse are left out rather
+ * than failing the registration.
+ */
+export declare function resolveGitContext(cwd: string, fallbackBranch?: string): Promise<GitContext>;
+//# sourceMappingURL=git-context.d.ts.map

package/dist/git-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-context.d.ts","sourceRoot":"","sources":["../src/git-context.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAKD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA4BhE;AA0BD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAcjG"}

package/dist/git-context.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeGitRemote = normalizeGitRemote;
+exports.resolveGitContext = resolveGitContext;
+/**
+ * The repository, branch and HEAD commit a process runs in: what cost per
+ * branch, per commit and per pull request is attributed by.
+ *
+ * The control plane copies a session's git context onto every trace it
+ * records under that session (`POST /api/v1/sessions` takes `repoUrl`,
+ * `branchName` and `commitHash`, the same fields the sync daemon reports), so
+ * this is what `ClawdeClient` registers its session with. Without it, SDK
+ * traffic is filed under "No git context".
+ *
+ * @module
+ */
+const child_process_1 = require("child_process");
+/** Schemes git can fetch over the network. `file:` and local paths are not repositories anyone else can name. */
+const NETWORK_SCHEMES = new Set(['http:', 'https:', 'ssh:', 'git:', 'git+ssh:', 'ssh+git:']);
+/**
+ * A remote reduced to `host/path`: lower-cased host, no scheme, user, password,
+ * port, query, fragment or `.git` suffix; null for anything that is not a
+ * network remote. A copy of `normalizeGitRemote` in `@intutic/shared-types`
+ * (this package has no dependencies), held to the same vectors in
+ * `packages/shared-types/fixtures/git-remote-vectors.json`. Normalised here,
+ * before it leaves the machine: a CI checkout's remote embeds a token.
+ */
+function normalizeGitRemote(remote) {
+    const raw = remote.trim();
+    if (!raw || raw.includes('\\') || /^[a-zA-Z]:\//.test(raw))
+        return null;
+    let host;
+    let path;
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(raw)) {
+        let url;
+        try {
+            url = new URL(raw);
+        }
+        catch {
+            return null;
+        }
+        if (!NETWORK_SCHEMES.has(url.protocol))
+            return null;
+        host = url.hostname;
+        path = url.pathname;
+    }
+    else {
+        // scp-like: [user[:password]@]host:path. A colon after the first slash
+        // makes it a local path, which is how git itself tells them apart.
+        const scp = /^(?:[^@/]+@)?([^:/\s]+):([^\s]+)$/.exec(raw);
+        if (!scp)
+            return null;
+        host = scp[1];
+        path = cutAtQueryOrFragment(scp[2]);
+    }
+    path = trimSlashes(trimSlashes(path).replace(/\.git$/, ''));
+    if (!host || !path)
+        return null;
+    return `${host.toLowerCase()}/${path}`;
+}
+// String scans rather than regexes: a remote is input the developer controls,
+// and `[?#].*$` / `\/+$` backtrack quadratically on long runs.
+function cutAtQueryOrFragment(s) {
+    for (let i = 0; i < s.length; i++)
+        if (s[i] === '?' || s[i] === '#')
+            return s.slice(0, i);
+    return s;
+}
+function trimSlashes(s) {
+    let start = 0;
+    let end = s.length;
+    while (start < end && s[start] === '/')
+        start++;
+    while (end > start && s[end - 1] === '/')
+        end--;
+    return s.slice(start, end);
+}
+function git(cwd, ...args) {
+    return new Promise((resolve) => {
+        (0, child_process_1.execFile)('git', args, { cwd, timeout: 3_000 }, (err, stdout) => {
+            const out = err ? '' : String(stdout).trim();
+            resolve(out.length > 0 ? out : undefined);
+        });
+    });
+}
+/**
+ * The git context of `cwd`, best effort: a directory that is not a
+ * repository, or a machine without git, gives an empty object.
+ *
+ * A detached HEAD names no branch. That is how CI checks out a pull request,
+ * so the branch then comes from `GITHUB_HEAD_REF` (GitHub Actions' pull
+ * request head branch), else `fallbackBranch` (`resolveContext().gitBranch`).
+ * Values the control plane's session route would refuse are left out rather
+ * than failing the registration.
+ */
+async function resolveGitContext(cwd, fallbackBranch) {
+    const [remote, head, commit] = await Promise.all([
+        git(cwd, 'remote', 'get-url', 'origin'),
+        git(cwd, 'rev-parse', '--abbrev-ref', 'HEAD'),
+        git(cwd, 'rev-parse', 'HEAD'),
+    ]);
+    const repoUrl = remote ? normalizeGitRemote(remote) : null;
+    const branchName = (head !== 'HEAD' ? head : undefined) || process.env.GITHUB_HEAD_REF || fallbackBranch;
+    const context = {};
+    if (repoUrl && repoUrl.length <= 512)
+        context.repoUrl = repoUrl;
+    if (branchName && branchName.length <= 256)
+        context.branchName = branchName;
+    // A SHA-1 object id; a SHA-256 repository's 64-character id does not fit the column.
+    if (commit && /^[0-9a-f]{40}$/.test(commit))
+        context.commitHash = commit;
+    return context;
+}
+//# sourceMappingURL=git-context.js.map

package/dist/git-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-context.js","sourceRoot":"","sources":["../src/git-context.ts"],"names":[],"mappings":";;AAgCA,gDA4BC;AAoCD,8CAcC;AA9GD;;;;;;;;;;;GAWG;AACH,iDAAwC;AASxC,iHAAiH;AACjH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAA;AAE5F;;;;;;;GAOG;AACH,SAAgB,kBAAkB,CAAC,MAAc;IAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;IACzB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAEvE,IAAI,IAAY,CAAA;IAChB,IAAI,IAAY,CAAA;IAChB,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,GAAQ,CAAA;QACZ,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAA;QACnD,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAA;QACnB,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAA;IACrB,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,GAAG,GAAG,mCAAmC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACzD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QACb,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACrC,CAAC;IAED,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAA;IAC3D,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAC/B,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAA;AACxC,CAAC;AAED,8EAA8E;AAC9E,+DAA+D;AAC/D,SAAS,oBAAoB,CAAC,CAAS;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACzF,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAA;IAClB,OAAO,KAAK,GAAG,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG;QAAE,KAAK,EAAE,CAAA;IAC/C,OAAO,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,EAAE,CAAA;IAC/C,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;AAC5B,CAAC;AAED,SAAS,GAAG,CAAC,GAAW,EAAE,GAAG,IAAc;IACzC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAA,wBAAQ,EAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;YAC5C,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC3C,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,cAAuB;IAC1E,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/C,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;QACvC,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC;QAC7C,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1D,MAAM,UAAU,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,cAAc,CAAA;IACxG,MAAM,OAAO,GAAe,EAAE,CAAA;IAC9B,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAA;IAC/D,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAA;IAC3E,qFAAqF;IACrF,IAAI,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,UAAU,GAAG,MAAM,CAAA;IACxE,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export { ClawdeClient } from './client';
 export { ControlPlaneClient } from './control-plane';
 export * from './types';
 export * from './errors';
+export { PROXY_REFUSALS, REFUSAL_HEADER, REFUSAL_RULE_HEADER, STREAM_REFUSAL_MARKER, streamRefusal, type ProxyRefusal, } from './refusals';
 export { resolveContext } from './context-resolver';
 export { normalizeRequest, normalizeResponse } from './schema-enforcer';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,cAAc,SAAS,CAAA;AACvB,cAAc,UAAU,CAAA;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,cAAc,SAAS,CAAA;AACvB,cAAc,UAAU,CAAA;AACxB,OAAO,EACL,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,EACb,KAAK,YAAY,GAClB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/index.js

@@ -14,13 +14,19 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.normalizeResponse = exports.normalizeRequest = exports.resolveContext = exports.ControlPlaneClient = exports.ClawdeClient = void 0;
+exports.normalizeResponse = exports.normalizeRequest = exports.resolveContext = exports.streamRefusal = exports.STREAM_REFUSAL_MARKER = exports.REFUSAL_RULE_HEADER = exports.REFUSAL_HEADER = exports.PROXY_REFUSALS = exports.ControlPlaneClient = exports.ClawdeClient = void 0;
 var client_1 = require("./client");
 Object.defineProperty(exports, "ClawdeClient", { enumerable: true, get: function () { return client_1.ClawdeClient; } });
 var control_plane_1 = require("./control-plane");
 Object.defineProperty(exports, "ControlPlaneClient", { enumerable: true, get: function () { return control_plane_1.ControlPlaneClient; } });
 __exportStar(require("./types"), exports);
 __exportStar(require("./errors"), exports);
+var refusals_1 = require("./refusals");
+Object.defineProperty(exports, "PROXY_REFUSALS", { enumerable: true, get: function () { return refusals_1.PROXY_REFUSALS; } });
+Object.defineProperty(exports, "REFUSAL_HEADER", { enumerable: true, get: function () { return refusals_1.REFUSAL_HEADER; } });
+Object.defineProperty(exports, "REFUSAL_RULE_HEADER", { enumerable: true, get: function () { return refusals_1.REFUSAL_RULE_HEADER; } });
+Object.defineProperty(exports, "STREAM_REFUSAL_MARKER", { enumerable: true, get: function () { return refusals_1.STREAM_REFUSAL_MARKER; } });
+Object.defineProperty(exports, "streamRefusal", { enumerable: true, get: function () { return refusals_1.streamRefusal; } });
 var context_resolver_1 = require("./context-resolver");
 Object.defineProperty(exports, "resolveContext", { enumerable: true, get: function () { return context_resolver_1.resolveContext; } });
 var schema_enforcer_1 = require("./schema-enforcer");

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,mCAAuC;AAA9B,sGAAA,YAAY,OAAA;AACrB,iDAAoD;AAA3C,mHAAA,kBAAkB,OAAA;AAC3B,0CAAuB;AACvB,2CAAwB;AACxB,uDAAmD;AAA1C,kHAAA,cAAc,OAAA;AACvB,qDAAuE;AAA9D,mHAAA,gBAAgB,OAAA;AAAE,oHAAA,iBAAiB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,mCAAuC;AAA9B,sGAAA,YAAY,OAAA;AACrB,iDAAoD;AAA3C,mHAAA,kBAAkB,OAAA;AAC3B,0CAAuB;AACvB,2CAAwB;AACxB,uCAOmB;AANjB,0GAAA,cAAc,OAAA;AACd,0GAAA,cAAc,OAAA;AACd,+GAAA,mBAAmB,OAAA;AACnB,iHAAA,qBAAqB,OAAA;AACrB,yGAAA,aAAa,OAAA;AAGf,uDAAmD;AAA1C,kHAAA,cAAc,OAAA;AACvB,qDAAuE;AAA9D,mHAAA,gBAAgB,OAAA;AAAE,oHAAA,iBAAiB,OAAA"}

package/dist/refusals.d.ts

@@ -1,17 +1,25 @@
 import type { RefusalVerdict } from './types';
 /**
- * The proxy's governance refusals: the `error.type` of its JSON error body
- * (`{"error": {"type", "message"}}`, `json_error` in packages/proxy/src/proxy.rs),
- * the status it always pairs that type with, and the verdict it represents.
+ * The proxy's governance refusals, by code, with the status the proxy sends
+ * each with and the verdict it represents.
  *
- * Matching on the pair rather than the status alone matters because the same
- * statuses also carry errors that are not decisions: a provider's own 429 rate
- * limit, a 403 for a key used against the wrong workspace, a 400 for a malformed
- * body. Those are not refusals and must not be reported as one.
+ * Most arrive as an error: the code is the `error.type` of the proxy's JSON
+ * error body (`{"error": {"type", "message"}}`, `json_error` in
+ * packages/proxy/src/proxy.rs). Matching on the status and the code together
+ * matters because the same statuses also carry errors that are not decisions:
+ * a provider's own 429 rate limit, a 403 for a key used against the wrong
+ * workspace, a 400 for a malformed body. Those are not refusals and must not
+ * be reported as one.
  *
- * `__tests__/refusals.test.ts` checks this table against proxy.rs, so a refusal
- * the proxy adds or renames fails the build instead of silently turning back
- * into a retried connection error.
+ * The rest (status 200, and `COST_GATE_EXCEEDED` on a non-streaming request)
+ * arrive in band: an assistant turn explaining the refusal, named by
+ * `REFUSAL_HEADER`, or on a stream by the `STREAM_REFUSAL_MARKER` comment line.
+ *
+ * `__tests__/refusals.test.ts` holds this table to
+ * packages/shared-types/fixtures/refusal-codes.json, the one list the proxy
+ * and the Python SDK are held to as well, so a refusal the proxy adds or
+ * renames fails the build instead of silently turning back into an `allow` or
+ * a retried connection error.
  */
 export declare const PROXY_REFUSALS: Readonly<Record<string, {
     status: number;
@@ -21,7 +29,32 @@ export interface ProxyRefusal {
     verdict: RefusalVerdict;
     code: string;
     message: string;
+    /** The rule that decided, for a refusal the proxy answered in band. */
+    ruleId?: string;
 }
 /** The refusal an error response carries, or `null` when it is any other kind of failure. */
 export declare function parseRefusal(status: number, body: string): ProxyRefusal | null;
+/**
+ * The headers the proxy sets on a 200 that is a refusal in the shape of an
+ * answer: the response gate withheld a tool call the model made, output DLP
+ * withheld the body, or the cost-prediction gate answered instead of the
+ * model. The first names the refusal's code, the second the rule that decided.
+ */
+export declare const REFUSAL_HEADER = "x-intutic-refusal";
+export declare const REFUSAL_RULE_HEADER = "x-intutic-refusal-rule";
+/** The refusal a 2xx response names in `REFUSAL_HEADER`, or `null` for a real answer. */
+export declare function headerRefusal(code: string | null, ruleId: string | null, message: string): ProxyRefusal | null;
+/**
+ * The prefix of the SSE comment line that names a refusal on a stream:
+ * `: intutic-refusal {"code", "rule", "message"}`. The response headers went
+ * out before the refusal happened, so a stream says it in band; every SSE
+ * parser skips comment lines, so clients that do not look for it are
+ * unaffected.
+ */
+export declare const STREAM_REFUSAL_MARKER = ": intutic-refusal ";
+/**
+ * The refusal named anywhere in a stream's text, or `null` when there is
+ * none. Pass the whole body, or each line as it arrives.
+ */
+export declare function streamRefusal(text: string): ProxyRefusal | null;
 //# sourceMappingURL=refusals.d.ts.map

package/dist/refusals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refusals.d.ts","sourceRoot":"","sources":["../src/refusals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE7C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC,CAUhG,CAAA;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,cAAc,CAAA;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,6FAA6F;AAC7F,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAe9E"}
+{"version":3,"file":"refusals.d.ts","sourceRoot":"","sources":["../src/refusals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE7C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC,CAiBhG,CAAA;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,cAAc,CAAA;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,6FAA6F;AAC7F,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAe9E;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,sBAAsB,CAAA;AACjD,eAAO,MAAM,mBAAmB,2BAA2B,CAAA;AAE3D,yFAAyF;AACzF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAG9G;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,uBAAuB,CAAA;AAEzD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAiB/D"}

package/dist/refusals.js

@@ -1,31 +1,48 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PROXY_REFUSALS = void 0;
+exports.STREAM_REFUSAL_MARKER = exports.REFUSAL_RULE_HEADER = exports.REFUSAL_HEADER = exports.PROXY_REFUSALS = void 0;
 exports.parseRefusal = parseRefusal;
+exports.headerRefusal = headerRefusal;
+exports.streamRefusal = streamRefusal;
 /**
- * The proxy's governance refusals: the `error.type` of its JSON error body
- * (`{"error": {"type", "message"}}`, `json_error` in packages/proxy/src/proxy.rs),
- * the status it always pairs that type with, and the verdict it represents.
+ * The proxy's governance refusals, by code, with the status the proxy sends
+ * each with and the verdict it represents.
  *
- * Matching on the pair rather than the status alone matters because the same
- * statuses also carry errors that are not decisions: a provider's own 429 rate
- * limit, a 403 for a key used against the wrong workspace, a 400 for a malformed
- * body. Those are not refusals and must not be reported as one.
+ * Most arrive as an error: the code is the `error.type` of the proxy's JSON
+ * error body (`{"error": {"type", "message"}}`, `json_error` in
+ * packages/proxy/src/proxy.rs). Matching on the status and the code together
+ * matters because the same statuses also carry errors that are not decisions:
+ * a provider's own 429 rate limit, a 403 for a key used against the wrong
+ * workspace, a 400 for a malformed body. Those are not refusals and must not
+ * be reported as one.
  *
- * `__tests__/refusals.test.ts` checks this table against proxy.rs, so a refusal
- * the proxy adds or renames fails the build instead of silently turning back
- * into a retried connection error.
+ * The rest (status 200, and `COST_GATE_EXCEEDED` on a non-streaming request)
+ * arrive in band: an assistant turn explaining the refusal, named by
+ * `REFUSAL_HEADER`, or on a stream by the `STREAM_REFUSAL_MARKER` comment line.
+ *
+ * `__tests__/refusals.test.ts` holds this table to
+ * packages/shared-types/fixtures/refusal-codes.json, the one list the proxy
+ * and the Python SDK are held to as well, so a refusal the proxy adds or
+ * renames fails the build instead of silently turning back into an `allow` or
+ * a retried connection error.
  */
 exports.PROXY_REFUSALS = {
     policy_denied: { status: 403, verdict: 'kill' },
     model_not_allowed: { status: 403, verdict: 'kill' },
     LOOP_RUN_TERMINATED: { status: 403, verdict: 'kill' },
     LOOP_RUN_PENDING_REVIEW: { status: 403, verdict: 'hold' },
+    policy_held: { status: 403, verdict: 'hold' },
     policy_reask: { status: 409, verdict: 'reask' },
+    GOVERNANCE_UNAVAILABLE: { status: 403, verdict: 'kill' },
     BUDGET_EXCEEDED: { status: 429, verdict: 'kill' },
     OVERAGE_HARD_CAP_EXCEEDED: { status: 429, verdict: 'kill' },
     COST_GATE_EXCEEDED: { status: 402, verdict: 'kill' },
     dlp_policy_violation: { status: 400, verdict: 'kill' },
+    TOOL_DENIED: { status: 200, verdict: 'kill' },
+    SSO_GROUP: { status: 200, verdict: 'kill' },
+    SQL_GUARD: { status: 200, verdict: 'kill' },
+    RESPONSE_UNPARSEABLE: { status: 200, verdict: 'kill' },
+    OUTPUT_DLP: { status: 200, verdict: 'kill' },
 };
 /** The refusal an error response carries, or `null` when it is any other kind of failure. */
 function parseRefusal(status, body) {
@@ -47,4 +64,58 @@ function parseRefusal(status, body) {
         message: typeof error.message === 'string' ? error.message : error.type,
     };
 }
+/**
+ * The headers the proxy sets on a 200 that is a refusal in the shape of an
+ * answer: the response gate withheld a tool call the model made, output DLP
+ * withheld the body, or the cost-prediction gate answered instead of the
+ * model. The first names the refusal's code, the second the rule that decided.
+ */
+exports.REFUSAL_HEADER = 'x-intutic-refusal';
+exports.REFUSAL_RULE_HEADER = 'x-intutic-refusal-rule';
+/** The refusal a 2xx response names in `REFUSAL_HEADER`, or `null` for a real answer. */
+function headerRefusal(code, ruleId, message) {
+    if (!code)
+        return null;
+    return named(code, ruleId || undefined, message);
+}
+/**
+ * The prefix of the SSE comment line that names a refusal on a stream:
+ * `: intutic-refusal {"code", "rule", "message"}`. The response headers went
+ * out before the refusal happened, so a stream says it in band; every SSE
+ * parser skips comment lines, so clients that do not look for it are
+ * unaffected.
+ */
+exports.STREAM_REFUSAL_MARKER = ': intutic-refusal ';
+/**
+ * The refusal named anywhere in a stream's text, or `null` when there is
+ * none. Pass the whole body, or each line as it arrives.
+ */
+function streamRefusal(text) {
+    for (const line of text.split('\n')) {
+        if (!line.startsWith(exports.STREAM_REFUSAL_MARKER))
+            continue;
+        let payload;
+        try {
+            payload = JSON.parse(line.slice(exports.STREAM_REFUSAL_MARKER.length));
+        }
+        catch {
+            continue;
+        }
+        if (typeof payload?.code !== 'string')
+            continue;
+        return named(payload.code, typeof payload.rule === 'string' ? payload.rule : undefined, typeof payload.message === 'string' ? payload.message : '');
+    }
+    return null;
+}
+function named(code, ruleId, message) {
+    // A code this SDK version does not know is still a refusal: the proxy only
+    // names a response it did not let through.
+    const known = exports.PROXY_REFUSALS[code];
+    return {
+        verdict: known?.verdict ?? 'kill',
+        code,
+        message: message || code,
+        ...(ruleId ? { ruleId } : {}),
+    };
+}
 //# sourceMappingURL=refusals.js.map

package/dist/refusals.js.map

@@ -1 +1 @@
-{"version":3,"file":"refusals.js","sourceRoot":"","sources":["../src/refusals.ts"],"names":[],"mappings":";;;AAmCA,oCAeC;AAhDD;;;;;;;;;;;;;GAaG;AACU,QAAA,cAAc,GAA0E;IACnG,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;IAC/C,iBAAiB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;IACnD,mBAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;IACrD,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;IACzD,YAAY,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE;IAC/C,eAAe,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;IACjD,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;IAC3D,kBAAkB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;IACpD,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;CACvD,CAAA;AAQD,6FAA6F;AAC7F,SAAgB,YAAY,CAAC,MAAc,EAAE,IAAY;IACvD,IAAI,KAAwD,CAAA;IAC5D,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACzD,MAAM,KAAK,GAAG,sBAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IAClD,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI;KACxE,CAAA;AACH,CAAC"}
+{"version":3,"file":"refusals.js","sourceRoot":"","sources":["../src/refusals.ts"],"names":[],"mappings":";;;AAoDA,oCAeC;AAYD,sCAGC;AAeD,sCAiBC;AAhHD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACU,QAAA,cAAc,GAA0E;IACnG,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;IAC/C,iBAAiB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;IACnD,mBAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;IACrD,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;IACzD,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;IAC7C,YAAY,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE;IAC/C,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;IACxD,eAAe,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;IACjD,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;IAC3D,kBAAkB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;IACpD,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;IACtD,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;IAC7C,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;IAC3C,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;IAC3C,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;IACtD,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;CAC7C,CAAA;AAUD,6FAA6F;AAC7F,SAAgB,YAAY,CAAC,MAAc,EAAE,IAAY;IACvD,IAAI,KAAwD,CAAA;IAC5D,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACzD,MAAM,KAAK,GAAG,sBAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IAClD,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI;KACxE,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACU,QAAA,cAAc,GAAG,mBAAmB,CAAA;AACpC,QAAA,mBAAmB,GAAG,wBAAwB,CAAA;AAE3D,yFAAyF;AACzF,SAAgB,aAAa,CAAC,IAAmB,EAAE,MAAqB,EAAE,OAAe;IACvF,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,OAAO,KAAK,CAAC,IAAI,EAAE,MAAM,IAAI,SAAS,EAAE,OAAO,CAAC,CAAA;AAClD,CAAC;AAED;;;;;;GAMG;AACU,QAAA,qBAAqB,GAAG,oBAAoB,CAAA;AAEzD;;;GAGG;AACH,SAAgB,aAAa,CAAC,IAAY;IACxC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,6BAAqB,CAAC;YAAE,SAAQ;QACrD,IAAI,OAA8D,CAAA;QAClE,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,6BAAqB,CAAC,MAAM,CAAC,CAAC,CAAA;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QACD,IAAI,OAAO,OAAO,EAAE,IAAI,KAAK,QAAQ;YAAE,SAAQ;QAC/C,OAAO,KAAK,CACV,OAAO,CAAC,IAAI,EACZ,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAC3D,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAC3D,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,KAAK,CAAC,IAAY,EAAE,MAA0B,EAAE,OAAe;IACtE,2EAA2E;IAC3E,2CAA2C;IAC3C,MAAM,KAAK,GAAG,sBAAc,CAAC,IAAI,CAAC,CAAA;IAClC,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,MAAM;QACjC,IAAI;QACJ,OAAO,EAAE,OAAO,IAAI,IAAI;QACxB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAA;AACH,CAAC"}

package/dist/types.d.ts

@@ -110,10 +110,12 @@ export interface BudgetCheckResult {
 export type EventCallback = (data: {
     /** One of the `RefusalVerdict` values; typed wider so listeners written against 2.0 compile. */
     verdict: Verdict | LegacyVerdict;
-    /** The proxy's error code, e.g. `policy_denied` or `OVERAGE_HARD_CAP_EXCEEDED`. */
+    /** The proxy's refusal code, e.g. `policy_denied`, `OVERAGE_HARD_CAP_EXCEEDED` or `TOOL_DENIED`. */
     code: string;
     status: number;
     message: string;
+    /** The rule that decided, when the proxy names one. */
+    ruleId?: string;
     /** @deprecated Never set. */
     budgetRemainingUsd?: number;
     /** @deprecated Never set. */
@@ -242,15 +244,28 @@ export interface GatewayStatus {
     litellmReachable: boolean | null;
     lastError: string | null;
     reportedAt: string | null;
+    /** The config version the gateway reported running in its last heartbeat; null when unreachable or not reported. */
+    appliedConfigVersion: number | null;
+    /** The version the latest config change produced; 0 before any. The gateway pulls it on its next heartbeat. */
+    desiredConfigVersion: number;
 }
 export interface GatewayConfigUpdate {
     requireVk?: boolean;
     requireProvisionedKey?: boolean;
 }
 export interface GatewayConfigResult {
+    /** The flags set on the gateway (`requireVk`, `requireProvisionedKey`). One never set is absent: the gateway runs its deployment's own value. */
     config: Record<string, unknown>;
     configVersion: number;
 }
+export interface WorkspaceSettings {
+    workspaceId: string;
+    /** Every setting, resolved with its default. */
+    settings: Record<string, unknown>;
+}
+export interface WorkspaceSettingsUpdateResult extends WorkspaceSettings {
+    updated: true;
+}
 export interface GatewayResolution {
     source: 'workspace' | 'org' | 'default';
     gateway: {

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAA;IAC5C,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC,OAAO,kBAAkB,EAAE,aAAa,CAAC,CAAA;CAClE;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAA;IAC9C,OAAO,EAAE,MAAM,GAAG,GAAG,EAAE,CAAA;IACvB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,GAAG,EAAE,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,WAAW,EAAE,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,GAAG,EAAE,CAAA;IACb,WAAW,CAAC,EAAE,GAAG,CAAA;IACjB,eAAe,CAAC,EAAE,GAAG,CAAA;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAA;QACb,OAAO,EAAE,WAAW,CAAA;QACpB,aAAa,EAAE,MAAM,CAAA;KACtB,EAAE,CAAA;IACH,KAAK,CAAC,EAAE;QACN,aAAa,EAAE,MAAM,CAAA;QACrB,iBAAiB,EAAE,MAAM,CAAA;QACzB,YAAY,EAAE,MAAM,CAAA;KACrB,CAAA;IACD,yFAAyF;IACzF,OAAO,CAAC,EAAE,OAAO,GAAG,aAAa,CAAA;IACjC,iGAAiG;IACjG,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,iGAAiG;IACjG,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAA;AAEtD,8EAA8E;AAC9E,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,cAAc,CAAA;AAE9C;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAA;AAE3D,6BAA6B;AAC7B,MAAM,MAAM,YAAY,GAAG,cAAc,GAAG,aAAa,CAAA;AAEzD,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,mFAAmF;IACnF,eAAe,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;IACxD,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,mFAAmF;AACnF,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE;IACjC,gGAAgG;IAChG,OAAO,EAAE,OAAO,GAAG,aAAa,CAAA;IAChC,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,6BAA6B;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,6BAA6B;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAI1B,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAA;IACzE,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAA;IAC3E,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAA;IACjF,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,6BAA6B;IAC5C,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,6BAA6B;IAC5C,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAA;IACvD,aAAa,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,MAAM,CAAA;IACtB,wGAAwG;IACxG,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,IAAI;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,gBAAgB,EAAE,QAAQ,GAAG,YAAY,GAAG,YAAY,CAAA;CACzD;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,gBAAgB,EAAE,MAAM,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,gBAAgB,EAAE,MAAM,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAA;IACb,uBAAuB,EAAE,MAAM,CAAA;IAC/B,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,aAAa,GAAG,SAAS,CAAA;IACzD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,gBAAgB,EAAE,OAAO,GAAG,IAAI,CAAA;IAChC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,qBAAqB,CAAC,EAAE,OAAO,CAAA;CAChC;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,WAAW,GAAG,KAAK,GAAG,SAAS,CAAA;IACvC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IAC7F,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,OAAO,CAAA;IACpB,WAAW,EAAE,OAAO,CAAA;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAA;IAC5C,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC,OAAO,kBAAkB,EAAE,aAAa,CAAC,CAAA;CAClE;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAA;IAC9C,OAAO,EAAE,MAAM,GAAG,GAAG,EAAE,CAAA;IACvB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,GAAG,EAAE,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,WAAW,EAAE,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,GAAG,EAAE,CAAA;IACb,WAAW,CAAC,EAAE,GAAG,CAAA;IACjB,eAAe,CAAC,EAAE,GAAG,CAAA;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAA;QACb,OAAO,EAAE,WAAW,CAAA;QACpB,aAAa,EAAE,MAAM,CAAA;KACtB,EAAE,CAAA;IACH,KAAK,CAAC,EAAE;QACN,aAAa,EAAE,MAAM,CAAA;QACrB,iBAAiB,EAAE,MAAM,CAAA;QACzB,YAAY,EAAE,MAAM,CAAA;KACrB,CAAA;IACD,yFAAyF;IACzF,OAAO,CAAC,EAAE,OAAO,GAAG,aAAa,CAAA;IACjC,iGAAiG;IACjG,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,iGAAiG;IACjG,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAA;AAEtD,8EAA8E;AAC9E,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,cAAc,CAAA;AAE9C;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAA;AAE3D,6BAA6B;AAC7B,MAAM,MAAM,YAAY,GAAG,cAAc,GAAG,aAAa,CAAA;AAEzD,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,mFAAmF;IACnF,eAAe,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;IACxD,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,mFAAmF;AACnF,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE;IACjC,gGAAgG;IAChG,OAAO,EAAE,OAAO,GAAG,aAAa,CAAA;IAChC,oGAAoG;IACpG,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,6BAA6B;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,6BAA6B;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAI1B,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAA;IACzE,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAA;IAC3E,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAA;IACjF,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,6BAA6B;IAC5C,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,6BAA6B;IAC5C,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAA;IACvD,aAAa,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,MAAM,CAAA;IACtB,wGAAwG;IACxG,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,IAAI;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,gBAAgB,EAAE,QAAQ,GAAG,YAAY,GAAG,YAAY,CAAA;CACzD;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,gBAAgB,EAAE,MAAM,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,gBAAgB,EAAE,MAAM,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAA;IACb,uBAAuB,EAAE,MAAM,CAAA;IAC/B,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,aAAa,GAAG,SAAS,CAAA;IACzD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,gBAAgB,EAAE,OAAO,GAAG,IAAI,CAAA;IAChC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,oHAAoH;IACpH,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,+GAA+G;IAC/G,oBAAoB,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,qBAAqB,CAAC,EAAE,OAAO,CAAA;CAChC;AAED,MAAM,WAAW,mBAAmB;IAClC,iJAAiJ;IACjJ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAA;IACnB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAED,MAAM,WAAW,6BAA8B,SAAQ,iBAAiB;IACtE,OAAO,EAAE,IAAI,CAAA;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,WAAW,GAAG,KAAK,GAAG,SAAS,CAAA;IACvC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IAC7F,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,OAAO,CAAA;IACpB,WAAW,EAAE,OAAO,CAAA;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intutic/clawde",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "publishConfig": {
     "access": "public"
   },