@intutic/cli 2.2.0 → 2.4.0

package/dist/commands/rules.js

@@ -0,0 +1,283 @@
+/**
+ * `intutic rules build|test` — Rego policies as Intutic rules.
+ *
+ * `build` compiles Rego with OPA (`opa build -t wasm`) and packages the module
+ * with the metadata the hosts read: the entrypoint to evaluate, the ABI
+ * (`opa`) and a default risk tier, in an `intutic.rule` custom section, so
+ * the result is still one `.wasm` file that installs and uploads like any
+ * rule. `test` runs a rule against sample inputs through the same Rego host
+ * the MCP proxy uses (`@intutic/shared-types`), which decides as the Rust
+ * proxy does: both are checked against `opa eval` on the same cases.
+ *
+ * Installing is `intutic policy install --wasm <file>`, the same command as
+ * for any rule; uploading is the dashboard or `POST /api/v1/wasm-rules`.
+ *
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { createHash } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { gunzipSync } from 'node:zlib';
+import { FUEL_EXPORT, REGO_FUEL_BUDGET, boundedRegoInput, evaluateRegoRule, loadRegoRule, meterFuel, regoDecision, withRegoMetadata, } from '@intutic/shared-types';
+import { log } from '../lib/logger.js';
+/** The OPA binary: `INTUTIC_OPA_BIN`, else `opa` on the PATH. */
+export function opaBinary() {
+    return process.env['INTUTIC_OPA_BIN'] || 'opa';
+}
+export const REGO_HOST = {
+    digest: (algorithm, data) => createHash(algorithm).update(data).digest('hex'),
+};
+const RISK_TIERS = ['low', 'medium', 'high', 'critical'];
+/**
+ * Load a Rego rule as the MCP proxy loads it: rewritten to count its own
+ * instructions against the proxies' budget (`REGO_FUEL_BUDGET`, the Rust
+ * proxy's `limits::REGO` on V8's meter), so a rule that runs out of fuel in a
+ * proxy runs out here, and reaches no decision the same way. Null for a
+ * native rule. `budget` is for tests.
+ */
+export function loadMeteredRegoRule(bytes, budget = REGO_FUEL_BUDGET) {
+    const plain = new Uint8Array(bytes);
+    const rule = loadRegoRule(plain, new WebAssembly.Module(meterFuel(plain, budget)), REGO_HOST);
+    return rule && { ...rule, fuelBudget: budget };
+}
+function run(cmd, args) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(cmd, args, { stdio: ['ignore', 'pipe', 'pipe'] });
+        let stdout = '';
+        let stderr = '';
+        child.stdout.setEncoding('utf8').on('data', (d) => (stdout += d));
+        child.stderr.setEncoding('utf8').on('data', (d) => (stderr += d));
+        child.on('error', reject);
+        child.on('close', (code) => resolve({ code: code ?? 1, stdout, stderr }));
+    });
+}
+/**
+ * `/policy.wasm` out of the gzipped tar `opa build` writes. Read here rather
+ * than by a `tar` binary, which a Windows machine may not have.
+ */
+export function extractPolicyWasm(bundle) {
+    const tar = gunzipSync(bundle);
+    for (let offset = 0; offset + 512 <= tar.length;) {
+        const header = tar.subarray(offset, offset + 512);
+        if (header.every((b) => b === 0))
+            break;
+        const field = (start, len) => header.subarray(start, start + len).toString('utf8').replace(/\0.*$/s, '');
+        const name = `${field(345, 155)}${field(0, 100)}`;
+        const size = parseInt(field(124, 12).trim() || '0', 8);
+        const body = offset + 512;
+        if (name.replace(/^\/+/, '') === 'policy.wasm')
+            return Buffer.from(tar.subarray(body, body + size));
+        offset = body + Math.ceil(size / 512) * 512;
+    }
+    throw new Error('the OPA bundle has no policy.wasm');
+}
+/** Every `.rego` file under `regoPath`, a file or a directory, with its text. */
+async function regoSources(regoPath) {
+    const stat = await fs.stat(regoPath);
+    if (!stat.isDirectory())
+        return [{ file: regoPath, text: await fs.readFile(regoPath, 'utf-8') }];
+    const entries = await fs.readdir(regoPath, { recursive: true, withFileTypes: true });
+    const files = entries
+        .filter((e) => e.isFile() && e.name.endsWith('.rego'))
+        .map((e) => path.join(e.parentPath, e.name));
+    return Promise.all(files.map(async (file) => ({ file, text: await fs.readFile(file, 'utf-8') })));
+}
+/**
+ * Whether a policy's source files, together, read `input.args` but never
+ * `input.truncated`.
+ *
+ * Strings in `args` are cut to keep the input under 64 KB, and `truncated`
+ * says so. A policy that inspects `args` without checking it judges a cut
+ * command as if it were whole, so padding a command past the limit hides
+ * whatever was cut. A textual check, comments stripped: it can be fooled by
+ * an alias (`a := input; a.args`), which is why it only warns.
+ */
+export function readsArgsIgnoringTruncation(sources) {
+    const code = sources
+        .join('\n')
+        .split('\n')
+        .map((line) => line.replace(/#.*$/, ''))
+        .join('\n');
+    const reads = (field) => new RegExp(`\\binput\\s*(\\.\\s*${field}\\b|\\[\\s*"${field}"\\s*\\])`).test(code);
+    return reads('args') && !reads('truncated');
+}
+/** Default output: `build/<entrypoint with / as _>.wasm`. */
+export function defaultOutPath(entrypoint) {
+    return path.join('build', `${entrypoint.replace(/[^A-Za-z0-9_-]+/g, '_')}.wasm`);
+}
+export async function runRulesBuild(opts) {
+    log.header('Intutic — Build Rego Rule');
+    const riskTier = opts.riskTier?.toLowerCase();
+    if (riskTier !== undefined && !RISK_TIERS.includes(riskTier)) {
+        log.error(`Invalid risk tier "${opts.riskTier}". Use one of: ${RISK_TIERS.join(', ')}.`);
+        process.exit(1);
+    }
+    if (!/^[A-Za-z_][\w.]*(\/[A-Za-z_][\w]*)+$/.test(opts.entrypoint)) {
+        log.error(`Invalid entrypoint "${opts.entrypoint}". Use package/rule, e.g. intutic/shell/deny.`);
+        process.exit(1);
+    }
+    // Warn, not fail: the check is textual, and a policy may have reasons of
+    // its own. Unreadable source is left for `opa build` to report.
+    const unguarded = await regoSources(opts.rego).then((sources) => readsArgsIgnoringTruncation(sources.map((s) => s.text)), () => false);
+    if (unguarded) {
+        log.warn('The policy reads input.args but never input.truncated. Arguments over the 64 KB input limit ' +
+            'are cut before the policy sees them, so a padded command can hide what it looks for. ' +
+            'Refuse the tools it governs when input.truncated is true.');
+    }
+    const opa = opaBinary();
+    try {
+        await run(opa, ['version']);
+    }
+    catch {
+        log.error(`OPA is required to compile Rego and "${opa}" was not found. Install it ` +
+            '(https://www.openpolicyagent.org/docs/latest/#1-download-opa) or set INTUTIC_OPA_BIN to its path.');
+        process.exit(1);
+    }
+    const work = await fs.mkdtemp(path.join(os.tmpdir(), 'intutic-rego-'));
+    let module;
+    try {
+        const bundle = path.join(work, 'bundle.tar.gz');
+        const built = await run(opa, ['build', '-t', 'wasm', '-e', opts.entrypoint, opts.rego, '-o', bundle]);
+        if (built.code !== 0) {
+            log.error(`opa build failed:\n${built.stderr || built.stdout}`);
+            process.exit(1);
+        }
+        module = withRegoMetadata(extractPolicyWasm(await fs.readFile(bundle)), {
+            v: 1,
+            abi: 'opa',
+            entrypoint: opts.entrypoint,
+            ...(riskTier ? { risk_tier: riskTier } : {}),
+        });
+    }
+    finally {
+        await fs.rm(work, { recursive: true, force: true });
+    }
+    // Refuse here what a host would refuse at load: a builtin it lacks, an old
+    // ABI. Building a rule that every proxy then skips helps nobody.
+    try {
+        loadMeteredRegoRule(module);
+    }
+    catch (err) {
+        log.error(`The policy compiled, but Intutic cannot run it: ${err.message}`);
+        process.exit(1);
+    }
+    const out = opts.out ?? defaultOutPath(opts.entrypoint);
+    await fs.mkdir(path.dirname(out), { recursive: true });
+    await fs.writeFile(out, module);
+    log.success(`Built ${out}`);
+    log.field('Entrypoint', opts.entrypoint);
+    log.field('Risk tier', riskTier ?? '(none)');
+    log.field('Size', `${(module.length / 1024).toFixed(0)} KB`);
+    log.field('SHA-256', createHash('sha256').update(module).digest('hex'));
+    log.info(`Test it: intutic rules test ${out} --input <cases.json>`);
+    log.info(`Install it: intutic policy install --wasm ${out}`);
+}
+/** A file of cases `[{name?, input, expect?}]`, or one bare input document. */
+export function parseCases(text) {
+    const parsed = JSON.parse(text);
+    if (Array.isArray(parsed)) {
+        return parsed.map((c, i) => {
+            if (c === null || typeof c !== 'object' || typeof c.input !== 'object') {
+                throw new Error(`case ${i + 1} has no "input" object`);
+            }
+            return c;
+        });
+    }
+    if (parsed === null || typeof parsed !== 'object')
+        throw new Error('expected an input object or an array of cases');
+    return [{ input: parsed }];
+}
+/**
+ * The decision `rule` reaches on one input, as a proxy would reach it. Throws
+ * when it reaches none: out of instructions (a metered rule), an error, or a
+ * result in none of the decision shapes.
+ */
+export function decideCase(rule, input) {
+    let fuel;
+    const host = {
+        ...REGO_HOST,
+        onInstance: (exports) => {
+            const counter = exports[FUEL_EXPORT];
+            if (counter instanceof WebAssembly.Global)
+                fuel = counter;
+        },
+    };
+    let raw;
+    try {
+        raw = evaluateRegoRule(rule, boundedRegoInput({ v: 1, ...input }), host);
+    }
+    catch (err) {
+        if (fuel && fuel.value < 0 && 'fuelBudget' in rule) {
+            throw new Error(`Rego rule ran out of its ${rule.fuelBudget}-instruction budget`, { cause: err });
+        }
+        throw err;
+    }
+    const decision = regoDecision(raw, rule.entrypoint);
+    return decision.riskTier || !rule.riskTier ? decision : { ...decision, riskTier: rule.riskTier };
+}
+export async function runRulesTest(modulePath, opts) {
+    log.header('Intutic — Test Rego Rule');
+    let rule;
+    try {
+        rule = loadMeteredRegoRule(await fs.readFile(modulePath));
+    }
+    catch (err) {
+        log.error(`Cannot load "${modulePath}": ${err.message}`);
+        process.exit(1);
+    }
+    if (!rule) {
+        log.error(`"${modulePath}" is a native rule, not a Rego one. Test it with: intutic policy test --wasm ${modulePath} --mock <context.json>`);
+        process.exit(1);
+    }
+    log.field('Entrypoint', rule.entrypoint);
+    let failed = 0;
+    let total = 0;
+    for (const file of opts.input) {
+        let cases;
+        try {
+            cases = parseCases(await fs.readFile(file, 'utf-8'));
+        }
+        catch (err) {
+            log.error(`Cannot read cases from "${file}": ${err.message}`);
+            process.exit(1);
+        }
+        for (const [i, c] of cases.entries()) {
+            total += 1;
+            const label = c.name ?? `${path.basename(file)} #${i + 1}`;
+            let decision;
+            try {
+                decision = decideCase(rule, c.input);
+            }
+            catch (err) {
+                failed += 1;
+                log.error(`${label}: evaluation reached no decision (a proxy refuses the call as GOVERNANCE_UNAVAILABLE): ${err.message}`);
+                continue;
+            }
+            const detail = [
+                decision.decision.toUpperCase(),
+                'reason' in decision ? `— ${decision.reason}` : '',
+                decision.riskTier ? `[${decision.riskTier}]` : '',
+            ]
+                .filter(Boolean)
+                .join(' ');
+            if (c.expect && c.expect !== decision.decision) {
+                failed += 1;
+                log.error(`${label}: expected ${c.expect.toUpperCase()}, got ${detail}`);
+            }
+            else if (c.expect) {
+                log.success(`${label}: ${detail}`);
+            }
+            else {
+                log.info(`${label}: ${detail}`);
+            }
+        }
+    }
+    if (failed > 0) {
+        log.error(`${failed} of ${total} case${total === 1 ? '' : 's'} failed`);
+        process.exit(1);
+    }
+    log.success(`${total} case${total === 1 ? '' : 's'} evaluated`);
+}
+//# sourceMappingURL=rules.js.map

package/dist/commands/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/commands/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,gBAAgB,GAIjB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AAEtC,iEAAiE;AACjE,MAAM,UAAU,SAAS;IACvB,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAA;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAoB;IACxC,MAAM,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;CAC9E,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAU,CAAA;AAKjE;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAiB,EAAE,MAAM,GAAG,gBAAgB;IAC9E,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACnC,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IAC7F,OAAO,IAAI,IAAI,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;AAChD,CAAC;AAED,SAAS,GAAG,CAAC,GAAW,EAAE,IAAc;IACtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QACrE,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAA;QACzE,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAA;QACzE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;IAC9B,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,GAAI,CAAC;QAClD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,CAAA;QACjD,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,MAAK;QACvC,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,GAAW,EAAU,EAAE,CACnD,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;QAC5E,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAA;QACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,CAAA;QACtD,MAAM,IAAI,GAAG,MAAM,GAAG,GAAG,CAAA;QACzB,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,aAAa;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC,CAAA;QACnG,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,CAAA;IAC7C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;AACtD,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,WAAW,CAAC,QAAgB;IACzC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACpC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAAE,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;IAChG,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IACpF,MAAM,KAAK,GAAG,OAAO;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SACrD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IAC9C,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AACnG,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAA0B;IACpE,MAAM,IAAI,GAAG,OAAO;SACjB,IAAI,CAAC,IAAI,CAAC;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;SACvC,IAAI,CAAC,IAAI,CAAC,CAAA;IACb,MAAM,KAAK,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,IAAI,MAAM,CAAC,uBAAuB,KAAK,eAAe,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5H,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;AAC7C,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;AAClF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAKnC;IACC,GAAG,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAA;IAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAA;IAC7C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAE,UAAgC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,KAAK,CAAC,sBAAsB,IAAI,CAAC,QAAQ,kBAAkB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACxF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,KAAK,CAAC,uBAAuB,IAAI,CAAC,UAAU,+CAA+C,CAAC,CAAA;QAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,yEAAyE;IACzE,gEAAgE;IAChE,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CACjD,CAAC,OAAO,EAAE,EAAE,CAAC,2BAA2B,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EACpE,GAAG,EAAE,CAAC,KAAK,CACZ,CAAA;IACD,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,IAAI,CACN,8FAA8F;YAC5F,uFAAuF;YACvF,2DAA2D,CAC9D,CAAA;IACH,CAAC;IAED,MAAM,GAAG,GAAG,SAAS,EAAE,CAAA;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,KAAK,CACP,wCAAwC,GAAG,8BAA8B;YACvE,mGAAmG,CACtG,CAAA;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAA;IACtE,IAAI,MAAkB,CAAA;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;QACrG,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,KAAK,CAAC,sBAAsB,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QACD,MAAM,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE;YACtE,CAAC,EAAE,CAAC;YACJ,GAAG,EAAE,KAAK;YACV,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC,CAAA;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,CAAC;IAED,2EAA2E;IAC3E,iEAAiE;IACjE,IAAI,CAAC;QACH,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,mDAAoD,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACvD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACtD,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC/B,GAAG,CAAC,OAAO,CAAC,SAAS,GAAG,EAAE,CAAC,CAAA;IAC3B,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;IACxC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,IAAI,QAAQ,CAAC,CAAA;IAC5C,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACvE,GAAG,CAAC,IAAI,CAAC,+BAA+B,GAAG,uBAAuB,CAAC,CAAA;IACnE,GAAG,CAAC,IAAI,CAAC,6CAA6C,GAAG,EAAE,CAAC,CAAA;AAC9D,CAAC;AASD,+EAA+E;AAC/E,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACzB,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAc,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACrF,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;YACxD,CAAC;YACD,OAAO,CAAa,CAAA;QACtB,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IACnH,OAAO,CAAC,EAAE,KAAK,EAAE,MAAiC,EAAE,CAAC,CAAA;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAgC,EAAE,KAA8B;IACzF,IAAI,IAAoC,CAAA;IACxC,MAAM,IAAI,GAAoB;QAC5B,GAAG,SAAS;QACZ,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE;YACtB,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;YACpC,IAAI,OAAO,YAAY,WAAW,CAAC,MAAM;gBAAE,IAAI,GAAG,OAAO,CAAA;QAC3D,CAAC;KACF,CAAA;IACD,IAAI,GAAY,CAAA;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,IAAI,IAAK,IAAI,CAAC,KAAgB,GAAG,CAAC,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,UAAU,qBAAqB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACnG,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;IACnD,OAAO,QAAQ,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAA;AAClG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAkB,EAAE,IAAyB;IAC9E,GAAG,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAA;IAEtC,IAAI,IAA4B,CAAA;IAChC,IAAI,CAAC;QACH,IAAI,GAAG,mBAAmB,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAA;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,gBAAgB,UAAU,MAAO,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,KAAK,CAAC,IAAI,UAAU,gFAAgF,UAAU,wBAAwB,CAAC,CAAA;QAC3I,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;IAExC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,KAAiB,CAAA;QACrB,IAAI,CAAC;YACH,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,2BAA2B,IAAI,MAAO,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;YACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACrC,KAAK,IAAI,CAAC,CAAA;YACV,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAA;YAC1D,IAAI,QAAsB,CAAA;YAC1B,IAAI,CAAC;gBACH,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,CAAC,CAAA;gBACX,GAAG,CAAC,KAAK,CACP,GAAG,KAAK,0FAA2F,GAAa,CAAC,OAAO,EAAE,CAC3H,CAAA;gBACD,SAAQ;YACV,CAAC;YACD,MAAM,MAAM,GAAG;gBACb,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE;gBAC/B,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;gBAClD,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE;aAClD;iBACE,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,GAAG,CAAC,CAAA;YACZ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBAC/C,MAAM,IAAI,CAAC,CAAA;gBACX,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC,CAAA;YAC1E,CAAC;iBAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBACpB,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,KAAK,MAAM,EAAE,CAAC,CAAA;YACpC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,MAAM,EAAE,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,GAAG,MAAM,OAAO,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAA;QACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAA;AACjE,CAAC"}

package/dist/commands/settings.d.ts

@@ -0,0 +1,44 @@
+/**
+ * `intutic settings` — read and change workspace settings.
+ *
+ * Subcommands:
+ *   - `intutic settings get [key] [--json]`
+ *   - `intutic settings set <key> [value] [--file <path>] [--json]`
+ *
+ * Server side: `GET` / `PUT /api/v1/workspace/settings`
+ * (services/control-plane/src/routes/workspace.ts). One generic pair rather
+ * than a command per setting: the route's strict schema is the authority on
+ * which keys exist and what each accepts, and refuses an unknown key or a bad
+ * value with a 400 naming it, so the CLI stays correct as settings are added.
+ * The MCP policy (`mcpDefaultPolicy`, `mcpHighRiskToolChange`, `mcpBudgets`,
+ * `mcpInjectionAction`, `mcpAnomalyMode`, …), the group policy
+ * (`sso_group_policy`), the PII detector actions (`piiDetectors`), upstream
+ * retries and fallbacks (`upstreamRetry`) and `configBodyUpload` are all set
+ * this way.
+ *
+ * The structured settings with a schema in `@intutic/shared-types` are
+ * checked here first, so a mistake in a budgets, group-policy, detector or
+ * retry file is reported with the path of the field at fault rather than only the
+ * top-level key the server's 400 names.
+ *
+ * @module
+ */
+import { type ApiCommandOpts } from './apiCommand.js';
+/**
+ * What is wrong with `value` for `key`, by field path, for the settings with
+ * a schema in `@intutic/shared-types`; empty for every other key, which the
+ * server checks.
+ */
+export declare function localProblems(key: string, value: unknown): string[];
+/**
+ * A value given on the command line: JSON when it parses as JSON (`true`,
+ * `30`, `null`, `["a","b"]`), the plain string otherwise (`deny`).
+ */
+export declare function parseSettingValue(raw: string): unknown;
+/** `intutic settings get [key]` */
+export declare function runSettingsGet(key: string | undefined, opts: ApiCommandOpts): Promise<void>;
+/** `intutic settings set <key> [value] [--file <path>]` */
+export declare function runSettingsSet(key: string, raw: string | undefined, opts: ApiCommandOpts & {
+    file?: string;
+}): Promise<void>;
+//# sourceMappingURL=settings.d.ts.map

package/dist/commands/settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../src/commands/settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AASH,OAAO,EAAqC,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAOxF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAYnE;AAMD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMtD;AAED,mCAAmC;AACnC,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BjG;AAED,2DAA2D;AAC3D,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,cAAc,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACvC,OAAO,CAAC,IAAI,CAAC,CAoBf"}

package/dist/commands/settings.js

@@ -0,0 +1,110 @@
+/**
+ * `intutic settings` — read and change workspace settings.
+ *
+ * Subcommands:
+ *   - `intutic settings get [key] [--json]`
+ *   - `intutic settings set <key> [value] [--file <path>] [--json]`
+ *
+ * Server side: `GET` / `PUT /api/v1/workspace/settings`
+ * (services/control-plane/src/routes/workspace.ts). One generic pair rather
+ * than a command per setting: the route's strict schema is the authority on
+ * which keys exist and what each accepts, and refuses an unknown key or a bad
+ * value with a 400 naming it, so the CLI stays correct as settings are added.
+ * The MCP policy (`mcpDefaultPolicy`, `mcpHighRiskToolChange`, `mcpBudgets`,
+ * `mcpInjectionAction`, `mcpAnomalyMode`, …), the group policy
+ * (`sso_group_policy`), the PII detector actions (`piiDetectors`), upstream
+ * retries and fallbacks (`upstreamRetry`) and `configBodyUpload` are all set
+ * this way.
+ *
+ * The structured settings with a schema in `@intutic/shared-types` are
+ * checked here first, so a mistake in a budgets, group-policy, detector or
+ * retry file is reported with the path of the field at fault rather than only the
+ * top-level key the server's 400 names.
+ *
+ * @module
+ */
+import { McpBudgetSettingsSchema, PiiDetectorSettingsSchema, SsoGroupPolicySchema, UpstreamRetrySettingsSchema, } from '@intutic/shared-types';
+import { log } from '../lib/logger.js';
+import { fail, readJsonFile, runApiCommand } from './apiCommand.js';
+/**
+ * What is wrong with `value` for `key`, by field path, for the settings with
+ * a schema in `@intutic/shared-types`; empty for every other key, which the
+ * server checks.
+ */
+export function localProblems(key, value) {
+    const schema = key === 'mcpBudgets' ? McpBudgetSettingsSchema
+        // `null` clears the policy.
+        : key === 'sso_group_policy' ? SsoGroupPolicySchema.nullable()
+            : key === 'piiDetectors' ? PiiDetectorSettingsSchema.nullable()
+                : key === 'upstreamRetry' ? UpstreamRetrySettingsSchema.nullable()
+                    : null;
+    if (!schema)
+        return [];
+    const checked = schema.safeParse(value);
+    if (checked.success)
+        return [];
+    return checked.error.issues.map((i) => `${[key, ...i.path.map(String)].join('.')}: ${i.message}`);
+}
+function formatValue(value) {
+    return typeof value === 'string' ? value : JSON.stringify(value, null, 2);
+}
+/**
+ * A value given on the command line: JSON when it parses as JSON (`true`,
+ * `30`, `null`, `["a","b"]`), the plain string otherwise (`deny`).
+ */
+export function parseSettingValue(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return raw;
+    }
+}
+/** `intutic settings get [key]` */
+export async function runSettingsGet(key, opts) {
+    await runApiCommand(
+    // Not `opts`: with a key, `--json` prints that value, not the whole response.
+    { dev: opts.dev }, 'Failed to read workspace settings', (client) => client.get('/api/v1/workspace/settings'), (res) => {
+        if (key !== undefined) {
+            const value = res.settings[key];
+            if (opts.json) {
+                console.log(JSON.stringify(value ?? null, null, 2));
+            }
+            else if (value === undefined) {
+                log.dim(`${key} is not set.`);
+            }
+            else {
+                console.log(formatValue(value));
+            }
+            return;
+        }
+        if (opts.json) {
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        log.header('Intutic — Workspace Settings');
+        log.field('Workspace', res.workspaceId);
+        for (const [name, value] of Object.entries(res.settings)) {
+            log.field(name, typeof value === 'string' ? value : JSON.stringify(value));
+        }
+    });
+}
+/** `intutic settings set <key> [value] [--file <path>]` */
+export async function runSettingsSet(key, raw, opts) {
+    if ((raw === undefined) === (opts.file === undefined)) {
+        fail('Give the value either as an argument or with --file <path>, not both.');
+    }
+    const value = opts.file !== undefined ? readJsonFile(opts.file) : parseSettingValue(raw);
+    const problems = localProblems(key, value);
+    if (problems.length > 0)
+        fail(`${key} is not valid:\n${problems.map((p) => `  ${p}`).join('\n')}`);
+    await runApiCommand(opts, `Failed to update ${key}`, (client) => client.put('/api/v1/workspace/settings', { [key]: value }), (res) => {
+        log.success(`${key} updated.`);
+        const now = res.settings[key];
+        if (now === undefined)
+            log.dim(`  ${key} is now unset.`);
+        else
+            console.log(formatValue(now));
+    });
+}
+//# sourceMappingURL=settings.js.map

package/dist/commands/settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../src/commands/settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAuB,MAAM,iBAAiB,CAAA;AAOxF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,KAAc;IACvD,MAAM,MAAM,GACV,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,uBAAuB;QAC9C,4BAA4B;QAC5B,CAAC,CAAC,GAAG,KAAK,kBAAkB,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE;YAC9D,CAAC,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC,CAAC,yBAAyB,CAAC,QAAQ,EAAE;gBAC/D,CAAC,CAAC,GAAG,KAAK,eAAe,CAAC,CAAC,CAAC,2BAA2B,CAAC,QAAQ,EAAE;oBAClE,CAAC,CAAC,IAAI,CAAA;IACR,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IACtB,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IAC9B,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;AACnG,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAA;IACZ,CAAC;AACH,CAAC;AAED,mCAAmC;AACnC,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAuB,EAAE,IAAoB;IAChF,MAAM,aAAa;IACjB,8EAA8E;IAC9E,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EACjB,mCAAmC,EACnC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAmB,4BAA4B,CAAC,EACtE,CAAC,GAAG,EAAE,EAAE;QACN,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;YAC/B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACrD,CAAC;iBAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,cAAc,CAAC,CAAA;YAC/B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAA;YACjC,CAAC;YACD,OAAM;QACR,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACzC,OAAM;QACR,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAA;QAC1C,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;QACvC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC,CACF,CAAA;AACH,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,GAAuB,EACvB,IAAwC;IAExC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,uEAAuE,CAAC,CAAA;IAC/E,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAa,CAAC,CAAA;IAElG,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC1C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,GAAG,GAAG,mBAAmB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAElG,MAAM,aAAa,CACjB,IAAI,EACJ,oBAAoB,GAAG,EAAE,EACzB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAA0C,4BAA4B,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAC/G,CAAC,GAAG,EAAE,EAAE;QACN,GAAG,CAAC,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC,CAAA;QAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,GAAG,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,KAAK,GAAG,gBAAgB,CAAC,CAAA;;YACnD,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACpC,CAAC,CACF,CAAA;AACH,CAAC"}

package/dist/commands/setup.d.ts

@@ -1,5 +1,5 @@
 /**
- * `intutic setup` — the cohort setup wizard (LLD #70, model catalog & cohort
+ * `intutic setup` — the cohort setup wizard (model catalog & cohort
  * wizard): codescan → provider → credentials → verify → persist → summary. Mirrors the dashboard's `SetupWizard.tsx` step order
  * (minus the parts that need a browser) and, wherever a step corresponds to
  * an existing flag-driven command, calls exactly what that command calls —

package/dist/commands/setup.js

@@ -1,5 +1,5 @@
 /**
- * `intutic setup` — the cohort setup wizard (LLD #70, model catalog & cohort
+ * `intutic setup` — the cohort setup wizard (model catalog & cohort
  * wizard): codescan → provider → credentials → verify → persist → summary. Mirrors the dashboard's `SetupWizard.tsx` step order
  * (minus the parts that need a browser) and, wherever a step corresponds to
  * an existing flag-driven command, calls exactly what that command calls —

package/dist/commands/siem.d.ts

@@ -0,0 +1,53 @@
+/**
+ * `intutic siem` — SIEM export destinations: where governance events stream
+ * (syslog CEF, HTTPS webhook, Splunk HEC, Datadog Logs, GCS, S3), and which
+ * event sources each receives.
+ *
+ * Subcommands:
+ *   - `intutic siem list [--json]`
+ *   - `intutic siem show <destination_id> [--json]`
+ *   - `intutic siem sources [--json]`
+ *   - `intutic siem create --name <name> --type <adapter> --config <path> [...] [--json]`
+ *   - `intutic siem update <destination_id> [...] [--json]`
+ *   - `intutic siem delete <destination_id> [--json]`
+ *   - `intutic siem rotate-secret <destination_id> [--json]`
+ *
+ * Server side: services/control-plane/src/routes/siem.ts. Writes need OWNER
+ * or ADMIN. The adapter config carries credentials (a HEC token, an API key),
+ * so it is read from a JSON file rather than taken on the command line, where
+ * it would land in shell history. The server encrypts it, masks it on every
+ * read, and refuses a destination that points at an internal address.
+ *
+ * @module
+ */
+import { type ApiCommandOpts } from './apiCommand.js';
+/** The flags `create` and `update` share. */
+export interface DestinationFlags {
+    name?: string;
+    config?: string;
+    sources?: string;
+    defaultSources?: boolean;
+    batchSize?: string;
+    flushIntervalMs?: string;
+}
+/** The request body for the given flags: only the fields a flag set. */
+export declare function destinationBody(flags: DestinationFlags): Record<string, unknown>;
+/** `intutic siem list` */
+export declare function runSiemList(opts: ApiCommandOpts): Promise<void>;
+/** `intutic siem show <destination_id>` */
+export declare function runSiemShow(destinationId: string, opts: ApiCommandOpts): Promise<void>;
+/** `intutic siem sources` */
+export declare function runSiemSources(opts: ApiCommandOpts): Promise<void>;
+/** `intutic siem create` */
+export declare function runSiemCreate(opts: ApiCommandOpts & DestinationFlags & {
+    type?: string;
+}): Promise<void>;
+/** `intutic siem update <destination_id>` */
+export declare function runSiemUpdate(destinationId: string, opts: ApiCommandOpts & DestinationFlags & {
+    enable?: boolean;
+}): Promise<void>;
+/** `intutic siem delete <destination_id>` */
+export declare function runSiemDelete(destinationId: string, opts: ApiCommandOpts): Promise<void>;
+/** `intutic siem rotate-secret <destination_id>` */
+export declare function runSiemRotateSecret(destinationId: string, opts: ApiCommandOpts): Promise<void>;
+//# sourceMappingURL=siem.d.ts.map

package/dist/commands/siem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"siem.d.ts","sourceRoot":"","sources":["../../src/commands/siem.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,EAA4E,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAuB/H,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiBhF;AAcD,0BAA0B;AAC1B,wBAAsB,WAAW,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBrE;AAED,2CAA2C;AAC3C,wBAAsB,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAU5F;AAED,6BAA6B;AAC7B,wBAAsB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAaxE;AAED,4BAA4B;AAC5B,wBAAsB,aAAa,CAAC,IAAI,EAAE,cAAc,GAAG,gBAAgB,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAe9G;AAED,6CAA6C;AAC7C,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,cAAc,GAAG,gBAAgB,GAAG;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7D,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,6CAA6C;AAC7C,wBAAsB,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAO9F;AAED,oDAAoD;AACpD,wBAAsB,mBAAmB,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAapG"}