@intutic/gate 1.10.1

package/dist/openai.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai.js","sourceRoot":"","sources":["../src/openai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiJG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAE/D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD;;0DAE0D;AAC1D,MAAM,CAAC,MAAM,cAAc,GAAG,SAAS,CAAA;AA2HvC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAA;AACzD,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;AAOpE,6EAA6E;AAE7E,SAAS,WAAW,CAAC,QAA0B,EAAE,IAAY;IAC3D,MAAM,CAAC,GAAG,QAAQ,IAAI,UAAU,EAAE,CAAA;IAClC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC5E,eAAe,IAAI,uCAAuC,CAC7D,CAAA;IACH,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAA8B;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IACnB,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,EAAE,CAAA;IAChB,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5E,OAAO,MAAmB,CAAA;IAC5B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC/D,OAAO,+CAA+C,MAAM,8DAA8D,CAAA;AAC5H,CAAC;AAED;;wEAEwE;AACxE,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAA;IAChD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAA;AACtD,CAAC;AAED,6EAA6E;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA0B,EAAE;IAC/D,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,cAAc;QACpB,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAClB,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAA;YAC1D,IAAI,CAAC;gBACH,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;YACpF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;oBACtC,OAAO;wBACL,QAAQ,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;wBACzD,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE;qBAC3D,CAAA;gBACH,CAAC;gBACD,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;YAC5E,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAA;QACxC,CAAC;KACF,CAAA;AACH,CAAC;AAED,4EAA4E;AAE5E,SAAS,gBAAgB,CAAC,IAAuB,EAAE,IAAuB;IACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,CAAA;IAC3C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,cAAc,CAAC;QAAE,OAAO,IAAI,CAAA;IAClE,uEAAuE;IACvE,0DAA0D;IAC1D,OAAO,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAA;AAChF,CAAC;AAED,SAAS,WAAW,CAAC,IAAqB;IACxC,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAA;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,YAAsD,CAAA;IACtE,OAAO,EAAE,EAAE,IAAI,KAAK,KAAK,CAAA;AAC3B,CAAC;AAED;;;;qDAIqD;AACrD,SAAS,0BAA0B,CAAC,eAAwB,EAAE,QAAgB;IAC5E,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,OAAO;QAAE,OAAO,KAAK,CAAA;IAC9E,IAAI,eAAe,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC7C,IAAI,eAAe,KAAK,IAAI,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,eAGd,CAAA;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,EAAE,UAAU,IAAI,MAAM,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAA;QAC5E,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAA;QAC/C,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAgC;IAChE,MAAM,OAAO,GAAG,IAAI,EAAE,OAAiG,CAAA;IACvH,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAA;IAChE,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAA;IACrC,MAAM,QAAQ,GACZ,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAC/C,CAAC,CAAC,EAAE,CAAC,IAAI;QACT,CAAC,CAAC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,sBAAsB;YAC3E,CAAC,CAAC,OAAO,CAAC,IAAI;YACd,CAAC,CAAC,IAAI,CAAA;IACZ,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAClC,OAAO;QACL,QAAQ;QACR,GAAG,CAAC,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAA;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAqB,EAAE,IAAuB;IACvE,MAAM,MAAM,GAAG,IAAiD,CAAA;IAChE,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAEzC,MAAM,EAAE,GAA+B,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAA;IACvE,MAAM,kBAAkB,GAAG,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,UAAU,CAAA;IAC1D,MAAM,uBAAuB,GAAG,EAAE,CAAC,gBAAgB,IAAI,EAAE,CAAC,eAAe,CAAA;IAEzE,EAAE,CAAC,gBAAgB,GAAG,QAAQ,CAAA;IAC9B,EAAE,CAAC,WAAW,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACvC,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;QAC/C,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;QAC9C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,uEAAuE;YACvE,sBAAsB;YACtB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EACJ,sFAAsF;oBACtF,qEAAqE;aACxE,CAAA;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,sBAAsB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAA;QAC/E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,eAAe,CAAC,GAAG,CAAC,CAAA;QAC7B,CAAC;QACD,IAAI,kBAAkB;YAAE,OAAO,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QAChE,IAAI,0BAA0B,CAAC,uBAAuB,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1E,uEAAuE;YACvE,gEAAgE;YAChE,uEAAuE;YACvE,sEAAsE;YACtE,wEAAwE;YACxE,sEAAsE;YACtE,6CAA6C;YAC7C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EACJ,2EAA2E;oBAC3E,+EAA+E;oBAC/E,oDAAoD;aACvD,CAAA;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC1B,CAAC,CAAA;IACD,OAAO,EAAE,CAAC,eAAe,CAAA;IACzB,OAAO,EAAE,CAAC,UAAU,CAAA;IAEpB,MAAM,OAAO,GAAoB,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,EAA6B,EAAE,CAAA;IACzF,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;IAC3E,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;yDASyD;AACzD,SAAS,qBAAqB,CAC5B,IAAO,EACP,IAAuB,EACvB,OAAmG;IAEnG,MAAM,MAAM,GAAG,IAAmC,CAAA;IAClD,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAEzC,MAAM,qBAAqB,GAAG,IAAI,CAAC,aAAa,CAAA;IAChD,MAAM,kBAAkB,GAAG,IAAI,CAAC,UAAU,CAAA;IAE1C,MAAM,UAAU,GAAG,KAAK,EAAE,UAAmB,EAAE,IAAgC,EAAmC,EAAE;QAClH,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;QAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACtC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EACJ,uDAAuD,IAAI,CAAC,IAAI,mBAAmB;oBACnF,2EAA2E;aAC9E,CAAA;QACH,CAAC;QACD,IAAI,CAAC;YACH,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC3C,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;YACrC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,eAAe,CAAC,GAAG,CAAC,CAAA;QAC7B,CAAC;QACD,yEAAyE;QACzE,+CAA+C;QAC/C,MAAM,gBAAgB,GACpB,OAAO,qBAAqB,KAAK,UAAU;YACzC,CAAC,CAAC,MAAM,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;YACzE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAA;QACpC,IAAI,CAAC,gBAAgB;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAC/C,IAAI,kBAAkB;YAAE,OAAO,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QACnE,yEAAyE;QACzE,uEAAuE;QACvE,gEAAgE;QAChE,uEAAuE;QACvE,OAAO,EAAE,CAAA;IACX,CAAC,CAAA;IAED,MAAM,OAAO,GAAM,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,CAAA;IAC3E,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;IAC3E,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB;IACpC,MAAM,GAAG,GAAG,OAA4F,CAAA;IACxG,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAA;IAClD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;IACjF,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAClC,OAAO;QACL,yEAAyE;QACzE,uDAAuD;QACvD,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrE,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,GAAG,CAAC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAA;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgB;IACzC,MAAM,GAAG,GAAG,OAIC,CAAA;IACb,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,GAAG,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAC1E,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAA;IACxB,IAAI,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC5C,MAAM,SAAS,GAAc;QAC3B,IAAI,EAAE,EAAE,CAAC,IAAI;QACb,SAAS,EAAE,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC5D,wEAAwE;QACxE,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAA;IACD,OAAO;QACL,UAAU,EAAE,CAAC,SAAS,CAAC;QACvB,MAAM,EAAE,EAAE;QACV,GAAG,CAAC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAKI,EAAE;IAEN,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,sBAAsB,CAAA;IACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAA;QAClE,MAAM,SAAS,GACb,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACrE,CAAC,CAAE,MAAoB;YACvB,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;QACvB,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,mEAAmE;YACnE,kBAAkB;YAClB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QAClD,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAuB,EAAE,IAAuB;IACxE,MAAM,MAAM,GAAG,IAAmD,CAAA;IAClE,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACzC,MAAM,OAAO,GAAsB;QACjC,GAAG,IAAI;QACP,aAAa,EAAE,4BAA4B,CAAC;YAC1C,GAAG,IAAI;YACP,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,QAAQ,EAAE,OAAO,IAAI,CAAC,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;SACpF,CAAC;KACH,CAAA;IACD,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;IAC3E,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,4EAA4E;AAE5E,SAAS,WAAW,CAAmB,IAAO,EAAE,IAAuB;IACrE,MAAM,CAAC,GAAG,IAA2C,CAAA;IACrD,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,UAAU;YACb,OAAO,gBAAgB,CAAC,IAAoC,EAAE,IAAI,CAAiB,CAAA;QACrF,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,MAAM,GAAG,IAAkC,CAAA;YACjD,sEAAsE;YACtE,qEAAqE;YACrE,+DAA+D;YAC/D,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAkB,CAAC,CAAC,CAAC,IAAI,CAAA;QACvF,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,oEAAoE;YACpE,uEAAuE;YACvE,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YACtC,OAAO,qBAAqB,CAAC,IAAiC,EAAE,IAAI,EAAE,YAAY,CAAiB,CAAA;QACrG,CAAC;QACD,KAAK,aAAa;YAChB,OAAO,qBAAqB,CAAC,IAAsC,EAAE,IAAI,EAAE,iBAAiB,CAAiB,CAAA;QAC/G,KAAK,UAAU;YACb,OAAO,gBAAgB,CAAC,IAAoC,EAAE,IAAI,CAAiB,CAAA;QACrF;YACE,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAmB,KAAmB,EAAE,OAA0B,EAAE;IAC3F,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,SAAS,CAA4B,KAAQ,EAAE,OAA0B,EAAE;IACzF,MAAM,MAAM,GAAG,KAAoC,CAAA;IACnD,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAEhD,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IAE1C,MAAM,mBAAmB,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAA8C,CACrG;IAAC,KAAyB,CAAC,WAAW,GAAG,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE,CACrE,SAAS,CAAC,MAAM,mBAAmB,CAAC,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;IAErD,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;IAChF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,4EAA4E;AAE5E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,CAAC,GAAG,CAAC,6BAA6B,GAAG,GAAG,CAAA;AACjD,CAAC;AAiBD;;;;;;;;;;;;GAYG;AACH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAyB,OAAO,CAAC,GAAG;IAChF,yEAAyE;IACzE,0EAA0E;IAC1E,iEAAiE;IACjE,IAAI,IAAI,GAAG,GAAG,CAAC,yBAAyB,IAAI,EAAE,CAAA;IAC9C,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe,IAAI,EAAE,CAAA;IACxC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,qHAAqH,CAAC,CAAA;IACxI,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,kDAAkD,EAAE,MAAM,EAAE,CAAA;AACxF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAA2B,EAAE;IAC7D,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QACtD,2BAA2B,EAAE,CAAA;IAC/B,CAAC;IAED,IAAI,MAAyB,CAAA;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC;YAC1B,OAAO,EAAE,eAAe;YACxB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,UAAU,EAAE;SAC9E,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,IAAI,CAAA;IACf,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,OAAO,CAAC,IAAI,CAAC,CAAA;IACb,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/shlex.d.ts

@@ -0,0 +1,16 @@
+/**
+ * A minimal POSIX-shell-like tokenizer, standing in for Python's `shlex.split`.
+ *
+ * Handles single quotes (literal, no escapes), double quotes (backslash
+ * escapes `\"`, `\\`, `\$`, `` \` ``), and unquoted backslash escapes.
+ * Throws on an unterminated quote, mirroring `shlex.split`'s `ValueError` —
+ * callers treat that as "could not tokenise" and fail closed, the same
+ * posture `imagecheck.py` documents.
+ *
+ * This is not a full shell grammar (no `$()`, no globbing, no `&&`
+ * splitting) — it only needs to split a single command line into argv-shaped
+ * tokens the way `kubectl`/`helm` would see them, which is exactly the scope
+ * `shlex.split` covers for the Python port too.
+ */
+export declare function shlexSplit(command: string): string[];
+//# sourceMappingURL=shlex.d.ts.map

package/dist/shlex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shlex.d.ts","sourceRoot":"","sources":["../src/shlex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAkEpD"}

package/dist/shlex.js

@@ -0,0 +1,78 @@
+/**
+ * A minimal POSIX-shell-like tokenizer, standing in for Python's `shlex.split`.
+ *
+ * Handles single quotes (literal, no escapes), double quotes (backslash
+ * escapes `\"`, `\\`, `\$`, `` \` ``), and unquoted backslash escapes.
+ * Throws on an unterminated quote, mirroring `shlex.split`'s `ValueError` —
+ * callers treat that as "could not tokenise" and fail closed, the same
+ * posture `imagecheck.py` documents.
+ *
+ * This is not a full shell grammar (no `$()`, no globbing, no `&&`
+ * splitting) — it only needs to split a single command line into argv-shaped
+ * tokens the way `kubectl`/`helm` would see them, which is exactly the scope
+ * `shlex.split` covers for the Python port too.
+ */
+export function shlexSplit(command) {
+    const tokens = [];
+    let current = '';
+    let inToken = false;
+    let i = 0;
+    const n = command.length;
+    while (i < n) {
+        const ch = command[i];
+        if (ch === "'") {
+            inToken = true;
+            const close = command.indexOf("'", i + 1);
+            if (close === -1)
+                throw new Error('shlex: unterminated single-quoted string');
+            current += command.slice(i + 1, close);
+            i = close + 1;
+            continue;
+        }
+        if (ch === '"') {
+            inToken = true;
+            i += 1;
+            let closed = false;
+            while (i < n) {
+                const c = command[i];
+                if (c === '"') {
+                    closed = true;
+                    i += 1;
+                    break;
+                }
+                if (c === '\\' && i + 1 < n && '"\\$`'.includes(command[i + 1])) {
+                    current += command[i + 1];
+                    i += 2;
+                    continue;
+                }
+                current += c;
+                i += 1;
+            }
+            if (!closed)
+                throw new Error('shlex: unterminated double-quoted string');
+            continue;
+        }
+        if (/\s/.test(ch)) {
+            if (inToken) {
+                tokens.push(current);
+                current = '';
+                inToken = false;
+            }
+            i += 1;
+            continue;
+        }
+        if (ch === '\\' && i + 1 < n) {
+            inToken = true;
+            current += command[i + 1];
+            i += 2;
+            continue;
+        }
+        inToken = true;
+        current += ch;
+        i += 1;
+    }
+    if (inToken)
+        tokens.push(current);
+    return tokens;
+}
+//# sourceMappingURL=shlex.js.map

package/dist/shlex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shlex.js","sourceRoot":"","sources":["../src/shlex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAA;IAExB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAE,CAAA;QAEtB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,OAAO,GAAG,IAAI,CAAA;YACd,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YACzC,IAAI,KAAK,KAAK,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;YAC7E,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;YACtC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;YACb,SAAQ;QACV,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,OAAO,GAAG,IAAI,CAAA;YACd,CAAC,IAAI,CAAC,CAAA;YACN,IAAI,MAAM,GAAG,KAAK,CAAA;YAClB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,CAAA;gBACrB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;oBACd,MAAM,GAAG,IAAI,CAAA;oBACb,CAAC,IAAI,CAAC,CAAA;oBACN,MAAK;gBACP,CAAC;gBACD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,EAAE,CAAC;oBACjE,OAAO,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;oBACzB,CAAC,IAAI,CAAC,CAAA;oBACN,SAAQ;gBACV,CAAC;gBACD,OAAO,IAAI,CAAC,CAAA;gBACZ,CAAC,IAAI,CAAC,CAAA;YACR,CAAC;YACD,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;YACxE,SAAQ;QACV,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAClB,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBACpB,OAAO,GAAG,EAAE,CAAA;gBACZ,OAAO,GAAG,KAAK,CAAA;YACjB,CAAC;YACD,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QAED,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,GAAG,IAAI,CAAA;YACd,OAAO,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACzB,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QAED,OAAO,GAAG,IAAI,CAAA;QACd,OAAO,IAAI,EAAE,CAAA;QACb,CAAC,IAAI,CAAC,CAAA;IACR,CAAC;IAED,IAAI,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACjC,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/snapshot.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Policy-snapshot reader — a port of the shipped gate contract.
+ *
+ * Primary porting source: `packages/intutic-clawde/intutic_clawde/gate/snapshot.py`.
+ * Source of truth for the wire format and evaluation order (both the Python
+ * port and this one target the same artifact):
+ *   services/sync-daemon/src/harness/gateBody.ts
+ *     - RULES_COLUMNS / toRulesLine()   the `.rules` line layout
+ *     - JS_SNAPSHOT_LOADER              parsing + integrity
+ *     - intuticGate()                   evaluation order
+ *
+ * The sync-daemon compiles a workspace's SOPs into
+ * `~/.intutic/hooks/policy-snapshot.rules` and every harness gate reads it.
+ * This is the JS/TS SDK's reader, for frameworks that have no dedicated
+ * adapter of their own — it consumes the same documented artifact rather than
+ * inventing a channel.
+ *
+ * Deliberate fidelity points, each of which the upstream comments call out as
+ * a past defect:
+ *
+ *   * Subjects are tested SEPARATELY, never concatenated. Joining them lets a
+ *     pattern match across the seam between two innocuous values.
+ *   * The block reason is the rule's own text plus `[id]`. `hookEvents.resolveSeverity`
+ *     greps that text for "governance-protected" to file the incident CRITICAL;
+ *     a generic message silently downgrades it to MEDIUM.
+ *   * INTUTIC_GUARD_DISABLE=1 drops ONLY the `destructive.*` family, never the
+ *     compiled floor and never a workspace's own rules.
+ *   * A snapshot rule whose regex will not compile is dropped, not fatal.
+ *   * Snapshot health is reported as an event — "snapshot missing on 400
+ *     machines" must not look identical to "snapshot present and healthy".
+ *
+ * ## Two deliberate divergences from the Python SDK reader
+ *
+ * Both were found empirically, by running `src/__tests__/fidelity.test.ts`
+ * against a hand-port of `intutic_clawde/gate/snapshot.py`'s `_normalise()`
+ * and watching real patterns from `protectedPaths.ts` fail to fire. Neither
+ * is a stylistic choice; both are confirmed gaps in `intutic_clawde`'s
+ * reader relative to the shipped contract it claims to port, carried here
+ * only as a documented finding, not as behaviour to reproduce.
+ *
+ * 1. **No padding.** `_normalise()` lowercases and collapses whitespace but
+ *    does not pad the result with a leading/trailing space. The actual
+ *    shipped gate (`intuticNormalise` in gateBody.ts, emitted from
+ *    `NORMALISE_CONTRACT.jsSource`) pads. Padding is what lets a
+ *    floor/destructive pattern use a plain leading space as a stand-in for
+ *    `^` (`' rm( +-[a-zA-Z-]+)+ +/( |\\*)'` requires a literal space before
+ *    `rm`) — POSIX ERE has no `\b` and no reliable `^`/`$` inside the emitted
+ *    shell gates, so the whole pattern table is authored against the padded
+ *    contract. It is also why `policySnapshot.ts`'s `toGuardPattern` strips
+ *    the `^`/`$` off an SOP `toolPattern` and re-wraps it as `' (name) '`
+ *    before shipping it as a `subject: 'tool'` snapshot rule — that
+ *    transformation only makes sense against a padded reader. Without
+ *    padding, a command that BEGINS with the dangerous verb (`"rm -rf /"`,
+ *    no leading space) never matches `' rm...'` at all, and the block
+ *    silently never fires.
+ * 2. **Forced lowercasing.** `_normalise()` lowercases unconditionally; the
+ *    real `NORMALISE_CONTRACT.jsSource` does not — case sensitivity is
+ *    governed entirely by each rule's own `ignoreCase`/`i`-flag column.
+ *    `bypass.env_kill_switch` (` [A-Z][A-Z0-9_]*_HOOKS?=`) and
+ *    `destructive.chmod_recursive_root`/`chown_recursive_root`
+ *    (`[a-zA-Z]*R[a-zA-Z]*`, a literal uppercase `R` for the recursive flag)
+ *    both key on case WITHOUT setting that flag; forcing the subject to
+ *    lowercase first makes them never fire, on real production patterns.
+ *
+ * This reader pads and preserves case, matching the real shipped contract;
+ * see the fidelity suite for the evidence.
+ *
+ * The regex-dialect divergence the Python module documents (`.rules` patterns
+ * are authored as JavaScript regexes; compiling them with a different engine
+ * can disagree on lookbehind syntax and some Unicode escapes) does not apply
+ * here — this reader compiles them as native JS `RegExp`, the dialect they
+ * were authored in.
+ */
+export declare const SNAPSHOT_STALE_AFTER_DAYS = 7;
+/** Severity tiers, in the order the shipped gate handles them. */
+export declare const SEV_SHADOW: "shadow";
+export declare const SEV_WARN: "warn";
+export declare const SEV_BLOCK: "block";
+export type Severity = typeof SEV_SHADOW | typeof SEV_WARN | typeof SEV_BLOCK;
+export type RuleSubject = 'tool' | 'command' | 'target' | 'any';
+export type SnapshotState = 'ok' | 'absent' | 'invalid' | 'empty' | 'stale';
+export interface Rule {
+    id: string;
+    severity: string;
+    subject: RuleSubject;
+    reason: string;
+    pattern: RegExp;
+}
+export declare class Snapshot {
+    rules: Rule[];
+    digest: string;
+    state: SnapshotState;
+    workspaceId: string;
+    generatedAt: string;
+    ageDays: number;
+    /** Regexes that would not compile. */
+    droppedRules: number;
+    get healthMessage(): string;
+}
+export interface Decision {
+    /** `null` means allow. */
+    severity: Severity | null;
+    reason: string;
+    ruleId: string;
+}
+export declare function snapshotPath(): string;
+export declare function loadSnapshot(workspaceId?: string, path?: string): Snapshot;
+/** Evaluate one tool call against the snapshot. First match wins. */
+export declare function evaluate(toolName: string, target: string, command: string, snap: Snapshot, guardDisabled?: boolean): Decision;
+export declare function guardDisabledFromEnv(): boolean;
+//# sourceMappingURL=snapshot.d.ts.map

package/dist/snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../src/snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AAOH,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAE1C,kEAAkE;AAClE,eAAO,MAAM,UAAU,EAAG,QAAiB,CAAA;AAC3C,eAAO,MAAM,QAAQ,EAAG,MAAe,CAAA;AACvC,eAAO,MAAM,SAAS,EAAG,OAAgB,CAAA;AAEzC,MAAM,MAAM,QAAQ,GAAG,OAAO,UAAU,GAAG,OAAO,QAAQ,GAAG,OAAO,SAAS,CAAA;AAC7E,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,KAAK,CAAA;AAC/D,MAAM,MAAM,aAAa,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAA;AAE3E,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,WAAW,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,qBAAa,QAAQ;IACnB,KAAK,EAAE,IAAI,EAAE,CAAK;IAClB,MAAM,SAAS;IACf,KAAK,EAAE,aAAa,CAAW;IAC/B,WAAW,SAAK;IAChB,WAAW,SAAK;IAChB,OAAO,SAAI;IACX,sCAAsC;IACtC,YAAY,SAAI;IAEhB,IAAI,aAAa,IAAI,MAAM,CAa1B;CACF;AAED,MAAM,WAAW,QAAQ;IACvB,0BAA0B;IAC1B,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf;AAMD,wBAAgB,YAAY,IAAI,MAAM,CAKrC;AAaD,wBAAgB,YAAY,CAAC,WAAW,SAAK,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,CAgFtE;AAED,qEAAqE;AACrE,wBAAgB,QAAQ,CACtB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,QAAQ,EACd,aAAa,UAAQ,GACpB,QAAQ,CA0CV;AAED,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C"}

package/dist/snapshot.js

@@ -0,0 +1,243 @@
+/**
+ * Policy-snapshot reader — a port of the shipped gate contract.
+ *
+ * Primary porting source: `packages/intutic-clawde/intutic_clawde/gate/snapshot.py`.
+ * Source of truth for the wire format and evaluation order (both the Python
+ * port and this one target the same artifact):
+ *   services/sync-daemon/src/harness/gateBody.ts
+ *     - RULES_COLUMNS / toRulesLine()   the `.rules` line layout
+ *     - JS_SNAPSHOT_LOADER              parsing + integrity
+ *     - intuticGate()                   evaluation order
+ *
+ * The sync-daemon compiles a workspace's SOPs into
+ * `~/.intutic/hooks/policy-snapshot.rules` and every harness gate reads it.
+ * This is the JS/TS SDK's reader, for frameworks that have no dedicated
+ * adapter of their own — it consumes the same documented artifact rather than
+ * inventing a channel.
+ *
+ * Deliberate fidelity points, each of which the upstream comments call out as
+ * a past defect:
+ *
+ *   * Subjects are tested SEPARATELY, never concatenated. Joining them lets a
+ *     pattern match across the seam between two innocuous values.
+ *   * The block reason is the rule's own text plus `[id]`. `hookEvents.resolveSeverity`
+ *     greps that text for "governance-protected" to file the incident CRITICAL;
+ *     a generic message silently downgrades it to MEDIUM.
+ *   * INTUTIC_GUARD_DISABLE=1 drops ONLY the `destructive.*` family, never the
+ *     compiled floor and never a workspace's own rules.
+ *   * A snapshot rule whose regex will not compile is dropped, not fatal.
+ *   * Snapshot health is reported as an event — "snapshot missing on 400
+ *     machines" must not look identical to "snapshot present and healthy".
+ *
+ * ## Two deliberate divergences from the Python SDK reader
+ *
+ * Both were found empirically, by running `src/__tests__/fidelity.test.ts`
+ * against a hand-port of `intutic_clawde/gate/snapshot.py`'s `_normalise()`
+ * and watching real patterns from `protectedPaths.ts` fail to fire. Neither
+ * is a stylistic choice; both are confirmed gaps in `intutic_clawde`'s
+ * reader relative to the shipped contract it claims to port, carried here
+ * only as a documented finding, not as behaviour to reproduce.
+ *
+ * 1. **No padding.** `_normalise()` lowercases and collapses whitespace but
+ *    does not pad the result with a leading/trailing space. The actual
+ *    shipped gate (`intuticNormalise` in gateBody.ts, emitted from
+ *    `NORMALISE_CONTRACT.jsSource`) pads. Padding is what lets a
+ *    floor/destructive pattern use a plain leading space as a stand-in for
+ *    `^` (`' rm( +-[a-zA-Z-]+)+ +/( |\\*)'` requires a literal space before
+ *    `rm`) — POSIX ERE has no `\b` and no reliable `^`/`$` inside the emitted
+ *    shell gates, so the whole pattern table is authored against the padded
+ *    contract. It is also why `policySnapshot.ts`'s `toGuardPattern` strips
+ *    the `^`/`$` off an SOP `toolPattern` and re-wraps it as `' (name) '`
+ *    before shipping it as a `subject: 'tool'` snapshot rule — that
+ *    transformation only makes sense against a padded reader. Without
+ *    padding, a command that BEGINS with the dangerous verb (`"rm -rf /"`,
+ *    no leading space) never matches `' rm...'` at all, and the block
+ *    silently never fires.
+ * 2. **Forced lowercasing.** `_normalise()` lowercases unconditionally; the
+ *    real `NORMALISE_CONTRACT.jsSource` does not — case sensitivity is
+ *    governed entirely by each rule's own `ignoreCase`/`i`-flag column.
+ *    `bypass.env_kill_switch` (` [A-Z][A-Z0-9_]*_HOOKS?=`) and
+ *    `destructive.chmod_recursive_root`/`chown_recursive_root`
+ *    (`[a-zA-Z]*R[a-zA-Z]*`, a literal uppercase `R` for the recursive flag)
+ *    both key on case WITHOUT setting that flag; forcing the subject to
+ *    lowercase first makes them never fire, on real production patterns.
+ *
+ * This reader pads and preserves case, matching the real shipped contract;
+ * see the fidelity suite for the evidence.
+ *
+ * The regex-dialect divergence the Python module documents (`.rules` patterns
+ * are authored as JavaScript regexes; compiling them with a different engine
+ * can disagree on lookbehind syntax and some Unicode escapes) does not apply
+ * here — this reader compiles them as native JS `RegExp`, the dialect they
+ * were authored in.
+ */
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+export const SNAPSHOT_STALE_AFTER_DAYS = 7;
+/** Severity tiers, in the order the shipped gate handles them. */
+export const SEV_SHADOW = 'shadow';
+export const SEV_WARN = 'warn';
+export const SEV_BLOCK = 'block';
+export class Snapshot {
+    rules = [];
+    digest = 'none';
+    state = 'absent';
+    workspaceId = '';
+    generatedAt = '';
+    ageDays = 0;
+    /** Regexes that would not compile. */
+    droppedRules = 0;
+    get healthMessage() {
+        switch (this.state) {
+            case 'absent':
+                return 'No policy snapshot — built-in protections only';
+            case 'invalid':
+                return 'Policy snapshot failed its digest or workspace check — dynamic rules dropped';
+            case 'empty':
+                return 'Policy snapshot contains no rules — the compile produced nothing';
+            case 'stale':
+                return `Policy snapshot is ${this.ageDays} days old and still enforced`;
+            default:
+                return '';
+        }
+    }
+}
+function allow() {
+    return { severity: null, reason: '', ruleId: '' };
+}
+export function snapshotPath() {
+    return (process.env.INTUTIC_SNAPSHOT_RULES ||
+        join(homedir(), '.intutic', 'hooks', 'policy-snapshot.rules'));
+}
+/**
+ * Collapse and pad whitespace, as the shipped gates do — case is
+ * DELIBERATELY left untouched; a rule that wants case-insensitivity sets its
+ * own `ignoreCase` flag. See the module doc comment for both ways the Python
+ * SDK's reader diverges from this.
+ */
+function normalise(value) {
+    const s = value === null || value === undefined ? '' : String(value);
+    return ' ' + s.replace(/\s+/g, ' ').trim() + ' ';
+}
+export function loadSnapshot(workspaceId = '', path) {
+    const p = path ?? snapshotPath();
+    const snap = new Snapshot();
+    let text;
+    try {
+        text = readFileSync(p, 'utf-8');
+    }
+    catch {
+        return snap; // state stays 'absent'
+    }
+    snap.state = 'ok';
+    for (const line of text.split('\n')) {
+        if (line.startsWith('#digest ')) {
+            snap.digest = line.slice(8).trim();
+            continue;
+        }
+        if (line.startsWith('#workspace ')) {
+            snap.workspaceId = line.slice(11).trim();
+            continue;
+        }
+        if (line.startsWith('#generated ')) {
+            snap.generatedAt = line.slice(11).trim();
+            continue;
+        }
+        if (!line || line.startsWith('#'))
+            continue;
+        const f = line.split('\t');
+        // Column order: id, severity, flags, subject, reason, source(regex), [argPatternB64].
+        if (f.length < 6 || !f[5])
+            continue;
+        try {
+            snap.rules.push({
+                id: f[0],
+                severity: f[1],
+                subject: f[3] || 'any',
+                reason: f[4],
+                pattern: new RegExp(f[5], f[2] === 'i' ? 'i' : ''),
+            });
+        }
+        catch {
+            snap.droppedRules += 1;
+        }
+    }
+    // Integrity. A digest nobody recomputes is a comment; a workspace id nobody
+    // compares means workspace A's rules get enforced on B's machine and B's
+    // events attribute A's policy to B.
+    const body = text
+        .split('\n')
+        .filter((l) => l && !l.startsWith('#'))
+        .join('\n');
+    const actual = createHash('sha256').update(body, 'utf-8').digest('hex').slice(0, 32);
+    if (snap.digest !== 'none' && actual !== snap.digest) {
+        snap.state = 'invalid';
+    }
+    if (snap.state === 'ok' && snap.workspaceId && workspaceId && snap.workspaceId !== workspaceId) {
+        snap.state = 'invalid';
+    }
+    // Distinct from absent: the writer always ships the destructive tier, so no
+    // rules means the compile produced nothing.
+    if (snap.state === 'ok' && snap.rules.length === 0) {
+        snap.state = 'empty';
+    }
+    if (snap.state === 'invalid') {
+        snap.rules = []; // additive tier — dropping it returns to yesterday's behaviour
+    }
+    if (snap.state === 'ok' && snap.generatedAt) {
+        const t = Date.parse(snap.generatedAt);
+        if (!Number.isNaN(t)) {
+            snap.ageDays = Math.max(0, Math.floor((Date.now() - t) / 86_400_000));
+            if (snap.ageDays > SNAPSHOT_STALE_AFTER_DAYS) {
+                snap.state = 'stale'; // staleness governs alerting, not enforcement
+            }
+        }
+    }
+    return snap;
+}
+/** Evaluate one tool call against the snapshot. First match wins. */
+export function evaluate(toolName, target, command, snap, guardDisabled = false) {
+    let rules = snap.rules;
+    if (guardDisabled) {
+        // Only the destructive family is skippable. The alternative a blocked
+        // developer reaches for is chflags nouchg on the hook itself, which is
+        // strictly worse; every use is recorded by the caller.
+        rules = rules.filter((r) => !r.id.startsWith('destructive.'));
+    }
+    const nTool = normalise(toolName);
+    const nCommand = normalise(command);
+    const nTarget = normalise(target);
+    for (const rule of rules) {
+        const subjects = rule.subject === 'tool'
+            ? [nTool]
+            : rule.subject === 'command'
+                ? [nCommand]
+                : rule.subject === 'target'
+                    ? [nTarget]
+                    : [nCommand, nTarget];
+        for (const subject of subjects) {
+            if (!rule.pattern.test(subject))
+                continue;
+            if (rule.severity === SEV_SHADOW) {
+                return { severity: SEV_SHADOW, reason: `${rule.reason} [${rule.id}]`, ruleId: rule.id };
+            }
+            if (rule.severity === SEV_WARN) {
+                const verb = nCommand.trim().split(' ')[0] ?? '';
+                return {
+                    severity: SEV_WARN,
+                    reason: `${rule.reason} [${rule.id}] verb=${verb}`,
+                    ruleId: rule.id,
+                };
+            }
+            // The rule's own reason, not a generic one — resolveSeverity reads it.
+            return { severity: SEV_BLOCK, reason: `${rule.reason} [${rule.id}]`, ruleId: rule.id };
+        }
+    }
+    return allow();
+}
+export function guardDisabledFromEnv() {
+    return process.env.INTUTIC_GUARD_DISABLE === '1';
+}
+//# sourceMappingURL=snapshot.js.map

package/dist/snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.js","sourceRoot":"","sources":["../src/snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAA;AAE1C,kEAAkE;AAClE,MAAM,CAAC,MAAM,UAAU,GAAG,QAAiB,CAAA;AAC3C,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAe,CAAA;AACvC,MAAM,CAAC,MAAM,SAAS,GAAG,OAAgB,CAAA;AAczC,MAAM,OAAO,QAAQ;IACnB,KAAK,GAAW,EAAE,CAAA;IAClB,MAAM,GAAG,MAAM,CAAA;IACf,KAAK,GAAkB,QAAQ,CAAA;IAC/B,WAAW,GAAG,EAAE,CAAA;IAChB,WAAW,GAAG,EAAE,CAAA;IAChB,OAAO,GAAG,CAAC,CAAA;IACX,sCAAsC;IACtC,YAAY,GAAG,CAAC,CAAA;IAEhB,IAAI,aAAa;QACf,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,KAAK,QAAQ;gBACX,OAAO,gDAAgD,CAAA;YACzD,KAAK,SAAS;gBACZ,OAAO,8EAA8E,CAAA;YACvF,KAAK,OAAO;gBACV,OAAO,kEAAkE,CAAA;YAC3E,KAAK,OAAO;gBACV,OAAO,sBAAsB,IAAI,CAAC,OAAO,8BAA8B,CAAA;YACzE;gBACE,OAAO,EAAE,CAAA;QACb,CAAC;IACH,CAAC;CACF;AASD,SAAS,KAAK;IACZ,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AACnD,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAC9D,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,CAAC,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACpE,OAAO,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,GAAG,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,WAAW,GAAG,EAAE,EAAE,IAAa;IAC1D,MAAM,CAAC,GAAG,IAAI,IAAI,YAAY,EAAE,CAAA;IAChC,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAA;IAE3B,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA,CAAC,uBAAuB;IACrC,CAAC;IAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;IACjB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAClC,SAAQ;QACV,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YACxC,SAAQ;QACV,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YACxC,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAE3C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC1B,sFAAsF;QACtF,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,SAAQ;QACnC,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBACd,EAAE,EAAE,CAAC,CAAC,CAAC,CAAE;gBACT,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE;gBACf,OAAO,EAAG,CAAC,CAAC,CAAC,CAAiB,IAAI,KAAK;gBACvC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE;gBACb,OAAO,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,YAAY,IAAI,CAAC,CAAA;QACxB,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,oCAAoC;IACpC,MAAM,IAAI,GAAG,IAAI;SACd,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACtC,IAAI,CAAC,IAAI,CAAC,CAAA;IACb,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACpF,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK,GAAG,SAAS,CAAA;IACxB,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,IAAI,WAAW,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QAC/F,IAAI,CAAC,KAAK,GAAG,SAAS,CAAA;IACxB,CAAC;IAED,4EAA4E;IAC5E,4CAA4C;IAC5C,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAA;IACtB,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,EAAE,CAAA,CAAC,+DAA+D;IACjF,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACtC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAA;YACrE,IAAI,IAAI,CAAC,OAAO,GAAG,yBAAyB,EAAE,CAAC;gBAC7C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAA,CAAC,8CAA8C;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,QAAQ,CACtB,QAAgB,EAChB,MAAc,EACd,OAAe,EACf,IAAc,EACd,aAAa,GAAG,KAAK;IAErB,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;IACtB,IAAI,aAAa,EAAE,CAAC;QAClB,sEAAsE;QACtE,uEAAuE;QACvE,uDAAuD;QACvD,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IACnC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;IAEjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GACZ,IAAI,CAAC,OAAO,KAAK,MAAM;YACrB,CAAC,CAAC,CAAC,KAAK,CAAC;YACT,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS;gBAC1B,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACZ,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ;oBACzB,CAAC,CAAC,CAAC,OAAO,CAAC;oBACX,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAE7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,SAAQ;YACzC,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACjC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAA;YACzF,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;gBAChD,OAAO;oBACL,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,UAAU,IAAI,EAAE;oBAClD,MAAM,EAAE,IAAI,CAAC,EAAE;iBAChB,CAAA;YACH,CAAC;YACD,uEAAuE;YACvE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAA;QACxF,CAAC;IACH,CAAC;IAED,OAAO,KAAK,EAAE,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,GAAG,CAAA;AAClD,CAAC"}

package/dist/soprules.d.ts

@@ -0,0 +1,88 @@
+/**
+ * SOP rules authored in the product, enforced before execution.
+ *
+ * Port of `packages/intutic-clawde/intutic_clawde/gate/soprules.py`.
+ *
+ * `SopRule` has carried an optional `argPattern` since mcp-proxy shipped, and
+ * `packages/mcp-proxy/src/policy.ts` matches it against the serialised tool
+ * input. `intutic/intutic-enterprise#14` added a ` WHERE ` clause to the SOP
+ * title grammar, so a rule can finally say "kubectl apply without a digest"
+ * instead of only "any shell call":
+ *
+ *     BLOCK:^shell$ WHERE kubectl\s+apply(?!.*@sha256:):deploy must be pinned
+ *
+ * Now the *policy* lives in the SOP register — versioned, lifecycle-gated,
+ * visible on the dashboard, editable without touching agent code — and this
+ * module is only the part that applies it.
+ *
+ * Matching mirrors `matchSopRule` in
+ * `services/control-plane/src/lib/sopRuleTitle.ts` (itself a deliberate
+ * line-for-line mirror of `PolicyClient.matchRule` in
+ * `packages/mcp-proxy/src/policy.ts`), deliberately:
+ *
+ *   * rules are tried in the order the control plane returned them
+ *   * first match wins
+ *   * `toolPattern` is tested against the tool name, `argPattern` against the
+ *     serialised tool input
+ *   * the serialisation is the `JSON.stringify(tool_input ?? {})` shape every
+ *     mirror matches against — compact separators, insertion order, non-ASCII
+ *     left intact
+ *   * a rule whose regex does not compile is SKIPPED, not fatal
+ *
+ * Fetch failure is non-fatal for the same reason it is in `policy.ts`: the
+ * gate's image-integrity tier independently covers the deploy case and fails
+ * CLOSED. This tier changes where the policy is *authored*, not whether the
+ * run is safe.
+ */
+export declare const FETCH_TIMEOUT_MS = 3000;
+export declare const ACTION_BLOCK = "block";
+export declare const ACTION_WARN = "warn";
+export declare const ACTION_APPROVAL = "require_approval";
+export interface SopRule {
+    id: string;
+    toolPattern: string;
+    action: string;
+    reason: string;
+    argPattern: string | null;
+}
+/** Mirror of `matchSopRule`, including its silent-skip on bad regex. */
+export declare function ruleMatches(rule: SopRule, toolName: string, toolInputJson: string): boolean;
+/**
+ * The `JSON.stringify(tool_input ?? {})` shape every mirror matches against.
+ *
+ * `JSON.stringify` already produces compact separators and preserves
+ * insertion order and non-ASCII by default — this function exists mainly so
+ * every call site names the contract explicitly rather than calling
+ * `JSON.stringify` inline and drifting on a future edit.
+ */
+export declare function serialiseToolInput(toolInput: Record<string, unknown> | null | undefined): string;
+/**
+ * Accept the rule list in whichever envelope the control plane used.
+ *
+ * `/api/v1/sop/rules` returns `{rules:[...]}`, while sibling list endpoints
+ * variously return `{items:[...]}` and `{data:[...]}`. Reading the wrong key
+ * yields zero rules and a tier that enforces nothing while looking healthy —
+ * the worst failure a gate can have — so all three are accepted rather than
+ * assumed.
+ */
+export declare function parseRules(payload: unknown): SopRule[];
+/**
+ * Fetch active VALIDATED rules, or `null` if they could not be fetched.
+ *
+ * `null` and `[]` mean different things and the caller must not conflate
+ * them: `null` is "the register did not answer", `[]` is "the register
+ * answered and this workspace has no rules". Only the second is a statement
+ * about policy.
+ */
+export declare function fetchRules(baseUrl: string, apiKey: string, workspaceId: string, timeoutMs?: number): Promise<SopRule[] | null>;
+/**
+ * True when the control plane emitted at least one usable `argPattern`.
+ *
+ * A control plane predating `intutic-enterprise#14` cannot produce one, so
+ * this doubles as a deployment probe — surface it rather than letting the
+ * tier be silently inert.
+ */
+export declare function supportsArgPatterns(rules: readonly SopRule[]): boolean;
+/** First rule matching this call, in control-plane order. */
+export declare function firstMatch(rules: readonly SopRule[], toolName: string, toolInput: Record<string, unknown> | null | undefined): SopRule | null;
+//# sourceMappingURL=soprules.d.ts.map

package/dist/soprules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"soprules.d.ts","sourceRoot":"","sources":["../src/soprules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,eAAO,MAAM,gBAAgB,OAAQ,CAAA;AAIrC,eAAO,MAAM,YAAY,UAAU,CAAA;AACnC,eAAO,MAAM,WAAW,SAAS,CAAA;AACjC,eAAO,MAAM,eAAe,qBAAqB,CAAA;AAGjD,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAY3F;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAEhG;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,EAAE,CA8BtD;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,MAAyB,GACnC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAqB3B;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAEtE;AAWD,6DAA6D;AAC7D,wBAAgB,UAAU,CACxB,KAAK,EAAE,SAAS,OAAO,EAAE,EACzB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GACpD,OAAO,GAAG,IAAI,CAMhB"}