@intutic/gate 2.1.0 → 2.3.0

package/dist/eve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"eve.d.ts","sourceRoot":"","sources":["../src/eve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8JG;AAEH,OAAO,EAAwB,KAAK,IAAI,EAAE,MAAM,WAAW,CAAA;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAMxC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAE/D;;gFAEgF;AAChF,eAAO,MAAM,sBAAsB,iBAAiB,CAAA;AAKpD;;;;;uEAKuE;AACvE,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,OAAO,GACP,gBAAgB,GAChB,UAAU,GACV,QAAQ,GACR,eAAe,GACf;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,CAAA;AAE/D;;;;mEAImE;AACnE,MAAM,WAAW,kBAAkB;IACjC;;;6CAGyC;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;iDAE6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAC7B;AAED;;;gDAGgD;AAChD,MAAM,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,kBAAkB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;AAEvF,MAAM,WAAW,sBAAsB;IACrC,4EAA4E;IAC5E,IAAI,CAAC,EAAE,IAAI,CAAA;IACX;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,CAAC,EAAE,gBAAgB,GAAG,eAAe,CAAA;CAC7C;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,eAAe,CAAC,IAAI,GAAE,sBAA2B,GAAG,iBAAiB,CAmBpF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,GAAE,sBAA2B,GAAG,iBAAiB,CAE9F;AAMD;;sEAEsE;AACtE,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;IACnC,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;QAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAA;QAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;QACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;QACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED;mDACmD;AACnD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,WAAW,CAAA;QAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;QACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,eAAe,GAAG,eAAe,CAAA;IAC7D;;kEAE8D;IAC9D,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KACzB,CAAA;CACF;AAED;;yEAEyE;AACzE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAA;QAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,eAAe,GAAG,eAAe,CAAA;IAC7D,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAA;IAC1F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KACvB,CAAA;CACF;AAED;;;;;0CAK0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAC/B,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAA;QACnD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED;;2CAE2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3C;AAED;oEACoE;AACpE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,iBAAiB,EAAE,CAC1B,KAAK,EAAE,sBAAsB,EAC7B,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,IAAI,CAAC,CAAA;QAClB,QAAQ,CAAC,oBAAoB,EAAE,CAC7B,KAAK,EAAE,yBAAyB,EAChC,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,IAAI,CAAC,CAAA;QAClB,QAAQ,CAAC,kBAAkB,EAAE,CAC3B,KAAK,EAAE,uBAAuB,EAC9B,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,IAAI,CAAC,CAAA;QAClB,QAAQ,CAAC,gBAAgB,EAAE,CACzB,KAAK,EAAE,qBAAqB,EAC5B,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,IAAI,CAAC,CAAA;KACnB,CAAA;CACF;AAED,MAAM,WAAW,wBAAwB;IACvC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,wBAA6B,GAAG,sBAAsB,CA6I7F"}
+{"version":3,"file":"eve.d.ts","sourceRoot":"","sources":["../src/eve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8JG;AAEH,OAAO,EAAwB,KAAK,IAAI,EAAE,MAAM,WAAW,CAAA;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAMxC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAE/D;;gFAEgF;AAChF,eAAO,MAAM,sBAAsB,iBAAiB,CAAA;AAKpD;;;;;uEAKuE;AACvE,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,OAAO,GACP,gBAAgB,GAChB,UAAU,GACV,QAAQ,GACR,eAAe,GACf;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,CAAA;AAE/D;;;;mEAImE;AACnE,MAAM,WAAW,kBAAkB;IACjC;;;6CAGyC;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;iDAE6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAC7B;AAED;;;gDAGgD;AAChD,MAAM,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,kBAAkB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;AAEvF,MAAM,WAAW,sBAAsB;IACrC,4EAA4E;IAC5E,IAAI,CAAC,EAAE,IAAI,CAAA;IACX;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,CAAC,EAAE,gBAAgB,GAAG,eAAe,CAAA;CAC7C;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,eAAe,CAAC,IAAI,GAAE,sBAA2B,GAAG,iBAAiB,CAmBpF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,GAAE,sBAA2B,GAAG,iBAAiB,CAE9F;AAMD;;sEAEsE;AACtE,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;IACnC,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;QAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAA;QAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;QACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;QACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED;mDACmD;AACnD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,WAAW,CAAA;QAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;QACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,eAAe,GAAG,eAAe,CAAA;IAC7D;;kEAE8D;IAC9D,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KACzB,CAAA;CACF;AAED;;yEAEyE;AACzE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAA;QAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,eAAe,GAAG,eAAe,CAAA;IAC7D,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAA;IAC1F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KACvB,CAAA;CACF;AAED;;;;;kCAKkC;AAClC,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAC/B,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAA;QACnD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED;;2CAE2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3C;AAED;oEACoE;AACpE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,iBAAiB,EAAE,CAC1B,KAAK,EAAE,sBAAsB,EAC7B,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,IAAI,CAAC,CAAA;QAClB,QAAQ,CAAC,oBAAoB,EAAE,CAC7B,KAAK,EAAE,yBAAyB,EAChC,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,IAAI,CAAC,CAAA;QAClB,QAAQ,CAAC,kBAAkB,EAAE,CAC3B,KAAK,EAAE,uBAAuB,EAC9B,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,IAAI,CAAC,CAAA;QAClB,QAAQ,CAAC,gBAAgB,EAAE,CACzB,KAAK,EAAE,qBAAqB,EAC5B,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,IAAI,CAAC,CAAA;KACnB,CAAA;CACF;AAED,MAAM,WAAW,wBAAwB;IACvC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,wBAA6B,GAAG,sBAAsB,CA6I7F"}

package/dist/eve.js

@@ -11,8 +11,9 @@
  * with `instructions.md`, `agent/tools/*.ts`, `agent/connections/*.ts`,
  * `agent/hooks/*.ts`, ...) that eve builds by walking the tree. It is a
  * pre-1.0 PREVIEW product (integrated at 0.39.1, re-verified at 0.71.0; very active) —
- * see docs/TECH_DEBT.md TD-410 for the churn shield this adapter carries,
- * the same posture the dsh integration established.
+ * this adapter carries a churn shield (structural copies of eve's types,
+ * re-checked against the real ones on every eve upgrade), the same posture
+ * the dsh integration established.
  *
  * ## The veto mechanism — CONFIRMED against a real install, not assumed
  *
@@ -94,7 +95,7 @@
  * `requestId`/`responderPrincipalId`/`turnId`/`stepIndex` but NOT the tool
  * name or input.
  *
- * TD-411 half 2, revisited: `intuticApproval()` and `intuticAuditHooks()` are
+ * Recovering the tool name: `intuticApproval()` and `intuticAuditHooks()` are
  * both plain functions exported from this one module and cannot be assumed to
  * run in the same process at settlement time — eve's own docs state a parked
  * approval survives a process restart verbatim ("the process can restart and
@@ -124,11 +125,10 @@
  * name too WHEN this cache is still warm (same-process, or a short-lived
  * pause). When it is not — a genuinely long-parked, cross-restart approval —
  * settlement still falls back to the synthetic {@link EVE_APPROVAL_TOOL_NAME},
- * exactly the pre-existing behaviour, never worse. See TD-411 for the full
- * reasoning and what a persistent (non-memory) correlation store would take
- * to close that residual gap.
+ * exactly the pre-existing behaviour, never worse. Closing that residual gap
+ * would take a persistent (non-memory) correlation store.
  *
- * TD-498: a live `eve start` run showed that `approval.candidate`/
+ * A live `eve start` run showed that `approval.candidate`/
  * `approval.settled` fire ONLY for the `approval: { request, response }`
  * form. The bare form this adapter documents (`approval: intuticApproval()`)
  * settles through a fourth hookable event, `input.resolved` (`HookEventMap`,
@@ -147,7 +147,7 @@
  * `VERCEL_OIDC_TOKEN` credentials — confirmed in `docs/agent-config.md` and
  * `docs/getting-started.mdx`). The AI Gateway wire protocol is NOT something
  * the Intutic proxy parses, so gateway-routed egress is ungoverned by the
- * proxy — full stop, and TD-412 tracks it. The governable path is eve's
+ * proxy — full stop. The governable path is eve's
  * other documented option: passing a provider-authored `LanguageModel`
  * (`createOpenAI(...)` etc.) to `defineAgent({ model })`, where the
  * `withIntuticProxy()` helper — implemented once in `vercel.ts` and
@@ -298,7 +298,7 @@ export function intuticConnectionApproval(opts = {}) {
  * - `input.requested`, one `kind: 'tool-approval'` request → `tool_flagged`,
  *   under the REAL tool name (`request.action.toolName`) — a genuinely new
  *   signal this adapter did not emit before: a call is now pending human
- *   approval. See the module doc (TD-411) for why this event, not a
+ *   approval. See the module doc for why this event, not a
  *   process-memory map, is what closes "no tool identity" here.
  * - `approval.settled` `outcome: 'approved'` → `tool_allowed` — a human
  *   explicitly approved the parked call.
@@ -346,7 +346,7 @@ export function intuticAuditHooks(opts = {}) {
     // settlement (eve's own docs say this is expected and safe for eve itself
     // — "the process can restart and the parked turn survives") simply finds
     // this map empty and falls back to EVE_APPROVAL_TOOL_NAME, exactly this
-    // function's behaviour before this cache existed. See TD-411.
+    // function's behaviour before this cache existed.
     const requestIdToToolName = new Map();
     // A `{ request, response }` approval settles through BOTH `approval.settled`
     // and `input.resolved`; a bare policy only through `input.resolved`. The

package/dist/eve.js.map

@@ -1 +1 @@
-{"version":3,"file":"eve.js","sourceRoot":"","sources":["../src/eve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8JG;AAEH,OAAO,EAAE,MAAM,IAAI,UAAU,EAAa,MAAM,WAAW,CAAA;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,2EAA2E;AAC3E,0EAA0E;AAC1E,iEAAiE;AACjE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAE/D;;gFAEgF;AAChF,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAA;AAEpD,sEAAsE;AACtE,MAAM,uBAAuB,GAAG,IAAI,CAAA;AA2EpC;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,KAAkB,CAAA;IAC3B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,eAAe,CAAC,OAA+B,EAAE;IAC/D,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,CAAA;QACnC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,8EAA8E;gBAC5E,oEAAoE,CACvE,CAAA;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;YAC9D,OAAO,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAA;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAA;YAChD,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA+B,EAAE;IACzE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAA;AAC9B,CAAC;AAsJD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAiC,EAAE;IACnE,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAA;IAEvD,wEAAwE;IACxE,sEAAsE;IACtE,gEAAgE;IAChE,sEAAsE;IACtE,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,wEAAwE;IACxE,8DAA8D;IAC9D,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAA;IAErD,6EAA6E;IAC7E,yEAAyE;IACzE,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,kDAAkD;IAClD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,SAAS,eAAe,CAAC,SAAiB;QACxC,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAA;QAC3C,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACtB,IAAI,OAAO,CAAC,IAAI,GAAG,uBAAuB,EAAE,CAAC;YAC3C,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAA;QACzD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,SAAS,SAAS,CAAC,SAAiB;QAClC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,MAAM,CAAA;QACjD,IAAI,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;gBAC/D,oEAAoE;gBACpE,6BAA6B;gBAC7B,MAAM,GAAG,IAAI,CAAA;YACf,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,OAAO;QACL,MAAM,EAAE;YACN,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACtC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;gBACxC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAC1C,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;wBAAE,SAAQ;oBAC9E,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;oBACnE,IAAI,MAAM,KAAK,IAAI;wBAAE,SAAQ;oBAC7B,MAAM,MAAM,CAAC,IAAI,CACf,cAAc,EACd,OAAO,CAAC,MAAM,CAAC,QAAQ,EACvB,kEAAkE,OAAO,CAAC,SAAS,GAAG,EACtF,OAAO,CAAC,MAAM,CAAC,KAAK,CACrB,CAAA;gBACH,CAAC;YACH,CAAC;YACD,oBAAoB,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACzC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS;oBAAE,OAAM;gBAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;gBACxC,IAAI,MAAM,KAAK,IAAI;oBAAE,OAAM;gBAC3B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAA;gBACxF,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;gBAChE,MAAM,MAAM,CAAC,IAAI,CACf,cAAc,EACd,QAAQ,EACR,0BAA0B,KAAK,CAAC,IAAI,CAAC,OAAO,aAAa,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI;oBAC/E,aAAa,KAAK,CAAC,IAAI,CAAC,oBAAoB,IAAI,MAAM,EAAE,EAC1D,KAAK,CAAC,IAAI,CACX,CAAA;YACH,CAAC;YACD,kBAAkB,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACvC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAA;gBACxF,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAChD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;oBAAE,OAAM;gBAClD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;gBACxC,IAAI,MAAM,KAAK,IAAI;oBAAE,OAAM;gBAC3B,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;oBACtC,MAAM,MAAM,CAAC,IAAI,CACf,cAAc,EACd,QAAQ,EACR,qCAAqC,KAAK,CAAC,IAAI,CAAC,oBAAoB,GAAG;wBACrE,YAAY,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,EACrC,KAAK,CAAC,IAAI,CACX,CAAA;oBACD,OAAM;gBACR,CAAC;gBACD,MAAM,MAAM,CAAC,IAAI,CACf,cAAc,EACd,QAAQ,EACR,mEAAmE;oBACjE,YAAY,KAAK,CAAC,IAAI,CAAC,SAAS,eAAe,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK;oBACnF,kFAAkF,EACpF,KAAK,CAAC,IAAI,CACX,CAAA;YACH,CAAC;YACD,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACrC,uDAAuD;gBACvD,oEAAoE;gBACpE,aAAa;gBACb,MAAM,QAAQ,GAAgE,EAAE,CAAA;gBAChF,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAChD,IAAI,UAAU,CAAC,IAAI,KAAK,eAAe;wBAAE,SAAQ;oBACjD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAA;oBACxF,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;oBAChD,IAAI,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC;wBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAA;gBACpF,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAM;gBACjC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;gBACxC,IAAI,MAAM,KAAK,IAAI;oBAAE,OAAM;gBAC3B,KAAK,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,QAAQ,EAAE,CAAC;oBAChD,MAAM,OAAO,GAAG,YAAY,UAAU,CAAC,SAAS,GAAG,CAAA;oBACnD,IAAI,UAAU,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;wBACtC,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,mCAAmC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAA;oBACvG,CAAC;yBAAM,IAAI,UAAU,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;wBAC3C,MAAM,MAAM,CAAC,IAAI,CACf,cAAc,EACd,QAAQ,EACR,kEAAkE,OAAO,IAAI;4BAC3E,kFAAkF,EACpF,UAAU,CACX,CAAA;oBACH,CAAC;yBAAM,CAAC;wBACN,MAAM,MAAM,CAAC,IAAI,CACf,cAAc,EACd,QAAQ,EACR,uCAAuC,UAAU,CAAC,OAAO,KAAK,OAAO,EAAE,EACvE,UAAU,CACX,CAAA;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;SACF;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"eve.js","sourceRoot":"","sources":["../src/eve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8JG;AAEH,OAAO,EAAE,MAAM,IAAI,UAAU,EAAa,MAAM,WAAW,CAAA;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,2EAA2E;AAC3E,0EAA0E;AAC1E,iEAAiE;AACjE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAE/D;;gFAEgF;AAChF,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAA;AAEpD,sEAAsE;AACtE,MAAM,uBAAuB,GAAG,IAAI,CAAA;AA2EpC;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,KAAkB,CAAA;IAC3B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,eAAe,CAAC,OAA+B,EAAE;IAC/D,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,CAAA;QACnC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,8EAA8E;gBAC5E,oEAAoE,CACvE,CAAA;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;YAC9D,OAAO,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAA;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAA;YAChD,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA+B,EAAE;IACzE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAA;AAC9B,CAAC;AAsJD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAiC,EAAE;IACnE,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAA;IAEvD,wEAAwE;IACxE,sEAAsE;IACtE,gEAAgE;IAChE,sEAAsE;IACtE,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,wEAAwE;IACxE,kDAAkD;IAClD,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAA;IAErD,6EAA6E;IAC7E,yEAAyE;IACzE,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,kDAAkD;IAClD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,SAAS,eAAe,CAAC,SAAiB;QACxC,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAA;QAC3C,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACtB,IAAI,OAAO,CAAC,IAAI,GAAG,uBAAuB,EAAE,CAAC;YAC3C,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAA;QACzD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,SAAS,SAAS,CAAC,SAAiB;QAClC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,MAAM,CAAA;QACjD,IAAI,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;gBAC/D,oEAAoE;gBACpE,6BAA6B;gBAC7B,MAAM,GAAG,IAAI,CAAA;YACf,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,OAAO;QACL,MAAM,EAAE;YACN,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACtC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;gBACxC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAC1C,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;wBAAE,SAAQ;oBAC9E,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;oBACnE,IAAI,MAAM,KAAK,IAAI;wBAAE,SAAQ;oBAC7B,MAAM,MAAM,CAAC,IAAI,CACf,cAAc,EACd,OAAO,CAAC,MAAM,CAAC,QAAQ,EACvB,kEAAkE,OAAO,CAAC,SAAS,GAAG,EACtF,OAAO,CAAC,MAAM,CAAC,KAAK,CACrB,CAAA;gBACH,CAAC;YACH,CAAC;YACD,oBAAoB,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACzC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS;oBAAE,OAAM;gBAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;gBACxC,IAAI,MAAM,KAAK,IAAI;oBAAE,OAAM;gBAC3B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAA;gBACxF,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;gBAChE,MAAM,MAAM,CAAC,IAAI,CACf,cAAc,EACd,QAAQ,EACR,0BAA0B,KAAK,CAAC,IAAI,CAAC,OAAO,aAAa,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI;oBAC/E,aAAa,KAAK,CAAC,IAAI,CAAC,oBAAoB,IAAI,MAAM,EAAE,EAC1D,KAAK,CAAC,IAAI,CACX,CAAA;YACH,CAAC;YACD,kBAAkB,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACvC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAA;gBACxF,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAChD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;oBAAE,OAAM;gBAClD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;gBACxC,IAAI,MAAM,KAAK,IAAI;oBAAE,OAAM;gBAC3B,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;oBACtC,MAAM,MAAM,CAAC,IAAI,CACf,cAAc,EACd,QAAQ,EACR,qCAAqC,KAAK,CAAC,IAAI,CAAC,oBAAoB,GAAG;wBACrE,YAAY,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,EACrC,KAAK,CAAC,IAAI,CACX,CAAA;oBACD,OAAM;gBACR,CAAC;gBACD,MAAM,MAAM,CAAC,IAAI,CACf,cAAc,EACd,QAAQ,EACR,mEAAmE;oBACjE,YAAY,KAAK,CAAC,IAAI,CAAC,SAAS,eAAe,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK;oBACnF,kFAAkF,EACpF,KAAK,CAAC,IAAI,CACX,CAAA;YACH,CAAC;YACD,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACrC,uDAAuD;gBACvD,oEAAoE;gBACpE,aAAa;gBACb,MAAM,QAAQ,GAAgE,EAAE,CAAA;gBAChF,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAChD,IAAI,UAAU,CAAC,IAAI,KAAK,eAAe;wBAAE,SAAQ;oBACjD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAA;oBACxF,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;oBAChD,IAAI,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC;wBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAA;gBACpF,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAM;gBACjC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;gBACxC,IAAI,MAAM,KAAK,IAAI;oBAAE,OAAM;gBAC3B,KAAK,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,QAAQ,EAAE,CAAC;oBAChD,MAAM,OAAO,GAAG,YAAY,UAAU,CAAC,SAAS,GAAG,CAAA;oBACnD,IAAI,UAAU,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;wBACtC,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,mCAAmC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAA;oBACvG,CAAC;yBAAM,IAAI,UAAU,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;wBAC3C,MAAM,MAAM,CAAC,IAAI,CACf,cAAc,EACd,QAAQ,EACR,kEAAkE,OAAO,IAAI;4BAC3E,kFAAkF,EACpF,UAAU,CACX,CAAA;oBACH,CAAC;yBAAM,CAAC;wBACN,MAAM,MAAM,CAAC,IAAI,CACf,cAAc,EACd,QAAQ,EACR,uCAAuC,UAAU,CAAC,OAAO,KAAK,OAAO,EAAE,EACvE,UAAU,CACX,CAAA;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;SACF;KACF,CAAA;AACH,CAAC"}

package/dist/gate.d.ts

@@ -9,13 +9,33 @@
  * PreToolUse hook for them. This package is that enforcement point: the
  * missing adapter, written against Intutic's own published gate contract.
  *
- * Four tiers, in order — identical precedence to the Python SDK:
+ * Six tiers, in order — identical precedence to the Python SDK:
  *
+ *   A0  SSO group policy  from the policy snapshot       unknown groups refused
  *   A1  policy snapshot   port of intuticGate()          fails CLOSED
+ *   M   MCP registry      from the policy snapshot       unverified snapshot admits none
  *   A3  SOP rules         authored in the product        fails OPEN (A2 covers it)
  *   A2  image integrity   local check                    fails CLOSED
  *   B   POST /hook-gate   control-plane check             fail posture set by GateClient
  *
+ * Tier M applies the workspace's MCP server registry and `mcpAllowedServers`
+ * list to an `mcp__<server>__<tool>` call, from the snapshot's
+ * `@mcp_registry` and `@mcp_allowlist` records, with the decision, codes,
+ * rule ids and reasons the hook gates and the MCP proxy use
+ * (`mcpRegistryRecord.ts`, a byte-identical copy of `@intutic/shared-types`'
+ * module). On a snapshot that fails its integrity check, Tier M refuses
+ * every MCP call with `POLICY_SNAPSHOT_UNVERIFIED`, observe-only or not: a
+ * deleted or edited record cannot be told from the workspace's own. A
+ * refusal of an unapproved server reaches the control plane as a
+ * `tool_blocked` event whose reason ends `[mcpDefaultPolicy]`, which puts the
+ * server in the approval queue, as a hook gate's refusal does.
+ *
+ * A hold rule in A1 or A3 (a `REQUIRE_APPROVAL:` SOP, or a local
+ * `review_before:` token) refuses with {@link IntuticGateHold} after
+ * recording the hold for review, unless an approved bypass lets this exact
+ * call through — the hook gates' and the MCP proxy's mechanism, through the
+ * same decisions API. See hold.ts.
+ *
  * A1 and A2 are load-bearing and local. Tier B contributes the DLP regexes
  * and workspace policy from the control plane; whether an unreachable control
  * plane blocks is the client's `failClosed` setting (default true).
@@ -106,6 +126,19 @@ export declare class Gate {
     private reportSnapshotHealthOnce;
     /** Throws {@link IntuticGateRefusal} if this call must not run. Resolves to allow. */
     guard(toolName: string, toolInput: ToolInput): Promise<void>;
+    /**
+     * Throws when the workspace's MCP server registry or allowlist refuses an
+     * `mcp__<server>__<tool>` call: the registry first, as every gate orders
+     * them. An allowlist in `shadow` records the refusal and lets the call on.
+     * A snapshot that failed its integrity check admits no MCP server.
+     */
+    private guardMcp;
+    /**
+     * A hold rule matched: resolves when an approved bypass lets this exact
+     * call through (the remaining tiers still apply), and otherwise throws
+     * {@link IntuticGateHold} after recording the hold.
+     */
+    private hold;
 }
 export { install, active } from './registry.js';
 //# sourceMappingURL=gate.d.ts.map

package/dist/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAKH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AACzC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AAEzC;yDACyD;AACzD,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAM9C,CAAA;AAEF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED,UAAU,cAAc;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,OAAO,CAAA;IACpB,WAAW,EAAE,OAAO,CAAA;CACrB;AAaD,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE/C,qBAAa,IAAI;IACf,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAA;IAClC,OAAO,CAAC,SAAS,CAAiC;IAClD,OAAO,CAAC,iBAAiB,CAAQ;IACjC,OAAO,CAAC,OAAO,CAAsC;IACrD;8EAC0E;IAC1E,OAAO,CAAC,SAAS,CAAkC;gBAEvC,GAAG,GAAE,UAAe,EAAE,MAAM,GAAE,UAAU,GAAG,IAAW;IAKlE,OAAO,CAAC,YAAY;IAOpB,WAAW,IAAI,QAAQ,CAAC,QAAQ;IAOhC;;;;;;;OAOG;IACH,SAAS,IAAI,UAAU,CAAC,WAAW;IAwBnC;;;;;;OAMG;IACG,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAwBlC,IAAI;IAalB;;;;OAIG;YACW,wBAAwB;IAWtC,sFAAsF;IAChF,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;CAqGnE;AAwBD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAOH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AACzC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AAGzC;yDACyD;AACzD,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAM9C,CAAA;AAEF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED,UAAU,cAAc;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,OAAO,CAAA;IACpB,WAAW,EAAE,OAAO,CAAA;CACrB;AAaD,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE/C,qBAAa,IAAI;IACf,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAA;IAClC,OAAO,CAAC,SAAS,CAAiC;IAClD,OAAO,CAAC,iBAAiB,CAAQ;IACjC,OAAO,CAAC,OAAO,CAAsC;IACrD;8EAC0E;IAC1E,OAAO,CAAC,SAAS,CAAkC;gBAEvC,GAAG,GAAE,UAAe,EAAE,MAAM,GAAE,UAAU,GAAG,IAAW;IAKlE,OAAO,CAAC,YAAY;IAOpB,WAAW,IAAI,QAAQ,CAAC,QAAQ;IAOhC;;;;;;;OAOG;IACH,SAAS,IAAI,UAAU,CAAC,WAAW;IAwBnC;;;;;;OAMG;IACG,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAwBlC,IAAI;IAalB;;;;OAIG;YACW,wBAAwB;IAWtC,sFAAsF;IAChF,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAyIlE;;;;;OAKG;YACW,QAAQ;IA+BtB;;;;OAIG;YACW,IAAI;CAgBnB;AAiCD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA"}

package/dist/gate.js

@@ -9,13 +9,33 @@
  * PreToolUse hook for them. This package is that enforcement point: the
  * missing adapter, written against Intutic's own published gate contract.
  *
- * Four tiers, in order — identical precedence to the Python SDK:
+ * Six tiers, in order — identical precedence to the Python SDK:
  *
+ *   A0  SSO group policy  from the policy snapshot       unknown groups refused
  *   A1  policy snapshot   port of intuticGate()          fails CLOSED
+ *   M   MCP registry      from the policy snapshot       unverified snapshot admits none
  *   A3  SOP rules         authored in the product        fails OPEN (A2 covers it)
  *   A2  image integrity   local check                    fails CLOSED
  *   B   POST /hook-gate   control-plane check             fail posture set by GateClient
  *
+ * Tier M applies the workspace's MCP server registry and `mcpAllowedServers`
+ * list to an `mcp__<server>__<tool>` call, from the snapshot's
+ * `@mcp_registry` and `@mcp_allowlist` records, with the decision, codes,
+ * rule ids and reasons the hook gates and the MCP proxy use
+ * (`mcpRegistryRecord.ts`, a byte-identical copy of `@intutic/shared-types`'
+ * module). On a snapshot that fails its integrity check, Tier M refuses
+ * every MCP call with `POLICY_SNAPSHOT_UNVERIFIED`, observe-only or not: a
+ * deleted or edited record cannot be told from the workspace's own. A
+ * refusal of an unapproved server reaches the control plane as a
+ * `tool_blocked` event whose reason ends `[mcpDefaultPolicy]`, which puts the
+ * server in the approval queue, as a hook gate's refusal does.
+ *
+ * A hold rule in A1 or A3 (a `REQUIRE_APPROVAL:` SOP, or a local
+ * `review_before:` token) refuses with {@link IntuticGateHold} after
+ * recording the hold for review, unless an approved bypass lets this exact
+ * call through — the hook gates' and the MCP proxy's mechanism, through the
+ * same decisions API. See hold.ts.
+ *
  * A1 and A2 are load-bearing and local. Tier B contributes the DLP regexes
  * and workspace policy from the control plane; whether an unreachable control
  * plane blocks is the client's `failClosed` setting (default true).
@@ -46,10 +66,14 @@
  */
 import { existsSync, readFileSync } from 'node:fs';
 import { isDeploy, touchesInfra } from './actions.js';
-import { IntuticGateRefusal } from './errors.js';
+import { IntuticGateHold, IntuticGateRefusal } from './errors.js';
+import { holdMessage, requestHold } from './hold.js';
+import { tooLargeReason } from './limits.js';
+import { evaluateMcpAllowlist, evaluateMcpRegistry, mcpSnapshotUnverifiedRefusal } from './mcpRegistryRecord.js';
 import * as imagecheck from './imagecheck.js';
 import * as snapshot from './snapshot.js';
 import * as soprules from './soprules.js';
+import { evaluateSsoGroupClearance } from './ssoGroups.js';
 /** Tools that cannot change anything. They still get the local snapshot check
  *  (Tier A1), but skip the remote gate call (Tier B). */
 export const READ_ONLY_TOOLS = new Set([
@@ -170,14 +194,46 @@ export class Gate {
             return;
         const target = String(toolInput.path ?? toolInput.file_path ?? '');
         const command = String(toolInput.command ?? '');
+        // ---- Size: refused before any tier reads the call ------------------
+        //
+        // Every built-in rule is linear, but a workspace's own WHERE patterns
+        // need not be, and the bound is what keeps a crafted call from holding
+        // the agent (or a harness hook) past its deadline. See limits.ts.
+        const tooLarge = tooLargeReason(command, toolInput);
+        if (tooLarge !== null) {
+            await this.emit('tool_blocked', toolName, tooLarge);
+            throw new IntuticGateRefusal(tooLarge, 'COMMAND_TOO_LARGE');
+        }
         await this.reportSnapshotHealthOnce(toolName);
+        // ---- Tier A0: SSO group policy, from the snapshot ------------------
+        //
+        // The workspace's group policy decided for the member the snapshot was
+        // issued to — the same evaluator, and so the same answer, as the control
+        // plane's hook gate. Not skippable by INTUTIC_GUARD_DISABLE: it is the
+        // workspace's own policy, not the destructive family.
+        const sso = this.getSnapshot().ssoGroups;
+        if (sso) {
+            const d = evaluateSsoGroupClearance(sso.policy, toolName, sso.member ? sso.member.ssoGroups : null);
+            if (d.clearance !== 'GRANTED') {
+                const reason = `${d.reason} [${d.ruleId}]`;
+                await this.emit('tool_blocked', toolName, reason, toolInput);
+                throw new IntuticGateRefusal(reason, 'SSO_GROUP');
+            }
+        }
         // ---- Tier A1: policy snapshot -------------------------------------
         const disabled = snapshot.guardDisabledFromEnv();
         if (disabled) {
             await this.emit('guards_disabled', toolName, 'INTUTIC_GUARD_DISABLE=1 — policy-snapshot rules skipped; built-in protections still active');
         }
+        // Hold rules an approved bypass let through on this call, so the register's
+        // copy of the same rule in Tier A3 does not hold it a second time.
+        const approved = new Set();
         const d = snapshot.evaluate(toolName, target, command, this.getSnapshot(), disabled);
-        if (d.severity === snapshot.SEV_BLOCK) {
+        if (d.severity === snapshot.SEV_HOLD) {
+            await this.hold({ id: d.ruleId, reason: d.reason }, toolName, toolInput);
+            approved.add(d.ruleId);
+        }
+        else if (d.severity === snapshot.SEV_BLOCK) {
             await this.emit('tool_blocked', toolName, d.reason, toolInput);
             throw new IntuticGateRefusal(d.reason, 'SNAPSHOT');
         }
@@ -187,6 +243,8 @@ export class Gate {
         else if (d.severity === snapshot.SEV_SHADOW) {
             await this.emit('tool_would_block', toolName, d.reason, toolInput);
         }
+        // ---- Tier M: the MCP server registry and allowlist ----------------
+        await this.guardMcp(toolName, toolInput);
         // ---- Tier A3: SOP rules authored in the product --------------------
         //
         // Runs before A2 on purpose. When both would fire, the block should be
@@ -201,12 +259,15 @@ export class Gate {
                     throw new IntuticGateRefusal(reason, 'SOP_RULE');
                 }
                 if (rule.action === soprules.ACTION_APPROVAL) {
-                    // No human is at the keyboard during an agent run, so an approval
-                    // that cannot be granted is a block.
-                    await this.emit('tool_blocked', toolName, `${reason} (approval required; no reviewer in an unattended run)`, toolInput);
-                    throw new IntuticGateRefusal(reason, 'SOP_RULE_APPROVAL');
+                    // Held for a person, under the id the snapshot gives the same rule
+                    // (`sop.<id>`), so one approval covers the call in either tier.
+                    const id = `sop.${rule.id}`;
+                    if (!approved.has(id))
+                        await this.hold({ id, reason: rule.reason }, toolName, toolInput);
+                }
+                else {
+                    await this.emit('tool_flagged', toolName, reason, toolInput);
                 }
-                await this.emit('tool_flagged', toolName, reason, toolInput);
             }
         }
         // ---- Tier A2: image integrity -------------------------------------
@@ -236,14 +297,79 @@ export class Gate {
             const resp = await this.client.hookGate(toolName, toolInput);
             if (!resp.allowed) {
                 await this.emit('tool_blocked', toolName, resp.reason, toolInput, resp.incidentId);
-                throw new IntuticGateRefusal(resp.reason, 'HOOK_GATE', resp.incidentId);
+                // The hook gate names the MCP registry's own code when the registry
+                // refused; anything else it refuses is HOOK_GATE.
+                const code = MCP_CODES.has(resp.code ?? '') ? resp.code : 'HOOK_GATE';
+                throw new IntuticGateRefusal(resp.reason, code, resp.incidentId);
             }
         }
         if (!READ_ONLY_TOOLS.has(toolName)) {
             await this.emit('tool_allowed', toolName, '', toolInput);
         }
     }
+    /**
+     * Throws when the workspace's MCP server registry or allowlist refuses an
+     * `mcp__<server>__<tool>` call: the registry first, as every gate orders
+     * them. An allowlist in `shadow` records the refusal and lets the call on.
+     * A snapshot that failed its integrity check admits no MCP server.
+     */
+    async guardMcp(toolName, toolInput) {
+        if (!toolName.startsWith('mcp__'))
+            return;
+        const rest = toolName.slice('mcp__'.length);
+        const sep = rest.indexOf('__');
+        if (sep <= 0)
+            return;
+        const snap = this.getSnapshot();
+        const server = rest.slice(0, sep);
+        if (snap.state === 'invalid') {
+            const refusal = mcpSnapshotUnverifiedRefusal(server);
+            const reason = `${refusal.reason} [${refusal.ruleId}]`;
+            await this.emit('tool_blocked', toolName, reason, toolInput);
+            throw new IntuticGateRefusal(reason, refusal.code);
+        }
+        const registry = snap.mcpRegistry ? evaluateMcpRegistry(snap.mcpRegistry, server, rest.slice(sep + 2)) : null;
+        if (registry) {
+            const reason = `${registry.reason} [${registry.ruleId}]`;
+            await this.emit('tool_blocked', toolName, reason, toolInput);
+            throw new IntuticGateRefusal(reason, registry.code);
+        }
+        const allowlist = snap.mcpAllowlist ? evaluateMcpAllowlist(snap.mcpAllowlist, server) : null;
+        if (allowlist) {
+            const reason = `${allowlist.reason} [${allowlist.ruleId}]`;
+            if (snap.mcpAllowlist.severity === 'shadow') {
+                await this.emit('tool_would_block', toolName, reason, toolInput);
+                return;
+            }
+            await this.emit('tool_blocked', toolName, reason, toolInput);
+            throw new IntuticGateRefusal(reason, allowlist.code);
+        }
+    }
+    /**
+     * A hold rule matched: resolves when an approved bypass lets this exact
+     * call through (the remaining tiers still apply), and otherwise throws
+     * {@link IntuticGateHold} after recording the hold.
+     */
+    async hold(rule, toolName, toolInput) {
+        const outcome = await requestHold(this.client, rule, toolName, toolInput);
+        if (outcome.kind === 'bypassed') {
+            // Let through, loudly: a bypass nobody can see used is no better than
+            // no review at all.
+            await this.emit('hold_approved_bypass_used', toolName, `Approved bypass for ${rule.id} — approved by ${outcome.decidedBy || 'an approver'} on hold ${outcome.holdId}`, toolInput);
+            return;
+        }
+        await this.emit('tool_held', toolName, `${rule.reason} [${rule.id}]`, toolInput);
+        throw new IntuticGateHold(holdMessage(rule.reason, rule.id, outcome), outcome.recorded ? outcome.holdId : undefined);
+    }
 }
+/** The refusal codes of the MCP registry and allowlist, which the hook gate may also return. */
+const MCP_CODES = new Set([
+    'SERVER_BLOCKED',
+    'SERVER_HELD',
+    'SERVER_NOT_APPROVED',
+    'TOOL_DISABLED',
+    'SERVER_NOT_ALLOWED',
+]);
 function isAbsolutePath(p) {
     return p.startsWith('/') || /^[a-zA-Z]:[\\/]/.test(p);
 }

package/dist/gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AACzC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AAEzC;yDACyD;AACzD,MAAM,CAAC,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IAC1D,WAAW;IACX,YAAY;IACZ,MAAM;IACN,KAAK;IACL,MAAM;CACP,CAAC,CAAA;AAoBF,SAAS,aAAa,CAAC,GAAe;IACpC,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG;QAC7B,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;QAClC,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,+BAA+B;QACnE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QAC5B,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACpC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;KACrC,CAAA;AACH,CAAC;AAID,MAAM,OAAO,IAAI;IACN,GAAG,CAAgB;IACnB,MAAM,CAAmB;IAC1B,SAAS,GAA6B,IAAI,CAAA;IAC1C,iBAAiB,GAAG,KAAK,CAAA;IACzB,OAAO,GAAkC,IAAI,CAAA;IACrD;8EAC0E;IAClE,SAAS,GAA8B,IAAI,CAAA;IAEnD,YAAY,MAAkB,EAAE,EAAE,SAA4B,IAAI;QAChE,IAAI,CAAC,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAEO,YAAY;QAClB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAA;QAChC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED,uEAAuE;IAEvE,WAAW;QACT,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC9D,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED;;;;;;;OAOG;IACH,SAAS;QACP,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAA;YAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,UAAU,CAAC,sBAAsB,iCAAiC;oBACrF,GAAG,IAAI,qEAAqE,EAC9E,UAAU,CAAC,sBAAsB,CAClC,CAAA;YACH,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAA2B,CAAA;YAClF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAA;gBAClE,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,UAAU,CAAC,sBAAsB,wBAAwB,IAAI,MAAM;oBACtF,eAAe,IAAI,GAAG,EACxB,UAAU,CAAC,sBAAsB,CAClC,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW;QACf,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,IAAI,OAAO,GAA8B,IAAI,CAAA;YAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBACzB,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YACpG,CAAC;YACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,mEAAmE;gBACnE,+CAA+C;gBAC/C,MAAM,IAAI,CAAC,IAAI,CACb,cAAc,EACd,WAAW,EACX,qEAAqE;oBACnE,oCAAoC,CACvC,CAAA;gBACD,OAAO,GAAG,EAAE,CAAA;YACd,CAAC;YACD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAA;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED,wEAAwE;IAEhE,KAAK,CAAC,IAAI,CAChB,KAAa,EACb,IAAY,EACZ,MAAM,GAAG,EAAE,EACX,SAAmB,EACnB,UAAmB,EACnB,QAAiB;QAEjB,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,wBAAwB,CAAC,IAAY;QACjD,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAM;QAClC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAA;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAC/B,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IAED,wEAAwE;IAExE,sFAAsF;IACtF,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,SAAoB;QAChD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO;YAAE,OAAM;QAE7B,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;QAClE,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;QAE/C,MAAM,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAA;QAE7C,sEAAsE;QACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,oBAAoB,EAAE,CAAA;QAChD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,IAAI,CACb,iBAAiB,EACjB,QAAQ,EACR,4FAA4F,CAC7F,CAAA;QACH,CAAC;QAED,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAA;QACpF,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;YAC9D,MAAM,IAAI,kBAAkB,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;QACpD,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAChE,CAAC;aAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QACpE,CAAC;QAED,uEAAuE;QACvE,EAAE;QACF,uEAAuE;QACvE,yEAAyE;QACzE,kBAAkB;QAClB,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;YAC/E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,QAAQ,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,EAAE,CAAA;gBAChD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;oBAC1C,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;oBAC5D,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;gBAClD,CAAC;gBACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,eAAe,EAAE,CAAC;oBAC7C,kEAAkE;oBAClE,qCAAqC;oBACrC,MAAM,IAAI,CAAC,IAAI,CACb,cAAc,EACd,QAAQ,EACR,GAAG,MAAM,wDAAwD,EACjE,SAAS,CACV,CAAA;oBACD,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;gBAC3D,CAAC;gBACD,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;YAC9D,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;YACrF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,MAAM,GAAG,GAAG,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAA;gBACxF,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;gBAC5D,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;YACpD,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,uCAAuC;QACvC,IAAI,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;YAC7D,MAAM,CAAC,GAAG,UAAU,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;YAC9F,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,IAAI,CACb,cAAc,EACd,QAAQ,EACR,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,oDAAoD,EAClF,SAAS,EACT,SAAS,EACT,MAAM,CACP,CAAA;YACH,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,EAAE;QACF,sEAAsE;QACtE,yEAAyE;QACzE,6CAA6C;QAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;YAC5D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;gBAClF,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YACzE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC;CACF;AAED,SAAS,cAAc,CAAC,CAAS;IAC/B,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACvD,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAS;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAA;IAClB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,EAAE,CAAA;IAC3C,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAS;IACnC,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,OAAO,KAAK,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG;QAAE,KAAK,EAAE,CAAA;IACpD,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;AACvB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAA;AAC7D,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA"}
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAwB,MAAM,aAAa,CAAA;AACvF,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAA;AAChH,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AACzC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AACzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAA;AAE1D;yDACyD;AACzD,MAAM,CAAC,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IAC1D,WAAW;IACX,YAAY;IACZ,MAAM;IACN,KAAK;IACL,MAAM;CACP,CAAC,CAAA;AAoBF,SAAS,aAAa,CAAC,GAAe;IACpC,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG;QAC7B,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;QAClC,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,+BAA+B;QACnE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QAC5B,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACpC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;KACrC,CAAA;AACH,CAAC;AAID,MAAM,OAAO,IAAI;IACN,GAAG,CAAgB;IACnB,MAAM,CAAmB;IAC1B,SAAS,GAA6B,IAAI,CAAA;IAC1C,iBAAiB,GAAG,KAAK,CAAA;IACzB,OAAO,GAAkC,IAAI,CAAA;IACrD;8EAC0E;IAClE,SAAS,GAA8B,IAAI,CAAA;IAEnD,YAAY,MAAkB,EAAE,EAAE,SAA4B,IAAI;QAChE,IAAI,CAAC,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAEO,YAAY;QAClB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAA;QAChC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED,uEAAuE;IAEvE,WAAW;QACT,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC9D,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED;;;;;;;OAOG;IACH,SAAS;QACP,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAA;YAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,UAAU,CAAC,sBAAsB,iCAAiC;oBACrF,GAAG,IAAI,qEAAqE,EAC9E,UAAU,CAAC,sBAAsB,CAClC,CAAA;YACH,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAA2B,CAAA;YAClF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAA;gBAClE,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,UAAU,CAAC,sBAAsB,wBAAwB,IAAI,MAAM;oBACtF,eAAe,IAAI,GAAG,EACxB,UAAU,CAAC,sBAAsB,CAClC,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW;QACf,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,IAAI,OAAO,GAA8B,IAAI,CAAA;YAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBACzB,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YACpG,CAAC;YACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,mEAAmE;gBACnE,+CAA+C;gBAC/C,MAAM,IAAI,CAAC,IAAI,CACb,cAAc,EACd,WAAW,EACX,qEAAqE;oBACnE,oCAAoC,CACvC,CAAA;gBACD,OAAO,GAAG,EAAE,CAAA;YACd,CAAC;YACD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAA;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED,wEAAwE;IAEhE,KAAK,CAAC,IAAI,CAChB,KAAa,EACb,IAAY,EACZ,MAAM,GAAG,EAAE,EACX,SAAmB,EACnB,UAAmB,EACnB,QAAiB;QAEjB,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,wBAAwB,CAAC,IAAY;QACjD,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAM;QAClC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAA;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAC/B,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IAED,wEAAwE;IAExE,sFAAsF;IACtF,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,SAAoB;QAChD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO;YAAE,OAAM;QAE7B,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;QAClE,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;QAE/C,uEAAuE;QACvE,EAAE;QACF,sEAAsE;QACtE,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QACnD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;YACnD,MAAM,IAAI,kBAAkB,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAA;QAC7D,CAAC;QAED,MAAM,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAA;QAE7C,uEAAuE;QACvE,EAAE;QACF,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,sDAAsD;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,SAAS,CAAA;QACxC,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,GAAG,yBAAyB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YACnG,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,GAAG,CAAA;gBAC1C,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;gBAC5D,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;YACnD,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,oBAAoB,EAAE,CAAA;QAChD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,IAAI,CACb,iBAAiB,EACjB,QAAQ,EACR,4FAA4F,CAC7F,CAAA;QACH,CAAC;QAED,4EAA4E;QAC5E,mEAAmE;QACnE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;QAClC,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAA;QACpF,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;YACxE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACxB,CAAC;aAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;YAC9D,MAAM,IAAI,kBAAkB,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;QACpD,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAChE,CAAC;aAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QACpE,CAAC;QAED,sEAAsE;QACtE,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QAExC,uEAAuE;QACvE,EAAE;QACF,uEAAuE;QACvE,yEAAyE;QACzE,kBAAkB;QAClB,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;YAC/E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,QAAQ,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,EAAE,CAAA;gBAChD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;oBAC1C,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;oBAC5D,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;gBAClD,CAAC;gBACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,eAAe,EAAE,CAAC;oBAC7C,mEAAmE;oBACnE,gEAAgE;oBAChE,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,EAAE,EAAE,CAAA;oBAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;gBAC1F,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;YACrF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,MAAM,GAAG,GAAG,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAA;gBACxF,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;gBAC5D,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;YACpD,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,uCAAuC;QACvC,IAAI,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;YAC7D,MAAM,CAAC,GAAG,UAAU,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;YAC9F,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,IAAI,CACb,cAAc,EACd,QAAQ,EACR,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,oDAAoD,EAClF,SAAS,EACT,SAAS,EACT,MAAM,CACP,CAAA;YACH,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,EAAE;QACF,sEAAsE;QACtE,yEAAyE;QACzE,6CAA6C;QAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;YAC5D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;gBAClF,oEAAoE;gBACpE,kDAAkD;gBAClD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,IAAwB,CAAC,CAAC,CAAC,WAAW,CAAA;gBAC1F,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YAClE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,SAAoB;QAC3D,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAM;QACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,GAAG,IAAI,CAAC;YAAE,OAAM;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QACjC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAA;YACpD,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,CAAA;YACtD,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;YAC5D,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QACpD,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC7G,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAA;YACxD,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;YAC5D,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;QACrD,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5F,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,GAAG,CAAA;YAC1D,IAAI,IAAI,CAAC,YAAa,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;gBAChE,OAAM;YACR,CAAC;YACD,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;YAC5D,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,IAAI,CAAC,IAAoC,EAAE,QAAgB,EAAE,SAAoB;QAC7F,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QACzE,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAChC,sEAAsE;YACtE,oBAAoB;YACpB,MAAM,IAAI,CAAC,IAAI,CACb,2BAA2B,EAC3B,QAAQ,EACR,uBAAuB,IAAI,CAAC,EAAE,kBAAkB,OAAO,CAAC,SAAS,IAAI,aAAa,YAAY,OAAO,CAAC,MAAM,EAAE,EAC9G,SAAS,CACV,CAAA;YACD,OAAM;QACR,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,CAAA;QAChF,MAAM,IAAI,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACtH,CAAC;CACF;AAED,gGAAgG;AAChG,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAkB;IAC9D,gBAAgB;IAChB,aAAa;IACb,qBAAqB;IACrB,eAAe;IACf,oBAAoB;CACrB,CAAC,CAAA;AAEF,SAAS,cAAc,CAAC,CAAS;IAC/B,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACvD,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAS;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAA;IAClB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,EAAE,CAAA;IAC3C,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAS;IACnC,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,OAAO,KAAK,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG;QAAE,KAAK,EAAE,CAAA;IACpD,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;AACvB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAA;AAC7D,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA"}

package/dist/harness.d.ts

@@ -47,7 +47,7 @@
  *    existing bypass-permissions behavior unless users opt in." Under
  *    `'allow-all'` nothing pauses. Under the stricter modes the mode decides
  *    WHICH built-ins pause, and each paused call is then a genuine per-call
- *    approval this gate answers (TD-415, corrected): the
+ *    approval this gate answers: the
  *    `@ai-sdk/harness-claude-code` bridge (`dist/bridge/index.mjs`,
  *    `createPermissionSettings`/`nativeToolRequiresApproval`) adds `ask` rules
  *    for bash-kind tools (`Bash`, `Monitor`) under `'allow-edits'`, and for
@@ -310,7 +310,7 @@ export interface RecommendedHarnessSettingsOptions {
      * Whether to also recommend excluding the sandbox's native `bash` builtin
      * from the tool set entirely, via `HarnessAgentSettings.inactiveTools`.
      * Defaults to `true` — see {@link RecommendedHarnessSettings.inactiveTools}
-     * for what this does and does not guarantee (TD-415).
+     * for what this does and does not guarantee.
      */
     filterBash?: boolean;
 }
@@ -340,12 +340,12 @@ export interface RecommendedHarnessSettings {
     networkPolicy: RecommendedNetworkPolicy;
     /**
      * Spread into `HarnessAgentSettings.inactiveTools` — `undefined` when
-     * `filterBash: false` was passed. TD-415, resolved with a corrected
-     * understanding: `HarnessV1BuiltinToolFiltering` (the same package's own
-     * type, `dist/index.d.ts`/`dist/agent/index.d.ts`) genuinely CAN drop
-     * `bash` at config time, confirmed against real shipped `dist/index.js`
-     * for both harnesses TD-417 discusses (not just their `.d.ts` — the
-     * behaviour lives in compiled logic no type file states):
+     * `filterBash: false` was passed. `HarnessV1BuiltinToolFiltering` (the
+     * same package's own type, `dist/index.d.ts`/`dist/agent/index.d.ts`)
+     * genuinely CAN drop `bash` at config time, confirmed against real
+     * shipped `dist/index.js` for both wrapped harnesses, Claude Code and
+     * Grok Build (not just their `.d.ts` — the behaviour lives in compiled
+     * logic no type file states):
      *
      *   - `@ai-sdk/harness-claude-code@1.0.78` sets BOTH
      *     `supportsBuiltinToolApprovals: true` AND
@@ -462,10 +462,10 @@ export interface IntuticSandboxBootstrapOptions {
      * inside the sandbox rather than a missing one.
      */
     policySnapshotRules?: string;
-    /** Embedded in the recipe hash only (so a workspace switch invalidates a
-     *  cached snapshot) — this module does not otherwise use it, matching
-     *  `snapshot.ts`'s reader, which also treats workspace id as an integrity
-     *  check rather than a lookup key. */
+    /** Embedded in the recipe hash (so a workspace switch invalidates a cached
+     *  snapshot) and in the hook script, which treats rules issued to another
+     *  workspace as unverified — an integrity check, as `snapshot.ts`'s reader
+     *  makes it, not a lookup key. */
     workspaceId?: string;
     /** Directory inside the sandbox (relative to `workDir`) the hook script
      *  and its rules file are written under. Defaults to `.intutic/hooks`,
@@ -474,11 +474,19 @@ export interface IntuticSandboxBootstrapOptions {
 }
 declare function sandboxJoin(workDir: string, relative: string): string;
 /**
- * Self-contained (zero-`require`) hand-port of `snapshot.ts`'s
- * `normalise`/`evaluate` — Tier A1 only. See the module-level comment above
- * for what this deliberately does and does not cover, and
- * `__tests__/harness.test.ts` for the behavioural-parity check against the
- * real `snapshot.evaluate()` this port is pinned to.
+ * Self-contained (built-ins only, no npm install) hand-port of `snapshot.ts`'s
+ * `loadSnapshot`/`normalise`/`evaluate` and of `gate.ts`'s Tier M — the
+ * policy-snapshot rules and the MCP server registry and allowlist. See the
+ * module-level comment above for what this deliberately does and does not
+ * cover, and `__tests__/harness.test.ts` for the behavioural-parity check
+ * against the real `snapshot.evaluate()` this port is pinned to and the
+ * shared MCP registry vectors.
+ *
+ * The rules text is checked as every gate checks it: a missing or broken
+ * `#digest`, or a `#workspace` other than `workspaceId`, leaves only its
+ * SSO-group refusals, and refuses every MCP call (`POLICY_SNAPSHOT_UNVERIFIED`)
+ * because neither MCP record can be vouched for. An empty rules text is no
+ * snapshot at all, as an absent file is.
  *
  * Contract matches the laptop's `claude-code-check.js`
  * (`services/sync-daemon/src/harness/claudeCodeHooks.ts`) deliberately:
@@ -488,7 +496,7 @@ declare function sandboxJoin(workDir: string, relative: string): string;
  * any parse/read error fails CLOSED (exit `2`), the same posture
  * `emitJsFailClosedPrelude` documents for the laptop's version.
  */
-declare function renderSandboxGateScript(rulesFileName: string): string;
+declare function renderSandboxGateScript(rulesFileName: string, workspaceId?: string): string;
 /**
  * Compiles the `.claude/settings.json` content that registers the generated
  * hook script — same matcher set and hook shape as the laptop writer's
@@ -498,8 +506,8 @@ declare function renderSandboxGateScript(rulesFileName: string): string;
 declare function renderSandboxClaudeSettings(hookScriptSandboxPath: string): string;
 /**
  * Builds `{ bootstrapHash, onBootstrap }` for
- * `HarnessAgentSettings.sandboxConfig` — the channel TD-417 identified as
- * existing but unused:
+ * `HarnessAgentSettings.sandboxConfig` — a channel the framework provides
+ * but nothing used:
  *
  * ```ts
  * import { HarnessAgent } from '@ai-sdk/harness/agent'

package/dist/harness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"harness.d.ts","sourceRoot":"","sources":["../src/harness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AAGH,OAAO,EAAwB,KAAK,IAAI,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAA;AAG3E;;;+EAG+E;AAC/E,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,wBAAwB,CAAA;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED;sEACsE;AACtE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CACpC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,+BAAgC,SAAQ,2BAA2B;IAClF,QAAQ,CAAC,gBAAgB,EAAE,2BAA2B,CAAA;IACtD,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;CACvC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CACpC;AAED,wEAAwE;AACxE,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG,aAAa,GAAG,WAAW,CAAA;AAE/E;;;;4CAI4C;AAC5C,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IACE,IAAI,EAAE,QAAQ,CAAA;IACd,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC,CAAA;AAEL;;;oBAGoB;AACpB,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,CAAC,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;CAC1G;AAED,MAAM,WAAW,+BAA+B;IAC9C,4EAA4E;IAC5E,IAAI,CAAC,EAAE,IAAI,CAAA;CACZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,CAahE;AAcD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,GAAE,+BAAoC,GACzC,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,KAAK,OAAO,CAAC,+BAA+B,EAAE,CAAC,CAgD7F;AAED,MAAM,WAAW,4BAA4B;IAC3C;yEACqE;IACrE,aAAa,EAAE,+BAA+B,EAAE,CAAA;IAChD;;qCAEiC;IACjC,SAAS,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE,SAAS,sBAAsB,EAAE,EAC3C,IAAI,GAAE,+BAAoC,GACzC,OAAO,CAAC,4BAA4B,CAAC,CAcvC;AAED,MAAM,WAAW,6BAA6B;IAC5C;;uEAEmE;IACnE,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClD,IAAI,GAAE,6BAAkC,GACvC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,GAAG,QAAQ,CAAC,CAAC,CAQtD;AAED,MAAM,WAAW,iCAAiC;IAChD;;;;;+BAK2B;IAC3B,cAAc,CAAC,EAAE,aAAa,GAAG,aAAa,CAAA;IAC9C;;2EAEuE;IACvE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED;;;;8CAI8C;AAC9C,MAAM,MAAM,wBAAwB,GAChC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAEvF,MAAM,WAAW,0BAA0B;IACzC,0CAA0C;IAC1C,cAAc,EAAE,aAAa,GAAG,aAAa,CAAA;IAC7C;;;;;;;OAOG;IACH,aAAa,EAAE,wBAAwB,CAAA;IACvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,aAAa,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAA;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,GAAE,iCAAsC,GAC3C,0BAA0B,CAgB5B;AA0HD;;;;;2BAK2B;AAC3B,MAAM,WAAW,mBAAmB;IAClC,aAAa,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;IAC/F,YAAY,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,WAAW,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAC9F,GAAG,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,WAAW,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAChI;AAED;;2EAE2E;AAC3E,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAA;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;;0DAMsD;IACtD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,+BAA+B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/E;AAED,MAAM,WAAW,8BAA8B;IAC7C;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B;;;0CAGsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;6DAEyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,iBAAS,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG9D;AAED;;;;;;;;;;;;;;GAcG;AACH,iBAAS,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CA+F9D;AAED;;;;;GAKG;AACH,iBAAS,2BAA2B,CAAC,qBAAqB,EAAE,MAAM,GAAG,MAAM,CAE1E;AA6ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,GAAE,8BAAmC,GAAG,uBAAuB,CAkC1G;AAGD,eAAO,MAAM,SAAS;;;;CAAwE,CAAA"}
+{"version":3,"file":"harness.d.ts","sourceRoot":"","sources":["../src/harness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AAGH,OAAO,EAAwB,KAAK,IAAI,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAA;AAO3E;;;+EAG+E;AAC/E,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,wBAAwB,CAAA;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED;sEACsE;AACtE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CACpC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,+BAAgC,SAAQ,2BAA2B;IAClF,QAAQ,CAAC,gBAAgB,EAAE,2BAA2B,CAAA;IACtD,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;CACvC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CACpC;AAED,wEAAwE;AACxE,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG,aAAa,GAAG,WAAW,CAAA;AAE/E;;;;4CAI4C;AAC5C,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IACE,IAAI,EAAE,QAAQ,CAAA;IACd,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC,CAAA;AAEL;;;oBAGoB;AACpB,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,CAAC,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;CAC1G;AAED,MAAM,WAAW,+BAA+B;IAC9C,4EAA4E;IAC5E,IAAI,CAAC,EAAE,IAAI,CAAA;CACZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,CAahE;AAcD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,GAAE,+BAAoC,GACzC,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,KAAK,OAAO,CAAC,+BAA+B,EAAE,CAAC,CAgD7F;AAED,MAAM,WAAW,4BAA4B;IAC3C;yEACqE;IACrE,aAAa,EAAE,+BAA+B,EAAE,CAAA;IAChD;;qCAEiC;IACjC,SAAS,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE,SAAS,sBAAsB,EAAE,EAC3C,IAAI,GAAE,+BAAoC,GACzC,OAAO,CAAC,4BAA4B,CAAC,CAcvC;AAED,MAAM,WAAW,6BAA6B;IAC5C;;uEAEmE;IACnE,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClD,IAAI,GAAE,6BAAkC,GACvC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,GAAG,QAAQ,CAAC,CAAC,CAQtD;AAED,MAAM,WAAW,iCAAiC;IAChD;;;;;+BAK2B;IAC3B,cAAc,CAAC,EAAE,aAAa,GAAG,aAAa,CAAA;IAC9C;;2EAEuE;IACvE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED;;;;8CAI8C;AAC9C,MAAM,MAAM,wBAAwB,GAChC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAEvF,MAAM,WAAW,0BAA0B;IACzC,0CAA0C;IAC1C,cAAc,EAAE,aAAa,GAAG,aAAa,CAAA;IAC7C;;;;;;;OAOG;IACH,aAAa,EAAE,wBAAwB,CAAA;IACvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,aAAa,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAA;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,GAAE,iCAAsC,GAC3C,0BAA0B,CAgB5B;AA8HD;;;;;2BAK2B;AAC3B,MAAM,WAAW,mBAAmB;IAClC,aAAa,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;IAC/F,YAAY,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,WAAW,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAC9F,GAAG,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,WAAW,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAChI;AAED;;2EAE2E;AAC3E,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAA;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;;0DAMsD;IACtD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,+BAA+B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/E;AAED,MAAM,WAAW,8BAA8B;IAC7C;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B;;;sCAGkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;6DAEyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,iBAAS,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG9D;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,iBAAS,uBAAuB,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,SAAK,GAAG,MAAM,CA8NhF;AAED;;;;;GAKG;AACH,iBAAS,2BAA2B,CAAC,qBAAqB,EAAE,MAAM,GAAG,MAAM,CAE1E;AA6ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,GAAE,8BAAmC,GAAG,uBAAuB,CAkC1G;AAGD,eAAO,MAAM,SAAS;;;;CAAwE,CAAA"}