@intutic/gate 2.1.0 → 2.3.0

package/dist/ssoGroups.js

@@ -0,0 +1,101 @@
+/**
+ * SSO-group tool clearance, read from the policy snapshot.
+ *
+ * Port of `evaluateSsoGroupClearance` and the `@sso_groups` record in
+ * `packages/shared-types/src/ssoGroupClearance.ts` — the evaluator the control
+ * plane's hook gate, the MCP proxy and the sync daemon's snapshot compiler
+ * share. This package has no workspace dependencies, so it carries a copy, and
+ * `src/__tests__/ssoGroups.test.ts` runs the shared vectors
+ * (`packages/shared-types/fixtures/sso-group-clearance-vectors.json`) through
+ * it so the copy cannot drift. `intutic_clawde/gate/sso_groups.py` is the
+ * Python port of the same thing.
+ *
+ * The snapshot's record carries the workspace's policy and the member the
+ * snapshot was issued to, with their groups as the control plane resolved
+ * them. It sits inside the snapshot's digest; when the digest fails, the gate
+ * still applies the policy but treats the member's groups as unknown, so an
+ * edited group list clears nothing.
+ */
+export const SSO_GROUP_RECORD_TAG = '@sso_groups';
+function stringList(value) {
+    return Array.isArray(value) ? value.filter((v) => typeof v === 'string') : [];
+}
+export function parseSsoGroupPolicy(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return null;
+    const p = value;
+    return {
+        highRiskTools: stringList(p['highRiskTools']),
+        requiredGroups: stringList(p['requiredGroups']),
+        requireOboFor: stringList(p['requireOboFor']),
+    };
+}
+function ruleId(kind, toolName) {
+    return `sso_group.${kind}.${toolName.replace(/[^A-Za-z0-9_.:-]/g, '_')}`;
+}
+/**
+ * Whether a call named `name` is the tool a policy entry names: exactly, or,
+ * for an entry that is an MCP tool's own name (not starting with `mcp__`), as
+ * the name a harness gives it on any server, `mcp__<server>__<entry>`.
+ */
+export function ssoGroupToolMatches(entry, name) {
+    if (name === entry)
+        return true;
+    if (entry.startsWith('mcp__') || !name.startsWith('mcp__'))
+        return false;
+    const suffix = `__${entry}`;
+    return name.length > 'mcp__'.length + suffix.length && name.endsWith(suffix);
+}
+function matchingEntry(list, toolName) {
+    if (list.includes(toolName))
+        return toolName;
+    return list.find((e) => ssoGroupToolMatches(e, toolName));
+}
+/** `memberGroups` null means the groups are unknown — a high-risk tool is then refused. */
+export function evaluateSsoGroupClearance(policy, toolName, memberGroups) {
+    if (!policy)
+        return { clearance: 'GRANTED', ruleId: null, reason: '' };
+    const obo = matchingEntry(policy.requireOboFor, toolName);
+    if (obo !== undefined) {
+        return {
+            clearance: 'REQUIRES_OBO',
+            ruleId: ruleId('require_obo', obo),
+            reason: `SSO group policy: ${obo} is on-behalf-of only, and a tool-call gate has no OBO token to present`,
+        };
+    }
+    const risky = matchingEntry(policy.highRiskTools, toolName);
+    if (risky === undefined)
+        return { clearance: 'GRANTED', ruleId: null, reason: '' };
+    if (memberGroups && policy.requiredGroups.some((g) => memberGroups.includes(g))) {
+        return { clearance: 'GRANTED', ruleId: null, reason: '' };
+    }
+    const groups = policy.requiredGroups.length > 0 ? policy.requiredGroups.join(', ') : '(none configured)';
+    return {
+        clearance: 'DENIED',
+        ruleId: ruleId('high_risk', risky),
+        reason: memberGroups
+            ? `SSO group policy: ${risky} requires one of the SSO groups ${groups}, and this member holds none of them`
+            : `SSO group policy: ${risky} requires one of the SSO groups ${groups}, and this gate does not know the member's groups`,
+    };
+}
+/** Reads the snapshot's record line; null for any other line or a damaged one. */
+export function decodeSsoGroupRecord(line) {
+    const [tag, b64, ...rest] = line.split('\t');
+    if (tag !== SSO_GROUP_RECORD_TAG || !b64 || rest.length > 0)
+        return null;
+    try {
+        const raw = JSON.parse(Buffer.from(b64, 'base64').toString('utf8'));
+        const policy = parseSsoGroupPolicy(raw['policy']);
+        if (!policy || typeof raw['issuedAt'] !== 'string')
+            return null;
+        const m = raw['member'];
+        const member = m && typeof m === 'object' && typeof m['memberId'] === 'string'
+            ? { memberId: m['memberId'], ssoGroups: stringList(m['ssoGroups']) }
+            : null;
+        return { policy, member, issuedAt: raw['issuedAt'] };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=ssoGroups.js.map

package/dist/ssoGroups.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssoGroups.js","sourceRoot":"","sources":["../src/ssoGroups.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAsBH,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAA;AAEjD,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC5F,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACpF,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO;QACL,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QAC7C,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAC/C,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;KAC9C,CAAA;AACH,CAAC;AAED,SAAS,MAAM,CAAC,IAAiC,EAAE,QAAgB;IACjE,OAAO,aAAa,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,EAAE,CAAA;AAC1E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,IAAY;IAC7D,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAC/B,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IACxE,MAAM,MAAM,GAAG,KAAK,KAAK,EAAE,CAAA;IAC3B,OAAO,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,IAAuB,EAAE,QAAgB;IAC9D,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;AAC3D,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,yBAAyB,CACvC,MAA6B,EAC7B,QAAgB,EAChB,YAAsC;IAEtC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACtE,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;IACzD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO;YACL,SAAS,EAAE,cAAc;YACzB,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC;YAClC,MAAM,EAAE,qBAAqB,GAAG,yEAAyE;SAC1G,CAAA;IACH,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;IAC3D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAClF,IAAI,YAAY,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAC3D,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAA;IACxG,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC;QAClC,MAAM,EAAE,YAAY;YAClB,CAAC,CAAC,qBAAqB,KAAK,mCAAmC,MAAM,sCAAsC;YAC3G,CAAC,CAAC,qBAAqB,KAAK,mCAAmC,MAAM,mDAAmD;KAC3H,CAAA;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC5C,IAAI,GAAG,KAAK,oBAAoB,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACxE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAA;QAC9F,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC/D,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAmC,CAAA;QACzD,MAAM,MAAM,GACV,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ;YAC7D,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE;YACpE,CAAC,CAAC,IAAI,CAAA;QACV,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/workflow.d.ts

@@ -62,7 +62,7 @@
  *
  * ## 3. `needsApproval` runs in the workflow VM — the gate must run in a step
  *
- * Observed in a live run on the Workflow DevKit's local world (TD-498):
+ * Observed in a live run on the Workflow DevKit's local world:
  * `WorkflowAgent`'s loop runs inside the `"use workflow"` function, so it
  * calls `needsApproval` in the workflow VM, which has no Node.js modules.
  * `Gate` reads its policy snapshot with `node:fs`, so evaluating it there
@@ -98,7 +98,7 @@
  * @module
  */
 import type { Gate } from './gate.js';
-import { IntuticGateRefusal } from './errors.js';
+import { IntuticGateRefusal, type GateRefusalCode } from './errors.js';
 import { type AnyFn, type ExecutableTool } from './wrapTools.js';
 /**
  * A refused call inside a durable workflow.
@@ -115,7 +115,9 @@ import { type AnyFn, type ExecutableTool } from './wrapTools.js';
  */
 export declare class IntuticWorkflowRefusal extends IntuticGateRefusal {
     readonly fatal: true;
-    constructor(reason: string, code: string, incidentId?: string);
+    /** The hold's id when the refusal was a hold (`code` `HELD`); see `IntuticGateHold`. */
+    readonly holdId: string | undefined;
+    constructor(reason: string, code: GateRefusalCode, incidentId?: string, holdId?: string);
     /** Rewrap a core refusal so the durable runtime treats it as fatal. */
     static from(refusal: IntuticGateRefusal): IntuticWorkflowRefusal;
     /**

package/dist/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkGG;AAKH,OAAO,KAAK,EAAE,IAAI,EAAa,MAAM,WAAW,CAAA;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,OAAO,EAAa,KAAK,KAAK,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAE3E;;;;;;;;;;;;GAYG;AACH,qBAAa,sBAAuB,SAAQ,kBAAkB;IAC5D,SAAgB,KAAK,EAAG,IAAI,CAAS;gBACzB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;IAK7D,uEAAuE;IACvE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,sBAAsB;IAIhE;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;CASnC;AAED;;;;qEAIqE;AACrE,MAAM,WAAW,4BAA4B;IAC3C,UAAU,EAAE,MAAM,CAAA;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;+BAE+B;AAC/B,MAAM,MAAM,qBAAqB,GAAG,CAClC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,4BAA4B,KAClC,OAAO,CAAC,OAAO,CAAC,CAAA;AAErB;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;AAEpF,UAAU,aAAa;IACrB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAC3B;AAED,MAAM,MAAM,2BAA2B,GACnC,CAAC,aAAa,GAAG;IACf;;;;;OAKG;IACH,IAAI,EAAE,eAAe,CAAA;IACrB,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,CAAC,GACF,CAAC,aAAa,GAAG;IACf;qDACiD;IACjD,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,IAAI,CAAC,EAAE,SAAS,CAAA;CACjB,CAAC,CAAA;AAEN;cACc;AACd,MAAM,MAAM,0BAA0B,GAAG,aAAa,GAAG;IAAE,IAAI,CAAC,EAAE,IAAI,CAAA;CAAE,CAAA;AAiDxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,IAAI,GAAE,0BAA+B,GACpC,OAAO,CAAC,OAAO,CAAC,CAYlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,2BAAgC,GACrC,qBAAqB,CAYvB;AAED;;mDAEmD;AACnD,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,KAAK,OAAO,CAAC,CAAA;IACrE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC5E,KAAK,EAAE,CAAC,EACR,IAAI,GAAE,2BAAgC,GACrC,CAAC,CAiBH;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,KAAK,GAAG,cAAc,EAChE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,EACxB,IAAI,CAAC,EAAE,IAAI,GACV,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAWnB"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkGG;AAKH,OAAO,KAAK,EAAE,IAAI,EAAa,MAAM,WAAW,CAAA;AAChD,OAAO,EAAmB,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAA;AAEvF,OAAO,EAAa,KAAK,KAAK,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAE3E;;;;;;;;;;;;GAYG;AACH,qBAAa,sBAAuB,SAAQ,kBAAkB;IAC5D,SAAgB,KAAK,EAAG,IAAI,CAAS;IACrC,wFAAwF;IACxF,SAAgB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;gBAC9B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;IAMvF,uEAAuE;IACvE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,sBAAsB;IAKhE;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;CASnC;AAED;;;;qEAIqE;AACrE,MAAM,WAAW,4BAA4B;IAC3C,UAAU,EAAE,MAAM,CAAA;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;+BAE+B;AAC/B,MAAM,MAAM,qBAAqB,GAAG,CAClC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,4BAA4B,KAClC,OAAO,CAAC,OAAO,CAAC,CAAA;AAErB;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;AAEpF,UAAU,aAAa;IACrB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAC3B;AAED,MAAM,MAAM,2BAA2B,GACnC,CAAC,aAAa,GAAG;IACf;;;;;OAKG;IACH,IAAI,EAAE,eAAe,CAAA;IACrB,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,CAAC,GACF,CAAC,aAAa,GAAG;IACf;qDACiD;IACjD,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,IAAI,CAAC,EAAE,SAAS,CAAA;CACjB,CAAC,CAAA;AAEN;cACc;AACd,MAAM,MAAM,0BAA0B,GAAG,aAAa,GAAG;IAAE,IAAI,CAAC,EAAE,IAAI,CAAA;CAAE,CAAA;AAiDxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,IAAI,GAAE,0BAA+B,GACpC,OAAO,CAAC,OAAO,CAAC,CAYlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,2BAAgC,GACrC,qBAAqB,CAYvB;AAED;;mDAEmD;AACnD,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,KAAK,OAAO,CAAC,CAAA;IACrE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC5E,KAAK,EAAE,CAAC,EACR,IAAI,GAAE,2BAAgC,GACrC,CAAC,CAiBH;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,KAAK,GAAG,cAAc,EAChE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,EACxB,IAAI,CAAC,EAAE,IAAI,GACV,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAWnB"}

package/dist/workflow.js

@@ -62,7 +62,7 @@
  *
  * ## 3. `needsApproval` runs in the workflow VM — the gate must run in a step
  *
- * Observed in a live run on the Workflow DevKit's local world (TD-498):
+ * Observed in a live run on the Workflow DevKit's local world:
  * `WorkflowAgent`'s loop runs inside the `"use workflow"` function, so it
  * calls `needsApproval` in the workflow VM, which has no Node.js modules.
  * `Gate` reads its policy snapshot with `node:fs`, so evaluating it there
@@ -97,7 +97,7 @@
  *
  * @module
  */
-import { IntuticGateRefusal } from './errors.js';
+import { IntuticGateHold, IntuticGateRefusal } from './errors.js';
 import { active as activeGate } from './registry.js';
 import { wrapTools } from './wrapTools.js';
 /**
@@ -115,13 +115,17 @@ import { wrapTools } from './wrapTools.js';
  */
 export class IntuticWorkflowRefusal extends IntuticGateRefusal {
     fatal = true;
-    constructor(reason, code, incidentId) {
+    /** The hold's id when the refusal was a hold (`code` `HELD`); see `IntuticGateHold`. */
+    holdId;
+    constructor(reason, code, incidentId, holdId) {
         super(reason, code, incidentId);
         this.name = 'FatalError';
+        this.holdId = holdId;
     }
     /** Rewrap a core refusal so the durable runtime treats it as fatal. */
     static from(refusal) {
-        return new IntuticWorkflowRefusal(refusal.reason, refusal.code, refusal.incidentId);
+        const holdId = refusal instanceof IntuticGateHold ? refusal.holdId : undefined;
+        return new IntuticWorkflowRefusal(refusal.reason, refusal.code, refusal.incidentId, holdId);
     }
     /**
      * Cross-realm-safe detection (the same trick `FatalError.is` itself uses):

package/dist/workflow.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.js","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkGG;AAMH,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,EAAE,SAAS,EAAmC,MAAM,gBAAgB,CAAA;AAE3E;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,sBAAuB,SAAQ,kBAAkB;IAC5C,KAAK,GAAG,IAAa,CAAA;IACrC,YAAY,MAAc,EAAE,IAAY,EAAE,UAAmB;QAC3D,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;QAC/B,IAAI,CAAC,IAAI,GAAG,YAAY,CAAA;IAC1B,CAAC;IAED,uEAAuE;IACvE,MAAM,CAAC,IAAI,CAAC,OAA2B;QACrC,OAAO,IAAI,sBAAsB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IACrF,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,KAAc;QACtB,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACb,KAA4B,CAAC,IAAI,KAAK,YAAY;YACnD,OAAQ,KAA+B,CAAC,OAAO,KAAK,QAAQ;YAC5D,CAAE,KAA6B,CAAC,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC,CAAC,CACrF,CAAA;IACH,CAAC;CACF;AA4ED,wEAAwE;AACxE,wEAAwE;AACxE,iEAAiE;AACjE,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;AAEzD,SAAS,iBAAiB;IACxB,OAAO,OAAQ,UAAsC,CAAC,iBAAiB,CAAC,KAAK,UAAU,CAAA;AACzF,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAc;IAC7C,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAM;IAChC,mEAAmE;IACnE,oEAAoE;IACpE,eAAe;IACf,MAAM,IAAI,sBAAsB,CAC9B,GAAG,MAAM,sFAAsF;QAC7F,2DAA2D;QAC3D,sHAAsH;QACtH,kFAAkF;QAClF,qCAAqC,EACvC,kBAAkB,CACnB,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAsB,EAAE,MAAc;IACzD,MAAM,CAAC,GAAG,IAAI,IAAI,UAAU,EAAE,CAAA;IAC9B,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,4DAA4D;QAC5D,wEAAwE;QACxE,sEAAsE;QACtE,gBAAgB;QAChB,MAAM,IAAI,sBAAsB,CAC9B,2FAA2F,MAAM,IAAI;YACnG,qCAAqC,EACvC,SAAS,CACV,CAAA;IACH,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,KAAkB,CAAA;IAC3B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,KAAc,EACd,OAAmC,EAAE;IAErC,uBAAuB,CAAC,uBAAuB,CAAC,CAAA;IAChD,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAA;IACzD,IAAI,CAAC;QACH,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAA;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,kBAAkB,IAAI,CAAC,CAAC,GAAG,YAAY,sBAAsB,CAAC,EAAE,CAAC;YAClF,MAAM,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACxC,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,KAAK,OAAO,CAAA;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,OAAoC,EAAE;IAEtC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,OAAO,CAAA;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACtB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,sEAAsE;QACtE,mEAAmE;QACnE,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,IAAI,KAAK,CAAA;IAChE,CAAC;IACD,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,uBAAuB,CAAC,wBAAwB,CAAC,CAAA;QACjD,OAAO,mBAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACzF,CAAC,CAAA;AACH,CAAC;AAUD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAQ,EACR,OAAoC,EAAE;IAEtC,MAAM,GAAG,GAAqC,EAAE,CAAA;IAChD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAA;QAChC,MAAM,YAAY,GAAG,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACrD,MAAM,QAAQ,GAA0B,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC/D,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;YACxD,IAAI,OAAO,KAAK,KAAK,SAAS;gBAAE,OAAO,KAAK,IAAI,aAAa,CAAA;YAC7D,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;gBAChC,MAAM,WAAW,GAAG,MAAO,KAA6C,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;gBACxF,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,aAAa,CAAA;YAC9C,CAAC;YACD,OAAO,aAAa,CAAA;QACtB,CAAC,CAAA;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAA;IAClD,CAAC;IACD,OAAO,GAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAwB,EACxB,IAAW;IAEX,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACtC,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAM,CAAA;QACjC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAI,IAAuB,EAAE,OAAO,EAAE,QAAQ,CAAE,IAAuB,CAAC,OAAO,CAAC,EAAO,CAAA;QACvG,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,QAAQ,CAAC,EAAS;IACzB,8DAA8D;IAC9D,OAAO,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE;QAC9B,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,IAAI,CAAC,CAAC,GAAG,YAAY,sBAAsB,CAAC,EAAE,CAAC;gBAClF,MAAM,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACxC,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"workflow.js","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkGG;AAMH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAwB,MAAM,aAAa,CAAA;AACvF,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,EAAE,SAAS,EAAmC,MAAM,gBAAgB,CAAA;AAE3E;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,sBAAuB,SAAQ,kBAAkB;IAC5C,KAAK,GAAG,IAAa,CAAA;IACrC,wFAAwF;IACxE,MAAM,CAAoB;IAC1C,YAAY,MAAc,EAAE,IAAqB,EAAE,UAAmB,EAAE,MAAe;QACrF,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;QAC/B,IAAI,CAAC,IAAI,GAAG,YAAY,CAAA;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED,uEAAuE;IACvE,MAAM,CAAC,IAAI,CAAC,OAA2B;QACrC,MAAM,MAAM,GAAG,OAAO,YAAY,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;QAC9E,OAAO,IAAI,sBAAsB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IAC7F,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,KAAc;QACtB,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACb,KAA4B,CAAC,IAAI,KAAK,YAAY;YACnD,OAAQ,KAA+B,CAAC,OAAO,KAAK,QAAQ;YAC5D,CAAE,KAA6B,CAAC,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC,CAAC,CACrF,CAAA;IACH,CAAC;CACF;AA4ED,wEAAwE;AACxE,wEAAwE;AACxE,iEAAiE;AACjE,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;AAEzD,SAAS,iBAAiB;IACxB,OAAO,OAAQ,UAAsC,CAAC,iBAAiB,CAAC,KAAK,UAAU,CAAA;AACzF,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAc;IAC7C,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAM;IAChC,mEAAmE;IACnE,oEAAoE;IACpE,eAAe;IACf,MAAM,IAAI,sBAAsB,CAC9B,GAAG,MAAM,sFAAsF;QAC7F,2DAA2D;QAC3D,sHAAsH;QACtH,kFAAkF;QAClF,qCAAqC,EACvC,kBAAkB,CACnB,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAsB,EAAE,MAAc;IACzD,MAAM,CAAC,GAAG,IAAI,IAAI,UAAU,EAAE,CAAA;IAC9B,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,4DAA4D;QAC5D,wEAAwE;QACxE,sEAAsE;QACtE,gBAAgB;QAChB,MAAM,IAAI,sBAAsB,CAC9B,2FAA2F,MAAM,IAAI;YACnG,qCAAqC,EACvC,SAAS,CACV,CAAA;IACH,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,KAAkB,CAAA;IAC3B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,KAAc,EACd,OAAmC,EAAE;IAErC,uBAAuB,CAAC,uBAAuB,CAAC,CAAA;IAChD,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAA;IACzD,IAAI,CAAC;QACH,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAA;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,kBAAkB,IAAI,CAAC,CAAC,GAAG,YAAY,sBAAsB,CAAC,EAAE,CAAC;YAClF,MAAM,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACxC,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,KAAK,OAAO,CAAA;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,OAAoC,EAAE;IAEtC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,OAAO,CAAA;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACtB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,sEAAsE;QACtE,mEAAmE;QACnE,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,IAAI,KAAK,CAAA;IAChE,CAAC;IACD,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,uBAAuB,CAAC,wBAAwB,CAAC,CAAA;QACjD,OAAO,mBAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACzF,CAAC,CAAA;AACH,CAAC;AAUD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAQ,EACR,OAAoC,EAAE;IAEtC,MAAM,GAAG,GAAqC,EAAE,CAAA;IAChD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAA;QAChC,MAAM,YAAY,GAAG,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACrD,MAAM,QAAQ,GAA0B,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC/D,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;YACxD,IAAI,OAAO,KAAK,KAAK,SAAS;gBAAE,OAAO,KAAK,IAAI,aAAa,CAAA;YAC7D,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;gBAChC,MAAM,WAAW,GAAG,MAAO,KAA6C,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;gBACxF,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,aAAa,CAAA;YAC9C,CAAC;YACD,OAAO,aAAa,CAAA;QACtB,CAAC,CAAA;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAA;IAClD,CAAC;IACD,OAAO,GAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAwB,EACxB,IAAW;IAEX,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACtC,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAM,CAAA;QACjC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAI,IAAuB,EAAE,OAAO,EAAE,QAAQ,CAAE,IAAuB,CAAC,OAAO,CAAC,EAAO,CAAA;QACvG,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,QAAQ,CAAC,EAAS;IACzB,8DAA8D;IAC9D,OAAO,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE;QAC9B,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,IAAI,CAAC,CAAC,GAAG,YAAY,sBAAsB,CAAC,EAAE,CAAC;gBAClF,MAAM,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACxC,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intutic/gate",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "description": "Intutic pre-execution tool gate for JS/TS agent frameworks without a shipped Intutic harness (Mastra, the Vercel AI SDK, LangChain.js, dsh, and hand-rolled agent loops)",
   "type": "module",
   "license": "MIT",