@intutic/gate 2.2.0 → 2.3.0

package/dist/imagecheck.js.map

@@ -1 +1 @@
-{"version":3,"file":"imagecheck.js","sourceRoot":"","sources":["../src/imagecheck.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AACzE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEvC,uEAAuE;AACvE,oDAAoD;AACpD,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAA;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAA;AAC9C,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AACtD,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAA;AAChD,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAA;AACpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAA;AAc9D,MAAM,UAAU,QAAQ,CAAC,GAAa;IACpC,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,CAAA;AAC5B,CAAC;AAeD,yDAAyD;AACzD,MAAM,UAAU,aAAa,CAAC,CAAU;IACtC,IAAI,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,CAAA;IACnB,OAAO,qBAAqB,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,CAAA;AACnD,CAAC;AAED,SAAS,EAAE,CAAC,SAAqB,EAAE;IACjC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAA;AACnD,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,MAAc,EAAE,SAAqB,EAAE;IACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,MAAM,GAAG,EAAE;IACpD,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IACpB,IAAI,MAAM,GAAkB,IAAI,CAAA;IAChC,IAAI,GAAG,GAAkB,IAAI,CAAA;IAE7B,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;QAC1B,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACxB,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;QAClB,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QAC1B,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAC3B,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;AAClE,CAAC;AAED,kEAAkE;AAClE,SAAS,oBAAoB,CAAC,GAAY,EAAE,MAAc;IACxD,MAAM,KAAK,GAAe,EAAE,CAAA;IAC5B,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,CAAC,CAAC,CAAA;IAEtF,SAAS,IAAI,CAAC,IAAa;QACzB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,KAAK,MAAM,IAAI,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YACnC,OAAM;QACR,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;gBAC3E,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;wBACtB,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAA6B,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;4BACpG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAE,CAA6B,CAAC,KAAe,EAAE,MAAM,CAAC,CAAC,CAAA;wBACnF,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,KAAK,CAAC,CAAA;gBACb,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,IAAI,MAAgB,CAAA;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;IACvC,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,QAAQ,GAAG,IAAI,CAAA;IACnB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAA;IAExE,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;QACtB,IAAI,KAAK,GAAkB,IAAI,CAAA;QAC/B,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YACpD,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,CAAA;YACtB,CAAC,IAAI,CAAC,CAAA;QACR,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3E,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACpC,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3E,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACtB,CAAC;QAED,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjF,QAAQ,GAAG,KAAK,CAAA;YAClB,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACnB,CAAC;QACH,CAAC;QACD,CAAC,IAAI,CAAC,CAAA;IACR,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;AAC5B,CAAC;AAED,0DAA0D;AAC1D,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,IAAI,GAAc,EAAE,CAAA;IAC1B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACjC,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1C,IAAI,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACxC,KAAK,MAAM,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QACtB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7D,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,GAAG,GAAe,EAAE,CAAA;IAC1B,IAAI,MAAgB,CAAA;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAClD,MAAM,SAAS,GAAG,EAAE,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAA;QACpE,+DAA+D;QAC/D,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACpF,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrG,SAAQ;YACV,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,MAA2B,EAAE,MAAmB;IAC1E,MAAM,aAAa,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAA;IACnD,MAAM,iBAAiB,GAAG,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAA;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;IACjC,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAA;IAEvB,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;QAErD,mDAAmD;QACnD,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;YACtE,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,sBAAsB,CAAA;YAClE,OAAO,IAAI,CACT,iBAAiB,EACjB,GAAG,KAAK,4EAA4E,KAAK,EAAE,EAC3F,GAAG,CACJ,CAAA;QACH,CAAC;QAED,sCAAsC;QACtC,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,aAAa,EAAE,CAAC;YACzC,OAAO,IAAI,CACT,cAAc,EACd,GAAG,GAAG,CAAC,GAAG,4DAA4D,KAAK,EAAE,EAC7E,GAAG,CACJ,CAAA;QACH,CAAC;QAED,oCAAoC;QACpC,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjG,OAAO,IAAI,CACT,kBAAkB,EAClB,GAAG,GAAG,CAAC,UAAU,oCAAoC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,EAC5F,GAAG,CACJ,CAAA;QACH,CAAC;QAED,2DAA2D;QAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,eAAe,EAAE,GAAG,GAAG,CAAC,UAAU,uCAAuC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAA;QACpG,CAAC;QAED,yCAAyC;QACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAA;QAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1D,OAAO,IAAI,CACT,iBAAiB,EACjB,GAAG,GAAG,CAAC,UAAU,iBAAiB,GAAG,CAAC,MAAM,mDAAmD,KAAK,EAAE,EACtG,GAAG,CACJ,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC,GAAG,CAAC,CAAA;AAChB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,QAAgB,EAAE,MAAmB;IACjF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAA;IAE/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CACT,sBAAsB,EACtB,8FAA8F,CAC/F,CAAA;IACH,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QAClD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,sBAAsB,EAAE,GAAG,CAAC,mDAAmD,CAAC,CAAA;QAC9F,CAAC;QACD,IAAI,IAAe,CAAA;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAA;YAClE,OAAO,IAAI,CACT,sBAAsB,EACtB,GAAG,CAAC,iCAAiC,IAAI,qCAAqC,CAC/E,CAAA;QACH,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,yDAAyD;IACzD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAA;IAEtC,OAAO,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,OAAe,EAAE,MAAmB;IACrF,IAAI,IAAe,CAAA;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC;aAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,CAAC,CAAA;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAA;QAClE,OAAO,IAAI,CAAC,sBAAsB,EAAE,GAAG,IAAI,uBAAuB,IAAI,GAAG,CAAC,CAAA;IAC5E,CAAC;IACD,MAAM,MAAM,GAAe,EAAE,CAAA;IAC7B,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAA;IACvE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAA;IACtC,OAAO,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AACpC,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,SAAkB;IAClE,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;AACtC,CAAC"}
+{"version":3,"file":"imagecheck.js","sourceRoot":"","sources":["../src/imagecheck.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AACzE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEvC,uEAAuE;AACvE,oDAAoD;AACpD,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAA;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAA;AAC9C,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AACtD,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAA;AAChD,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAA;AACpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAA;AAsB9D,MAAM,UAAU,QAAQ,CAAC,GAAa;IACpC,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,CAAA;AAC5B,CAAC;AAaD,yDAAyD;AACzD,MAAM,UAAU,aAAa,CAAC,CAAU;IACtC,IAAI,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,CAAA;IACnB,OAAO,qBAAqB,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,CAAA;AACnD,CAAC;AAED,SAAS,EAAE,CAAC,SAAqB,EAAE;IACjC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAA;AACnD,CAAC;AAED,SAAS,IAAI,CAAC,IAAsB,EAAE,MAAc,EAAE,SAAqB,EAAE;IAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,MAAM,GAAG,EAAE;IACpD,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IACpB,IAAI,MAAM,GAAkB,IAAI,CAAA;IAChC,IAAI,GAAG,GAAkB,IAAI,CAAA;IAE7B,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;QAC1B,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACxB,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;QAClB,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QAC1B,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAC3B,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;AAClE,CAAC;AAED,kEAAkE;AAClE,SAAS,oBAAoB,CAAC,GAAY,EAAE,MAAc;IACxD,MAAM,KAAK,GAAe,EAAE,CAAA;IAC5B,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,CAAC,CAAC,CAAA;IAEtF,SAAS,IAAI,CAAC,IAAa;QACzB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,KAAK,MAAM,IAAI,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YACnC,OAAM;QACR,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;gBAC3E,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;wBACtB,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAA6B,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;4BACpG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAE,CAA6B,CAAC,KAAe,EAAE,MAAM,CAAC,CAAC,CAAA;wBACnF,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,KAAK,CAAC,CAAA;gBACb,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,IAAI,MAAgB,CAAA;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;IACvC,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,QAAQ,GAAG,IAAI,CAAA;IACnB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAA;IAExE,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;QACtB,IAAI,KAAK,GAAkB,IAAI,CAAA;QAC/B,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YACpD,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,CAAA;YACtB,CAAC,IAAI,CAAC,CAAA;QACR,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3E,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACpC,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3E,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACtB,CAAC;QAED,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjF,QAAQ,GAAG,KAAK,CAAA;YAClB,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACnB,CAAC;QACH,CAAC;QACD,CAAC,IAAI,CAAC,CAAA;IACR,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;AAC5B,CAAC;AAED,0DAA0D;AAC1D,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,IAAI,GAAc,EAAE,CAAA;IAC1B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACjC,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1C,IAAI,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACxC,KAAK,MAAM,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QACtB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7D,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,GAAG,GAAe,EAAE,CAAA;IAC1B,IAAI,MAAgB,CAAA;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAClD,MAAM,SAAS,GAAG,EAAE,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAA;QACpE,+DAA+D;QAC/D,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACpF,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrG,SAAQ;YACV,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,MAA2B,EAAE,MAAmB;IAC1E,MAAM,aAAa,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAA;IACnD,MAAM,iBAAiB,GAAG,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAA;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;IACjC,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAA;IAEvB,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;QAErD,mDAAmD;QACnD,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;YACtE,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,sBAAsB,CAAA;YAClE,OAAO,IAAI,CACT,iBAAiB,EACjB,GAAG,KAAK,4EAA4E,KAAK,EAAE,EAC3F,GAAG,CACJ,CAAA;QACH,CAAC;QAED,sCAAsC;QACtC,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,aAAa,EAAE,CAAC;YACzC,OAAO,IAAI,CACT,cAAc,EACd,GAAG,GAAG,CAAC,GAAG,4DAA4D,KAAK,EAAE,EAC7E,GAAG,CACJ,CAAA;QACH,CAAC;QAED,oCAAoC;QACpC,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjG,OAAO,IAAI,CACT,kBAAkB,EAClB,GAAG,GAAG,CAAC,UAAU,oCAAoC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,EAC5F,GAAG,CACJ,CAAA;QACH,CAAC;QAED,2DAA2D;QAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,eAAe,EAAE,GAAG,GAAG,CAAC,UAAU,uCAAuC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAA;QACpG,CAAC;QAED,yCAAyC;QACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAA;QAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1D,OAAO,IAAI,CACT,iBAAiB,EACjB,GAAG,GAAG,CAAC,UAAU,iBAAiB,GAAG,CAAC,MAAM,mDAAmD,KAAK,EAAE,EACtG,GAAG,CACJ,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC,GAAG,CAAC,CAAA;AAChB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,QAAgB,EAAE,MAAmB;IACjF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAA;IAE/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CACT,sBAAsB,EACtB,8FAA8F,CAC/F,CAAA;IACH,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QAClD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,sBAAsB,EAAE,GAAG,CAAC,mDAAmD,CAAC,CAAA;QAC9F,CAAC;QACD,IAAI,IAAe,CAAA;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAA;YAClE,OAAO,IAAI,CACT,sBAAsB,EACtB,GAAG,CAAC,iCAAiC,IAAI,qCAAqC,CAC/E,CAAA;QACH,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,yDAAyD;IACzD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAA;IAEtC,OAAO,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,OAAe,EAAE,MAAmB;IACrF,IAAI,IAAe,CAAA;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC;aAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,CAAC,CAAA;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAA;QAClE,OAAO,IAAI,CAAC,sBAAsB,EAAE,GAAG,IAAI,uBAAuB,IAAI,GAAG,CAAC,CAAA;IAC5E,CAAC;IACD,MAAM,MAAM,GAAe,EAAE,CAAA;IAC7B,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAA;IACvE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAA;IACtC,OAAO,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AACpC,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,SAAkB;IAClE,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;AACtC,CAAC"}

package/dist/index.d.ts

@@ -10,16 +10,20 @@
 export { classify, isDeploy, isTest, touchesInfra } from './actions.js';
 export { GateClient } from './client.js';
 export type { GateClientOptions, GateResponse } from './client.js';
-export { GateError, GateConnectionError, IntuticGateRefusal } from './errors.js';
+export { GateError, GateConnectionError, IntuticGateHold, IntuticGateRefusal, GATE_REFUSAL_CODES } from './errors.js';
+export type { GateRefusalCode } from './errors.js';
+export { canonicalJson, holdKey, holdMessage } from './hold.js';
+export { COMMAND_SIZE_LIMIT, ARGUMENTS_SIZE_LIMIT, GATE_DEADLINE_MS } from './limits.js';
 export { Gate, READ_ONLY_TOOLS, install, active } from './gate.js';
 export type { GateConfig, ToolInput } from './gate.js';
 export { intuticHeaders } from './headers.js';
 export type { IntuticHeadersOptions } from './headers.js';
 export { checkCommand, checkImages, checkWrittenManifest, isDeployCommand, isPinned, manifestPathsFromCommand, parseImageRef, verdictReason, } from './imagecheck.js';
-export type { ImagePolicy, ImageRef, Verdict as ImageVerdict } from './imagecheck.js';
-export { Snapshot, evaluate, guardDisabledFromEnv, loadSnapshot, snapshotPath, SEV_BLOCK, SEV_SHADOW, SEV_WARN, } from './snapshot.js';
+export type { ImagePolicy, ImageRef, ImageRefusalCode, Verdict as ImageVerdict } from './imagecheck.js';
+export { Snapshot, evaluate, guardDisabledFromEnv, loadSnapshot, snapshotPath, SEV_BLOCK, SEV_HOLD, SEV_SHADOW, SEV_WARN, } from './snapshot.js';
 export type { Decision, Rule, RuleSubject, Severity, SnapshotState } from './snapshot.js';
 export type { SsoGroupClearance, SsoGroupPolicy, SsoGroupRecord } from './ssoGroups.js';
+export type { McpAllowlistRecord, McpRegistryRecord } from './mcpRegistryRecord.js';
 export { firstMatch, parseRules, ruleMatches, serialiseToolInput, supportsArgPatterns, fetchRules, ACTION_BLOCK, ACTION_WARN, ACTION_APPROVAL, } from './soprules.js';
 export type { SopRule } from './soprules.js';
 export { wrapTool, wrapTools } from './wrapTools.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEvE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAElE,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhF,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAClE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAEtD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,YAAY,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAEzD,OAAO,EACL,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACR,wBAAwB,EACxB,aAAa,EACb,aAAa,GACd,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAErF,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,UAAU,EACV,QAAQ,GACT,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAEzF,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEvF,OAAO,EACL,UAAU,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,eAAe,GAChB,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAE5C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AACpD,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEvE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAElE,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACrH,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE/D,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAExF,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAClE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAEtD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,YAAY,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAEzD,OAAO,EACL,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACR,wBAAwB,EACxB,aAAa,EACb,aAAa,GACd,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEvG,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,UAAU,EACV,QAAQ,GACT,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAEzF,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEvF,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAEnF,OAAO,EACL,UAAU,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,eAAe,GAChB,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAE5C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AACpD,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/index.js

@@ -9,11 +9,13 @@
  */
 export { classify, isDeploy, isTest, touchesInfra } from './actions.js';
 export { GateClient } from './client.js';
-export { GateError, GateConnectionError, IntuticGateRefusal } from './errors.js';
+export { GateError, GateConnectionError, IntuticGateHold, IntuticGateRefusal, GATE_REFUSAL_CODES } from './errors.js';
+export { canonicalJson, holdKey, holdMessage } from './hold.js';
+export { COMMAND_SIZE_LIMIT, ARGUMENTS_SIZE_LIMIT, GATE_DEADLINE_MS } from './limits.js';
 export { Gate, READ_ONLY_TOOLS, install, active } from './gate.js';
 export { intuticHeaders } from './headers.js';
 export { checkCommand, checkImages, checkWrittenManifest, isDeployCommand, isPinned, manifestPathsFromCommand, parseImageRef, verdictReason, } from './imagecheck.js';
-export { Snapshot, evaluate, guardDisabledFromEnv, loadSnapshot, snapshotPath, SEV_BLOCK, SEV_SHADOW, SEV_WARN, } from './snapshot.js';
+export { Snapshot, evaluate, guardDisabledFromEnv, loadSnapshot, snapshotPath, SEV_BLOCK, SEV_HOLD, SEV_SHADOW, SEV_WARN, } from './snapshot.js';
 export { firstMatch, parseRules, ruleMatches, serialiseToolInput, supportsArgPatterns, fetchRules, ACTION_BLOCK, ACTION_WARN, ACTION_APPROVAL, } from './soprules.js';
 export { wrapTool, wrapTools } from './wrapTools.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEvE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhF,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAGlE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAG7C,OAAO,EACL,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACR,wBAAwB,EACxB,aAAa,EACb,aAAa,GACd,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,UAAU,EACV,QAAQ,GACT,MAAM,eAAe,CAAA;AAKtB,OAAO,EACL,UAAU,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,eAAe,GAChB,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEvE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAGrH,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE/D,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAExF,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAGlE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAG7C,OAAO,EACL,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACR,wBAAwB,EACxB,aAAa,EACb,aAAa,GACd,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,UAAU,EACV,QAAQ,GACT,MAAM,eAAe,CAAA;AAOtB,OAAO,EACL,UAAU,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,eAAe,GAChB,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/limits.d.ts

@@ -0,0 +1,26 @@
+/**
+ * How much the gate evaluates before it refuses, and for how long a hook
+ * script it writes may run. The same values as `@intutic/shared-types`
+ * gateLimits.ts, which documents where they come from; a test holds both to
+ * the `limits` of `packages/shared-types/fixtures/gate-rule-vectors.json`.
+ */
+/** The largest shell command, in UTF-8 bytes, the gate evaluates. */
+export declare const COMMAND_SIZE_LIMIT: number;
+/** The largest tool arguments, in UTF-8 bytes of compact JSON, the gate evaluates. */
+export declare const ARGUMENTS_SIZE_LIMIT: number;
+/**
+ * The timeout, in seconds, on the Claude Code hook entry the sandbox bootstrap
+ * writes (`intuticSandboxBootstrap`); Claude Code runs a call whose hook times out.
+ */
+export declare const HOOK_TIMEOUT_SECONDS = 10;
+/** How far below its harness's hook timeout a gate refuses: interpreter start-up, and the refusal written and read. */
+export declare const GATE_DEADLINE_MARGIN_MS = 1000;
+/** How long the hook script the sandbox bootstrap writes may run, from process start, before it refuses. */
+export declare const GATE_DEADLINE_MS: number;
+/**
+ * Why a call is too large to evaluate, or null. Counts the command and the
+ * compact JSON of the arguments in UTF-8 bytes; arguments that do not
+ * serialize are left to the tiers, which handle them already.
+ */
+export declare function tooLargeReason(command: string, toolInput: unknown): string | null;
+//# sourceMappingURL=limits.d.ts.map

package/dist/limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,QAAa,CAAA;AAE5C,sFAAsF;AACtF,eAAO,MAAM,oBAAoB,QAAc,CAAA;AAE/C;;;GAGG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAA;AAEtC,uHAAuH;AACvH,eAAO,MAAM,uBAAuB,OAAO,CAAA;AAE3C,4GAA4G;AAC5G,eAAO,MAAM,gBAAgB,QAAwD,CAAA;AAErF;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAsBjF"}

package/dist/limits.js

@@ -0,0 +1,45 @@
+/**
+ * How much the gate evaluates before it refuses, and for how long a hook
+ * script it writes may run. The same values as `@intutic/shared-types`
+ * gateLimits.ts, which documents where they come from; a test holds both to
+ * the `limits` of `packages/shared-types/fixtures/gate-rule-vectors.json`.
+ */
+/** The largest shell command, in UTF-8 bytes, the gate evaluates. */
+export const COMMAND_SIZE_LIMIT = 256 * 1024;
+/** The largest tool arguments, in UTF-8 bytes of compact JSON, the gate evaluates. */
+export const ARGUMENTS_SIZE_LIMIT = 1024 * 1024;
+/**
+ * The timeout, in seconds, on the Claude Code hook entry the sandbox bootstrap
+ * writes (`intuticSandboxBootstrap`); Claude Code runs a call whose hook times out.
+ */
+export const HOOK_TIMEOUT_SECONDS = 10;
+/** How far below its harness's hook timeout a gate refuses: interpreter start-up, and the refusal written and read. */
+export const GATE_DEADLINE_MARGIN_MS = 1000;
+/** How long the hook script the sandbox bootstrap writes may run, from process start, before it refuses. */
+export const GATE_DEADLINE_MS = HOOK_TIMEOUT_SECONDS * 1000 - GATE_DEADLINE_MARGIN_MS;
+/**
+ * Why a call is too large to evaluate, or null. Counts the command and the
+ * compact JSON of the arguments in UTF-8 bytes; arguments that do not
+ * serialize are left to the tiers, which handle them already.
+ */
+export function tooLargeReason(command, toolInput) {
+    const commandBytes = Buffer.byteLength(command, 'utf8');
+    if (commandBytes > COMMAND_SIZE_LIMIT) {
+        return (`COMMAND_TOO_LARGE: the command is ${commandBytes} bytes, over the ${COMMAND_SIZE_LIMIT}-byte ` +
+            'limit a gate evaluates; split it into smaller commands');
+    }
+    let json;
+    try {
+        json = JSON.stringify(toolInput ?? {});
+    }
+    catch {
+        return null;
+    }
+    const argumentBytes = json === undefined ? 0 : Buffer.byteLength(json, 'utf8');
+    if (argumentBytes > ARGUMENTS_SIZE_LIMIT) {
+        return (`COMMAND_TOO_LARGE: the tool arguments are ${argumentBytes} bytes, over the ` +
+            `${ARGUMENTS_SIZE_LIMIT}-byte limit a gate evaluates; write the content in smaller parts`);
+    }
+    return null;
+}
+//# sourceMappingURL=limits.js.map

package/dist/limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAA;AAE5C,sFAAsF;AACtF,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,IAAI,CAAA;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAA;AAEtC,uHAAuH;AACvH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAA;AAE3C,4GAA4G;AAC5G,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,IAAI,GAAG,uBAAuB,CAAA;AAErF;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,SAAkB;IAChE,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACvD,IAAI,YAAY,GAAG,kBAAkB,EAAE,CAAC;QACtC,OAAO,CACL,qCAAqC,YAAY,oBAAoB,kBAAkB,QAAQ;YAC/F,wDAAwD,CACzD,CAAA;IACH,CAAC;IACD,IAAI,IAAwB,CAAA;IAC5B,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC9E,IAAI,aAAa,GAAG,oBAAoB,EAAE,CAAC;QACzC,OAAO,CACL,6CAA6C,aAAa,mBAAmB;YAC7E,GAAG,oBAAoB,kEAAkE,CAC1F,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/managedAgents.d.ts

@@ -20,7 +20,7 @@
  * adapter was built) was installed as a devDependency of this package and its
  * shipped `.d.ts` read directly (not inferred from docs alone; the Python
  * twin was checked the same way against `anthropic==0.122.0`, its own
- * latest). Re-read against `@anthropic-ai/sdk@0.131.0` (TD-429 bump) — see
+ * latest). Re-read against `@anthropic-ai/sdk@0.131.0` — see
  * "0.131 additions" below:
  *
  *   * `resources/beta/sessions/events.d.ts` — every request this module
@@ -303,7 +303,7 @@ export declare function confirmationForEvent(event: ManagedAgentsSessionEventLik
  * }
  * ```
  */
-/** Options for {@link IntuticSessionConfirmer.watch} (TD-428). */
+/** Options for {@link IntuticSessionConfirmer.watch}. */
 export interface WatchOptions {
     /** Reconnects allowed after the first connection; unbounded by default. */
     maxReconnects?: number;
@@ -361,7 +361,7 @@ export declare class IntuticSessionConfirmer {
     /**
      * Catch up on anything already pending, then follow the live event
      * stream, yielding each confirmation as it is sent, reconnecting when the
-     * stream drops (TD-428).
+     * stream drops.
      *
      * Modelled on the SDK's own `SessionToolRunner#streamLoop`: open the
      * stream FIRST, then reconcile with `poll()` — an event emitted in the gap

package/dist/managedAgents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"managedAgents.d.ts","sourceRoot":"","sources":["../src/managedAgents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyJG;AAEH,OAAO,EAAE,IAAI,EAAwB,MAAM,WAAW,CAAA;AActD;;;yBAGyB;AACzB,eAAO,MAAM,mBAAmB,8BAA8B,CAAA;AAE9D,uEAAuE;AACvE,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,gBAAgB,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,oBAAoB,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,IAAI,CAAA;IACtD;;oDAEgD;IAChD,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;mEAC+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED,0EAA0E;AAC1E,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,oBAAoB,CAAA;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,eAAe,EAAE,MAAM,CAAA;IACvB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,oBAAoB,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,IAAI,CAAA;IACtD,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED;yEACyE;AACzE,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,uBAAuB,CAAA;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED;;;+EAG+E;AAC/E,MAAM,MAAM,6BAA6B,GACrC,qBAAqB,GACrB,wBAAwB,GACxB,2BAA2B,GAC3B;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAEvD;0DAC0D;AAC1D,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,wBAAwB,CAAA;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAA;IACxB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;iEACiE;AACjE,MAAM,MAAM,4BAA4B,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,wBAAwB,CAAA;AAE7G;;;2DAG2D;AAC3D,MAAM,WAAW,oCAAoC;IACnD,IAAI,CACF,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,4BAA4B,EAAE,CAAA;KAAE,GAClE,aAAa,CAAC,6BAA6B,CAAC,CAAA;IAC/C,IAAI,CACF,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE;QAAE,MAAM,EAAE,0BAA0B,EAAE,CAAA;KAAE,GAC/C,OAAO,CAAC,OAAO,CAAC,CAAA;IACnB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,6BAA6B,CAAC,CAAC,CAAA;CACjF;AAED;qCACqC;AACrC,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE;QACJ,QAAQ,EAAE;YACR,MAAM,EAAE,oCAAoC,CAAA;SAC7C,CAAA;KACF,CAAA;CACF;AAaD,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,IAAI,CAAC,EAAE,IAAI,CAAA;CACZ;AAkBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAyC5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,uDAAuD;IACvD,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB;AAMD,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGhD;AAkCD,qBAAa,uBAAuB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAkB;IACvC;;uDAEmD;IACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;gBAEjC,MAAM,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,wBAA6B;IAMnG,OAAO,CAAC,qBAAqB;IAK7B;;uEAEmE;IAC7D,WAAW,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAUnG;;;;OAIG;IACG,IAAI,CAAC,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,0BAA0B,EAAE,CAAC;IAiBhF;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,SAAS,EAAE;QAAE,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAC5G,0BAA0B,EAAE,CAC7B;IAaD;;;;;;;;;;;;;;;;OAgBG;IACI,KAAK,CAAC,IAAI,GAAE,YAAiB,GAAG,cAAc,CAAC,0BAA0B,CAAC;CAsClF;AAID;;;;wCAIwC;AACxC,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAA;IAClE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAID;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,6BAA6B,EACjF,IAAI,EAAE,CAAC,EACP,IAAI,GAAE,wBAA6B,GAClC,CAAC,CAeH;AAED;2CAC2C;AAC3C,wBAAgB,4BAA4B,CAAC,CAAC,SAAS,6BAA6B,EAClF,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,IAAI,GAAE,wBAA6B,GAClC,CAAC,EAAE,CAEL"}
+{"version":3,"file":"managedAgents.d.ts","sourceRoot":"","sources":["../src/managedAgents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyJG;AAEH,OAAO,EAAE,IAAI,EAAwB,MAAM,WAAW,CAAA;AActD;;;yBAGyB;AACzB,eAAO,MAAM,mBAAmB,8BAA8B,CAAA;AAE9D,uEAAuE;AACvE,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,gBAAgB,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,oBAAoB,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,IAAI,CAAA;IACtD;;oDAEgD;IAChD,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;mEAC+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED,0EAA0E;AAC1E,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,oBAAoB,CAAA;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,eAAe,EAAE,MAAM,CAAA;IACvB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,oBAAoB,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,IAAI,CAAA;IACtD,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED;yEACyE;AACzE,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,uBAAuB,CAAA;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED;;;+EAG+E;AAC/E,MAAM,MAAM,6BAA6B,GACrC,qBAAqB,GACrB,wBAAwB,GACxB,2BAA2B,GAC3B;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAEvD;0DAC0D;AAC1D,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,wBAAwB,CAAA;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAA;IACxB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;iEACiE;AACjE,MAAM,MAAM,4BAA4B,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,wBAAwB,CAAA;AAE7G;;;2DAG2D;AAC3D,MAAM,WAAW,oCAAoC;IACnD,IAAI,CACF,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,4BAA4B,EAAE,CAAA;KAAE,GAClE,aAAa,CAAC,6BAA6B,CAAC,CAAA;IAC/C,IAAI,CACF,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE;QAAE,MAAM,EAAE,0BAA0B,EAAE,CAAA;KAAE,GAC/C,OAAO,CAAC,OAAO,CAAC,CAAA;IACnB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,6BAA6B,CAAC,CAAC,CAAA;CACjF;AAED;qCACqC;AACrC,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE;QACJ,QAAQ,EAAE;YACR,MAAM,EAAE,oCAAoC,CAAA;SAC7C,CAAA;KACF,CAAA;CACF;AAaD,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,IAAI,CAAC,EAAE,IAAI,CAAA;CACZ;AAkBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAyC5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,uDAAuD;IACvD,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB;AAMD,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGhD;AAkCD,qBAAa,uBAAuB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAkB;IACvC;;uDAEmD;IACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;gBAEjC,MAAM,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,wBAA6B;IAMnG,OAAO,CAAC,qBAAqB;IAK7B;;uEAEmE;IAC7D,WAAW,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAUnG;;;;OAIG;IACG,IAAI,CAAC,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,0BAA0B,EAAE,CAAC;IAiBhF;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,SAAS,EAAE;QAAE,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAC5G,0BAA0B,EAAE,CAC7B;IAaD;;;;;;;;;;;;;;;;OAgBG;IACI,KAAK,CAAC,IAAI,GAAE,YAAiB,GAAG,cAAc,CAAC,0BAA0B,CAAC;CAsClF;AAID;;;;wCAIwC;AACxC,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAA;IAClE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAID;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,6BAA6B,EACjF,IAAI,EAAE,CAAC,EACP,IAAI,GAAE,wBAA6B,GAClC,CAAC,CAeH;AAED;2CAC2C;AAC3C,wBAAgB,4BAA4B,CAAC,CAAC,SAAS,6BAA6B,EAClF,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,IAAI,GAAE,wBAA6B,GAClC,CAAC,EAAE,CAEL"}

package/dist/managedAgents.js

@@ -20,7 +20,7 @@
  * adapter was built) was installed as a devDependency of this package and its
  * shipped `.d.ts` read directly (not inferred from docs alone; the Python
  * twin was checked the same way against `anthropic==0.122.0`, its own
- * latest). Re-read against `@anthropic-ai/sdk@0.131.0` (TD-429 bump) — see
+ * latest). Re-read against `@anthropic-ai/sdk@0.131.0` — see
  * "0.131 additions" below:
  *
  *   * `resources/beta/sessions/events.d.ts` — every request this module
@@ -370,7 +370,7 @@ export class IntuticSessionConfirmer {
     /**
      * Catch up on anything already pending, then follow the live event
      * stream, yielding each confirmation as it is sent, reconnecting when the
-     * stream drops (TD-428).
+     * stream drops.
      *
      * Modelled on the SDK's own `SessionToolRunner#streamLoop`: open the
      * stream FIRST, then reconcile with `poll()` — an event emitted in the gap

package/dist/mcpRegistryRecord.d.ts

@@ -0,0 +1,143 @@
+/**
+ * The workspace's MCP server registry decisions, as the gates apply them.
+ *
+ * An owner or admin approves or blocks each MCP server on the MCP Servers
+ * page, disables tools within one, and sets what happens to a server nobody
+ * has decided on (`mcpDefaultPolicy`); a high-risk tool-set change can send a
+ * server back to the queue. The control plane serves those decisions as
+ * `mcpRegistry` on `GET /api/v1/policy/resolve`. The MCP proxy applies them to
+ * the servers it fronts; the sync daemon writes them into the policy snapshot
+ * as an `@mcp_registry` record so the harness hook gates apply them to every
+ * `mcp__<server>__<tool>` call, the servers no proxy fronts included.
+ *
+ * {@link evaluateMcpRegistry} is the one decision. The MCP proxy and the
+ * control plane's hook gate call it, the JavaScript hook gates embed its
+ * source ({@link MCP_REGISTRY_JS_SOURCE}), `@intutic/gate` carries a
+ * byte-identical copy of this file, and the bash gates and `intutic-clawde`
+ * run its Python transliteration (`intutic_clawde/gate/mcp_registry.py`);
+ * `fixtures/mcp-registry-vectors.json` holds all of them to the same codes,
+ * rule ids and reasons.
+ *
+ * The workspace's `mcpAllowedServers` list rides beside it as an
+ * `@mcp_allowlist` record ({@link evaluateMcpAllowlist}). Both records sit
+ * inside the snapshot's digest, and a gate that finds the snapshot unverified
+ * (its digest broken or missing, or another workspace's) trusts neither: it
+ * refuses every MCP call with {@link mcpSnapshotUnverifiedRefusal}, at `block`
+ * even in an observe-only workspace. An edit that widens either record, or
+ * deletes one, therefore admits nothing. A policy activates only when it
+ * verifies; the sync daemon restores the last snapshot it verified.
+ *
+ * Self-contained (no imports) so `@intutic/gate`, which has no workspace
+ * dependencies, can carry the copy.
+ *
+ * @module
+ */
+/** What the registry decides, per workspace. The MCP proxy's `McpRegistryPolicy` has the same shape. */
+export interface McpRegistryRecord {
+    defaultPolicy: 'allow' | 'deny';
+    approvedServers: string[];
+    blockedServers: string[];
+    /** Servers a high-risk tool change returned to the approval queue; refused under either default. */
+    heldServers: string[];
+    /** Server name → tool names disabled within it. */
+    disabledTools: Record<string, string[]>;
+}
+/** A registry refusal: the code every MCP surface uses, the deciding rule, and why. */
+export interface McpRegistryRefusal {
+    code: 'SERVER_BLOCKED' | 'SERVER_HELD' | 'SERVER_NOT_APPROVED' | 'TOOL_DISABLED';
+    ruleId: string;
+    reason: string;
+}
+/**
+ * Decides one MCP tool call against the registry: a blocked server, then a
+ * held one, then — under `deny` — one not approved, then a disabled tool.
+ * Null lets the call continue.
+ *
+ * Self-contained (no imports, no module state) because the JavaScript hook
+ * gates run it as emitted source.
+ */
+export declare function evaluateMcpRegistry(registry: McpRegistryRecord, serverName: string, toolName: string): McpRegistryRefusal | null;
+/** {@link evaluateMcpRegistry} as source, for the JavaScript hook gates. */
+export declare const MCP_REGISTRY_JS_SOURCE: string;
+/**
+ * Reads `mcpRegistry` as the control plane sends it. Null for anything that is
+ * not a registry object; wrong-typed lists read as empty, and any default but
+ * `deny` reads as `allow`, the control plane's own reading of the setting.
+ */
+export declare function parseMcpRegistryRecord(value: unknown): McpRegistryRecord | null;
+/** Whether a registry refuses nothing: no snapshot record is written for one. */
+export declare function isUnrestrictedMcpRegistry(registry: McpRegistryRecord): boolean;
+/**
+ * First column of the record's line in `policy-snapshot.rules`. A data line,
+ * like `@sso_groups`, so the digest every gate recomputes covers it; two
+ * columns, so every rule parser (which needs six) skips it.
+ */
+export declare const MCP_REGISTRY_RECORD_TAG = "@mcp_registry";
+/** The record as one `.rules` line: the tag, a tab, base64 of its JSON. */
+export declare function encodeMcpRegistryRecord(registry: McpRegistryRecord): string;
+/** Reads a record line back; null for any other line or a damaged one. */
+export declare function decodeMcpRegistryRecord(line: string): McpRegistryRecord | null;
+/**
+ * The workspace's `mcpAllowedServers` list as the gates apply it: only the
+ * listed servers may be called, and under `shadow` (an observe-only
+ * workspace) a call to another is recorded instead of refused. A workspace
+ * with no list has no record.
+ */
+export interface McpAllowlistRecord {
+    severity: 'block' | 'shadow';
+    servers: string[];
+}
+/** An allowlist refusal, shaped like {@link McpRegistryRefusal}. */
+export interface McpAllowlistRefusal {
+    code: 'SERVER_NOT_ALLOWED';
+    ruleId: 'mcp_allowlist';
+    reason: string;
+}
+/**
+ * Decides one MCP call's server against the allowlist. Null lets the call
+ * continue; a refusal under `shadow` is recorded, not enforced, by the caller.
+ *
+ * Self-contained, like {@link evaluateMcpRegistry}, because the JavaScript
+ * hook gates run it as emitted source.
+ */
+export declare function evaluateMcpAllowlist(allowlist: McpAllowlistRecord, serverName: string): McpAllowlistRefusal | null;
+/** {@link evaluateMcpAllowlist} as source, for the JavaScript hook gates. */
+export declare const MCP_ALLOWLIST_JS_SOURCE: string;
+/** The refusal of an MCP call on a snapshot that failed its integrity check. */
+export interface McpSnapshotUnverifiedRefusal {
+    code: 'POLICY_SNAPSHOT_UNVERIFIED';
+    ruleId: 'policy_snapshot';
+    reason: string;
+}
+/**
+ * Refuses one MCP call because the policy snapshot failed its digest or
+ * workspace check. Neither the registry's approvals nor the allowlist's
+ * servers can be vouched for then, and a deleted record is indistinguishable
+ * from one the workspace never set, so the snapshot admits no MCP server at
+ * all. Every gate that reads the snapshot refuses with this, at `block`.
+ *
+ * Self-contained, like {@link evaluateMcpRegistry}, because the JavaScript
+ * hook gates run it as emitted source.
+ */
+export declare function mcpSnapshotUnverifiedRefusal(serverName: string): McpSnapshotUnverifiedRefusal;
+/** {@link mcpSnapshotUnverifiedRefusal} as source, for the JavaScript hook gates. */
+export declare const MCP_SNAPSHOT_UNVERIFIED_JS_SOURCE: string;
+/**
+ * First column of the allowlist's line in `policy-snapshot.rules`. A data
+ * line, so the digest covers it and a server added to the list by hand fails
+ * the check; three columns, so every rule parser skips it.
+ */
+export declare const MCP_ALLOWLIST_RECORD_TAG = "@mcp_allowlist";
+/**
+ * The allowlist as one `.rules` line: the tag, the severity and the server
+ * names joined by commas, tab-separated. Plain text, so the bash gates read
+ * it with parameter expansion; the snapshot writer drops a name holding
+ * whitespace or a comma.
+ */
+export declare function encodeMcpAllowlistRecord(allowlist: McpAllowlistRecord): string;
+/**
+ * Reads an allowlist line back; null for any other line. A severity other
+ * than `shadow` reads as `block`, so a damaged one refuses.
+ */
+export declare function decodeMcpAllowlistRecord(line: string): McpAllowlistRecord | null;
+//# sourceMappingURL=mcpRegistryRecord.d.ts.map

package/dist/mcpRegistryRecord.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpRegistryRecord.d.ts","sourceRoot":"","sources":["../src/mcpRegistryRecord.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,wGAAwG;AACxG,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,OAAO,GAAG,MAAM,CAAA;IAC/B,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,oGAAoG;IACpG,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,mDAAmD;IACnD,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;CACxC;AAED,uFAAuF;AACvF,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,gBAAgB,GAAG,aAAa,GAAG,qBAAqB,GAAG,eAAe,CAAA;IAChF,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,iBAAiB,EAC3B,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,kBAAkB,GAAG,IAAI,CA2C3B;AAED,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,QAAiC,CAAA;AAUpE;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,GAAG,IAAI,CAgB/E;AAED,iFAAiF;AACjF,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAO9E;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,kBAAkB,CAAA;AAYtD,2EAA2E;AAC3E,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAE3E;AAED,0EAA0E;AAC1E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAQ9E;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAA;IAC5B,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,oEAAoE;AACpE,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,oBAAoB,CAAA;IAC1B,MAAM,EAAE,eAAe,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAOlH;AAED,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,QAAkC,CAAA;AAEtE,gFAAgF;AAChF,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,4BAA4B,CAAA;IAClC,MAAM,EAAE,iBAAiB,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,4BAA4B,CAS7F;AAED,qFAAqF;AACrF,eAAO,MAAM,iCAAiC,QAA0C,CAAA;AAExF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,mBAAmB,CAAA;AAExD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,kBAAkB,GAAG,MAAM,CAE9E;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAIhF"}

package/dist/mcpRegistryRecord.js

@@ -0,0 +1,217 @@
+/**
+ * The workspace's MCP server registry decisions, as the gates apply them.
+ *
+ * An owner or admin approves or blocks each MCP server on the MCP Servers
+ * page, disables tools within one, and sets what happens to a server nobody
+ * has decided on (`mcpDefaultPolicy`); a high-risk tool-set change can send a
+ * server back to the queue. The control plane serves those decisions as
+ * `mcpRegistry` on `GET /api/v1/policy/resolve`. The MCP proxy applies them to
+ * the servers it fronts; the sync daemon writes them into the policy snapshot
+ * as an `@mcp_registry` record so the harness hook gates apply them to every
+ * `mcp__<server>__<tool>` call, the servers no proxy fronts included.
+ *
+ * {@link evaluateMcpRegistry} is the one decision. The MCP proxy and the
+ * control plane's hook gate call it, the JavaScript hook gates embed its
+ * source ({@link MCP_REGISTRY_JS_SOURCE}), `@intutic/gate` carries a
+ * byte-identical copy of this file, and the bash gates and `intutic-clawde`
+ * run its Python transliteration (`intutic_clawde/gate/mcp_registry.py`);
+ * `fixtures/mcp-registry-vectors.json` holds all of them to the same codes,
+ * rule ids and reasons.
+ *
+ * The workspace's `mcpAllowedServers` list rides beside it as an
+ * `@mcp_allowlist` record ({@link evaluateMcpAllowlist}). Both records sit
+ * inside the snapshot's digest, and a gate that finds the snapshot unverified
+ * (its digest broken or missing, or another workspace's) trusts neither: it
+ * refuses every MCP call with {@link mcpSnapshotUnverifiedRefusal}, at `block`
+ * even in an observe-only workspace. An edit that widens either record, or
+ * deletes one, therefore admits nothing. A policy activates only when it
+ * verifies; the sync daemon restores the last snapshot it verified.
+ *
+ * Self-contained (no imports) so `@intutic/gate`, which has no workspace
+ * dependencies, can carry the copy.
+ *
+ * @module
+ */
+/**
+ * Decides one MCP tool call against the registry: a blocked server, then a
+ * held one, then — under `deny` — one not approved, then a disabled tool.
+ * Null lets the call continue.
+ *
+ * Self-contained (no imports, no module state) because the JavaScript hook
+ * gates run it as emitted source.
+ */
+export function evaluateMcpRegistry(registry, serverName, toolName) {
+    if (registry.blockedServers.indexOf(serverName) !== -1) {
+        return {
+            code: 'SERVER_BLOCKED',
+            ruleId: 'mcp_registry.' + serverName,
+            reason: 'MCP server "' + serverName + '" is blocked in this workspace\'s MCP server registry. ' +
+                'An owner or admin can change that on the MCP Servers page.',
+        };
+    }
+    if (registry.heldServers.indexOf(serverName) !== -1) {
+        return {
+            code: 'SERVER_HELD',
+            ruleId: 'mcp_registry.' + serverName,
+            reason: 'MCP server "' + serverName + '" changed its tools in a way scored high risk, and this workspace ' +
+                'holds such a server until it is approved again. It is waiting in the approval queue on the MCP ' +
+                'Servers page for an owner or admin.',
+        };
+    }
+    if (registry.defaultPolicy === 'deny' && registry.approvedServers.indexOf(serverName) === -1) {
+        return {
+            code: 'SERVER_NOT_APPROVED',
+            ruleId: 'mcpDefaultPolicy',
+            reason: 'MCP server "' + serverName + '" is not approved in this workspace\'s MCP server registry, ' +
+                'and the workspace refuses unapproved servers (mcpDefaultPolicy: deny). It is waiting in ' +
+                'the approval queue on the MCP Servers page for an owner or admin.',
+        };
+    }
+    const disabled = Object.prototype.hasOwnProperty.call(registry.disabledTools, serverName)
+        ? registry.disabledTools[serverName]
+        : undefined;
+    if (disabled && disabled.indexOf(toolName) !== -1) {
+        return {
+            code: 'TOOL_DISABLED',
+            ruleId: 'mcp_registry.' + serverName + '.' + toolName,
+            reason: 'Tool "' + toolName + '" is disabled on MCP server "' + serverName + '" in this workspace\'s ' +
+                'MCP server registry. An owner or admin can re-enable it on the MCP Servers page.',
+        };
+    }
+    return null;
+}
+/** {@link evaluateMcpRegistry} as source, for the JavaScript hook gates. */
+export const MCP_REGISTRY_JS_SOURCE = evaluateMcpRegistry.toString();
+function stringList(value) {
+    return Array.isArray(value) ? value.filter((v) => typeof v === 'string') : [];
+}
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Reads `mcpRegistry` as the control plane sends it. Null for anything that is
+ * not a registry object; wrong-typed lists read as empty, and any default but
+ * `deny` reads as `allow`, the control plane's own reading of the setting.
+ */
+export function parseMcpRegistryRecord(value) {
+    if (!isPlainObject(value))
+        return null;
+    const disabledTools = {};
+    if (isPlainObject(value['disabledTools'])) {
+        for (const [server, tools] of Object.entries(value['disabledTools'])) {
+            const list = stringList(tools);
+            if (list.length > 0)
+                disabledTools[server] = list;
+        }
+    }
+    return {
+        defaultPolicy: value['defaultPolicy'] === 'deny' ? 'deny' : 'allow',
+        approvedServers: stringList(value['approvedServers']),
+        blockedServers: stringList(value['blockedServers']),
+        heldServers: stringList(value['heldServers']),
+        disabledTools,
+    };
+}
+/** Whether a registry refuses nothing: no snapshot record is written for one. */
+export function isUnrestrictedMcpRegistry(registry) {
+    return (registry.defaultPolicy === 'allow' &&
+        registry.blockedServers.length === 0 &&
+        registry.heldServers.length === 0 &&
+        Object.keys(registry.disabledTools).length === 0);
+}
+/**
+ * First column of the record's line in `policy-snapshot.rules`. A data line,
+ * like `@sso_groups`, so the digest every gate recomputes covers it; two
+ * columns, so every rule parser (which needs six) skips it.
+ */
+export const MCP_REGISTRY_RECORD_TAG = '@mcp_registry';
+function toBase64(text) {
+    let binary = '';
+    for (const byte of new TextEncoder().encode(text))
+        binary += String.fromCharCode(byte);
+    return btoa(binary);
+}
+function fromBase64(b64) {
+    return new TextDecoder('utf-8', { fatal: true }).decode(Uint8Array.from(atob(b64), (c) => c.charCodeAt(0)));
+}
+/** The record as one `.rules` line: the tag, a tab, base64 of its JSON. */
+export function encodeMcpRegistryRecord(registry) {
+    return `${MCP_REGISTRY_RECORD_TAG}\t${toBase64(JSON.stringify(registry))}`;
+}
+/** Reads a record line back; null for any other line or a damaged one. */
+export function decodeMcpRegistryRecord(line) {
+    const [tag, b64, ...rest] = line.split('\t');
+    if (tag !== MCP_REGISTRY_RECORD_TAG || !b64 || rest.length > 0)
+        return null;
+    try {
+        return parseMcpRegistryRecord(JSON.parse(fromBase64(b64)));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Decides one MCP call's server against the allowlist. Null lets the call
+ * continue; a refusal under `shadow` is recorded, not enforced, by the caller.
+ *
+ * Self-contained, like {@link evaluateMcpRegistry}, because the JavaScript
+ * hook gates run it as emitted source.
+ */
+export function evaluateMcpAllowlist(allowlist, serverName) {
+    if (allowlist.servers.indexOf(serverName) !== -1)
+        return null;
+    return {
+        code: 'SERVER_NOT_ALLOWED',
+        ruleId: 'mcp_allowlist',
+        reason: 'MCP server "' + serverName + '" is not on the MCP server allowlist for this workspace',
+    };
+}
+/** {@link evaluateMcpAllowlist} as source, for the JavaScript hook gates. */
+export const MCP_ALLOWLIST_JS_SOURCE = evaluateMcpAllowlist.toString();
+/**
+ * Refuses one MCP call because the policy snapshot failed its digest or
+ * workspace check. Neither the registry's approvals nor the allowlist's
+ * servers can be vouched for then, and a deleted record is indistinguishable
+ * from one the workspace never set, so the snapshot admits no MCP server at
+ * all. Every gate that reads the snapshot refuses with this, at `block`.
+ *
+ * Self-contained, like {@link evaluateMcpRegistry}, because the JavaScript
+ * hook gates run it as emitted source.
+ */
+export function mcpSnapshotUnverifiedRefusal(serverName) {
+    return {
+        code: 'POLICY_SNAPSHOT_UNVERIFIED',
+        ruleId: 'policy_snapshot',
+        reason: 'MCP server "' + serverName + '" is refused because the policy snapshot on this machine failed its ' +
+            'integrity check, so its MCP server registry and allowlist admit no server until the sync daemon ' +
+            'restores a verified snapshot',
+    };
+}
+/** {@link mcpSnapshotUnverifiedRefusal} as source, for the JavaScript hook gates. */
+export const MCP_SNAPSHOT_UNVERIFIED_JS_SOURCE = mcpSnapshotUnverifiedRefusal.toString();
+/**
+ * First column of the allowlist's line in `policy-snapshot.rules`. A data
+ * line, so the digest covers it and a server added to the list by hand fails
+ * the check; three columns, so every rule parser skips it.
+ */
+export const MCP_ALLOWLIST_RECORD_TAG = '@mcp_allowlist';
+/**
+ * The allowlist as one `.rules` line: the tag, the severity and the server
+ * names joined by commas, tab-separated. Plain text, so the bash gates read
+ * it with parameter expansion; the snapshot writer drops a name holding
+ * whitespace or a comma.
+ */
+export function encodeMcpAllowlistRecord(allowlist) {
+    return `${MCP_ALLOWLIST_RECORD_TAG}\t${allowlist.severity}\t${allowlist.servers.join(',')}`;
+}
+/**
+ * Reads an allowlist line back; null for any other line. A severity other
+ * than `shadow` reads as `block`, so a damaged one refuses.
+ */
+export function decodeMcpAllowlistRecord(line) {
+    const [tag, severity, servers, ...rest] = line.split('\t');
+    if (tag !== MCP_ALLOWLIST_RECORD_TAG || severity === undefined || servers === undefined || rest.length > 0)
+        return null;
+    return { severity: severity === 'shadow' ? 'shadow' : 'block', servers: servers.split(',').filter(Boolean) };
+}
+//# sourceMappingURL=mcpRegistryRecord.js.map

package/dist/mcpRegistryRecord.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpRegistryRecord.js","sourceRoot":"","sources":["../src/mcpRegistryRecord.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAoBH;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAA2B,EAC3B,UAAkB,EAClB,QAAgB;IAEhB,IAAI,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACvD,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,eAAe,GAAG,UAAU;YACpC,MAAM,EACJ,cAAc,GAAG,UAAU,GAAG,yDAAyD;gBACvF,4DAA4D;SAC/D,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,eAAe,GAAG,UAAU;YACpC,MAAM,EACJ,cAAc,GAAG,UAAU,GAAG,oEAAoE;gBAClG,iGAAiG;gBACjG,qCAAqC;SACxC,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,aAAa,KAAK,MAAM,IAAI,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC7F,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EACJ,cAAc,GAAG,UAAU,GAAG,8DAA8D;gBAC5F,0FAA0F;gBAC1F,mEAAmE;SACtE,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,UAAU,CAAC;QACvF,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC;QACpC,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAClD,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,eAAe,GAAG,UAAU,GAAG,GAAG,GAAG,QAAQ;YACrD,MAAM,EACJ,QAAQ,GAAG,QAAQ,GAAG,+BAA+B,GAAG,UAAU,GAAG,yBAAyB;gBAC9F,kFAAkF;SACrF,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC,QAAQ,EAAE,CAAA;AAEpE,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC5F,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,MAAM,aAAa,GAA6B,EAAE,CAAA;IAClD,IAAI,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;YAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;QACnD,CAAC;IACH,CAAC;IACD,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,eAAe,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QACnE,eAAe,EAAE,UAAU,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrD,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACnD,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC7C,aAAa;KACd,CAAA;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,yBAAyB,CAAC,QAA2B;IACnE,OAAO,CACL,QAAQ,CAAC,aAAa,KAAK,OAAO;QAClC,QAAQ,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QACpC,QAAQ,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,MAAM,KAAK,CAAC,CACjD,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAA;AAEtD,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IACtF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAA;AACrB,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC7G,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,uBAAuB,CAAC,QAA2B;IACjE,OAAO,GAAG,uBAAuB,KAAK,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAA;AAC5E,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC5C,IAAI,GAAG,KAAK,uBAAuB,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3E,IAAI,CAAC;QACH,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAoBD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAA6B,EAAE,UAAkB;IACpF,IAAI,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7D,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,eAAe;QACvB,MAAM,EAAE,cAAc,GAAG,UAAU,GAAG,yDAAyD;KAChG,CAAA;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC,QAAQ,EAAE,CAAA;AAStE;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,UAAkB;IAC7D,OAAO;QACL,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,iBAAiB;QACzB,MAAM,EACJ,cAAc,GAAG,UAAU,GAAG,sEAAsE;YACpG,kGAAkG;YAClG,8BAA8B;KACjC,CAAA;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,iCAAiC,GAAG,4BAA4B,CAAC,QAAQ,EAAE,CAAA;AAExF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB,CAAA;AAExD;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAA6B;IACpE,OAAO,GAAG,wBAAwB,KAAK,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;AAC7F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC1D,IAAI,GAAG,KAAK,wBAAwB,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACvH,OAAO,EAAE,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAA;AAC9G,CAAC"}