@intutic/gate 2.5.0 → 2.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +29 -10
- package/dist/actions.d.ts +1 -0
- package/dist/actions.d.ts.map +1 -1
- package/dist/actions.js +1 -0
- package/dist/actions.js.map +1 -1
- package/dist/client.d.ts +77 -4
- package/dist/client.d.ts.map +1 -1
- package/dist/client.js +64 -8
- package/dist/client.js.map +1 -1
- package/dist/eve.d.ts +1 -1
- package/dist/eve.d.ts.map +1 -1
- package/dist/eve.js +1 -1
- package/dist/eve.js.map +1 -1
- package/dist/gate.d.ts +36 -1
- package/dist/gate.d.ts.map +1 -1
- package/dist/gate.js +25 -5
- package/dist/gate.js.map +1 -1
- package/dist/harness.d.ts +0 -38
- package/dist/harness.d.ts.map +1 -1
- package/dist/harness.js +0 -2
- package/dist/harness.js.map +1 -1
- package/dist/registry.d.ts +2 -0
- package/dist/registry.d.ts.map +1 -1
- package/dist/registry.js +2 -0
- package/dist/registry.js.map +1 -1
- package/dist/snapshot.d.ts +8 -0
- package/dist/snapshot.d.ts.map +1 -1
- package/dist/snapshot.js +8 -0
- package/dist/snapshot.js.map +1 -1
- package/dist/soprules.d.ts +10 -2
- package/dist/soprules.d.ts.map +1 -1
- package/dist/soprules.js +21 -5
- package/dist/soprules.js.map +1 -1
- package/dist/vercel.d.ts +19 -5
- package/dist/vercel.d.ts.map +1 -1
- package/dist/vercel.js +27 -6
- package/dist/vercel.js.map +1 -1
- package/dist/wrapTools.d.ts +1 -0
- package/dist/wrapTools.d.ts.map +1 -1
- package/dist/wrapTools.js.map +1 -1
- package/package.json +14 -12
package/README.md
CHANGED
|
@@ -15,9 +15,11 @@ eve's per-tool/per-connection `approval` policy surface — Vercel's
|
|
|
15
15
|
filesystem-first durable-agent framework, a pre-1.0 **Preview** product),
|
|
16
16
|
`@intutic/gate/harness` (Vercel's `@ai-sdk/harness` sandboxed coding-agent
|
|
17
17
|
runtime), `@intutic/gate/workflow` (Vercel's `@ai-sdk/workflow` durable
|
|
18
|
-
workflow agents),
|
|
18
|
+
workflow agents), `@intutic/gate/managed-agents` (Anthropic's Managed
|
|
19
19
|
Agents — a session-confirmation responder, not a hook, since Anthropic hosts
|
|
20
|
-
the tool-call loop; see below)
|
|
20
|
+
the tool-call loop; see below), and `@intutic/gate/trueforge`
|
|
21
|
+
(`intuticApprovalResponder()` answering TrueForge's `tool.approval_required`
|
|
22
|
+
pauses, for a process that embeds `@truefoundry/trueforge-core`). LangChain.js has no dedicated adapter planned
|
|
21
23
|
and instead uses the generic `wrapTool`/`wrapTools` helper directly.
|
|
22
24
|
|
|
23
25
|
## Quick start
|
|
@@ -54,6 +56,20 @@ outage. A request the hook gate cannot read (HTTP 400, `INVALID_REQUEST`) is
|
|
|
54
56
|
refused whatever `failClosed` says. intutic-clawde's `GateClient` behaves the
|
|
55
57
|
same way, held to it by `packages/shared-types/fixtures/hook-gate-response-vectors.json`.
|
|
56
58
|
|
|
59
|
+
Each hook-gate answer names its decision (`decisionId`). The gate reports the
|
|
60
|
+
call as `tool_blocked` or `tool_allowed` with it as `gateDecisionId`, so the
|
|
61
|
+
control plane files the decision's incident once and exports it to SIEM once,
|
|
62
|
+
as the hook gate's own record. A `GOVERNANCE_UNAVAILABLE` answer keeps the id
|
|
63
|
+
only while failing closed.
|
|
64
|
+
|
|
65
|
+
A `GateClient` with no API key (what `fromEnv()` builds when neither
|
|
66
|
+
`INTUTIC_API_KEY` nor `~/.intutic/credentials.json` has one) is local-only
|
|
67
|
+
(`client.localOnly`): it sends nothing, the gate skips the SOP register and
|
|
68
|
+
the hook gate, whose answer is an allow with code `LOCAL_ONLY`, and the
|
|
69
|
+
snapshot, SSO-group, MCP-registry and image tiers still decide. A key the
|
|
70
|
+
control plane refuses (401) is not local-only and fails closed as above. Both
|
|
71
|
+
SDKs run `packages/shared-types/fixtures/gate-client-credentials-vectors.json`.
|
|
72
|
+
|
|
57
73
|
## Public API surface
|
|
58
74
|
|
|
59
75
|
| Export | From | What it is |
|
|
@@ -62,11 +78,11 @@ same way, held to it by `packages/shared-types/fixtures/hook-gate-response-vecto
|
|
|
62
78
|
| `install(gate)`, `active()` | `gate.ts` | Process-wide default gate, so wrapped tools don't need the instance threaded through every call site. |
|
|
63
79
|
| `IntuticGateRefusal`, `GateError`, `GateConnectionError` | `errors.ts` | Thrown on refusal. `.reason`, `.code` (a `GateRefusalCode`, listed in `GATE_REFUSAL_CODES`), `.incidentId` carry the structured verdict; `.message` carries the `[Intutic Governance] BLOCKED: ...` text. |
|
|
64
80
|
| `IntuticGateHold` | `errors.ts` | The `IntuticGateRefusal` a hold rule throws (`code` `HELD`) after recording the hold for approval; `.holdId` names it. See `hold.ts`. |
|
|
65
|
-
| `GateClient` | `client.ts` | Control-plane client (`hookGate`, `emit`, `GateClient.fromEnv(...)`). |
|
|
81
|
+
| `GateClient` | `client.ts` | Control-plane client (`hookGate`, `emit`, `localOnly`, `GateClient.fromEnv(...)`). |
|
|
66
82
|
| `wrapTool(fn \| tool, opts?)`, `wrapTools(list \| record, gate?)` | `wrapTools.ts` | Generic wrapping for a plain async function or an `{ execute, ... }`-shaped tool object. **This is the integration point for any JS framework without a dedicated adapter — LangChain.js included.** |
|
|
67
83
|
| `intuticHeaders(opts?)` | `headers.ts` | Headers for a proxy-pointed HTTP/OpenAI-compatible client (`x-session-id`, `x-workspace-id`, `x-intutic-harness`). |
|
|
68
84
|
| `loadSnapshot`, `evaluate`, `Snapshot`, `guardDisabledFromEnv` | `snapshot.ts` | Tier A1: reads `~/.intutic/hooks/policy-snapshot.rules`. |
|
|
69
|
-
| `parseRules`, `firstMatch`, `fetchRules`, `SopRule` | `soprules.ts` | Tier A3: SOP-authored `WHERE`-clause rules. |
|
|
85
|
+
| `parseRules`, `firstMatch`, `fetchRules`, `fetchRegister`, `parseRegister`, `SopRule`, `SopRegister` | `soprules.ts` | Tier A3: SOP-authored `WHERE`-clause rules, and the register they come in (rules plus the workspace's intervention mode). |
|
|
70
86
|
| `checkCommand`, `checkImages`, `checkWrittenManifest`, `ImageVerdict` | `imagecheck.ts` | Tier A2: container-image provenance on deploy commands. |
|
|
71
87
|
| `McpRegistryRecord`, `McpAllowlistRecord` | `mcpRegistryRecord.ts` | Tier M: the snapshot's MCP server registry and allowlist (`Snapshot.mcpRegistry`, `Snapshot.mcpAllowlist`), decided as the hook gates and the MCP proxy decide them; a byte-identical copy of `@intutic/shared-types`' module. |
|
|
72
88
|
| `classify`, `isDeploy`, `isTest`, `touchesInfra` | `actions.ts` | Command classifier shared by A2's deploy trigger. |
|
|
@@ -82,7 +98,7 @@ dropped, the SSO group policy still refuses, and every MCP call is refused with
|
|
|
82
98
|
`POLICY_SNAPSHOT_UNVERIFIED`. A hand-written snapshot for a test needs the line
|
|
83
99
|
too.
|
|
84
100
|
|
|
85
|
-
Full reference: [Gate SDK](https://docs.intutic.ai/reference/gate-sdk).
|
|
101
|
+
Full reference: [Gate SDK](https://docs.intutic.ai/reference/gate-sdk). Every export, with its signature and defaults: [API reference](https://docs.intutic.ai/reference/sdk/gate/).
|
|
86
102
|
|
|
87
103
|
### A note for sibling adapter phases
|
|
88
104
|
|
|
@@ -249,7 +265,7 @@ ordering gotcha.
|
|
|
249
265
|
|
|
250
266
|
## Subpath convention
|
|
251
267
|
|
|
252
|
-
|
|
268
|
+
Nine adapters exist today, one source file each: `@intutic/gate/dsh`
|
|
253
269
|
(`src/dsh.ts` — a Cordis plugin; see its module doc for the veto contract and
|
|
254
270
|
`services/sync-daemon/src/harness/dshHooks.ts` for profile registration),
|
|
255
271
|
`@intutic/gate/mastra` (`src/mastra.ts`), `@intutic/gate/vercel`
|
|
@@ -260,7 +276,8 @@ per-tool/per-connection `approval` surface, plus the observe-only
|
|
|
260
276
|
pre-1.0 Preview product, see its module doc), `@intutic/gate/harness`
|
|
261
277
|
(`src/harness.ts` — see above), `@intutic/gate/workflow` (`src/workflow.ts`
|
|
262
278
|
— see above), and `@intutic/gate/managed-agents` (`src/managedAgents.ts` — see
|
|
263
|
-
above)
|
|
279
|
+
above), and `@intutic/gate/trueforge` (`src/trueforge.ts` — embedded mode
|
|
280
|
+
only; see its module doc). Later adapter phases follow the SAME convention (also
|
|
264
281
|
`services/sync-daemon`'s existing subpath convention — see that package's
|
|
265
282
|
`package.json`):
|
|
266
283
|
|
|
@@ -270,10 +287,12 @@ above). Later adapter phases follow the SAME convention (also
|
|
|
270
287
|
```json
|
|
271
288
|
"./vercel": { "import": "./dist/vercel.js", "types": "./dist/vercel.d.ts" }
|
|
272
289
|
```
|
|
273
|
-
3. A matching `typesVersions` entry
|
|
274
|
-
|
|
290
|
+
3. A matching `typesVersions` entry pointing at the built declarations, so a
|
|
291
|
+
consumer resolving with `moduleResolution: node` finds the subpath's types
|
|
292
|
+
(only `dist/` is published, so a `src/` path here resolves to nothing;
|
|
293
|
+
`tools/scripts/check-package-entrypoints.js` fails the build on one):
|
|
275
294
|
```json
|
|
276
|
-
"typesVersions": { "*": { "vercel": ["
|
|
295
|
+
"typesVersions": { "*": { "vercel": ["dist/vercel.d.ts"] } }
|
|
277
296
|
```
|
|
278
297
|
4. Each adapter file imports from `./gate.js`, `./errors.js`, etc. (this
|
|
279
298
|
package's core, already built) rather than re-implementing any tier —
|
package/dist/actions.d.ts
CHANGED
|
@@ -80,6 +80,7 @@ export declare function toolIs(name: string, group: readonly string[]): boolean;
|
|
|
80
80
|
export declare function classify(toolName: string, toolInput: unknown): string[];
|
|
81
81
|
/** True when this call would deploy — the trigger for the image check. */
|
|
82
82
|
export declare function isDeploy(toolName: string, toolInput: unknown): boolean;
|
|
83
|
+
/** True when this call runs a test suite. */
|
|
83
84
|
export declare function isTest(toolName: string, toolInput: unknown): boolean;
|
|
84
85
|
/** True when a written path is infrastructure-as-code. */
|
|
85
86
|
export declare function touchesInfra(path: string | null | undefined): boolean;
|
package/dist/actions.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,0DAA0D;AAC1D,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAe5C,CAAA;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAS7C,CAAA;AAED,mCAAmC;AACnC,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAO7C,CAAA;AAED,sCAAsC;AACtC,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAqB1C,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAO/C,CAAA;AAED,yCAAyC;AACzC,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAS9C,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAclD,CAAA;AAED,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAO/C,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAYxC,CAAA;AAED,kDAAkD;AAClD,eAAO,MAAM,UAAU,EAAE,SAAS,MAAM,EAAqD,CAAA;AAE7F,kDAAkD;AAClD,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAAmE,CAAA;AAE5G;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EASjD,CAAA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAUnD;AAUD,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAEjF;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAGtE;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,EAAE,CAsBvE;AAED,0EAA0E;AAC1E,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAEtE;AAED,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAEpE;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErE"}
|
|
1
|
+
{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,0DAA0D;AAC1D,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAe5C,CAAA;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAS7C,CAAA;AAED,mCAAmC;AACnC,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAO7C,CAAA;AAED,sCAAsC;AACtC,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAqB1C,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAO/C,CAAA;AAED,yCAAyC;AACzC,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAS9C,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAclD,CAAA;AAED,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAO/C,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAYxC,CAAA;AAED,kDAAkD;AAClD,eAAO,MAAM,UAAU,EAAE,SAAS,MAAM,EAAqD,CAAA;AAE7F,kDAAkD;AAClD,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAAmE,CAAA;AAE5G;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EASjD,CAAA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAUnD;AAUD,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAEjF;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAGtE;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,EAAE,CAsBvE;AAED,0EAA0E;AAC1E,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAEtE;AAED,6CAA6C;AAC7C,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAEpE;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErE"}
|
package/dist/actions.js
CHANGED
|
@@ -245,6 +245,7 @@ export function classify(toolName, toolInput) {
|
|
|
245
245
|
export function isDeploy(toolName, toolInput) {
|
|
246
246
|
return classify(toolName, toolInput).includes(ACTION_PREFIX + 'deploy');
|
|
247
247
|
}
|
|
248
|
+
/** True when this call runs a test suite. */
|
|
248
249
|
export function isTest(toolName, toolInput) {
|
|
249
250
|
return classify(toolName, toolInput).includes(ACTION_PREFIX + 'run_tests');
|
|
250
251
|
}
|
package/dist/actions.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"actions.js","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAmB,MAAM,cAAc,CAAA;AAErE,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAA;AAEtC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,UAAU;IACV,eAAe;IACf,iBAAiB;IACjB,cAAc;IACd,cAAc;IACd,iBAAiB;IACjB,aAAa;IACb,mBAAmB;IACnB,YAAY;IACZ,eAAe;IACf,mBAAmB;IACnB,YAAY;IACZ,aAAa;IACb,WAAW;CACZ,CAAA;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,aAAa;IACb,cAAc;IACd,cAAc;IACd,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,UAAU;IACV,sBAAsB;CACvB,CAAA;AAED,mCAAmC;AACnC,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,mBAAmB;IACnB,SAAS;IACT,aAAa;IACb,eAAe;IACf,oBAAoB;IACpB,kBAAkB;CACnB,CAAA;AAED,sCAAsC;AACtC,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,UAAU;IACV,cAAc;IACd,WAAW;IACX,eAAe;IACf,WAAW;IACX,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,kBAAkB;IAClB,QAAQ;IACR,MAAM;IACN,OAAO;IACP,OAAO;IACP,SAAS;IACT,WAAW;IACX,aAAa;IACb,UAAU;IACV,aAAa;IACb,YAAY;IACZ,KAAK;CACN,CAAA;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,cAAc;IACd,qBAAqB;IACrB,UAAU;IACV,aAAa;IACb,aAAa;IACb,WAAW;CACZ,CAAA;AAED,yCAAyC;AACzC,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,aAAa;IACb,SAAS;IACT,aAAa;IACb,YAAY;IACZ,eAAe;IACf,aAAa;IACb,WAAW;IACX,aAAa;CACd,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,MAAM;IACN,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,MAAM;IACN,MAAM;IACN,UAAU;IACV,QAAQ;IACR,OAAO;IACP,OAAO;IACP,YAAY;IACZ,iBAAiB;CAClB,CAAA;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,UAAU;IACV,WAAW;IACX,KAAK;IACL,UAAU;IACV,MAAM;IACN,SAAS;CACV,CAAA;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,WAAW,GAAsB;IAC5C,MAAM;IACN,OAAO;IACP,aAAa;IACb,YAAY;IACZ,0EAA0E;IAC1E,iBAAiB;IACjB,2BAA2B;IAC3B,mBAAmB;IACnB,UAAU;IACV,SAAS;IACT,MAAM;CACP,CAAA;AAED,kDAAkD;AAClD,MAAM,CAAC,MAAM,UAAU,GAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,CAAA;AAE7F,kDAAkD;AAClD,MAAM,CAAC,MAAM,WAAW,GAAsB,CAAC,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;AAE5G;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,WAAW;IACX,KAAK;IACL,MAAM;IACN,aAAa;IACb,OAAO;IACP,YAAY;IACZ,gBAAgB;IAChB,UAAU;CACX,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAA;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACjF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;aACjC,IAAI,CAAC,EAAE,CAAC,CAAA;IACb,CAAC;IACD,2DAA2D;IAC3D,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAiB,EAAE,QAA2B;IACnE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,QAA2B;IACtE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,KAAwB;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAChC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAkB;IAC3D,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;IACpC,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,qEAAqE;IACrE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAE9B,IAAI,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;QAClC,sEAAsE;QACtE,kEAAkE;QAClE,IAAI,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAClE,IAAI,aAAa,CAAC,KAAK,EAAE,eAAe,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACjE,IAAI,aAAa,CAAC,KAAK,EAAE,gBAAgB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACnE,IAAI,aAAa,CAAC,KAAK,EAAE,gBAAgB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACnE,wEAAwE;QACxE,sCAAsC;QACtC,IAAI,UAAU,CAAC,IAAI,EAAE,qBAAqB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACxE,IAAI,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACpE,IAAI,aAAa,CAAC,KAAK,EAAE,kBAAkB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACvE,IAAI,aAAa,CAAC,KAAK,EAAE,iBAAiB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACvE,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,GAAG,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAkB;IAC3D,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,aAAa,GAAG,QAAQ,CAAC,CAAA;AACzE,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,QAAgB,EAAE,SAAkB;IACzD,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,aAAa,GAAG,WAAW,CAAC,CAAA;AAC5E,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,IAA+B;IAC1D,OAAO,UAAU,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,oBAAoB,CAAC,CAAA;AACrE,CAAC"}
|
|
1
|
+
{"version":3,"file":"actions.js","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAmB,MAAM,cAAc,CAAA;AAErE,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAA;AAEtC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,UAAU;IACV,eAAe;IACf,iBAAiB;IACjB,cAAc;IACd,cAAc;IACd,iBAAiB;IACjB,aAAa;IACb,mBAAmB;IACnB,YAAY;IACZ,eAAe;IACf,mBAAmB;IACnB,YAAY;IACZ,aAAa;IACb,WAAW;CACZ,CAAA;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,aAAa;IACb,cAAc;IACd,cAAc;IACd,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,UAAU;IACV,sBAAsB;CACvB,CAAA;AAED,mCAAmC;AACnC,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,mBAAmB;IACnB,SAAS;IACT,aAAa;IACb,eAAe;IACf,oBAAoB;IACpB,kBAAkB;CACnB,CAAA;AAED,sCAAsC;AACtC,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,UAAU;IACV,cAAc;IACd,WAAW;IACX,eAAe;IACf,WAAW;IACX,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,kBAAkB;IAClB,QAAQ;IACR,MAAM;IACN,OAAO;IACP,OAAO;IACP,SAAS;IACT,WAAW;IACX,aAAa;IACb,UAAU;IACV,aAAa;IACb,YAAY;IACZ,KAAK;CACN,CAAA;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,cAAc;IACd,qBAAqB;IACrB,UAAU;IACV,aAAa;IACb,aAAa;IACb,WAAW;CACZ,CAAA;AAED,yCAAyC;AACzC,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,aAAa;IACb,SAAS;IACT,aAAa;IACb,YAAY;IACZ,eAAe;IACf,aAAa;IACb,WAAW;IACX,aAAa;CACd,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,MAAM;IACN,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,MAAM;IACN,MAAM;IACN,UAAU;IACV,QAAQ;IACR,OAAO;IACP,OAAO;IACP,YAAY;IACZ,iBAAiB;CAClB,CAAA;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,UAAU;IACV,WAAW;IACX,KAAK;IACL,UAAU;IACV,MAAM;IACN,SAAS;CACV,CAAA;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,WAAW,GAAsB;IAC5C,MAAM;IACN,OAAO;IACP,aAAa;IACb,YAAY;IACZ,0EAA0E;IAC1E,iBAAiB;IACjB,2BAA2B;IAC3B,mBAAmB;IACnB,UAAU;IACV,SAAS;IACT,MAAM;CACP,CAAA;AAED,kDAAkD;AAClD,MAAM,CAAC,MAAM,UAAU,GAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,CAAA;AAE7F,kDAAkD;AAClD,MAAM,CAAC,MAAM,WAAW,GAAsB,CAAC,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;AAE5G;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,WAAW;IACX,KAAK;IACL,MAAM;IACN,aAAa;IACb,OAAO;IACP,YAAY;IACZ,gBAAgB;IAChB,UAAU;CACX,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAA;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACjF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;aACjC,IAAI,CAAC,EAAE,CAAC,CAAA;IACb,CAAC;IACD,2DAA2D;IAC3D,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAiB,EAAE,QAA2B;IACnE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,QAA2B;IACtE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,KAAwB;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAChC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAkB;IAC3D,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;IACpC,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,qEAAqE;IACrE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAE9B,IAAI,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;QAClC,sEAAsE;QACtE,kEAAkE;QAClE,IAAI,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAClE,IAAI,aAAa,CAAC,KAAK,EAAE,eAAe,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACjE,IAAI,aAAa,CAAC,KAAK,EAAE,gBAAgB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACnE,IAAI,aAAa,CAAC,KAAK,EAAE,gBAAgB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACnE,wEAAwE;QACxE,sCAAsC;QACtC,IAAI,UAAU,CAAC,IAAI,EAAE,qBAAqB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACxE,IAAI,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACpE,IAAI,aAAa,CAAC,KAAK,EAAE,kBAAkB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACvE,IAAI,aAAa,CAAC,KAAK,EAAE,iBAAiB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACvE,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,GAAG,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAkB;IAC3D,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,aAAa,GAAG,QAAQ,CAAC,CAAA;AACzE,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,MAAM,CAAC,QAAgB,EAAE,SAAkB;IACzD,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,aAAa,GAAG,WAAW,CAAC,CAAA;AAC5E,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,IAA+B;IAC1D,OAAO,UAAU,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,oBAAoB,CAAC,CAAA;AACrE,CAAC"}
|
package/dist/client.d.ts
CHANGED
|
@@ -5,7 +5,7 @@
|
|
|
5
5
|
*
|
|
6
6
|
* Endpoints used:
|
|
7
7
|
*
|
|
8
|
-
* POST /api/v1/hook-gate synchronous allow/deny -> {allowed, reason, incidentId?, code?, degraded?}
|
|
8
|
+
* POST /api/v1/hook-gate synchronous allow/deny -> {allowed, reason, incidentId?, code?, degraded?, decisionId?}
|
|
9
9
|
* POST /api/v1/hook-events batched telemetry -> creates governance_incidents rows
|
|
10
10
|
* POST /api/v1/decisions record a hold -> joins the review queue (hold.ts)
|
|
11
11
|
* GET /api/v1/decisions/approved-bypasses -> approvals that let a held call through
|
|
@@ -24,6 +24,14 @@
|
|
|
24
24
|
* is wrong, not the control plane that is down, and allowing would hide it.
|
|
25
25
|
* * `emit` NEVER throws. Telemetry that can break a run is worse than no
|
|
26
26
|
* telemetry.
|
|
27
|
+
*
|
|
28
|
+
* A client with no API key is LOCAL-ONLY ({@link GateClient.localOnly}): it
|
|
29
|
+
* cannot authenticate, so it makes no request at all. Its hook gate answers
|
|
30
|
+
* allow with code `LOCAL_ONLY` and says why, its events and holds are not
|
|
31
|
+
* sent, and the `Gate` skips the SOP register. The local tiers (policy
|
|
32
|
+
* snapshot, SSO groups from the snapshot, MCP registry, image integrity) are
|
|
33
|
+
* unaffected. A client WITH a key that the control plane refuses (401) is not
|
|
34
|
+
* local-only: that is an authentication fault, and fails closed as above.
|
|
27
35
|
*/
|
|
28
36
|
export interface GateResponse {
|
|
29
37
|
allowed: boolean;
|
|
@@ -37,18 +45,64 @@ export interface GateResponse {
|
|
|
37
45
|
code?: string | undefined;
|
|
38
46
|
/** False when the hook gate gave no verdict and `failClosed` decided it. */
|
|
39
47
|
reached: boolean;
|
|
48
|
+
/**
|
|
49
|
+
* The hook gate's id for this decision, when this answer is its own verdict:
|
|
50
|
+
* every verdict it gives names one, and a `GOVERNANCE_UNAVAILABLE` refusal
|
|
51
|
+
* keeps it only while `failClosed` refuses too. The gate reports the call
|
|
52
|
+
* with it (`gateDecisionId`), so the control plane exports the decision to
|
|
53
|
+
* SIEM once and files its incident once.
|
|
54
|
+
*/
|
|
55
|
+
decisionId?: string | undefined;
|
|
56
|
+
}
|
|
57
|
+
/**
|
|
58
|
+
* The fields {@link GateClient.hookGate} reads from a `POST /api/v1/hook-gate`
|
|
59
|
+
* answer, each checked before use. `src/__tests__/response-types.ts` pins
|
|
60
|
+
* them to the control plane's response schema.
|
|
61
|
+
*/
|
|
62
|
+
export interface HookGateAnswer {
|
|
63
|
+
allowed?: unknown;
|
|
64
|
+
reason?: unknown;
|
|
65
|
+
incidentId?: unknown;
|
|
66
|
+
code?: unknown;
|
|
67
|
+
decisionId?: unknown;
|
|
68
|
+
}
|
|
69
|
+
/** The field {@link GateClient.approvedBypasses} reads from `GET /api/v1/decisions/approved-bypasses`. */
|
|
70
|
+
export interface ApprovedBypassesAnswer {
|
|
71
|
+
bypasses?: unknown;
|
|
40
72
|
}
|
|
73
|
+
/** Options for a {@link GateClient}. Every field is optional. */
|
|
41
74
|
export interface GateClientOptions {
|
|
75
|
+
/**
|
|
76
|
+
* The control plane's address.
|
|
77
|
+
* @defaultValue `INTUTIC_CONTROL_PLANE_URL`, then Intutic's hosted control plane
|
|
78
|
+
*/
|
|
42
79
|
baseUrl?: string;
|
|
80
|
+
/**
|
|
81
|
+
* The API key. Without one the client is {@link GateClient.localOnly | local-only}.
|
|
82
|
+
* @defaultValue `''`
|
|
83
|
+
*/
|
|
43
84
|
apiKey?: string;
|
|
85
|
+
/** @defaultValue `''` */
|
|
44
86
|
workspaceId?: string;
|
|
87
|
+
/** @defaultValue `''` */
|
|
45
88
|
sessionId?: string;
|
|
46
89
|
/**
|
|
47
90
|
* Attributes incidents to the right adapter. Sent as `harnessType` on every
|
|
48
91
|
* gate call and event.
|
|
92
|
+
* @defaultValue `'generic'`
|
|
49
93
|
*/
|
|
50
94
|
harness?: string;
|
|
95
|
+
/**
|
|
96
|
+
* Block a call when the hook gate gives no verdict: the control plane
|
|
97
|
+
* cannot be reached, answers without one, or answers
|
|
98
|
+
* `GOVERNANCE_UNAVAILABLE`. `false` lets such a call go ahead.
|
|
99
|
+
* @defaultValue `true`
|
|
100
|
+
*/
|
|
51
101
|
failClosed?: boolean;
|
|
102
|
+
/**
|
|
103
|
+
* How long one control-plane request may take.
|
|
104
|
+
* @defaultValue `2000`
|
|
105
|
+
*/
|
|
52
106
|
timeoutMs?: number;
|
|
53
107
|
}
|
|
54
108
|
/**
|
|
@@ -68,6 +122,12 @@ export declare class GateClient {
|
|
|
68
122
|
readonly failClosed: boolean;
|
|
69
123
|
readonly timeoutMs: number;
|
|
70
124
|
constructor(opts?: GateClientOptions);
|
|
125
|
+
/**
|
|
126
|
+
* True when there is no API key. Such a client cannot authenticate, so it
|
|
127
|
+
* sends nothing: the control-plane tiers (SOP register, hook gate) are
|
|
128
|
+
* skipped, events and holds are not reported, and the local tiers decide.
|
|
129
|
+
*/
|
|
130
|
+
get localOnly(): boolean;
|
|
71
131
|
private post;
|
|
72
132
|
private request;
|
|
73
133
|
/**
|
|
@@ -84,17 +144,29 @@ export declare class GateClient {
|
|
|
84
144
|
* because a client with no verdict has nothing to defer to; false reports
|
|
85
145
|
* allow. A 400 `INVALID_REQUEST` is a BLOCK whatever `failClosed` says. A
|
|
86
146
|
* shadow-mode workspace's `{allowed: true, degraded: true}` is an allow.
|
|
147
|
+
*
|
|
148
|
+
* A {@link localOnly} client makes no call and answers allow with code
|
|
149
|
+
* `LOCAL_ONLY`, whatever `failClosed` says: with no key there is no
|
|
150
|
+
* control-plane tier to fail, only local ones, which have already run.
|
|
87
151
|
*/
|
|
88
152
|
hookGate(toolName: string, toolInput: unknown): Promise<GateResponse>;
|
|
89
|
-
/**
|
|
153
|
+
/**
|
|
154
|
+
* The answer when the hook gate gave no verdict: `failClosed` decides. A
|
|
155
|
+
* `GOVERNANCE_UNAVAILABLE` refusal's `decisionId` is kept when failing
|
|
156
|
+
* closed, which refuses as the hook gate did, and dropped when failing open:
|
|
157
|
+
* the call then runs, and its report must not stand for the refusal.
|
|
158
|
+
*/
|
|
90
159
|
private noVerdict;
|
|
91
160
|
/**
|
|
92
161
|
* Fire-and-forget telemetry. Never throws.
|
|
93
162
|
*
|
|
94
163
|
* A `tool_blocked` event creates a `governance_incidents` row whose
|
|
95
|
-
* description embeds the reason verbatim.
|
|
164
|
+
* description embeds the reason verbatim. `gateDecisionId` is the hook
|
|
165
|
+
* gate's `decisionId` for the call this event reports: the control plane
|
|
166
|
+
* then files the decision's incident once and does not export it to SIEM a
|
|
167
|
+
* second time.
|
|
96
168
|
*/
|
|
97
|
-
emit(event: string, toolName: string, reason?: string, toolInput?: unknown, incidentId?: string, filePath?: string): Promise<boolean>;
|
|
169
|
+
emit(event: string, toolName: string, reason?: string, toolInput?: unknown, incidentId?: string, filePath?: string, gateDecisionId?: string): Promise<boolean>;
|
|
98
170
|
/**
|
|
99
171
|
* Records one hold in the review queue (`POST /api/v1/decisions`), the way
|
|
100
172
|
* the hook gates' records reach it. Never throws; `false` when the control
|
|
@@ -113,6 +185,7 @@ export declare class GateClient {
|
|
|
113
185
|
*
|
|
114
186
|
* Reading `~/.intutic/credentials.json` means the gate works with whatever
|
|
115
187
|
* workspace `intutic login` already bound, instead of duplicating the key.
|
|
188
|
+
* With no key in either place the client is {@link localOnly}.
|
|
116
189
|
*/
|
|
117
190
|
static fromEnv(opts?: {
|
|
118
191
|
sessionId?: string;
|
package/dist/client.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AA4BH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/B;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAA;IAChB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED,0GAA0G;AAC1G,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AA4BD,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,qBAAa,UAAU;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;gBAEd,IAAI,GAAE,iBAAsB;IAaxC;;;;OAIG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;YAEa,IAAI;YAIJ,OAAO;IAoCrB;;;;;;;;;;;;;;;;;;OAkBG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC;IAuD3E;;;;;OAKG;IACH,OAAO,CAAC,SAAS;IASjB;;;;;;;;OAQG;IACG,IAAI,CACR,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,MAAM,SAAK,EACX,SAAS,CAAC,EAAE,OAAO,EACnB,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,EACjB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,OAAO,CAAC;IA6BnB;;;;;OAKG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IASjE;;;;OAIG;IACG,gBAAgB,IAAI,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;IASnD;;;;;;OAMG;IACH,MAAM,CAAC,OAAO,CAAC,IAAI,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,UAAU;CAoCtG"}
|
package/dist/client.js
CHANGED
|
@@ -5,7 +5,7 @@
|
|
|
5
5
|
*
|
|
6
6
|
* Endpoints used:
|
|
7
7
|
*
|
|
8
|
-
* POST /api/v1/hook-gate synchronous allow/deny -> {allowed, reason, incidentId?, code?, degraded?}
|
|
8
|
+
* POST /api/v1/hook-gate synchronous allow/deny -> {allowed, reason, incidentId?, code?, degraded?, decisionId?}
|
|
9
9
|
* POST /api/v1/hook-events batched telemetry -> creates governance_incidents rows
|
|
10
10
|
* POST /api/v1/decisions record a hold -> joins the review queue (hold.ts)
|
|
11
11
|
* GET /api/v1/decisions/approved-bypasses -> approvals that let a held call through
|
|
@@ -24,6 +24,14 @@
|
|
|
24
24
|
* is wrong, not the control plane that is down, and allowing would hide it.
|
|
25
25
|
* * `emit` NEVER throws. Telemetry that can break a run is worse than no
|
|
26
26
|
* telemetry.
|
|
27
|
+
*
|
|
28
|
+
* A client with no API key is LOCAL-ONLY ({@link GateClient.localOnly}): it
|
|
29
|
+
* cannot authenticate, so it makes no request at all. Its hook gate answers
|
|
30
|
+
* allow with code `LOCAL_ONLY` and says why, its events and holds are not
|
|
31
|
+
* sent, and the `Gate` skips the SOP register. The local tiers (policy
|
|
32
|
+
* snapshot, SSO groups from the snapshot, MCP registry, image integrity) are
|
|
33
|
+
* unaffected. A client WITH a key that the control plane refuses (401) is not
|
|
34
|
+
* local-only: that is an authentication fault, and fails closed as above.
|
|
27
35
|
*/
|
|
28
36
|
import { randomBytes } from 'node:crypto';
|
|
29
37
|
import { readFileSync } from 'node:fs';
|
|
@@ -50,6 +58,15 @@ const VALID_EVENTS = new Set([
|
|
|
50
58
|
]);
|
|
51
59
|
/** The hook gate's code for a call whose checks could not run. */
|
|
52
60
|
const GOVERNANCE_UNAVAILABLE = 'GOVERNANCE_UNAVAILABLE';
|
|
61
|
+
/** The code on a local-only client's hook-gate answer: no key, so no call was made. */
|
|
62
|
+
const LOCAL_ONLY = 'LOCAL_ONLY';
|
|
63
|
+
/** Thrown before any request a local-only client would otherwise send. */
|
|
64
|
+
class LocalOnlyError extends Error {
|
|
65
|
+
constructor(path) {
|
|
66
|
+
super(`no API key: ${path} not called (local-only client)`);
|
|
67
|
+
this.name = 'LocalOnlyError';
|
|
68
|
+
}
|
|
69
|
+
}
|
|
53
70
|
/** A non-2xx answer, with its status and whatever JSON body it carried. */
|
|
54
71
|
class HttpStatusError extends Error {
|
|
55
72
|
status;
|
|
@@ -86,10 +103,20 @@ export class GateClient {
|
|
|
86
103
|
this.failClosed = opts.failClosed ?? true;
|
|
87
104
|
this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
|
|
88
105
|
}
|
|
106
|
+
/**
|
|
107
|
+
* True when there is no API key. Such a client cannot authenticate, so it
|
|
108
|
+
* sends nothing: the control-plane tiers (SOP register, hook gate) are
|
|
109
|
+
* skipped, events and holds are not reported, and the local tiers decide.
|
|
110
|
+
*/
|
|
111
|
+
get localOnly() {
|
|
112
|
+
return this.apiKey === '';
|
|
113
|
+
}
|
|
89
114
|
async post(path, body, timeoutMs) {
|
|
90
115
|
return this.request('POST', path, body, timeoutMs);
|
|
91
116
|
}
|
|
92
117
|
async request(method, path, body, timeoutMs) {
|
|
118
|
+
if (this.localOnly)
|
|
119
|
+
throw new LocalOnlyError(path);
|
|
93
120
|
const controller = new AbortController();
|
|
94
121
|
const timer = setTimeout(() => controller.abort(), timeoutMs);
|
|
95
122
|
try {
|
|
@@ -134,8 +161,22 @@ export class GateClient {
|
|
|
134
161
|
* because a client with no verdict has nothing to defer to; false reports
|
|
135
162
|
* allow. A 400 `INVALID_REQUEST` is a BLOCK whatever `failClosed` says. A
|
|
136
163
|
* shadow-mode workspace's `{allowed: true, degraded: true}` is an allow.
|
|
164
|
+
*
|
|
165
|
+
* A {@link localOnly} client makes no call and answers allow with code
|
|
166
|
+
* `LOCAL_ONLY`, whatever `failClosed` says: with no key there is no
|
|
167
|
+
* control-plane tier to fail, only local ones, which have already run.
|
|
137
168
|
*/
|
|
138
169
|
async hookGate(toolName, toolInput) {
|
|
170
|
+
if (this.localOnly) {
|
|
171
|
+
return {
|
|
172
|
+
allowed: true,
|
|
173
|
+
reason: 'hook-gate skipped — no API key, so this client is local-only: the control-plane ' +
|
|
174
|
+
'tiers (SOP register, hook gate) did not run; the policy snapshot, SSO-group and ' +
|
|
175
|
+
'image tiers did',
|
|
176
|
+
code: LOCAL_ONLY,
|
|
177
|
+
reached: false,
|
|
178
|
+
};
|
|
179
|
+
}
|
|
139
180
|
let d;
|
|
140
181
|
try {
|
|
141
182
|
d = await this.post('/api/v1/hook-gate', {
|
|
@@ -157,13 +198,13 @@ export class GateClient {
|
|
|
157
198
|
};
|
|
158
199
|
}
|
|
159
200
|
if (exc instanceof HttpStatusError && exc.body.code === GOVERNANCE_UNAVAILABLE) {
|
|
160
|
-
return this.noVerdict(`governance check unavailable (${GOVERNANCE_UNAVAILABLE})`, GOVERNANCE_UNAVAILABLE);
|
|
201
|
+
return this.noVerdict(`governance check unavailable (${GOVERNANCE_UNAVAILABLE})`, GOVERNANCE_UNAVAILABLE, exc.body.decisionId);
|
|
161
202
|
}
|
|
162
203
|
const name = exc instanceof Error ? exc.constructor.name : 'Error';
|
|
163
204
|
return this.noVerdict(`unreachable (${name})`);
|
|
164
205
|
}
|
|
165
206
|
if (d.allowed === false && d.code === GOVERNANCE_UNAVAILABLE) {
|
|
166
|
-
return this.noVerdict(`governance check unavailable (${GOVERNANCE_UNAVAILABLE})`, GOVERNANCE_UNAVAILABLE);
|
|
207
|
+
return this.noVerdict(`governance check unavailable (${GOVERNANCE_UNAVAILABLE})`, GOVERNANCE_UNAVAILABLE, d.decisionId);
|
|
167
208
|
}
|
|
168
209
|
if (typeof d.allowed !== 'boolean')
|
|
169
210
|
return this.noVerdict('answered without a verdict');
|
|
@@ -173,21 +214,33 @@ export class GateClient {
|
|
|
173
214
|
incidentId: typeof d.incidentId === 'string' ? d.incidentId : undefined,
|
|
174
215
|
code: typeof d.code === 'string' ? d.code : undefined,
|
|
175
216
|
reached: true,
|
|
217
|
+
decisionId: typeof d.decisionId === 'string' ? d.decisionId : undefined,
|
|
176
218
|
};
|
|
177
219
|
}
|
|
178
|
-
/**
|
|
179
|
-
|
|
220
|
+
/**
|
|
221
|
+
* The answer when the hook gate gave no verdict: `failClosed` decides. A
|
|
222
|
+
* `GOVERNANCE_UNAVAILABLE` refusal's `decisionId` is kept when failing
|
|
223
|
+
* closed, which refuses as the hook gate did, and dropped when failing open:
|
|
224
|
+
* the call then runs, and its report must not stand for the refusal.
|
|
225
|
+
*/
|
|
226
|
+
noVerdict(what, code, decisionId) {
|
|
180
227
|
return this.failClosed
|
|
181
|
-
? {
|
|
228
|
+
? {
|
|
229
|
+
allowed: false, reason: `hook-gate ${what} — failing closed (failClosed=true)`, code, reached: false,
|
|
230
|
+
decisionId: typeof decisionId === 'string' ? decisionId : undefined,
|
|
231
|
+
}
|
|
182
232
|
: { allowed: true, reason: `hook-gate ${what} — failing open (failClosed=false)`, code, reached: false };
|
|
183
233
|
}
|
|
184
234
|
/**
|
|
185
235
|
* Fire-and-forget telemetry. Never throws.
|
|
186
236
|
*
|
|
187
237
|
* A `tool_blocked` event creates a `governance_incidents` row whose
|
|
188
|
-
* description embeds the reason verbatim.
|
|
238
|
+
* description embeds the reason verbatim. `gateDecisionId` is the hook
|
|
239
|
+
* gate's `decisionId` for the call this event reports: the control plane
|
|
240
|
+
* then files the decision's incident once and does not export it to SIEM a
|
|
241
|
+
* second time.
|
|
189
242
|
*/
|
|
190
|
-
async emit(event, toolName, reason = '', toolInput, incidentId, filePath) {
|
|
243
|
+
async emit(event, toolName, reason = '', toolInput, incidentId, filePath, gateDecisionId) {
|
|
191
244
|
if (!VALID_EVENTS.has(event))
|
|
192
245
|
return false;
|
|
193
246
|
const ev = {
|
|
@@ -209,6 +262,8 @@ export class GateClient {
|
|
|
209
262
|
ev.toolInput = toolInput;
|
|
210
263
|
if (incidentId)
|
|
211
264
|
ev.incidentId = incidentId;
|
|
265
|
+
if (gateDecisionId)
|
|
266
|
+
ev.gateDecisionId = gateDecisionId;
|
|
212
267
|
if (filePath)
|
|
213
268
|
ev.filePath = filePath.slice(0, 512);
|
|
214
269
|
try {
|
|
@@ -253,6 +308,7 @@ export class GateClient {
|
|
|
253
308
|
*
|
|
254
309
|
* Reading `~/.intutic/credentials.json` means the gate works with whatever
|
|
255
310
|
* workspace `intutic login` already bound, instead of duplicating the key.
|
|
311
|
+
* With no key in either place the client is {@link localOnly}.
|
|
256
312
|
*/
|
|
257
313
|
static fromEnv(opts = {}) {
|
|
258
314
|
const base = process.env.INTUTIC_CONTROL_PLANE_URL || 'https://api.intutic.ai';
|
package/dist/client.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAChC,MAAM,gBAAgB,GAAG,KAAK,CAAA;AAC9B,MAAM,UAAU,GAAG,GAAG,CAAA,CAAC,2DAA2D;AAElF,8EAA8E;AAC9E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,cAAc;IACd,cAAc;IACd,cAAc;IACd,kBAAkB;IAClB,eAAe;IACf,gBAAgB;IAChB,iBAAiB;IACjB,iBAAiB;IACjB,gBAAgB;IAChB,kBAAkB;IAClB,gBAAgB;IAChB,WAAW;IACX,2BAA2B;CAC5B,CAAC,CAAA;AA0CF,kEAAkE;AAClE,MAAM,sBAAsB,GAAG,wBAAwB,CAAA;AAEvD,uFAAuF;AACvF,MAAM,UAAU,GAAG,YAAY,CAAA;AAE/B,0EAA0E;AAC1E,MAAM,cAAe,SAAQ,KAAK;IAChC,YAAY,IAAY;QACtB,KAAK,CAAC,eAAe,IAAI,iCAAiC,CAAC,CAAA;QAC3D,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAA;IAC9B,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,eAAgB,SAAQ,KAAK;IAGtB;IACA;IAHX,YACE,IAAY,EACH,MAAc,EACd,IAA6B;QAEtC,KAAK,CAAC,QAAQ,MAAM,SAAS,IAAI,EAAE,CAAC,CAAA;QAH3B,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAyB;QAGtC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;IAC/B,CAAC;CACF;AAsCD;;;;;;;GAOG;AACH,MAAM,OAAO,UAAU;IACZ,OAAO,CAAQ;IACf,MAAM,CAAQ;IACd,WAAW,CAAQ;IACnB,SAAS,CAAQ;IACjB,OAAO,CAAQ;IACf,UAAU,CAAS;IACnB,SAAS,CAAQ;IAE1B,YAAY,OAA0B,EAAE;QACtC,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,wBAAwB,CAAC,CAAC,OAAO,CACxG,KAAK,EACL,EAAE,CACH,CAAA;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAA;QAC/B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAA;QACzC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAA;QACrC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,SAAS,CAAA;QACxC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAA;QACzC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAA;IACvD,CAAC;IAED;;;;OAIG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,MAAM,KAAK,EAAE,CAAA;IAC3B,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAAa,EAAE,SAAiB;QAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IACpD,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAsB,EACtB,IAAY,EACZ,IAAa,EACb,SAAiB;QAEjB,IAAI,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,CAAA;QAClD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAA;QAC7D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE;gBAC3C,MAAM;gBACN,OAAO,EAAE;oBACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;oBACrE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;oBACtC,gBAAgB,EAAE,IAAI,CAAC,WAAW;iBACnC;gBACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7D,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAC7B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,IAAI,IAAI,GAAY,IAAI,CAAA;gBACxB,IAAI,CAAC;oBACH,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;gBACvC,CAAC;gBAAC,MAAM,CAAC;oBACP,4CAA4C;gBAC9C,CAAC;gBACD,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YACjI,CAAC;YACD,OAAO,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6B,CAAC,CAAC,CAAC,EAAE,CAAA;QAClE,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,SAAkB;QACjD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EACJ,kFAAkF;oBAClF,kFAAkF;oBAClF,iBAAiB;gBACnB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,KAAK;aACf,CAAA;QACH,CAAC;QACD,IAAI,CAAiB,CAAA;QACrB,IAAI,CAAC;YACH,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CACjB,mBAAmB,EACnB;gBACE,QAAQ;gBACR,SAAS;gBACT,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,WAAW,EAAE,IAAI,CAAC,OAAO;aAC1B,EACD,IAAI,CAAC,SAAS,CACf,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACzD,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAA;gBAC/E,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,qDAAqD,GAAG,EAAE;oBAClE,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,IAAI;iBACd,CAAA;YACH,CAAC;YACD,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;gBAC/E,OAAO,IAAI,CAAC,SAAS,CAAC,iCAAiC,sBAAsB,GAAG,EAAE,sBAAsB,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YAChI,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAA;YAClE,OAAO,IAAI,CAAC,SAAS,CAAC,gBAAgB,IAAI,GAAG,CAAC,CAAA;QAChD,CAAC;QACD,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC,SAAS,CAAC,iCAAiC,sBAAsB,GAAG,EAAE,sBAAsB,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;QACzH,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAA;QACvF,OAAO;YACL,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;YAC9B,UAAU,EAAE,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACvE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACrD,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;SACxE,CAAA;IACH,CAAC;IAED;;;;;OAKG;IACK,SAAS,CAAC,IAAY,EAAE,IAAa,EAAE,UAAoB;QACjE,OAAO,IAAI,CAAC,UAAU;YACpB,CAAC,CAAC;gBACE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,IAAI,qCAAqC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK;gBACpG,UAAU,EAAE,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;aACpE;YACH,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,IAAI,oCAAoC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC5G,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,IAAI,CACR,KAAa,EACb,QAAgB,EAChB,MAAM,GAAG,EAAE,EACX,SAAmB,EACnB,UAAmB,EACnB,QAAiB,EACjB,cAAuB;QAEvB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QAC1C,MAAM,EAAE,GAA4B;YAClC,KAAK;YACL,QAAQ;YACR,MAAM,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC;YAC3C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,IAAI,CAAC,OAAO;YACzB,uEAAuE;YACvE,uEAAuE;YACvE,UAAU,EAAE,KAAK;YACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,wEAAwE;YACxE,kCAAkC;YAClC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;SACzC,CAAA;QACD,IAAI,SAAS,KAAK,SAAS;YAAE,EAAE,CAAC,SAAS,GAAG,SAAS,CAAA;QACrD,IAAI,UAAU;YAAE,EAAE,CAAC,UAAU,GAAG,UAAU,CAAA;QAC1C,IAAI,cAAc;YAAE,EAAE,CAAC,cAAc,GAAG,cAAc,CAAA;QACtD,IAAI,QAAQ;YAAE,EAAE,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAClD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAA;YAC1E,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,IAA6B;QAC5C,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;YACjF,OAAO,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB;QACpB,IAAI,CAAC;YACH,MAAM,CAAC,GAA2B,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,qCAAqC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;YAC7H,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,OAAO,CAAC,OAAuE,EAAE;QACtF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,wBAAwB,CAAA;QAC9E,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAA;QAC3C,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAA;QAE/C,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAA;gBAChE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAA4B,CAAA;gBAChF,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;gBACnC,EAAE,GAAG,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;YACnE,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAA;QACnE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,qEAAqE;YACrE,oEAAoE;YACpE,MAAM,IAAI,KAAK,CACb,kFAAkF;gBAChF,gFAAgF;gBAChF,oBAAoB,CACvB,CAAA;QACH,CAAC;QAED,OAAO,IAAI,UAAU,CAAC;YACpB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS;YAClC,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;SACpC,CAAC,CAAA;IACJ,CAAC;CACF"}
|
package/dist/eve.d.ts
CHANGED
|
@@ -159,7 +159,7 @@
|
|
|
159
159
|
*/
|
|
160
160
|
import { type Gate } from './gate.js';
|
|
161
161
|
import { GateClient } from './client.js';
|
|
162
|
-
export { intuticProxyUrl, withIntuticProxy } from './vercel.js';
|
|
162
|
+
export { intuticProxyBaseUrl, intuticProxyUrl, withIntuticProxy } from './vercel.js';
|
|
163
163
|
/** Synthetic tool name used by {@link intuticAuditHooks} — eve's
|
|
164
164
|
* `approval.candidate`/`approval.settled` events do not carry the real tool
|
|
165
165
|
* name (verified against `dist/src/protocol/message.d.ts`; see module doc). */
|
package/dist/eve.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"eve.d.ts","sourceRoot":"","sources":["../src/eve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8JG;AAEH,OAAO,EAAwB,KAAK,IAAI,EAAE,MAAM,WAAW,CAAA;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAMxC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;
|
|
1
|
+
{"version":3,"file":"eve.d.ts","sourceRoot":"","sources":["../src/eve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8JG;AAEH,OAAO,EAAwB,KAAK,IAAI,EAAE,MAAM,WAAW,CAAA;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAMxC,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEpF;;gFAEgF;AAChF,eAAO,MAAM,sBAAsB,iBAAiB,CAAA;AAKpD;;;;;uEAKuE;AACvE,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,OAAO,GACP,gBAAgB,GAChB,UAAU,GACV,QAAQ,GACR,eAAe,GACf;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,CAAA;AAE/D;;;;mEAImE;AACnE,MAAM,WAAW,kBAAkB;IACjC;;;6CAGyC;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;iDAE6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAC7B;AAED;;;gDAGgD;AAChD,MAAM,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,kBAAkB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;AAEvF,MAAM,WAAW,sBAAsB;IACrC,4EAA4E;IAC5E,IAAI,CAAC,EAAE,IAAI,CAAA;IACX;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,CAAC,EAAE,gBAAgB,GAAG,eAAe,CAAA;CAC7C;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,eAAe,CAAC,IAAI,GAAE,sBAA2B,GAAG,iBAAiB,CAmBpF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,GAAE,sBAA2B,GAAG,iBAAiB,CAE9F;AAMD;;sEAEsE;AACtE,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;IACnC,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;QAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAA;QAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;QACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;QACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED;mDACmD;AACnD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,WAAW,CAAA;QAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;QACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,eAAe,GAAG,eAAe,CAAA;IAC7D;;kEAE8D;IAC9D,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KACzB,CAAA;CACF;AAED;;yEAEyE;AACzE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAA;QAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,eAAe,GAAG,eAAe,CAAA;IAC7D,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAA;IAC1F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KACvB,CAAA;CACF;AAED;;;;;kCAKkC;AAClC,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAC/B,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAA;QACnD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED;;2CAE2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3C;AAED;oEACoE;AACpE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,iBAAiB,EAAE,CAC1B,KAAK,EAAE,sBAAsB,EAC7B,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,IAAI,CAAC,CAAA;QAClB,QAAQ,CAAC,oBAAoB,EAAE,CAC7B,KAAK,EAAE,yBAAyB,EAChC,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,IAAI,CAAC,CAAA;QAClB,QAAQ,CAAC,kBAAkB,EAAE,CAC3B,KAAK,EAAE,uBAAuB,EAC9B,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,IAAI,CAAC,CAAA;QAClB,QAAQ,CAAC,gBAAgB,EAAE,CACzB,KAAK,EAAE,qBAAqB,EAC5B,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,IAAI,CAAC,CAAA;KACnB,CAAA;CACF;AAED,MAAM,WAAW,wBAAwB;IACvC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,wBAA6B,GAAG,sBAAsB,CA6I7F"}
|
package/dist/eve.js
CHANGED
|
@@ -163,7 +163,7 @@ import { IntuticGateRefusal } from './errors.js';
|
|
|
163
163
|
// One routing story, one implementation: eve's direct-provider path is the
|
|
164
164
|
// Vercel AI SDK's (eve is built on `ai` v7), so the helper is re-exported
|
|
165
165
|
// rather than duplicated. See vercel.ts for the full module doc.
|
|
166
|
-
export { intuticProxyUrl, withIntuticProxy } from './vercel.js';
|
|
166
|
+
export { intuticProxyBaseUrl, intuticProxyUrl, withIntuticProxy } from './vercel.js';
|
|
167
167
|
/** Synthetic tool name used by {@link intuticAuditHooks} — eve's
|
|
168
168
|
* `approval.candidate`/`approval.settled` events do not carry the real tool
|
|
169
169
|
* name (verified against `dist/src/protocol/message.d.ts`; see module doc). */
|
package/dist/eve.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"eve.js","sourceRoot":"","sources":["../src/eve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8JG;AAEH,OAAO,EAAE,MAAM,IAAI,UAAU,EAAa,MAAM,WAAW,CAAA;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,2EAA2E;AAC3E,0EAA0E;AAC1E,iEAAiE;AACjE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;
|
|
1
|
+
{"version":3,"file":"eve.js","sourceRoot":"","sources":["../src/eve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8JG;AAEH,OAAO,EAAE,MAAM,IAAI,UAAU,EAAa,MAAM,WAAW,CAAA;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,2EAA2E;AAC3E,0EAA0E;AAC1E,iEAAiE;AACjE,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEpF;;gFAEgF;AAChF,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAA;AAEpD,sEAAsE;AACtE,MAAM,uBAAuB,GAAG,IAAI,CAAA;AA2EpC;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,KAAkB,CAAA;IAC3B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,eAAe,CAAC,OAA+B,EAAE;IAC/D,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,CAAA;QACnC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,8EAA8E;gBAC5E,oEAAoE,CACvE,CAAA;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;YAC9D,OAAO,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAA;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAA;YAChD,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA+B,EAAE;IACzE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAA;AAC9B,CAAC;AAsJD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAiC,EAAE;IACnE,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAA;IAEvD,wEAAwE;IACxE,sEAAsE;IACtE,gEAAgE;IAChE,sEAAsE;IACtE,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,wEAAwE;IACxE,kDAAkD;IAClD,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAA;IAErD,6EAA6E;IAC7E,yEAAyE;IACzE,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,kDAAkD;IAClD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,SAAS,eAAe,CAAC,SAAiB;QACxC,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAA;QAC3C,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACtB,IAAI,OAAO,CAAC,IAAI,GAAG,uBAAuB,EAAE,CAAC;YAC3C,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAA;QACzD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,SAAS,SAAS,CAAC,SAAiB;QAClC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,MAAM,CAAA;QACjD,IAAI,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;gBAC/D,oEAAoE;gBACpE,6BAA6B;gBAC7B,MAAM,GAAG,IAAI,CAAA;YACf,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,OAAO;QACL,MAAM,EAAE;YACN,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACtC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;gBACxC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAC1C,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;wBAAE,SAAQ;oBAC9E,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;oBACnE,IAAI,MAAM,KAAK,IAAI;wBAAE,SAAQ;oBAC7B,MAAM,MAAM,CAAC,IAAI,CACf,cAAc,EACd,OAAO,CAAC,MAAM,CAAC,QAAQ,EACvB,kEAAkE,OAAO,CAAC,SAAS,GAAG,EACtF,OAAO,CAAC,MAAM,CAAC,KAAK,CACrB,CAAA;gBACH,CAAC;YACH,CAAC;YACD,oBAAoB,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACzC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS;oBAAE,OAAM;gBAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;gBACxC,IAAI,MAAM,KAAK,IAAI;oBAAE,OAAM;gBAC3B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAA;gBACxF,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;gBAChE,MAAM,MAAM,CAAC,IAAI,CACf,cAAc,EACd,QAAQ,EACR,0BAA0B,KAAK,CAAC,IAAI,CAAC,OAAO,aAAa,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI;oBAC/E,aAAa,KAAK,CAAC,IAAI,CAAC,oBAAoB,IAAI,MAAM,EAAE,EAC1D,KAAK,CAAC,IAAI,CACX,CAAA;YACH,CAAC;YACD,kBAAkB,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACvC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAA;gBACxF,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAChD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;oBAAE,OAAM;gBAClD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;gBACxC,IAAI,MAAM,KAAK,IAAI;oBAAE,OAAM;gBAC3B,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;oBACtC,MAAM,MAAM,CAAC,IAAI,CACf,cAAc,EACd,QAAQ,EACR,qCAAqC,KAAK,CAAC,IAAI,CAAC,oBAAoB,GAAG;wBACrE,YAAY,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,EACrC,KAAK,CAAC,IAAI,CACX,CAAA;oBACD,OAAM;gBACR,CAAC;gBACD,MAAM,MAAM,CAAC,IAAI,CACf,cAAc,EACd,QAAQ,EACR,mEAAmE;oBACjE,YAAY,KAAK,CAAC,IAAI,CAAC,SAAS,eAAe,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK;oBACnF,kFAAkF,EACpF,KAAK,CAAC,IAAI,CACX,CAAA;YACH,CAAC;YACD,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACrC,uDAAuD;gBACvD,oEAAoE;gBACpE,aAAa;gBACb,MAAM,QAAQ,GAAgE,EAAE,CAAA;gBAChF,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAChD,IAAI,UAAU,CAAC,IAAI,KAAK,eAAe;wBAAE,SAAQ;oBACjD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAA;oBACxF,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;oBAChD,IAAI,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC;wBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAA;gBACpF,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAM;gBACjC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;gBACxC,IAAI,MAAM,KAAK,IAAI;oBAAE,OAAM;gBAC3B,KAAK,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,QAAQ,EAAE,CAAC;oBAChD,MAAM,OAAO,GAAG,YAAY,UAAU,CAAC,SAAS,GAAG,CAAA;oBACnD,IAAI,UAAU,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;wBACtC,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,mCAAmC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAA;oBACvG,CAAC;yBAAM,IAAI,UAAU,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;wBAC3C,MAAM,MAAM,CAAC,IAAI,CACf,cAAc,EACd,QAAQ,EACR,kEAAkE,OAAO,IAAI;4BAC3E,kFAAkF,EACpF,UAAU,CACX,CAAA;oBACH,CAAC;yBAAM,CAAC;wBACN,MAAM,MAAM,CAAC,IAAI,CACf,cAAc,EACd,QAAQ,EACR,uCAAuC,UAAU,CAAC,OAAO,KAAK,OAAO,EAAE,EACvE,UAAU,CACX,CAAA;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;SACF;KACF,CAAA;AACH,CAAC"}
|
package/dist/gate.d.ts
CHANGED
|
@@ -49,7 +49,9 @@
|
|
|
49
49
|
* A1 and A2 are load-bearing and local. Tier B contributes the DLP regexes
|
|
50
50
|
* and workspace policy from the control plane; whether an unreachable control
|
|
51
51
|
* plane, or one whose checks could not run (`GOVERNANCE_UNAVAILABLE`), blocks
|
|
52
|
-
* is the client's `failClosed` setting (default true).
|
|
52
|
+
* is the client's `failClosed` setting (default true). A client with no API
|
|
53
|
+
* key is local-only (`GateClient.localOnly`): A3 and B are skipped and the
|
|
54
|
+
* hook-gate answer says so (code `LOCAL_ONLY`), while A0, A1, M and A2 run.
|
|
53
55
|
*
|
|
54
56
|
* Tier A3 applies rules written in the SOP register rather than in code. It
|
|
55
57
|
* runs BEFORE A2 so that a block, when both would fire, is attributed to the
|
|
@@ -82,12 +84,38 @@ import * as soprules from './soprules.js';
|
|
|
82
84
|
/** Tools that cannot change anything. They still get the local snapshot check
|
|
83
85
|
* (Tier A1), but skip the remote gate call (Tier B). */
|
|
84
86
|
export declare const READ_ONLY_TOOLS: ReadonlySet<string>;
|
|
87
|
+
/** How a {@link Gate} evaluates calls. Every field is optional. */
|
|
85
88
|
export interface GateConfig {
|
|
89
|
+
/**
|
|
90
|
+
* Where relative manifest and allowlist paths resolve from.
|
|
91
|
+
* @defaultValue `'.'`
|
|
92
|
+
*/
|
|
86
93
|
repoRoot?: string;
|
|
94
|
+
/**
|
|
95
|
+
* Compared with the workspace the policy snapshot was compiled for, and
|
|
96
|
+
* scopes the SOP-rule fetch.
|
|
97
|
+
* @defaultValue `''`
|
|
98
|
+
*/
|
|
87
99
|
workspaceId?: string;
|
|
100
|
+
/**
|
|
101
|
+
* The image allowlist, relative to `repoRoot` unless absolute.
|
|
102
|
+
* @defaultValue `'.intutic/image-allowlist.json'`
|
|
103
|
+
*/
|
|
88
104
|
allowlistPath?: string;
|
|
105
|
+
/**
|
|
106
|
+
* `false` turns {@link Gate.guard} into a no-op.
|
|
107
|
+
* @defaultValue `true`
|
|
108
|
+
*/
|
|
89
109
|
enforce?: boolean;
|
|
110
|
+
/**
|
|
111
|
+
* Call the control plane's hook gate (needs a client).
|
|
112
|
+
* @defaultValue `true`
|
|
113
|
+
*/
|
|
90
114
|
useHookGate?: boolean;
|
|
115
|
+
/**
|
|
116
|
+
* Fetch and apply the workspace's SOP rules (needs a client).
|
|
117
|
+
* @defaultValue `true`
|
|
118
|
+
*/
|
|
91
119
|
useSopRules?: boolean;
|
|
92
120
|
}
|
|
93
121
|
interface ResolvedConfig {
|
|
@@ -99,6 +127,13 @@ interface ResolvedConfig {
|
|
|
99
127
|
useSopRules: boolean;
|
|
100
128
|
}
|
|
101
129
|
export type ToolInput = Record<string, unknown>;
|
|
130
|
+
/**
|
|
131
|
+
* The pre-execution gate. {@link Gate.guard} evaluates one tool call against
|
|
132
|
+
* the local tiers (SSO group policy, policy snapshot, MCP servers, image
|
|
133
|
+
* integrity) and, with a {@link GateClient}, the control-plane tiers (SOP
|
|
134
|
+
* rules, hook gate), and throws {@link IntuticGateRefusal} to refuse it.
|
|
135
|
+
* Without a client only the local tiers run.
|
|
136
|
+
*/
|
|
102
137
|
export declare class Gate {
|
|
103
138
|
readonly cfg: ResolvedConfig;
|
|
104
139
|
readonly client: GateClient | null;
|