@intutic/mcp-governance-proxy 1.10.0 → 1.10.1

package/dist/wasm/hostImports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostImports.d.ts","sourceRoot":"","sources":["../../src/wasm/hostImports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EACL,eAAe,EAOhB,MAAM,sBAAsB,CAAA;AAI7B,mIAAmI;AACnI,eAAO,MAAM,WAAW,KAAU,CAAA;AAElC,uEAAuE;AACvE,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,KAAK,EAAE,eAAe,CAAA;IACtB,6DAA6D;IAC7D,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED,wBAAgB,kBAAkB,CAAC,KAAK,GAAE,eAAyC,GAAG,eAAe,CAEpG;AAoBD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,WAAW,CAAC,MAAM,GAAG,SAAS,EAC/C,KAAK,GAAE,eAAsC,GAC5C,WAAW,CAAC,aAAa,CA0G3B"}

package/dist/wasm/hostImports.js

@@ -0,0 +1,158 @@
+/**
+ * wasm/hostImports.ts — The 4 frozen host imports (`WASM_HOST_IMPORTS` from
+ * `@intutic/shared-types`), implemented for this proxy's `worker_threads`
+ * sandbox.
+ *
+ * Built from `packages/proxy/src/wasm/host.rs` (the Rust behavior each
+ * import must match) and from `packages/wasm-sdk/__tests__/generatedRules.test.ts`'s
+ * `HOST_IMPL` (the reference Node-side implementation the task named as the
+ * base to build from). `log_info`/`abort`/`trace` mirror `host.rs`'s
+ * tracing-log behavior, routed through this package's own `createStderrLogger`
+ * (never `console.log`/stdout — the same stdio-isolation rule every other
+ * module in this package follows). `read_referenced_file` resolves against
+ * the per-evaluation table the runner pre-reads through `referencedFiles.ts`
+ * (TD-441) — the port of `host.rs`'s `read_referenced_file_impl`, code for
+ * code: the read budget is charged before argument validation, a refusal is
+ * a value the rule can act on, and nothing here traps. With no table (no
+ * `INTUTIC_WASM_MANIFEST_ROOT`, or a rule that does not import the function)
+ * every call gets `ERR_REFUSED`, which is what the Rust proxy answers with no
+ * root configured.
+ *
+ * @module
+ */
+import { createStderrLogger as createLogger } from '../stderrLog.js';
+import { ReferencedFiles, ERR_BAD_ARGS, ERR_BUDGET, ERR_BUFFER_TOO_SMALL, ERR_REFUSED as REFUSED, MAX_GUEST_PATH_BYTES, MAX_READS_PER_EVALUATION, } from './referencedFiles.js';
+const log = createLogger('mcp-proxy-wasm-host');
+/** `referenced_files.rs`'s `ERR_REFUSED` (-2), kept exported here for the callers that imported it before the resolver existed. */
+export const ERR_REFUSED = REFUSED;
+export function newHostImportState(files = ReferencedFiles.empty()) {
+    return { files, fileReadsRemaining: MAX_READS_PER_EVALUATION };
+}
+/**
+ * Decode a UTF-8 string out of a WASM instance's linear memory. Returns `''`
+ * on any bounds/decode failure — mirrors `host.rs`'s own posture of logging
+ * a warning and returning without acting, never trapping the guest over a
+ * malformed log call.
+ */
+function readUtf8(memory, ptr, len) {
+    if (ptr < 0 || len < 0)
+        return null;
+    const bytes = new Uint8Array(memory.buffer);
+    const end = ptr + len;
+    if (end > bytes.length)
+        return null;
+    try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(bytes.subarray(ptr, end));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Builds the `env.*` import object for one WASM instance. `getMemory` is a
+ * thunk rather than a captured value because the memory export does not
+ * exist until AFTER `WebAssembly.instantiate` returns, while the import
+ * object has to be supplied BEFORE it — the same ordering `host.rs` avoids
+ * entirely by reading `caller.get_export("memory")` inside each call; this
+ * is the Node-side equivalent of that lazy lookup.
+ */
+export function createHostImports(getMemory, state = newHostImportState()) {
+    return {
+        log_info: (ptr, len) => {
+            const memory = getMemory();
+            if (!memory) {
+                log.warn({ action: 'wasm_host_no_memory', call: 'log_info' }, 'WASM rule called log_info with no memory export');
+                return;
+            }
+            const msg = readUtf8(memory, ptr, len);
+            if (msg === null) {
+                log.warn({ action: 'wasm_log_info_bad_args' }, 'WASM rule log_info payload out of bounds or not valid UTF-8');
+                return;
+            }
+            log.info({ action: 'wasm_rule_log' }, msg);
+        },
+        // Mirrors host.rs's `abort` import: log only, never throw/trap. A guest
+        // unhandled-exception calling `abort` must not crash the evaluation —
+        // the caller (worker.ts) still wraps the whole `evaluate` call so any
+        // resulting trap fails open, but this import itself is inert.
+        abort: (msgPtr, filePtr, line, col) => {
+            log.warn({ action: 'wasm_abort', msgPtr, filePtr, line, col }, 'WASM rule called abort (AssemblyScript unhandled exception)');
+        },
+        // Best-effort decode of AssemblyScript's `String#trace` layout — a
+        // length-prefixed UTF-16LE string with the 4-byte length immediately
+        // before `ptr`. Falls back to logging the raw pointer/length, same as
+        // host.rs's own fallback branch, rather than treating a decode failure
+        // as fatal.
+        trace: (ptr, n) => {
+            const memory = getMemory();
+            if (!memory)
+                return;
+            if (ptr >= 4) {
+                const bytes = new Uint8Array(memory.buffer);
+                if (ptr <= bytes.length) {
+                    const lenBytes = bytes.subarray(ptr - 4, ptr);
+                    const len = new DataView(lenBytes.buffer, lenBytes.byteOffset, 4).getUint32(0, true);
+                    const end = ptr + len;
+                    if (end <= bytes.length) {
+                        try {
+                            const utf16 = new Uint16Array(bytes.buffer, bytes.byteOffset + ptr, len / 2);
+                            const msg = String.fromCharCode(...utf16);
+                            log.info({ action: 'wasm_trace', n }, msg);
+                            return;
+                        }
+                        catch {
+                            // fall through to the raw fallback below
+                        }
+                    }
+                }
+            }
+            log.info({ action: 'wasm_trace_raw', ptr, n }, 'WASM trace (undecoded)');
+        },
+        // Ported from host.rs's `read_referenced_file_impl`. Returns a length or
+        // one of the negative codes; never throws — a host trap would unwind the
+        // guest, fail the whole evaluation and land in the runner's fail-open
+        // arm, so one malformed call would silently switch off every OTHER
+        // check the rule performs.
+        read_referenced_file: (pathPtr, pathLen, outPtr, outCap) => {
+            // Charged before anything else, including argument validation, so a
+            // guest cannot spin on cheap malformed calls any more than on
+            // expensive good ones.
+            if (state.fileReadsRemaining <= 0) {
+                log.warn({ action: 'wasm_file_read_budget_exhausted', budget: MAX_READS_PER_EVALUATION }, 'WASM rule exhausted its referenced-file reads in one evaluation');
+                return ERR_BUDGET;
+            }
+            state.fileReadsRemaining -= 1;
+            const memory = getMemory();
+            if (!memory) {
+                log.warn({ action: 'wasm_host_no_memory', call: 'read_referenced_file' }, 'WASM rule called read_referenced_file with no memory export');
+                return ERR_BAD_ARGS;
+            }
+            if (pathPtr < 0 || pathLen <= 0 || pathLen > MAX_GUEST_PATH_BYTES || outCap < 0)
+                return ERR_BAD_ARGS;
+            const requested = readUtf8(memory, pathPtr, pathLen);
+            if (requested === null)
+                return ERR_BAD_ARGS;
+            const hit = state.files.lookup(requested);
+            if (!hit.ok) {
+                // The reason is operator-facing only. The guest gets the code and is
+                // told nothing it did not already supply.
+                log.debug({ action: 'wasm_referenced_file_refused', path: requested, code: hit.code, reason: state.files.refusalReason(requested) }, "refused a WASM rule's referenced-file read");
+                return hit.code;
+            }
+            const len = hit.bytes.length; // capped at MAX_REFERENCED_FILE_BYTES on the way in
+            if (outCap === 0)
+                return len;
+            if (outCap < len)
+                return ERR_BUFFER_TOO_SMALL;
+            const view = new Uint8Array(memory.buffer);
+            if (outPtr < 0 || outPtr + len > view.length) {
+                // Out of bounds: a refusal, not a trap, same as host.rs.
+                log.warn({ action: 'wasm_referenced_file_out_ptr_oob', outPtr, len }, 'WASM rule passed an out-of-bounds output buffer');
+                return ERR_BAD_ARGS;
+            }
+            view.set(hit.bytes, outPtr);
+            return len;
+        },
+    };
+}
+//# sourceMappingURL=hostImports.js.map

package/dist/wasm/hostImports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostImports.js","sourceRoot":"","sources":["../../src/wasm/hostImports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACpE,OAAO,EACL,eAAe,EACf,YAAY,EACZ,UAAU,EACV,oBAAoB,EACpB,WAAW,IAAI,OAAO,EACtB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA;AAE7B,MAAM,GAAG,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAA;AAE/C,mIAAmI;AACnI,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAA;AAUlC,MAAM,UAAU,kBAAkB,CAAC,QAAyB,eAAe,CAAC,KAAK,EAAE;IACjF,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,CAAA;AAChE,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,MAA0B,EAAE,GAAW,EAAE,GAAW;IACpE,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,MAAM,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;IACrB,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAA+C,EAC/C,QAAyB,kBAAkB,EAAE;IAE7C,OAAO;QACL,QAAQ,EAAE,CAAC,GAAW,EAAE,GAAW,EAAQ,EAAE;YAC3C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;YAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,iDAAiD,CAAC,CAAA;gBAChH,OAAM;YACR,CAAC;YACD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YACtC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,EAAE,6DAA6D,CAAC,CAAA;gBAC7G,OAAM;YACR,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5C,CAAC;QAED,wEAAwE;QACxE,sEAAsE;QACtE,sEAAsE;QACtE,8DAA8D;QAC9D,KAAK,EAAE,CAAC,MAAc,EAAE,OAAe,EAAE,IAAY,EAAE,GAAW,EAAQ,EAAE;YAC1E,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,EACpD,6DAA6D,CAC9D,CAAA;QACH,CAAC;QAED,mEAAmE;QACnE,qEAAqE;QACrE,sEAAsE;QACtE,uEAAuE;QACvE,YAAY;QACZ,KAAK,EAAE,CAAC,GAAW,EAAE,CAAS,EAAQ,EAAE;YACtC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;YAC1B,IAAI,CAAC,MAAM;gBAAE,OAAM;YACnB,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBAC3C,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;oBAC7C,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;oBACpF,MAAM,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;oBACrB,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;wBACxB,IAAI,CAAC;4BACH,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,CAAA;4BAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAA;4BACzC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;4BAC1C,OAAM;wBACR,CAAC;wBAAC,MAAM,CAAC;4BACP,yCAAyC;wBAC3C,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAA;QAC1E,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,mEAAmE;QACnE,2BAA2B;QAC3B,oBAAoB,EAAE,CAAC,OAAe,EAAE,OAAe,EAAE,MAAc,EAAE,MAAc,EAAU,EAAE;YACjG,oEAAoE;YACpE,8DAA8D;YAC9D,uBAAuB;YACvB,IAAI,KAAK,CAAC,kBAAkB,IAAI,CAAC,EAAE,CAAC;gBAClC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,iCAAiC,EAAE,MAAM,EAAE,wBAAwB,EAAE,EAC/E,iEAAiE,CAClE,CAAA;gBACD,OAAO,UAAU,CAAA;YACnB,CAAC;YACD,KAAK,CAAC,kBAAkB,IAAI,CAAC,CAAA;YAE7B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;YAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE,6DAA6D,CAAC,CAAA;gBACxI,OAAO,YAAY,CAAA;YACrB,CAAC;YACD,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,GAAG,oBAAoB,IAAI,MAAM,GAAG,CAAC;gBAAE,OAAO,YAAY,CAAA;YACpG,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;YACpD,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,YAAY,CAAA;YAE3C,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YACzC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,qEAAqE;gBACrE,0CAA0C;gBAC1C,GAAG,CAAC,KAAK,CACP,EAAE,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,EACzH,4CAA4C,CAC7C,CAAA;gBACD,OAAO,GAAG,CAAC,IAAI,CAAA;YACjB,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAA,CAAC,oDAAoD;YACjF,IAAI,MAAM,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAA;YAC5B,IAAI,MAAM,GAAG,GAAG;gBAAE,OAAO,oBAAoB,CAAA;YAC7C,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC1C,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC7C,yDAAyD;gBACzD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kCAAkC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,iDAAiD,CAAC,CAAA;gBACxH,OAAO,YAAY,CAAA;YACrB,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YAC3B,OAAO,GAAG,CAAA;QACZ,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/wasm/loader.d.ts

@@ -0,0 +1,95 @@
+/**
+ * wasm/loader.ts — `~/.intutic/wasm/` directory loader.
+ *
+ * Direct TypeScript port of `packages/proxy/src/wasm/local_loader.rs`'s
+ * directory-resolution order, `NN_name.wasm` priority parsing, the 10MB
+ * per-file size cap, and mtime+size-based change detection — confirmed by
+ * reading that file, not guessed. Compilation and import validation
+ * themselves happen in the worker (`worker.ts`); this module owns file
+ * discovery, diffing, and the fail-open-per-file bookkeeping (a corrupt or
+ * oversized file is skipped and logged; if a previous good rule was loaded
+ * from that same file, it is retained rather than dropped).
+ *
+ * @module
+ */
+/** Ported from `local_loader.rs`'s `MAX_RULE_FILE_BYTES`. */
+export declare const MAX_RULE_FILE_BYTES: number;
+/** Ported from `local_loader.rs`'s `DEFAULT_PRIORITY`. */
+export declare const DEFAULT_PRIORITY = 100;
+/**
+ * Resolve the local rules directory: `INTUTIC_WASM_DIR` env var, then the
+ * caller-supplied config override, then `~/.intutic/wasm` — same precedence
+ * order as `local_loader.rs`'s `resolve_local_dir` (confirmed by its own
+ * `resolve_dir_precedence` test: env wins over config, config wins over the
+ * home default).
+ */
+export declare function resolveWasmDir(configOverride?: string): string;
+/**
+ * Parse `NN_name.wasm` into `{ priority, name }`. Ported from
+ * `local_loader.rs`'s `parse_priority`, including its edge cases:
+ * `10_block-prod-db.wasm` -> `{10, "block-prod-db"}`; `my-rule.wasm` ->
+ * `{100, "my-rule"}`; a non-numeric or empty prefix (`block_prod.wasm`,
+ * `_hidden.wasm`) also defaults to priority 100 with the whole stem as the name.
+ */
+export declare function parsePriority(fileName: string): {
+    priority: number;
+    name: string;
+};
+export interface FileSignature {
+    mtimeMs: number;
+    size: number;
+}
+/**
+ * `(mtime, size)` signature of every `*.wasm` file in `dir`, keyed by full
+ * path. A missing directory returns an empty map (first-run UX, ported from
+ * `scan_signatures`'s own `NotFound` handling) — any other I/O error
+ * propagates so the caller can retain the previously loaded rules instead of
+ * mistaking a transient EACCES/EIO for "every rule was deleted."
+ */
+export declare function scanSignatures(dir: string): Promise<Map<string, FileSignature>>;
+export interface LoadedRuleMeta {
+    /** `local:<file name>` — same convention `local_loader.rs` uses. */
+    ruleId: string;
+    fileName: string;
+    name: string;
+    priority: number;
+    readsReferencedFiles: boolean;
+    /** Cached raw bytes, so a worker respawn (wasm/runner.ts) can resend every
+     *  currently-loaded rule without re-reading the directory from disk. */
+    bytes: Uint8Array;
+}
+export type CompileOutcome = {
+    ok: true;
+    readsReferencedFiles: boolean;
+} | {
+    ok: false;
+    error: string;
+    unsupportedImports?: string[];
+};
+/** What `WasmLoader` needs from the worker to load/unload a rule — implemented by `WasmRunner`. */
+export interface CompileBridge {
+    compile(ruleId: string, bytes: Uint8Array): Promise<CompileOutcome>;
+    remove(ruleId: string): void;
+}
+/**
+ * Tracks the local rules directory's current state: which files exist, their
+ * change signatures, and the rule metadata successfully compiled from each.
+ * Fail-open per file — see this module's doc comment.
+ */
+export declare class WasmLoader {
+    private readonly dir;
+    private signatures;
+    private loaded;
+    constructor(dir: string);
+    getDir(): string;
+    /** Currently loaded rules, priority order (lower runs first), ties in file-scan order. */
+    getRules(): LoadedRuleMeta[];
+    /**
+     * Rescans the directory and (re)compiles anything changed via `bridge`.
+     * `force` reloads every current file unconditionally (used by the
+     * policy-tick hook after a worker respawn, where the worker's own module
+     * cache was lost and must be rebuilt even though nothing on disk moved).
+     */
+    rescan(bridge: CompileBridge, force?: boolean): Promise<void>;
+}
+//# sourceMappingURL=loader.d.ts.map

package/dist/wasm/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/wasm/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,6DAA6D;AAC7D,eAAO,MAAM,mBAAmB,QAAmB,CAAA;AAEnD,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,MAAM,CAAA;AAEnC;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAK9D;AAOD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAWlF;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAsBrF;AAWD,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,oBAAoB,EAAE,OAAO,CAAA;IAC7B;4EACwE;IACxE,KAAK,EAAE,UAAU,CAAA;CAClB;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,oBAAoB,EAAE,OAAO,CAAA;CAAE,GAC3C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAA;AAE/D,mGAAmG;AACnG,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IACnE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED;;;;GAIG;AACH,qBAAa,UAAU;IAIT,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHhC,OAAO,CAAC,UAAU,CAAmC;IACrD,OAAO,CAAC,MAAM,CAAoC;gBAErB,GAAG,EAAE,MAAM;IAExC,MAAM,IAAI,MAAM;IAIhB,0FAA0F;IAC1F,QAAQ,IAAI,cAAc,EAAE;IAI5B;;;;;OAKG;IACG,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CA+ElE"}

package/dist/wasm/loader.js

@@ -0,0 +1,198 @@
+/**
+ * wasm/loader.ts — `~/.intutic/wasm/` directory loader.
+ *
+ * Direct TypeScript port of `packages/proxy/src/wasm/local_loader.rs`'s
+ * directory-resolution order, `NN_name.wasm` priority parsing, the 10MB
+ * per-file size cap, and mtime+size-based change detection — confirmed by
+ * reading that file, not guessed. Compilation and import validation
+ * themselves happen in the worker (`worker.ts`); this module owns file
+ * discovery, diffing, and the fail-open-per-file bookkeeping (a corrupt or
+ * oversized file is skipped and logged; if a previous good rule was loaded
+ * from that same file, it is retained rather than dropped).
+ *
+ * @module
+ */
+import * as node_fs from 'node:fs/promises';
+import * as node_os from 'node:os';
+import * as node_path from 'node:path';
+import { createStderrLogger as createLogger } from '../stderrLog.js';
+const log = createLogger('mcp-proxy-wasm-loader');
+/** Ported from `local_loader.rs`'s `MAX_RULE_FILE_BYTES`. */
+export const MAX_RULE_FILE_BYTES = 10 * 1024 * 1024;
+/** Ported from `local_loader.rs`'s `DEFAULT_PRIORITY`. */
+export const DEFAULT_PRIORITY = 100;
+/**
+ * Resolve the local rules directory: `INTUTIC_WASM_DIR` env var, then the
+ * caller-supplied config override, then `~/.intutic/wasm` — same precedence
+ * order as `local_loader.rs`'s `resolve_local_dir` (confirmed by its own
+ * `resolve_dir_precedence` test: env wins over config, config wins over the
+ * home default).
+ */
+export function resolveWasmDir(configOverride) {
+    const envDir = process.env['INTUTIC_WASM_DIR'];
+    if (envDir)
+        return expandHome(envDir);
+    if (configOverride)
+        return expandHome(configOverride);
+    return node_path.join(node_os.homedir(), '.intutic', 'wasm');
+}
+function expandHome(raw) {
+    if (raw.startsWith('~/'))
+        return node_path.join(node_os.homedir(), raw.slice(2));
+    return raw;
+}
+/**
+ * Parse `NN_name.wasm` into `{ priority, name }`. Ported from
+ * `local_loader.rs`'s `parse_priority`, including its edge cases:
+ * `10_block-prod-db.wasm` -> `{10, "block-prod-db"}`; `my-rule.wasm` ->
+ * `{100, "my-rule"}`; a non-numeric or empty prefix (`block_prod.wasm`,
+ * `_hidden.wasm`) also defaults to priority 100 with the whole stem as the name.
+ */
+export function parsePriority(fileName) {
+    const stem = fileName.endsWith('.wasm') ? fileName.slice(0, -'.wasm'.length) : fileName;
+    const idx = stem.indexOf('_');
+    if (idx > 0 && idx < stem.length - 1) {
+        const prefix = stem.slice(0, idx);
+        const rest = stem.slice(idx + 1);
+        if (/^\d+$/.test(prefix)) {
+            return { priority: Number.parseInt(prefix, 10), name: rest };
+        }
+    }
+    return { priority: DEFAULT_PRIORITY, name: stem };
+}
+/**
+ * `(mtime, size)` signature of every `*.wasm` file in `dir`, keyed by full
+ * path. A missing directory returns an empty map (first-run UX, ported from
+ * `scan_signatures`'s own `NotFound` handling) — any other I/O error
+ * propagates so the caller can retain the previously loaded rules instead of
+ * mistaking a transient EACCES/EIO for "every rule was deleted."
+ */
+export async function scanSignatures(dir) {
+    const signatures = new Map();
+    let entries;
+    try {
+        entries = await node_fs.readdir(dir, { withFileTypes: true });
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return signatures;
+        throw err;
+    }
+    for (const entry of entries) {
+        if (!entry.isFile() || !entry.name.endsWith('.wasm'))
+            continue;
+        const full = node_path.join(dir, entry.name);
+        try {
+            const stat = await node_fs.stat(full);
+            signatures.set(full, { mtimeMs: stat.mtimeMs, size: stat.size });
+        }
+        catch {
+            // Vanished between readdir and stat (race with a concurrent
+            // write/delete) — skip it this pass; the next rescan sees whatever
+            // state settles.
+        }
+    }
+    return signatures;
+}
+function signaturesEqual(a, b) {
+    if (a.size !== b.size)
+        return false;
+    for (const [key, sig] of a) {
+        const other = b.get(key);
+        if (!other || other.mtimeMs !== sig.mtimeMs || other.size !== sig.size)
+            return false;
+    }
+    return true;
+}
+/**
+ * Tracks the local rules directory's current state: which files exist, their
+ * change signatures, and the rule metadata successfully compiled from each.
+ * Fail-open per file — see this module's doc comment.
+ */
+export class WasmLoader {
+    dir;
+    signatures = new Map();
+    loaded = new Map(); // keyed by file path
+    constructor(dir) {
+        this.dir = dir;
+    }
+    getDir() {
+        return this.dir;
+    }
+    /** Currently loaded rules, priority order (lower runs first), ties in file-scan order. */
+    getRules() {
+        return [...this.loaded.values()].sort((a, b) => a.priority - b.priority);
+    }
+    /**
+     * Rescans the directory and (re)compiles anything changed via `bridge`.
+     * `force` reloads every current file unconditionally (used by the
+     * policy-tick hook after a worker respawn, where the worker's own module
+     * cache was lost and must be rebuilt even though nothing on disk moved).
+     */
+    async rescan(bridge, force = false) {
+        let newSignatures;
+        try {
+            newSignatures = await scanSignatures(this.dir);
+        }
+        catch (err) {
+            log.warn({ action: 'wasm_scan_error', dir: this.dir, err: err.message }, 'local WASM rule directory scan failed — keeping previously loaded rules');
+            return;
+        }
+        if (!force && signaturesEqual(newSignatures, this.signatures))
+            return;
+        // Removed files.
+        for (const filePath of [...this.loaded.keys()]) {
+            if (!newSignatures.has(filePath)) {
+                const meta = this.loaded.get(filePath);
+                if (meta)
+                    bridge.remove(meta.ruleId);
+                this.loaded.delete(filePath);
+            }
+        }
+        // New or changed files.
+        for (const [filePath, sig] of newSignatures) {
+            const previousSig = this.signatures.get(filePath);
+            const changed = force || !previousSig || previousSig.mtimeMs !== sig.mtimeMs || previousSig.size !== sig.size;
+            if (!changed)
+                continue;
+            const fileName = node_path.basename(filePath);
+            const ruleId = `local:${fileName}`;
+            if (sig.size > MAX_RULE_FILE_BYTES) {
+                log.warn({ action: 'wasm_rule_too_large', file: filePath, sizeBytes: sig.size, capBytes: MAX_RULE_FILE_BYTES }, 'local WASM rule exceeds size cap — skipped');
+                continue; // fail-open-per-file: whatever was in `this.loaded` for this path (if anything) stays
+            }
+            let bytes;
+            try {
+                bytes = await node_fs.readFile(filePath);
+            }
+            catch (err) {
+                log.warn({ action: 'wasm_rule_read_error', file: filePath, err: err.message }, 'local WASM rule failed to read — retaining previous version if any');
+                continue;
+            }
+            const result = await bridge.compile(ruleId, bytes);
+            if (result.ok) {
+                const { priority, name } = parsePriority(fileName);
+                this.loaded.set(filePath, {
+                    ruleId,
+                    fileName,
+                    name,
+                    priority,
+                    readsReferencedFiles: result.readsReferencedFiles,
+                    bytes,
+                });
+            }
+            else {
+                log.warn({
+                    action: 'wasm_rule_load_error',
+                    file: filePath,
+                    error: result.error,
+                    unsupportedImports: result.unsupportedImports,
+                }, 'local WASM rule failed to load — retaining previous version if any');
+                // Fail-open-per-file: do NOT touch `this.loaded.get(filePath)` — a
+                // previously good module (if any) for this exact path stays active.
+            }
+        }
+        this.signatures = newSignatures;
+    }
+}
+//# sourceMappingURL=loader.js.map

package/dist/wasm/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/wasm/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEpE,MAAM,GAAG,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAEjD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAEnD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAA;AAEnC;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,cAAuB;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC9C,IAAI,MAAM;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;IACrC,IAAI,cAAc;QAAE,OAAO,UAAU,CAAC,cAAc,CAAC,CAAA;IACrD,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAChF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;IACvF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;QAChC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AACnD,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAA;IACnD,IAAI,OAAmC,CAAA;IACvC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAA;QACvE,MAAM,GAAG,CAAA;IACX,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAQ;QAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QAC5C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACrC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;YAC5D,mEAAmE;YACnE,iBAAiB;QACnB,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,CAA6B,EAAE,CAA6B;IACnF,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACnC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACxB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI;YAAE,OAAO,KAAK,CAAA;IACtF,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAwBD;;;;GAIG;AACH,MAAM,OAAO,UAAU;IAIQ;IAHrB,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC7C,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAA,CAAC,qBAAqB;IAExE,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IAE5C,MAAM;QACJ,OAAO,IAAI,CAAC,GAAG,CAAA;IACjB,CAAC;IAED,0FAA0F;IAC1F,QAAQ;QACN,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC1E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,MAAqB,EAAE,KAAK,GAAG,KAAK;QAC/C,IAAI,aAAyC,CAAA;QAC7C,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EACzE,yEAAyE,CAC1E,CAAA;YACD,OAAM;QACR,CAAC;QAED,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC;YAAE,OAAM;QAErE,iBAAiB;QACjB,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBACtC,IAAI,IAAI;oBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;gBACpC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC9B,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,aAAa,EAAE,CAAC;YAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACjD,MAAM,OAAO,GAAG,KAAK,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,IAAI,WAAW,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAA;YAC7G,IAAI,CAAC,OAAO;gBAAE,SAAQ;YAEtB,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAC7C,MAAM,MAAM,GAAG,SAAS,QAAQ,EAAE,CAAA;YAElC,IAAI,GAAG,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;gBACnC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,mBAAmB,EAAE,EACrG,4CAA4C,CAC7C,CAAA;gBACD,SAAQ,CAAC,sFAAsF;YACjG,CAAC;YAED,IAAI,KAAa,CAAA;YACjB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAC/E,oEAAoE,CACrE,CAAA;gBACD,SAAQ;YACV,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YAClD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;gBAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE;oBACxB,MAAM;oBACN,QAAQ;oBACR,IAAI;oBACJ,QAAQ;oBACR,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;oBACjD,KAAK;iBACN,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CACN;oBACE,MAAM,EAAE,sBAAsB;oBAC9B,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;iBAC9C,EACD,oEAAoE,CACrE,CAAA;gBACD,mEAAmE;gBACnE,oEAAoE;YACtE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,aAAa,CAAA;IACjC,CAAC;CACF"}

package/dist/wasm/referencedFiles.d.ts

@@ -0,0 +1,115 @@
+/**
+ * wasm/referencedFiles.ts — The MCP-side resolver behind the
+ * `read_referenced_file` host import (TD-441). A 1:1 port of
+ * `packages/proxy/src/wasm/referenced_files.rs`: same constants, same error
+ * codes, same candidate-token rules, same six guards, same realpath
+ * confinement. Where the two differ it is stated at the site.
+ *
+ * ## The design, in one paragraph
+ *
+ * A rule never names a file. The proxy derives the candidate paths from the
+ * CURRENT tool call's arguments (structured path keys and the shell words of
+ * a command), keeps the manifest-shaped ones, resolves each under the
+ * operator-configured root with every symlink followed, and reads the ones
+ * that survive — all BEFORE the sandbox exists. The guest then passes a path
+ * as a lookup key into that fixed table. There is no code path from a guest
+ * string to `open(2)`.
+ *
+ * ## Guards (numbered as in the Rust module)
+ *
+ * 1. Only paths the tool call literally named (no glob expansion).
+ * 2. Only manifest extensions.
+ * 3. No `..` component; no platform prefix.
+ * 4. Realpath must stay under the realpath'd root (symlink escape covered).
+ * 5. Regular files only.
+ * 6. Size-capped, checked on the stat AND on the read.
+ *
+ * ## Divergence from the Rust module
+ *
+ * Reads are `fs/promises` (async) rather than a blocking pool — the runner
+ * awaits them once per evaluation, before any rule runs, so the per-rule
+ * deadline still covers only guest execution. The residual TOCTOU between
+ * `realpath` and `open` is the same one `referenced_files.rs` documents;
+ * closing it needs `openat2(RESOLVE_BENEATH)`, which Node does not expose.
+ *
+ * @module
+ */
+/** Largest file the host will hand to a rule. `referenced_files.rs`: 256 KiB. */
+export declare const MAX_REFERENCED_FILE_BYTES: number;
+/** Candidate paths considered per evaluation. */
+export declare const MAX_REFERENCED_FILES = 8;
+/** Longest path a guest may ask for. */
+export declare const MAX_GUEST_PATH_BYTES = 4096;
+export declare const ERR_BAD_ARGS = -1;
+export declare const ERR_REFUSED = -2;
+export declare const ERR_NOT_FOUND = -3;
+export declare const ERR_TOO_LARGE = -4;
+export declare const ERR_BUFFER_TOO_SMALL = -5;
+export declare const ERR_BUDGET = -6;
+/** Host calls one evaluation may make, charged before argument validation. */
+export declare const MAX_READS_PER_EVALUATION = 64;
+/** The operator-configured root. Unset means the capability is off. */
+export declare const MANIFEST_ROOT_ENV = "INTUTIC_WASM_MANIFEST_ROOT";
+/** One candidate's fate. `content` carries bytes; everything else a code. */
+export type Outcome = {
+    kind: 'content';
+    bytes: Uint8Array;
+} | {
+    kind: 'refused';
+    why: string;
+} | {
+    kind: 'not_found';
+} | {
+    kind: 'too_large';
+    size: number;
+};
+/** The structured-clone-safe wire form the runner posts to the worker. */
+export type ReferencedFilesTable = Array<[string, Outcome]>;
+export interface ToolCallLike {
+    name: string;
+    arguments: unknown;
+}
+/**
+ * The pre-read table one evaluation sees. Immutable after construction; the
+ * worker rebuilds it from `toTable()` on its side of `postMessage`.
+ */
+export declare class ReferencedFiles {
+    private readonly entries;
+    private constructor();
+    static empty(): ReferencedFiles;
+    static fromTable(table: ReferencedFilesTable | undefined): ReferencedFiles;
+    toTable(): ReferencedFilesTable;
+    isEmpty(): boolean;
+    readableCount(): number;
+    /** The bytes for `requested`, or the error code the guest gets. */
+    lookup(requested: string): {
+        ok: true;
+        bytes: Uint8Array;
+    } | {
+        ok: false;
+        code: number;
+    };
+    /** Operator-facing reason. Never handed to the guest. */
+    refusalReason(requested: string): string;
+    /** Debug rendering: states, never contents. */
+    describe(): string;
+}
+/** The configured root, `~/` expanded. `undefined` keeps the capability off. */
+export declare function resolveRoot(env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * Guard 1 and 2: every manifest-shaped path the tool calls literally name,
+ * deduped, capped at `MAX_REFERENCED_FILES`, in first-seen order.
+ */
+export declare function candidateTokens(toolCalls: readonly ToolCallLike[]): string[];
+/**
+ * Split a command into shell words. Quotes group; whitespace and the
+ * metacharacters that end a word separate. Deliberately does NOT expand
+ * globs, variables or command substitution — an unexpanded `*.yaml` simply
+ * fails to resolve and the guest is told so.
+ */
+export declare function shellTokens(command: string): string[];
+/** Resolve and read every candidate under `root`. Async, so the runner awaits it once per evaluation. */
+export declare function readTokens(tokens: readonly string[], root: string): Promise<ReferencedFiles>;
+/** Convenience for callers with tool calls in hand. */
+export declare function prefetch(toolCalls: readonly ToolCallLike[], root: string): Promise<ReferencedFiles>;
+//# sourceMappingURL=referencedFiles.d.ts.map

package/dist/wasm/referencedFiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"referencedFiles.d.ts","sourceRoot":"","sources":["../../src/wasm/referencedFiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAUH,iFAAiF;AACjF,eAAO,MAAM,yBAAyB,QAAa,CAAA;AACnD,iDAAiD;AACjD,eAAO,MAAM,oBAAoB,IAAI,CAAA;AACrC,wCAAwC;AACxC,eAAO,MAAM,oBAAoB,OAAO,CAAA;AAMxC,eAAO,MAAM,YAAY,KAAK,CAAA;AAC9B,eAAO,MAAM,WAAW,KAAK,CAAA;AAC7B,eAAO,MAAM,aAAa,KAAK,CAAA;AAC/B,eAAO,MAAM,aAAa,KAAK,CAAA;AAC/B,eAAO,MAAM,oBAAoB,KAAK,CAAA;AACtC,eAAO,MAAM,UAAU,KAAK,CAAA;AAE5B,8EAA8E;AAC9E,eAAO,MAAM,wBAAwB,KAAK,CAAA;AAE1C,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,+BAA+B,CAAA;AAO7D,6EAA6E;AAC7E,MAAM,MAAM,OAAO,GACf;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAEvC,0EAA0E;AAC1E,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;AAE3D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,OAAO,CAAA;CACnB;AAED;;;GAGG;AACH,qBAAa,eAAe;IACN,OAAO,CAAC,QAAQ,CAAC,OAAO;IAA5C,OAAO;IAEP,MAAM,CAAC,KAAK,IAAI,eAAe;IAI/B,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,oBAAoB,GAAG,SAAS,GAAG,eAAe;IAI1E,OAAO,IAAI,oBAAoB;IAI/B,OAAO,IAAI,OAAO;IAIlB,aAAa,IAAI,MAAM;IAIvB,mEAAmE;IACnE,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE;IAgBxF,yDAAyD;IACzD,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAgBxC,+CAA+C;IAC/C,QAAQ,IAAI,MAAM;CAgBnB;AAED,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAKpF;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,EAAE,CAoB5E;AAsBD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA0BrD;AAED,yGAAyG;AACzG,wBAAsB,UAAU,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CA2ClG;AAeD,uDAAuD;AACvD,wBAAgB,QAAQ,CAAC,SAAS,EAAE,SAAS,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAEnG"}