@intutic/mcp-governance-proxy 1.10.0 → 2.0.0

package/dist/daemon/policyCache.js

@@ -10,6 +10,7 @@
 import https from 'node:https';
 import http from 'node:http';
 import { Redis } from 'ioredis';
+import { describeConnectionError } from '../valkeyErrors.js';
 import { createLogger } from '@intutic/logger';
 const logger = createLogger('mcp-proxy.policyCache');
 const getPolicyTtlMs = () => parseInt(process.env['MCP_DAEMON_POLICY_TTL_MS'] ?? '300000', 10);
@@ -22,8 +23,30 @@ const valkey = new Redis(VALKEY_URL, {
     maxRetriesPerRequest: 3,
 });
 valkey.on('error', (err) => {
-    logger.warn({ err: err.message }, 'policyCache Valkey connection error');
+    logger.warn({ err: describeConnectionError(err) }, 'policyCache Valkey connection error');
 });
+/** Same key `packages/db`'s `configVersionKey` builds; this package does not depend on it. */
+const configVersionKey = (workspaceId) => `v2:sync:config_version:${workspaceId}`;
+async function readConfigVersion(workspaceId) {
+    // Only a connected client is asked. With Valkey down, ioredis queues the GET
+    // and rejects it after `maxRetriesPerRequest` reconnect attempts — hundreds
+    // of milliseconds on every cache hit, on the tool-call path. Unknown version
+    // means "serve the cached entry", which is what the cache did before the
+    // version existed. The miss path below still connects lazily, so a reachable
+    // Valkey reaches `ready` on the first fetch.
+    if (valkey.status !== 'ready')
+        return undefined;
+    try {
+        const raw = await valkey.get(configVersionKey(workspaceId));
+        if (raw === null)
+            return undefined;
+        const n = Number(raw);
+        return Number.isFinite(n) ? n : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 // Simple LRU map (insertion-order eviction)
 const lru = new Map();
 function evictIfFull() {
@@ -35,24 +58,127 @@ function evictIfFull() {
 function isStale(entry) {
     return Date.now() - entry.cachedAt > getPolicyTtlMs();
 }
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Validates a `GET /api/v1/policy/resolve` body. The response is `unknown` at
+ * this boundary — it crosses the network — so every field is checked rather
+ * than asserted. Returns null when the body is not JSON or not an object;
+ * individual fields fall back to their empty value.
+ *
+ * `allowedTools`/`toolDescriptionOverrides`/`allowedServers` default to
+ * `[]`/`{}`/`[]` when absent — both because an older control plane may not
+ * send them yet, and because absent is this policy's existing convention for
+ * "unrestricted" (see `packages/mcp-proxy/src/policy.ts`'s `absorbCuration`).
+ */
+function parsePolicyResponse(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!isRecord(parsed))
+        return null;
+    const sopRules = parsed['sopRules'];
+    const dlpPatterns = parsed['dlpPatterns'];
+    const interventionMode = parsed['interventionMode'];
+    const allowedTools = parsed['allowedTools'];
+    const toolDescriptionOverrides = parsed['toolDescriptionOverrides'];
+    const allowedServers = parsed['allowedServers'];
+    const mcpInjectionAction = parsed['mcpInjectionAction'];
+    const mcpInjectionPatterns = parsed['mcpInjectionPatterns'];
+    const mcpAnomalyMode = parsed['mcpAnomalyMode'];
+    const mcpAnomalyOverridesRaw = parsed['mcpAnomalyOverrides'];
+    return {
+        sopRules: Array.isArray(sopRules) ? sopRules.filter(isRecord) : [],
+        dlpPatterns: Array.isArray(dlpPatterns)
+            ? dlpPatterns.filter((p) => typeof p === 'string')
+            : [],
+        // 'TRANSPARENT', matching every other default in this pipeline: the
+        // resolve route's own fallback (services/control-plane/src/routes/
+        // evaluate.ts), the schema default on pcas_policies.intervention_mode,
+        // and this module's snapshot-seed path below. The old default here was
+        // 'BYPASS', which is not an intervention_mode_type value at all — a
+        // fabricated mode no other component recognises.
+        interventionMode: typeof interventionMode === 'string' ? interventionMode : 'TRANSPARENT',
+        allowedTools: Array.isArray(allowedTools)
+            ? allowedTools.filter((t) => typeof t === 'string')
+            : [],
+        toolDescriptionOverrides: isRecord(toolDescriptionOverrides)
+            ? Object.fromEntries(Object.entries(toolDescriptionOverrides).filter((entry) => typeof entry[1] === 'string'))
+            : {},
+        allowedServers: Array.isArray(allowedServers)
+            ? allowedServers.filter((s) => typeof s === 'string')
+            : [],
+        mcpInjectionAction: mcpInjectionAction === 'warn' || mcpInjectionAction === 'block' ? mcpInjectionAction : undefined,
+        mcpInjectionPatterns: Array.isArray(mcpInjectionPatterns)
+            ? mcpInjectionPatterns.filter((p) => typeof p === 'string')
+            : [],
+        mcpAnomalyMode: mcpAnomalyMode === 'enforce' || mcpAnomalyMode === 'warn' || mcpAnomalyMode === 'off'
+            ? mcpAnomalyMode
+            : undefined,
+        mcpAnomalyOverrides: isRecord(mcpAnomalyOverridesRaw)
+            ? Object.fromEntries(Object.entries(mcpAnomalyOverridesRaw).filter((entry) => entry[1] === 'steer' || entry[1] === 'reask' || entry[1] === 'kill' || entry[1] === 'off'))
+            : {},
+    };
+}
 async function fetchFromControlPlane(workspaceId) {
+    // Read BEFORE the fetch: a bump that lands during the request is then seen
+    // as "changed" on the next hit and refetched, never missed.
+    const versionAtFetch = await readConfigVersion(workspaceId);
     return new Promise((resolve) => {
         const path = `/api/v1/policy/resolve?workspaceId=${encodeURIComponent(workspaceId)}`;
         const url = new URL(path, getCpUrl());
         const lib = url.protocol === 'https:' ? https : http;
         const req = lib.request({ hostname: url.hostname, port: url.port, path: url.pathname + url.search, method: 'GET',
             headers: { 'Authorization': `Bearer ${getDaemonApiKey()}`, 'Accept': 'application/json' } }, (res) => {
+            // Without an encoding the stream yields Buffers, and `data += chunk`
+            // then stringifies each one in isolation — a multi-byte UTF-8 character
+            // split across a chunk boundary becomes U+FFFD and the JSON.parse below
+            // fails. setEncoding makes the decoder span chunks, which is also what
+            // makes the `chunk: string` annotation true rather than wishful.
+            res.setEncoding('utf8');
+            const statusCode = res.statusCode ?? 0;
             let data = '';
-            res.on('data', (c) => { data += c; });
+            res.on('data', (chunk) => { data += chunk; });
             res.on('end', () => {
-                try {
-                    const parsed = JSON.parse(data);
-                    resolve({ workspaceId, sopRules: parsed.sopRules ?? [], dlpPatterns: parsed.dlpPatterns ?? [],
-                        interventionMode: parsed.interventionMode ?? 'BYPASS', cachedAt: Date.now() });
+                // An error body parses as JSON too. `{"error":"unauthorized"}` used to
+                // become a policy with no sopRules and the parser's fallback
+                // interventionMode (historically the fabricated 'BYPASS', now
+                // 'TRANSPARENT'), which resolvePolicy then cached for the full TTL
+                // and socketServer read as `allowed: true` — an expired daemon key
+                // silently turned enforcement off. A non-2xx is a failure to
+                // resolve, so it returns null, the same as the transport failures
+                // below.
+                if (statusCode < 200 || statusCode >= 300) {
+                    logger.warn({ workspaceId, statusCode }, 'policy_cache.fetch_http_error');
+                    resolve(null);
+                    return;
                 }
-                catch {
+                const parsed = parsePolicyResponse(data);
+                if (!parsed) {
+                    logger.warn({ workspaceId }, 'policy_cache.fetch_unparseable_body');
                     resolve(null);
+                    return;
                 }
+                resolve({
+                    workspaceId,
+                    sopRules: parsed.sopRules,
+                    dlpPatterns: parsed.dlpPatterns,
+                    interventionMode: parsed.interventionMode,
+                    allowedTools: parsed.allowedTools,
+                    toolDescriptionOverrides: parsed.toolDescriptionOverrides,
+                    allowedServers: parsed.allowedServers,
+                    mcpInjectionAction: parsed.mcpInjectionAction,
+                    mcpInjectionPatterns: parsed.mcpInjectionPatterns,
+                    mcpAnomalyMode: parsed.mcpAnomalyMode,
+                    mcpAnomalyOverrides: parsed.mcpAnomalyOverrides,
+                    cachedAt: Date.now(),
+                    configVersion: versionAtFetch,
+                });
             });
         });
         req.on('error', () => resolve(null));
@@ -60,6 +186,97 @@ async function fetchFromControlPlane(workspaceId) {
         req.end();
     });
 }
+/**
+ * Seeds the LRU from the policy snapshot the sync daemon writes locally.
+ *
+ * # What this removes
+ *
+ * `resolvePolicy`'s cold path is a blocking HTTP GET with a 5s socket timeout,
+ * taken on the daemon's first request for a workspace after every restart. The
+ * sync daemon already writes the same policy to
+ * `~/.intutic/hooks/policy-snapshot.json` every cycle, so on the machine's own
+ * workspace that round trip is avoidable.
+ *
+ * # Two things that make the obvious version wrong
+ *
+ * **It reads `sopRules`, not `rules`.** The snapshot carries both. `rules` is the
+ * *gate* projection — patterns rewritten as space-padded EREs, `{source,
+ * severity, subject}`, `warn` rules already dropped. Those pass this module's
+ * `parsePolicyResponse` (it only checks that entries are objects) and are then
+ * rejected wholesale by `isSopRule` in `../policy.ts`, which requires
+ * `toolPattern` and `action`. The result would be a cache that reports entries,
+ * logs nothing above `debug`, and enforces **nothing** — strictly worse than the
+ * blocking fetch, and invisible.
+ *
+ * **`cachedAt` comes from the snapshot, not from now.** Stamping `Date.now()` on
+ * a file written days ago (the sync daemon may be stopped — the snapshot writer
+ * anticipates exactly that) would present stale policy as fresh and suppress the
+ * refresh for a full TTL. Carrying the real write time means a stale snapshot
+ * seeds the cache *and* is immediately recognised as stale, so the first request
+ * returns instantly and triggers a background refresh — which is the actual goal.
+ *
+ * Never throws. This runs inside the daemon's `main()`, whose rejections become
+ * `process.exit(1)`, and the daemon is a KeepAlive LaunchAgent — so a throw here
+ * would be a restart loop rather than an error.
+ *
+ * @returns the workspaceId seeded, or null if nothing usable was found.
+ */
+export async function seedFromSnapshot(snapshotPath) {
+    try {
+        const { readFile } = await import('node:fs/promises');
+        const os = await import('node:os');
+        const path = await import('node:path');
+        const file = snapshotPath ??
+            process.env['INTUTIC_POLICY_SNAPSHOT'] ??
+            path.join(os.homedir(), '.intutic', 'hooks', 'policy-snapshot.json');
+        const parsed = JSON.parse(await readFile(file, 'utf-8'));
+        if (!isRecord(parsed))
+            return null;
+        const workspaceId = parsed['workspaceId'];
+        if (typeof workspaceId !== 'string' || !workspaceId)
+            return null;
+        // Absent `sopRules` means an older snapshot that carries only the gate
+        // projection. Seed nothing rather than seed an empty policy: an empty
+        // policy is indistinguishable from "no rules configured" downstream, and
+        // this path exists to avoid a slow answer, never to invent a wrong one.
+        const raw = parsed['sopRules'];
+        if (!Array.isArray(raw)) {
+            logger.debug({ file }, 'policy_cache.seed_skipped_no_sop_rules');
+            return null;
+        }
+        const generatedAt = parsed['generatedAt'];
+        const cachedAt = typeof generatedAt === 'string' && !Number.isNaN(Date.parse(generatedAt))
+            ? Date.parse(generatedAt)
+            : 0; // unknown age reads as maximally stale, never as fresh
+        const entry = {
+            workspaceId,
+            sopRules: raw.filter(isRecord),
+            dlpPatterns: [],
+            interventionMode: typeof parsed['interventionMode'] === 'string' ? parsed['interventionMode'] : 'TRANSPARENT',
+            // The sync daemon's snapshot (services/sync-daemon/src/lib/policySnapshot.ts)
+            // does not carry MCP curation today — it predates this field and is a
+            // separate `.rules`-gate mechanism, not this module's HTTP/Valkey path.
+            // Default to unrestricted rather than invent a value; the background
+            // HTTP refresh this seed exists to avoid delaying will fill these in on
+            // the next cycle.
+            mcpInjectionPatterns: [],
+            allowedTools: [],
+            toolDescriptionOverrides: {},
+            allowedServers: [],
+            mcpAnomalyOverrides: {},
+            cachedAt,
+        };
+        evictIfFull();
+        lru.set(workspaceId, entry);
+        logger.info({ workspaceId, ruleCount: entry.sopRules.length, ageMs: cachedAt ? Date.now() - cachedAt : null }, 'policy_cache.seeded_from_snapshot');
+        return workspaceId;
+    }
+    catch {
+        // No snapshot, unreadable, or malformed. The cold HTTP path still works;
+        // this is an optimisation, and an optimisation must never be load-bearing.
+        return null;
+    }
+}
 /**
  * Resolves policy for a workspace.
  * Order: LRU (fresh) → LRU (stale, triggers async refresh) → Valkey → HTTP fetch
@@ -67,6 +284,28 @@ async function fetchFromControlPlane(workspaceId) {
 export async function resolvePolicy(workspaceId) {
     const cached = lru.get(workspaceId);
     if (cached && !isStale(cached)) {
+        // A fresh entry is still refetched when the workspace's config version
+        // moved since it was fetched (a guardrail promote/retire bumps it) — one
+        // Valkey GET per hit, the same class of read as the Valkey-backed miss
+        // path below. A failed refetch keeps serving the cached entry.
+        if (cached.configVersion !== undefined) {
+            const current = await readConfigVersion(workspaceId);
+            if (current !== undefined && current !== cached.configVersion) {
+                const fresh = await fetchFromControlPlane(workspaceId);
+                if (fresh) {
+                    lru.delete(workspaceId);
+                    evictIfFull();
+                    lru.set(workspaceId, fresh);
+                    try {
+                        await valkey.set(`mcp_daemon:policy:${workspaceId}`, JSON.stringify(fresh), 'PX', getPolicyTtlMs());
+                    }
+                    catch {
+                        // Same reasoning as the stale-refresh branch below.
+                    }
+                    return fresh;
+                }
+            }
+        }
         // Touch for LRU recency
         lru.delete(workspaceId);
         lru.set(workspaceId, cached);
@@ -82,7 +321,14 @@ export async function resolvePolicy(workspaceId) {
                 try {
                     await valkey.set(`mcp_daemon:policy:${workspaceId}`, JSON.stringify(fresh), 'PX', getPolicyTtlMs());
                 }
-                catch { }
+                catch {
+                    // Valkey unreachable. This write only shares the refreshed policy
+                    // with sibling daemons; the in-process LRU above already holds it,
+                    // so resolution stays correct and the peers simply take an HTTP miss.
+                    // Deliberately not logged — this runs on a background refresh every
+                    // TTL per workspace and would flood the log while Valkey is down.
+                    // The connection-level 'error' handler above reports the outage once.
+                }
             }
         });
         return cached;
@@ -91,13 +337,31 @@ export async function resolvePolicy(workspaceId) {
     try {
         const valkeyCached = await valkey.get(`mcp_daemon:policy:${workspaceId}`);
         if (valkeyCached) {
-            const parsed = JSON.parse(valkeyCached);
+            // Cast, not validated — this is our own prior write, not a network
+            // boundary. But an entry written before this field existed is still a
+            // valid prior write of an older shape, so the three curation fields
+            // are normalized rather than trusted blindly off the cast.
+            const raw = JSON.parse(valkeyCached);
+            const parsed = {
+                ...raw,
+                allowedTools: Array.isArray(raw.allowedTools) ? raw.allowedTools : [],
+                toolDescriptionOverrides: isRecord(raw.toolDescriptionOverrides) ? raw.toolDescriptionOverrides : {},
+                allowedServers: Array.isArray(raw.allowedServers) ? raw.allowedServers : [],
+                mcpInjectionPatterns: Array.isArray(raw.mcpInjectionPatterns) ? raw.mcpInjectionPatterns : [],
+                mcpAnomalyOverrides: isRecord(raw.mcpAnomalyOverrides) ? raw.mcpAnomalyOverrides : {},
+            };
             evictIfFull();
             lru.set(workspaceId, parsed);
             return parsed;
         }
     }
-    catch { }
+    catch {
+        // Valkey unreachable, or the cached value is not parseable JSON (written
+        // by an older ResolvedPolicy shape). Either way this is only a cache tier:
+        // falling through to the control-plane fetch below yields the same answer,
+        // just slower. Swallowing here is what keeps the daemon serving policy
+        // during a Valkey outage.
+    }
     // Cache miss in Valkey too — fetch synchronously
     logger.debug({ workspaceId }, 'policy_cache.miss');
     const fresh = await fetchFromControlPlane(workspaceId);
@@ -107,7 +371,12 @@ export async function resolvePolicy(workspaceId) {
         try {
             await valkey.set(`mcp_daemon:policy:${workspaceId}`, JSON.stringify(fresh), 'PX', getPolicyTtlMs());
         }
-        catch { }
+        catch {
+            // Valkey unreachable. Write-through to the shared tier is an
+            // optimisation, not a correctness step: `fresh` is already in the LRU
+            // and is returned below. Failing the caller's policy resolution because
+            // a cache write failed would take the daemon down with Valkey.
+        }
     }
     return fresh;
 }

package/dist/daemon/policyCache.js.map

@@ -1 +1 @@
-{"version":3,"file":"policyCache.js","sourceRoot":"","sources":["../../src/daemon/policyCache.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,MAAM,YAAY,CAAA;AAC9B,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,MAAM,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAEpD,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,QAAQ,EAAE,EAAE,CAAC,CAAA;AAC9F,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,KAAK,EAAK,EAAE,CAAC,CAAA;AACjG,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,uBAAuB,CAAA;AAClF,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAM,EAAE,CAAA;AAEpE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,wBAAwB,CAAA;AACpG,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,UAAU,EAAE;IACnC,WAAW,EAAE,IAAI;IACjB,oBAAoB,EAAE,CAAC;CACxB,CAAC,CAAA;AAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAQ,EAAE,EAAE;IAC9B,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,qCAAqC,CAAC,CAAA;AAC1E,CAAC,CAAC,CAAA;AAUF,4CAA4C;AAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,EAA0B,CAAA;AAE7C,SAAS,WAAW;IAClB,IAAI,GAAG,CAAC,IAAI,IAAI,aAAa,EAAE,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAA;QAClD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACtB,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAqB;IACpC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,GAAG,cAAc,EAAE,CAAA;AACvD,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,WAAmB;IACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,sCAAsC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAA;QACpF,MAAM,GAAG,GAAI,IAAI,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QACtC,MAAM,GAAG,GAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;QACrD,MAAM,GAAG,GAAI,GAAG,CAAC,OAAO,CACtB,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK;YACtF,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,eAAe,EAAE,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,EAAE,EAC7F,CAAC,GAAQ,EAAE,EAAE;YACX,IAAI,IAAI,GAAG,EAAE,CAAA;YACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,IAAI,IAAI,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YAC5C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAA;oBAC1D,OAAO,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;wBAC3F,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;gBAClF,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAAC,CAAC;YAC3B,CAAC,CAAC,CAAA;QACJ,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QACpC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QAC5D,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,WAAmB;IACrD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IAEnC,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,wBAAwB;QACxB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QACvB,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QAC5B,OAAO,MAAM,CAAA;IACf,CAAC;IAED,IAAI,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,sCAAsC;QACtC,KAAK,qBAAqB,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC3D,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;gBACvB,WAAW,EAAE,CAAA;gBACb,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;gBAC3B,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,GAAG,CAAC,qBAAqB,WAAW,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;gBACrG,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IAED,mCAAmC;IACnC,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,qBAAqB,WAAW,EAAE,CAAC,CAAA;QACzE,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAmB,CAAA;YACzD,WAAW,EAAE,CAAA;YACb,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;YAC5B,OAAO,MAAM,CAAA;QACf,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,iDAAiD;IACjD,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,EAAE,mBAAmB,CAAC,CAAA;IAClD,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,WAAW,CAAC,CAAA;IACtD,IAAI,KAAK,EAAE,CAAC;QACV,WAAW,EAAE,CAAA;QACb,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,GAAG,CAAC,qBAAqB,WAAW,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;QACrG,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACvB,MAAM,CAAC,GAAG,CAAC,qBAAqB,WAAW,EAAE,EAAE,wBAAwB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACrG,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,0BAA0B,CAAC,CAAA;AAC1D,CAAC;AAED,gCAAgC;AAChC,MAAM,UAAU,aAAa;IAC3B,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAA,CAAC,4CAA4C;AACvF,CAAC"}
+{"version":3,"file":"policyCache.js","sourceRoot":"","sources":["../../src/daemon/policyCache.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,MAAM,YAAY,CAAA;AAC9B,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,MAAM,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAEpD,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,QAAQ,EAAE,EAAE,CAAC,CAAA;AAC9F,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,KAAK,EAAK,EAAE,CAAC,CAAA;AACjG,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,uBAAuB,CAAA;AAClF,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAM,EAAE,CAAA;AAEpE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,wBAAwB,CAAA;AACpG,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,UAAU,EAAE;IACnC,WAAW,EAAE,IAAI;IACjB,oBAAoB,EAAE,CAAC;CACxB,CAAC,CAAA;AAGF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;IAChC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,uBAAuB,CAAC,GAAG,CAAC,EAAE,EAAE,qCAAqC,CAAC,CAAA;AAC3F,CAAC,CAAC,CAAA;AAyDF,8FAA8F;AAC9F,MAAM,gBAAgB,GAAG,CAAC,WAAmB,EAAE,EAAE,CAAC,0BAA0B,WAAW,EAAE,CAAA;AAEzF,KAAK,UAAU,iBAAiB,CAAC,WAAmB;IAClD,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,6CAA6C;IAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,SAAS,CAAA;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAA;QAC3D,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAClC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QACrB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,4CAA4C;AAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,EAA0B,CAAA;AAE7C,SAAS,WAAW;IAClB,IAAI,GAAG,CAAC,IAAI,IAAI,aAAa,EAAE,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAA;QAClD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACtB,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAqB;IACpC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,GAAG,cAAc,EAAE,CAAA;AACvD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAiBD;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAElC,MAAM,QAAQ,GAAoB,MAAM,CAAC,UAAU,CAAC,CAAA;IACpD,MAAM,WAAW,GAAiB,MAAM,CAAC,aAAa,CAAC,CAAA;IACvD,MAAM,gBAAgB,GAAY,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAC5D,MAAM,YAAY,GAAgB,MAAM,CAAC,cAAc,CAAC,CAAA;IACxD,MAAM,wBAAwB,GAAI,MAAM,CAAC,0BAA0B,CAAC,CAAA;IACpE,MAAM,cAAc,GAAc,MAAM,CAAC,gBAAgB,CAAC,CAAA;IAC1D,MAAM,kBAAkB,GAAU,MAAM,CAAC,oBAAoB,CAAC,CAAA;IAC9D,MAAM,oBAAoB,GAAQ,MAAM,CAAC,sBAAsB,CAAC,CAAA;IAChE,MAAM,cAAc,GAAc,MAAM,CAAC,gBAAgB,CAAC,CAAA;IAC1D,MAAM,sBAAsB,GAAM,MAAM,CAAC,qBAAqB,CAAC,CAAA;IAE/D,OAAO;QACL,QAAQ,EAAK,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;QACrE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;YACrC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAC/D,CAAC,CAAC,EAAE;QACN,oEAAoE;QACpE,mEAAmE;QACnE,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,iDAAiD;QACjD,gBAAgB,EAAE,OAAO,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa;QACzF,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;YACvC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAChE,CAAC,CAAC,EAAE;QACN,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB,CAAC;YAC1D,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAC7C,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CACnE,CACF;YACH,CAAC,CAAC,EAAE;QACN,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;YAC3C,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAClE,CAAC,CAAC,EAAE;QACN,kBAAkB,EAChB,kBAAkB,KAAK,MAAM,IAAI,kBAAkB,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;QAClG,oBAAoB,EAAE,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;YACvD,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACxE,CAAC,CAAC,EAAE;QACN,cAAc,EACZ,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,MAAM,IAAI,cAAc,KAAK,KAAK;YACnF,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,SAAS;QACf,mBAAmB,EAAE,QAAQ,CAAC,sBAAsB,CAAC;YACnD,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAC3C,CAAC,KAAK,EAAyD,EAAE,CAC/D,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAC5F,CACF;YACH,CAAC,CAAC,EAAE;KACP,CAAA;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,WAAmB;IACtD,2EAA2E;IAC3E,4DAA4D;IAC5D,MAAM,cAAc,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,CAAA;IAC3D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,sCAAsC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAA;QACpF,MAAM,GAAG,GAAI,IAAI,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QACtC,MAAM,GAAG,GAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;QACrD,MAAM,GAAG,GAAI,GAAG,CAAC,OAAO,CACtB,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK;YACtF,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,eAAe,EAAE,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,EAAE,EAC7F,CAAC,GAAyB,EAAE,EAAE;YAC5B,qEAAqE;YACrE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,iEAAiE;YACjE,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;YACvB,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAA;YACtC,IAAI,IAAI,GAAG,EAAE,CAAA;YACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAA,CAAC,CAAC,CAAC,CAAA;YACpD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,uEAAuE;gBACvE,6DAA6D;gBAC7D,8DAA8D;gBAC9D,mEAAmE;gBACnE,mEAAmE;gBACnE,6DAA6D;gBAC7D,kEAAkE;gBAClE,SAAS;gBACT,IAAI,UAAU,GAAG,GAAG,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;oBAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,+BAA+B,CAAC,CAAA;oBACzE,OAAO,CAAC,IAAI,CAAC,CAAA;oBACb,OAAM;gBACR,CAAC;gBACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;gBACxC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,qCAAqC,CAAC,CAAA;oBACnE,OAAO,CAAC,IAAI,CAAC,CAAA;oBACb,OAAM;gBACR,CAAC;gBACD,OAAO,CAAC;oBACN,WAAW;oBACX,QAAQ,EAAU,MAAM,CAAC,QAAQ;oBACjC,WAAW,EAAO,MAAM,CAAC,WAAW;oBACpC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;oBACzC,YAAY,EAAM,MAAM,CAAC,YAAY;oBACrC,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;oBACzD,cAAc,EAAI,MAAM,CAAC,cAAc;oBACvC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;oBAC7C,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;oBACjD,cAAc,EAAI,MAAM,CAAC,cAAc;oBACvC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;oBAC/C,QAAQ,EAAU,IAAI,CAAC,GAAG,EAAE;oBAC5B,aAAa,EAAK,cAAc;iBACjC,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACJ,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QACpC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QAC5D,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,YAAqB;IAC1D,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAA;QACrD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAA;QACtC,MAAM,IAAI,GACR,YAAY;YACZ,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAA;QAEtE,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;QACjE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAA;QAElC,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;QACzC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAA;QAEhE,uEAAuE;QACvE,sEAAsE;QACtE,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAA;QAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,wCAAwC,CAAC,CAAA;YAChE,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;QACzC,MAAM,QAAQ,GACZ,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACvE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;YACzB,CAAC,CAAC,CAAC,CAAA,CAAC,uDAAuD;QAE/D,MAAM,KAAK,GAAmB;YAC5B,WAAW;YACX,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC9B,WAAW,EAAE,EAAE;YACf,gBAAgB,EACd,OAAO,MAAM,CAAC,kBAAkB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,aAAa;YAC7F,8EAA8E;YAC9E,sEAAsE;YACtE,wEAAwE;YACxE,qEAAqE;YACrE,wEAAwE;YACxE,kBAAkB;YAClB,oBAAoB,EAAE,EAAE;YACxB,YAAY,EAAE,EAAE;YAChB,wBAAwB,EAAE,EAAE;YAC5B,cAAc,EAAE,EAAE;YAClB,mBAAmB,EAAE,EAAE;YACvB,QAAQ;SACT,CAAA;QAED,WAAW,EAAE,CAAA;QACb,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QAC3B,MAAM,CAAC,IAAI,CACT,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EACjG,mCAAmC,CACpC,CAAA;QACD,OAAO,WAAW,CAAA;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,2EAA2E;QAC3E,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,WAAmB;IACrD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IAEnC,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,+DAA+D;QAC/D,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,CAAA;YACpD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC9D,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,WAAW,CAAC,CAAA;gBACtD,IAAI,KAAK,EAAE,CAAC;oBACV,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;oBACvB,WAAW,EAAE,CAAA;oBACb,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;oBAC3B,IAAI,CAAC;wBACH,MAAM,MAAM,CAAC,GAAG,CAAC,qBAAqB,WAAW,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;oBACrG,CAAC;oBAAC,MAAM,CAAC;wBACP,oDAAoD;oBACtD,CAAC;oBACD,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QACD,wBAAwB;QACxB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QACvB,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QAC5B,OAAO,MAAM,CAAA;IACf,CAAC;IAED,IAAI,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,sCAAsC;QACtC,KAAK,qBAAqB,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC3D,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;gBACvB,WAAW,EAAE,CAAA;gBACb,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;gBAC3B,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,GAAG,CAAC,qBAAqB,WAAW,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;gBACrG,CAAC;gBAAC,MAAM,CAAC;oBACP,kEAAkE;oBAClE,mEAAmE;oBACnE,sEAAsE;oBACtE,oEAAoE;oBACpE,kEAAkE;oBAClE,sEAAsE;gBACxE,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IAED,mCAAmC;IACnC,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,qBAAqB,WAAW,EAAE,CAAC,CAAA;QACzE,IAAI,YAAY,EAAE,CAAC;YACjB,mEAAmE;YACnE,sEAAsE;YACtE,oEAAoE;YACpE,2DAA2D;YAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CACiE,CAAA;YACpG,MAAM,MAAM,GAAmB;gBAC7B,GAAG,GAAG;gBACN,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;gBACrE,wBAAwB,EAAE,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE;gBACpG,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE;gBAC3E,oBAAoB,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE;gBAC7F,mBAAmB,EAAE,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE;aACtF,CAAA;YACD,WAAW,EAAE,CAAA;YACb,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;YAC5B,OAAO,MAAM,CAAA;QACf,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,2EAA2E;QAC3E,2EAA2E;QAC3E,uEAAuE;QACvE,0BAA0B;IAC5B,CAAC;IAED,iDAAiD;IACjD,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,EAAE,mBAAmB,CAAC,CAAA;IAClD,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,WAAW,CAAC,CAAA;IACtD,IAAI,KAAK,EAAE,CAAC;QACV,WAAW,EAAE,CAAA;QACb,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,GAAG,CAAC,qBAAqB,WAAW,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;QACrG,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;YAC7D,sEAAsE;YACtE,wEAAwE;YACxE,+DAA+D;QACjE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACvB,MAAM,CAAC,GAAG,CAAC,qBAAqB,WAAW,EAAE,EAAE,wBAAwB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACrG,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,0BAA0B,CAAC,CAAA;AAC1D,CAAC;AAED,gCAAgC;AAChC,MAAM,UAAU,aAAa;IAC3B,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAA,CAAC,4CAA4C;AACvF,CAAC"}

package/dist/daemon/statusReporter.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Starts periodic status reporting. A daemon with no workspace credential
+ * stays silent — an unauthenticated report would only ever 401, which is the
+ * 404-heartbeat failure mode this module exists to not repeat.
+ */
+export declare function startStatusReporter(): void;
+/**
+ * Stops the timer and sends a final `running: false` snapshot so the dashboard
+ * flips promptly on clean shutdown instead of waiting out the TTL.
+ */
+export declare function stopStatusReporter(): Promise<void>;
+//# sourceMappingURL=statusReporter.d.ts.map

package/dist/daemon/statusReporter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"statusReporter.d.ts","sourceRoot":"","sources":["../../src/daemon/statusReporter.ts"],"names":[],"mappings":"AAoGA;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAiB1C;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CASxD"}

package/dist/daemon/statusReporter.js

@@ -0,0 +1,130 @@
+/**
+ * MCP Daemon Status Reporter — periodic upload to the control plane.
+ *
+ * The predecessor of this module (uploadSnapshots in healthMonitor.ts, removed
+ * in 514eff7c) POSTed to /api/v1/mcp-daemon/health-snapshot, a route that never
+ * existed in the control plane, so every heartbeat 404'd. Its removal note said
+ * "restore an ingest route before re-adding an upload" — the ingest route now
+ * exists (`POST /api/v1/mcp-daemon/report`), and this is the upload half.
+ *
+ * The workspace credential is attached ONLY to the control-plane request, never
+ * to the per-server probes in healthMonitor.ts — those hit third-party MCP
+ * servers named in the user's local harness config, and forwarding the Intutic
+ * key there would send it to hosts Intutic does not control.
+ *
+ * Reporting is best-effort and quiet: a control plane that is briefly down
+ * costs one snapshot (TTL on the stored key makes staleness self-describing —
+ * the dashboard reads an expired key as "not running"). No retry ladder, no
+ * disk buffer: unlike hook events, a status snapshot is worthless once the next
+ * one exists.
+ *
+ * LLD #28: MCP Daemon Mode, WS-5MCP
+ * @module
+ */
+import https from 'node:https';
+import http from 'node:http';
+import { createLogger } from '@intutic/logger';
+import { getHealthSnapshot } from './healthMonitor.js';
+import { getCacheStats } from './policyCache.js';
+import { pendingCount } from './telemetryBatcher.js';
+import { loadPin } from '../tofu.js';
+const logger = createLogger('mcp-proxy.statusReporter');
+const CP_URL = process.env['CONTROL_PLANE_URL'] ?? 'http://localhost:3001';
+const DAEMON_API_KEY = process.env['INTUTIC_API_KEY'] ?? '';
+// Same env var config.ts's loadConfig reads as a fallback for workspaceId
+// (INTUTIC_WORKSPACE_ID, written to ~/.intutic/env/runtime.env by the
+// sync-daemon). A daemon process is scoped to one workspace, so this module
+// reads it directly rather than threading it through every call.
+const WORKSPACE_ID = process.env['INTUTIC_WORKSPACE_ID'] ?? '';
+const REPORT_MS = parseInt(process.env['MCP_DAEMON_STATUS_REPORT_MS'] ?? '60000', 10);
+const startedAt = new Date().toISOString();
+let timer = null;
+/**
+ * Enriches each health-probed server with its current TOFU pin fingerprint
+ * (tofu.ts), read from the same local `~/.intutic/mcp-pins/` files the proxy
+ * itself pins to — so `mcp_servers.pin_fingerprint` (Part 3's ingest upsert)
+ * can eventually be cross-referenced with fingerprint history, even though
+ * building that cross-referencing view is explicitly out of scope for this
+ * phase. `harness`/`transport` are NOT attached here: healthMonitor.ts's
+ * `discoverServers` merges servers across harness config paths without
+ * recording which one a given entry came from, so there is no honest value
+ * to report yet — omitted (optional on the wire schema) rather than guessed.
+ */
+async function buildMcpServersPayload() {
+    const health = getHealthSnapshot();
+    if (!WORKSPACE_ID)
+        return health;
+    return Promise.all(health.map(async (server) => {
+        const pin = await loadPin(WORKSPACE_ID, server.serverName).catch(() => null);
+        return pin ? { ...server, pinFingerprint: pin.fingerprint } : server;
+    }));
+}
+async function buildSnapshot(running) {
+    return JSON.stringify({
+        running,
+        policyCache: getCacheStats(),
+        telemetryBuffer: { pending: pendingCount() },
+        mcpServers: await buildMcpServersPayload(),
+        startedAt,
+    });
+}
+function postReport(body) {
+    const url = new URL('/api/v1/mcp-daemon/report', CP_URL);
+    const lib = url.protocol === 'https:' ? https : http;
+    return new Promise((resolve, reject) => {
+        const req = lib.request({ hostname: url.hostname, port: url.port, path: url.pathname, method: 'POST',
+            headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body),
+                'Authorization': `Bearer ${DAEMON_API_KEY}` } }, (res) => {
+            res.resume();
+            if (res.statusCode && res.statusCode < 400)
+                resolve();
+            else
+                reject(new Error(`HTTP ${res.statusCode}`));
+        });
+        req.on('error', reject);
+        req.setTimeout(5000, () => { req.destroy(); reject(new Error('timeout')); });
+        req.write(body);
+        req.end();
+    });
+}
+/**
+ * Starts periodic status reporting. A daemon with no workspace credential
+ * stays silent — an unauthenticated report would only ever 401, which is the
+ * 404-heartbeat failure mode this module exists to not repeat.
+ */
+export function startStatusReporter() {
+    if (DAEMON_API_KEY.length === 0) {
+        logger.info('status_reporter.disabled_no_api_key');
+        return;
+    }
+    const report = () => {
+        buildSnapshot(true)
+            .then((body) => postReport(body))
+            .catch((err) => {
+            logger.debug({ err: err instanceof Error ? err.message : String(err) }, 'status_reporter.report_failed');
+        });
+    };
+    report(); // First snapshot immediately — the panel should not wait a full interval.
+    timer = setInterval(report, REPORT_MS);
+    timer.unref();
+}
+/**
+ * Stops the timer and sends a final `running: false` snapshot so the dashboard
+ * flips promptly on clean shutdown instead of waiting out the TTL.
+ */
+export async function stopStatusReporter() {
+    if (timer) {
+        clearInterval(timer);
+        timer = null;
+    }
+    if (DAEMON_API_KEY.length === 0)
+        return;
+    try {
+        const body = await buildSnapshot(false);
+        await postReport(body);
+    }
+    catch {
+        // Shutdown path — the TTL covers an unreachable control plane.
+    }
+}
+//# sourceMappingURL=statusReporter.js.map

package/dist/daemon/statusReporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"statusReporter.js","sourceRoot":"","sources":["../../src/daemon/statusReporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,MAAM,YAAY,CAAA;AAC9B,OAAO,IAAI,MAAO,WAAW,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAEpC,MAAM,MAAM,GAAG,YAAY,CAAC,0BAA0B,CAAC,CAAA;AAEvD,MAAM,MAAM,GAAW,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,uBAAuB,CAAA;AAClF,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAM,EAAE,CAAA;AAC7D,0EAA0E;AAC1E,sEAAsE;AACtE,4EAA4E;AAC5E,iEAAiE;AACjE,MAAM,YAAY,GAAK,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAA;AAChE,MAAM,SAAS,GAAQ,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,IAAI,OAAO,EAAE,EAAE,CAAC,CAAA;AAE1F,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;AAC1C,IAAI,KAAK,GAA0C,IAAI,CAAA;AAEvD;;;;;;;;;;GAUG;AACH,KAAK,UAAU,sBAAsB;IACnC,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAA;IAClC,IAAI,CAAC,YAAY;QAAE,OAAO,MAAM,CAAA;IAEhC,OAAO,OAAO,CAAC,GAAG,CAChB,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC1B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QAC5E,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;IACtE,CAAC,CAAC,CACH,CAAA;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAgB;IAC3C,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO;QACP,WAAW,EAAE,aAAa,EAAE;QAC5B,eAAe,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE;QAC5C,UAAU,EAAE,MAAM,sBAAsB,EAAE;QAC1C,SAAS;KACV,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAA;IACxD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAEpD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CACrB,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM;YAC1E,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;gBAC7E,eAAe,EAAE,UAAU,cAAc,EAAE,EAAE,EAAE,EAC5D,CAAC,GAAG,EAAE,EAAE;YACN,GAAG,CAAC,MAAM,EAAE,CAAA;YACZ,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG;gBAAE,OAAO,EAAE,CAAA;;gBAChD,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;QAClD,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QAC3E,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACf,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAA;QAClD,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,aAAa,CAAC,IAAI,CAAC;aAChB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;aAChC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAA;QAC1G,CAAC,CAAC,CAAA;IACN,CAAC,CAAA;IAED,MAAM,EAAE,CAAA,CAAC,0EAA0E;IACnF,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACtC,KAAK,CAAC,KAAK,EAAE,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,IAAI,KAAK,EAAE,CAAC;QAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAAC,KAAK,GAAG,IAAI,CAAA;IAAC,CAAC;IACjD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAA;QACvC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;AACH,CAAC"}

package/dist/daemon/telemetryBatcher.d.ts

@@ -8,8 +8,10 @@ export interface HookEvent {
 }
 /** Enqueues a hook event. Evicts oldest on overflow. */
 export declare function enqueueEvent(event: HookEvent): void;
+/** Events awaiting the next flush. Reported upstream by the status reporter. */
+export declare function pendingCount(): number;
 /** Drains any Valkey or disk buffer from a previous crash, then starts the flush timer. */
 export declare function startBatcher(): void;
-/** Flushes remaining events and stops the timer. */
+/** Flushes remaining events and stops the timer. Never rejects. */
 export declare function stopBatcher(): Promise<void>;
 //# sourceMappingURL=telemetryBatcher.d.ts.map

package/dist/daemon/telemetryBatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"telemetryBatcher.d.ts","sourceRoot":"","sources":["../../src/daemon/telemetryBatcher.ts"],"names":[],"mappings":"AAqCA,MAAM,WAAW,SAAS;IACxB,KAAK,EAAQ,MAAM,CAAA;IACnB,QAAQ,EAAK,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAI,MAAM,CAAA;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAMD,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAGnD;AA0DD,2FAA2F;AAC3F,wBAAgB,YAAY,IAAI,IAAI,CA2BnC;AAED,oDAAoD;AACpD,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAGjD"}
+{"version":3,"file":"telemetryBatcher.d.ts","sourceRoot":"","sources":["../../src/daemon/telemetryBatcher.ts"],"names":[],"mappings":"AAuCA,MAAM,WAAW,SAAS;IACxB,KAAK,EAAQ,MAAM,CAAA;IACnB,QAAQ,EAAK,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAI,MAAM,CAAA;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAMD,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAGnD;AAED,gFAAgF;AAChF,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAwED,2FAA2F;AAC3F,wBAAgB,YAAY,IAAI,IAAI,CAoDnC;AAED,mEAAmE;AACnE,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAKjD"}