@intutic/mcp-governance-proxy 1.9.0 → 1.10.1

package/dist/tofu.d.ts

@@ -0,0 +1,112 @@
+/**
+ * tofu.ts — Server-level trust-on-first-use (TOFU) pinning of MCP tool
+ * definitions.
+ *
+ * Direct TypeScript port of `packages/proxy/src/tool_pin.rs`'s canonicalization
+ * and hashing rule, extended from "one fingerprint per request's tool array"
+ * to "one fingerprint per {workspace, server} pair" — the shape this proxy
+ * needs, since each `McpGovernanceProxy` process fronts exactly one real MCP
+ * server (identified by `--server-name`, see config.ts) rather than a
+ * multi-provider gateway request.
+ *
+ * ## What this catches, and what it does not
+ *
+ * A tool-providing server declares its tools, and those declarations enter
+ * the model's context as instructions it will follow. Nothing in the MCP
+ * specification requires re-approval when a declaration changes, so a server
+ * can ship benign tools, wait to be trusted, and later serve altered ones —
+ * the "rug pull". The first tool list a workspace sees from a given server is
+ * pinned locally; every later `tools/list` response is compared against it.
+ *
+ * Straight from `tool_pin.rs`'s own doc comment, because it is still exactly
+ * true here: **TOFU is change-detection, not content-detection.** A server
+ * that is malicious from the very first `tools/list` response has its payload
+ * adopted as the trusted baseline — this module cannot help with that. It
+ * only catches a LATER definition change.
+ *
+ * @module
+ */
+/** The subset of a `tools/list` tool entry this module hashes. */
+export interface ToolDefinition {
+    name?: unknown;
+    description?: unknown;
+    inputSchema?: unknown;
+}
+/**
+ * Serialise with object keys sorted, so a re-serialised schema with the same
+ * content hashes identically regardless of property insertion order. Array
+ * order IS preserved — `required`/`enum` are ordered lists, and a rule that
+ * treated them as sets would let a real change (reordered enum values,
+ * different required-field order) hide from the pin. Direct port of
+ * `tool_pin.rs`'s `canonical_json`.
+ */
+export declare function canonicalJson(value: unknown): string;
+/**
+ * Canonical signature of one server's tool list — SHA-256 over the sorted,
+ * canonicalised `{name, description, inputSchema}` triple of every tool.
+ *
+ * Empty string when the server declares no tools, which the caller uses to
+ * skip TOFU entirely rather than pinning an absence (mirrors `tool_pin.rs`'s
+ * `signature`: "no tools yields no signature").
+ *
+ * Sorted by the full canonical per-tool string (name first, so this sorts by
+ * name in practice) so that a server reordering its list does not read as a
+ * change — reordering is not an attack, and a false positive here interrupts
+ * real work for nothing.
+ */
+export declare function computeToolsFingerprint(tools: readonly ToolDefinition[]): string;
+interface PinRecord {
+    fingerprint: string;
+    pinnedAt: string;
+}
+/** Reads the stored pin for a {workspace, server} pair, or `null` if none exists. */
+export declare function loadPin(workspaceId: string, serverName: string): Promise<PinRecord | null>;
+/**
+ * Persists a pin. Called once, on first contact — a pin is never silently
+ * overwritten by a later mismatch (that would defeat the point: the whole
+ * mechanism exists to keep comparing against the FIRST trusted definition,
+ * the same "SET NX, first definition wins" rule `tool_pin.rs` documents).
+ */
+export declare function savePin(workspaceId: string, serverName: string, fingerprint: string): Promise<void>;
+export type TofuOutcome = {
+    status: 'skipped';
+} | {
+    status: 'first_contact';
+    fingerprint: string;
+} | {
+    status: 'match';
+    fingerprint: string;
+} | {
+    status: 'mismatch';
+    fingerprint: string;
+    previousFingerprint: string;
+};
+/**
+ * Runs the full TOFU check for one server's `tools/list` response: compute
+ * the fingerprint, load any existing pin, and report first-contact / match /
+ * mismatch. Does not itself decide whether a mismatch blocks the request —
+ * that is `mcpProxyFailBehavior`'s call, made by the caller (proxy.ts), the
+ * same fail-open/fail-closed mechanism `config.ts`/`interceptor.ts` already
+ * use elsewhere in this package.
+ */
+export declare function checkTofu(workspaceId: string, serverName: string, tools: readonly ToolDefinition[]): Promise<TofuOutcome>;
+/**
+ * Decides whether a `TofuOutcome` should block the `tools/list` request that
+ * produced it, given the workspace's `mcpProxyFailBehavior` — the SAME
+ * `failOpen` boolean `config.ts`/`interceptor.ts` already thread through for
+ * every other governance check in this package, not a new mechanism.
+ *
+ * A pure function, deliberately separated from `checkTofu`'s file I/O and
+ * from `proxy.ts`'s stdout-writing caller, so the fail-open/fail-closed
+ * branching itself — the part with real behavioural consequences — can be
+ * tested without spawning a child process or touching disk.
+ *
+ * Only `'mismatch'` can ever block: `'skipped'` (no tools declared) and
+ * `'first_contact'`/`'match'` are never a reason to refuse a request.
+ */
+export declare function decideTofuAction(outcome: TofuOutcome, serverName: string, failOpen: boolean): {
+    block: boolean;
+    reason?: string;
+};
+export {};
+//# sourceMappingURL=tofu.d.ts.map

package/dist/tofu.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tofu.d.ts","sourceRoot":"","sources":["../src/tofu.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAOH,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAgBpD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAiBhF;AAID,UAAU,SAAS;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAqBD,qFAAqF;AACrF,wBAAsB,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAehG;AAED;;;;;GAKG;AACH,wBAAsB,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKzG;AAID,MAAM,MAAM,WAAW,GACnB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAA;CAAE,CAAA;AAE5E;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAC7B,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,SAAS,cAAc,EAAE,GAC/B,OAAO,CAAC,WAAW,CAAC,CAetB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,OAAO,GAChB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAiBrC"}

package/dist/tofu.js

@@ -0,0 +1,180 @@
+/**
+ * tofu.ts — Server-level trust-on-first-use (TOFU) pinning of MCP tool
+ * definitions.
+ *
+ * Direct TypeScript port of `packages/proxy/src/tool_pin.rs`'s canonicalization
+ * and hashing rule, extended from "one fingerprint per request's tool array"
+ * to "one fingerprint per {workspace, server} pair" — the shape this proxy
+ * needs, since each `McpGovernanceProxy` process fronts exactly one real MCP
+ * server (identified by `--server-name`, see config.ts) rather than a
+ * multi-provider gateway request.
+ *
+ * ## What this catches, and what it does not
+ *
+ * A tool-providing server declares its tools, and those declarations enter
+ * the model's context as instructions it will follow. Nothing in the MCP
+ * specification requires re-approval when a declaration changes, so a server
+ * can ship benign tools, wait to be trusted, and later serve altered ones —
+ * the "rug pull". The first tool list a workspace sees from a given server is
+ * pinned locally; every later `tools/list` response is compared against it.
+ *
+ * Straight from `tool_pin.rs`'s own doc comment, because it is still exactly
+ * true here: **TOFU is change-detection, not content-detection.** A server
+ * that is malicious from the very first `tools/list` response has its payload
+ * adopted as the trusted baseline — this module cannot help with that. It
+ * only catches a LATER definition change.
+ *
+ * @module
+ */
+import * as node_crypto from 'node:crypto';
+import * as node_fs from 'node:fs/promises';
+import * as node_os from 'node:os';
+import * as node_path from 'node:path';
+/**
+ * Serialise with object keys sorted, so a re-serialised schema with the same
+ * content hashes identically regardless of property insertion order. Array
+ * order IS preserved — `required`/`enum` are ordered lists, and a rule that
+ * treated them as sets would let a real change (reordered enum values,
+ * different required-field order) hide from the pin. Direct port of
+ * `tool_pin.rs`'s `canonical_json`.
+ */
+export function canonicalJson(value) {
+    if (Array.isArray(value)) {
+        return `[${value.map(canonicalJson).join(',')}]`;
+    }
+    if (value !== null && typeof value === 'object') {
+        const keys = Object.keys(value).sort();
+        const inner = keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(value[k])}`);
+        return `{${inner.join(',')}}`;
+    }
+    // Scalars (string/number/boolean/null) and undefined: JSON.stringify(undefined)
+    // is the string 'undefined' has no JSON form; normalise it to 'null' so a
+    // missing optional field never produces an unparseable canonical fragment.
+    const serialised = JSON.stringify(value);
+    return serialised === undefined ? 'null' : serialised;
+}
+/**
+ * Canonical signature of one server's tool list — SHA-256 over the sorted,
+ * canonicalised `{name, description, inputSchema}` triple of every tool.
+ *
+ * Empty string when the server declares no tools, which the caller uses to
+ * skip TOFU entirely rather than pinning an absence (mirrors `tool_pin.rs`'s
+ * `signature`: "no tools yields no signature").
+ *
+ * Sorted by the full canonical per-tool string (name first, so this sorts by
+ * name in practice) so that a server reordering its list does not read as a
+ * change — reordering is not an attack, and a false positive here interrupts
+ * real work for nothing.
+ */
+export function computeToolsFingerprint(tools) {
+    if (tools.length === 0)
+        return '';
+    const UNIT_SEP = String.fromCharCode(0x1f);
+    const RECORD_SEP = String.fromCharCode(0x1e);
+    const canonical = tools.map((t) => {
+        const name = typeof t.name === 'string' ? t.name : '';
+        const description = typeof t.description === 'string' ? t.description : '';
+        const schema = t.inputSchema === undefined ? '' : canonicalJson(t.inputSchema);
+        return name + UNIT_SEP + description + UNIT_SEP + schema;
+    });
+    canonical.sort();
+    const hash = node_crypto.createHash('sha256');
+    hash.update(canonical.join(RECORD_SEP));
+    return hash.digest('hex');
+}
+function pinsDir() {
+    return node_path.join(node_os.homedir(), '.intutic', 'mcp-pins');
+}
+/** Filenames are flat, one per {workspace, server} pair — the same flat,
+ *  id-keyed convention `~/.intutic/wasm/<ruleId>.wasm` and
+ *  `<workspaceRoot>/.intutic/sops/<sopId>.md` already use, not a nested
+ *  per-workspace directory tree. Unsafe filename characters (anything but
+ *  alphanumerics, dot, dash, underscore) are replaced so a server name
+ *  containing e.g. `/` cannot escape the pins directory. */
+function sanitizeForFilename(raw) {
+    return raw.replace(/[^a-zA-Z0-9._-]/g, '_');
+}
+function pinFilePath(workspaceId, serverName) {
+    const fileName = `${sanitizeForFilename(workspaceId)}__${sanitizeForFilename(serverName)}.json`;
+    return node_path.join(pinsDir(), fileName);
+}
+/** Reads the stored pin for a {workspace, server} pair, or `null` if none exists. */
+export async function loadPin(workspaceId, serverName) {
+    try {
+        const raw = await node_fs.readFile(pinFilePath(workspaceId, serverName), 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed === 'object' &&
+            parsed !== null &&
+            typeof parsed.fingerprint === 'string') {
+            return parsed;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Persists a pin. Called once, on first contact — a pin is never silently
+ * overwritten by a later mismatch (that would defeat the point: the whole
+ * mechanism exists to keep comparing against the FIRST trusted definition,
+ * the same "SET NX, first definition wins" rule `tool_pin.rs` documents).
+ */
+export async function savePin(workspaceId, serverName, fingerprint) {
+    const dir = pinsDir();
+    await node_fs.mkdir(dir, { recursive: true });
+    const record = { fingerprint, pinnedAt: new Date().toISOString() };
+    await node_fs.writeFile(pinFilePath(workspaceId, serverName), JSON.stringify(record, null, 2) + '\n', 'utf-8');
+}
+/**
+ * Runs the full TOFU check for one server's `tools/list` response: compute
+ * the fingerprint, load any existing pin, and report first-contact / match /
+ * mismatch. Does not itself decide whether a mismatch blocks the request —
+ * that is `mcpProxyFailBehavior`'s call, made by the caller (proxy.ts), the
+ * same fail-open/fail-closed mechanism `config.ts`/`interceptor.ts` already
+ * use elsewhere in this package.
+ */
+export async function checkTofu(workspaceId, serverName, tools) {
+    const fingerprint = computeToolsFingerprint(tools);
+    if (fingerprint === '')
+        return { status: 'skipped' };
+    const existing = await loadPin(workspaceId, serverName);
+    if (!existing) {
+        await savePin(workspaceId, serverName, fingerprint);
+        return { status: 'first_contact', fingerprint };
+    }
+    if (existing.fingerprint === fingerprint) {
+        return { status: 'match', fingerprint };
+    }
+    return { status: 'mismatch', fingerprint, previousFingerprint: existing.fingerprint };
+}
+/**
+ * Decides whether a `TofuOutcome` should block the `tools/list` request that
+ * produced it, given the workspace's `mcpProxyFailBehavior` — the SAME
+ * `failOpen` boolean `config.ts`/`interceptor.ts` already thread through for
+ * every other governance check in this package, not a new mechanism.
+ *
+ * A pure function, deliberately separated from `checkTofu`'s file I/O and
+ * from `proxy.ts`'s stdout-writing caller, so the fail-open/fail-closed
+ * branching itself — the part with real behavioural consequences — can be
+ * tested without spawning a child process or touching disk.
+ *
+ * Only `'mismatch'` can ever block: `'skipped'` (no tools declared) and
+ * `'first_contact'`/`'match'` are never a reason to refuse a request.
+ */
+export function decideTofuAction(outcome, serverName, failOpen) {
+    if (outcome.status !== 'mismatch')
+        return { block: false };
+    const reason = `MCP server "${serverName}"'s tool definitions changed since they were first pinned ` +
+        `(possible supply-chain "rug pull"). TOFU detects the change; it cannot tell whether ` +
+        `the new definitions are malicious. An operator can review the server and, if the ` +
+        `change is legitimate, remove its stale pin file under ~/.intutic/mcp-pins/ to re-pin.`;
+    if (failOpen)
+        return { block: false, reason };
+    return {
+        block: true,
+        reason: `${reason} Blocked by workspace policy (fail-closed mode). Contact your ` +
+            `administrator or update mcpProxyFailBehavior to open.`,
+    };
+}
+//# sourceMappingURL=tofu.js.map

package/dist/tofu.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tofu.js","sourceRoot":"","sources":["../src/tofu.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,WAAW,MAAM,aAAa,CAAA;AAC1C,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AAStC;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAClD,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,CAAA;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,aAAa,CAAE,KAAiC,CAAC,CAAC,CAAC,CAAC,EAAE,CACtF,CAAA;QACD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAC/B,CAAC;IACD,gFAAgF;IAChF,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACxC,OAAO,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;AACvD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAgC;IACtE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAEjC,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IAC1C,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IAE5C,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;QACrD,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAA;QAC1E,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;QAC9E,OAAO,IAAI,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC1D,CAAC,CAAC,CAAA;IACF,SAAS,CAAC,IAAI,EAAE,CAAA;IAEhB,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;IAC7C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;IACvC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC;AASD,SAAS,OAAO;IACd,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;AAClE,CAAC;AAED;;;;;4DAK4D;AAC5D,SAAS,mBAAmB,CAAC,GAAW;IACtC,OAAO,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAA;AAC7C,CAAC;AAED,SAAS,WAAW,CAAC,WAAmB,EAAE,UAAkB;IAC1D,MAAM,QAAQ,GAAG,GAAG,mBAAmB,CAAC,WAAW,CAAC,KAAK,mBAAmB,CAAC,UAAU,CAAC,OAAO,CAAA;IAC/F,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAA;AAC5C,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,WAAmB,EAAE,UAAkB;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAA;QACjF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAA;QACzC,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,OAAQ,MAAoB,CAAC,WAAW,KAAK,QAAQ,EACrD,CAAC;YACD,OAAO,MAAmB,CAAA;QAC5B,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,WAAmB,EAAE,UAAkB,EAAE,WAAmB;IACxF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAA;IACrB,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,MAAM,MAAM,GAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAA;IAC7E,MAAM,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;AAChH,CAAC;AAUD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,WAAmB,EACnB,UAAkB,EAClB,KAAgC;IAEhC,MAAM,WAAW,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAA;IAClD,IAAI,WAAW,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAEpD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;IACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,OAAO,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC,CAAA;QACnD,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,CAAA;IACjD,CAAC;IAED,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QACzC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;IACzC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,mBAAmB,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAA;AACvF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAoB,EACpB,UAAkB,EAClB,QAAiB;IAEjB,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IAE1D,MAAM,MAAM,GACV,eAAe,UAAU,4DAA4D;QACrF,sFAAsF;QACtF,mFAAmF;QACnF,uFAAuF,CAAA;IAEzF,IAAI,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IAE7C,OAAO;QACL,KAAK,EAAE,IAAI;QACX,MAAM,EACJ,GAAG,MAAM,gEAAgE;YACzE,uDAAuD;KAC1D,CAAA;AACH,CAAC"}

package/dist/toolPoison.d.ts

@@ -0,0 +1,32 @@
+/**
+ * toolPoison.ts — Tool-description poisoning patterns.
+ *
+ * Direct TypeScript port of `packages/proxy/src/tool_poison.rs`'s `scan`
+ * function and its seven named patterns (confirmed by reading that file
+ * directly). This is a SEPARATE pattern set from `injection.ts`, on purpose:
+ * `tool_poison.rs`'s own module doc records that it tried reusing
+ * `injection::scan` for this and measured that its five patterns match ZERO
+ * of the tool-poisoning payloads — they are tuned for conversational
+ * jailbreak phrasing ("ignore previous instructions"), while a poisoned tool
+ * description reads like documentation, not a jailbreak. `ToolPoisoningDetector`
+ * (Phase 2's `anomaly/detectors.ts`) is what consumes this module.
+ *
+ * The Rust source gates each pattern behind a cheap substring pre-check
+ * (`GATES`) before running the regex, measured to be ~1.8× faster than the
+ * regex alone on their corpus. That optimization is NOT ported here — it is
+ * a performance detail proven equivalent to the plain regex loop (the Rust
+ * module's own `gating_never_changes_a_verdict` test asserts exactly that
+ * equivalence), never a correctness one, and the volume of tool descriptions
+ * one MCP session evaluates is orders of magnitude below the Rust proxy's
+ * request-path corpus. The pattern SOURCE TEXT below is unchanged from the
+ * Rust `PATTERNS` array — only the verbatim regex text is what was actually
+ * measured, so preserving it exactly (not the gate) is what matters here.
+ *
+ * @module
+ */
+/**
+ * Pattern names matching this tool description, deduplicated, empty when it
+ * looks like ordinary prose (the overwhelmingly common case).
+ */
+export declare function scanToolDescription(description: string): string[];
+//# sourceMappingURL=toolPoison.d.ts.map

package/dist/toolPoison.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolPoison.d.ts","sourceRoot":"","sources":["../src/toolPoison.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAkDH;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAOjE"}

package/dist/toolPoison.js

@@ -0,0 +1,81 @@
+/**
+ * toolPoison.ts — Tool-description poisoning patterns.
+ *
+ * Direct TypeScript port of `packages/proxy/src/tool_poison.rs`'s `scan`
+ * function and its seven named patterns (confirmed by reading that file
+ * directly). This is a SEPARATE pattern set from `injection.ts`, on purpose:
+ * `tool_poison.rs`'s own module doc records that it tried reusing
+ * `injection::scan` for this and measured that its five patterns match ZERO
+ * of the tool-poisoning payloads — they are tuned for conversational
+ * jailbreak phrasing ("ignore previous instructions"), while a poisoned tool
+ * description reads like documentation, not a jailbreak. `ToolPoisoningDetector`
+ * (Phase 2's `anomaly/detectors.ts`) is what consumes this module.
+ *
+ * The Rust source gates each pattern behind a cheap substring pre-check
+ * (`GATES`) before running the regex, measured to be ~1.8× faster than the
+ * regex alone on their corpus. That optimization is NOT ported here — it is
+ * a performance detail proven equivalent to the plain regex loop (the Rust
+ * module's own `gating_never_changes_a_verdict` test asserts exactly that
+ * equivalence), never a correctness one, and the volume of tool descriptions
+ * one MCP session evaluates is orders of magnitude below the Rust proxy's
+ * request-path corpus. The pattern SOURCE TEXT below is unchanged from the
+ * Rust `PATTERNS` array — only the verbatim regex text is what was actually
+ * measured, so preserving it exactly (not the gate) is what matters here.
+ *
+ * @module
+ */
+/**
+ * Ported verbatim from `tool_poison.rs`'s `PATTERNS` const. All bounded
+ * repetitions here are small fixed-width gaps (`{0,40}`, `{0,60}`, `{0,80}`)
+ * over a handful of alternations — the same "no wide bounded repetition, no
+ * RegexSet performance regression" shape `injection.ts` documents, not the
+ * `dlp.rs` shape that regressed.
+ */
+const PATTERNS = [
+    {
+        name: 'hidden-instruction-block',
+        regex: /<\s*(important|secret|system|hidden|instructions?)\s*>/i,
+    },
+    {
+        name: 'conceal-from-user',
+        regex: /\bdo\s+not\s+(mention|tell|inform|reveal|disclose|show)\b[^.!?]{0,40}\buser\b|\bwithout\s+(informing|telling|notifying|alerting)\s+the\s+user\b/i,
+    },
+    {
+        name: 'sidechannel-exfil',
+        regex: /\b(pass|send|include|append|forward|provide)\b[^.!?]{0,60}\b(content|value|text)s?\s+of\b[^.!?]{0,40}(~\/|\.env|\.ssh|id_rsa|credential|secret|token|api[_ ]?key)/i,
+    },
+    {
+        name: 'read-sensitive-path',
+        // Rust's own comment: no `\b` before the alternation, because a word
+        // boundary cannot exist before a literal `.` — `\b\.env` matches
+        // nothing. Preserved exactly, including that absence.
+        regex: /\b(read|open|cat|load|access)\b[^.!?]{0,30}(~\/\.\w+|\.ssh\/|id_rsa|\.env\b|\.aws\/|mcp\.json|\/etc\/passwd)/i,
+    },
+    {
+        name: 'cross-tool-shadowing',
+        regex: /\buse\s+this\s+tool\s+instead\s+of\b|\bdo\s+not\s+use\s+the\s+\w+\s+tool\b|\bthis\s+tool\s+supersedes\b/i,
+    },
+    {
+        name: 'agent-directed-precondition',
+        regex: /\bbefore\s+(using|calling|invoking)\s+(this|the)\s+tool\b[^.!?]{0,80}\b(you\s+must|first\s+read|first\s+call)\b/i,
+    },
+    {
+        name: 'tool-scoped-instruction-override',
+        regex: /\b(ignore|disregard|override)\b[^.!?]{0,40}\b(other\s+tools?|previous\s+tools?|system\s+prompt)\b/i,
+    },
+];
+/**
+ * Pattern names matching this tool description, deduplicated, empty when it
+ * looks like ordinary prose (the overwhelmingly common case).
+ */
+export function scanToolDescription(description) {
+    if (!description)
+        return [];
+    const found = [];
+    for (const { name, regex } of PATTERNS) {
+        if (regex.test(description))
+            found.push(name);
+    }
+    return found;
+}
+//# sourceMappingURL=toolPoison.js.map

package/dist/toolPoison.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolPoison.js","sourceRoot":"","sources":["../src/toolPoison.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAOH;;;;;;GAMG;AACH,MAAM,QAAQ,GAAiC;IAC7C;QACE,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE,yDAAyD;KACjE;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EACH,kJAAkJ;KACrJ;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EACH,oKAAoK;KACvK;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,qEAAqE;QACrE,iEAAiE;QACjE,sDAAsD;QACtD,KAAK,EAAE,+GAA+G;KACvH;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,0GAA0G;KAClH;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,KAAK,EAAE,kHAAkH;KAC1H;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,KAAK,EAAE,oGAAoG;KAC5G;CACF,CAAA;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAA;IAC3B,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/valkeyErrors.d.ts

@@ -0,0 +1,17 @@
+/**
+ * valkeyErrors.ts — one-line rendering of an ioredis connection error.
+ *
+ * Not just `err.message`: Node's dual-stack connect reports a refused Valkey
+ * as an AggregateError holding one child error per address family, and an
+ * AggregateError's own `.message` is the empty string — so the most common
+ * outage was logged `"err":""` and told an operator nothing. Message text
+ * only, so a credentialed VALKEY_URL cannot reach the log through an error
+ * property bag.
+ *
+ * Shared by the daemon's policy cache and telemetry batcher and by the stdio
+ * proxy's session store (Wave 5.3) — three Valkey clients, one description.
+ *
+ * @module
+ */
+export declare function describeConnectionError(err: unknown): string;
+//# sourceMappingURL=valkeyErrors.d.ts.map

package/dist/valkeyErrors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"valkeyErrors.d.ts","sourceRoot":"","sources":["../src/valkeyErrors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAM5D"}

package/dist/valkeyErrors.js

@@ -0,0 +1,24 @@
+/**
+ * valkeyErrors.ts — one-line rendering of an ioredis connection error.
+ *
+ * Not just `err.message`: Node's dual-stack connect reports a refused Valkey
+ * as an AggregateError holding one child error per address family, and an
+ * AggregateError's own `.message` is the empty string — so the most common
+ * outage was logged `"err":""` and told an operator nothing. Message text
+ * only, so a credentialed VALKEY_URL cannot reach the log through an error
+ * property bag.
+ *
+ * Shared by the daemon's policy cache and telemetry batcher and by the stdio
+ * proxy's session store (Wave 5.3) — three Valkey clients, one description.
+ *
+ * @module
+ */
+export function describeConnectionError(err) {
+    if (err instanceof AggregateError && err.errors.length > 0) {
+        return err.errors.map((e) => (e instanceof Error ? e.message : String(e))).join('; ');
+    }
+    if (err instanceof Error)
+        return err.message || err.name;
+    return String(err);
+}
+//# sourceMappingURL=valkeyErrors.js.map

package/dist/valkeyErrors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"valkeyErrors.js","sourceRoot":"","sources":["../src/valkeyErrors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChG,CAAC;IACD,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAA;IACxD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;AACpB,CAAC"}

package/dist/wasm/context.d.ts

@@ -0,0 +1,57 @@
+/**
+ * wasm/context.ts — Builds the `RequestContext` JSON this proxy honestly has
+ * data for, matching the field NAMES `packages/proxy/src/wasm/context.rs`
+ * (and its AssemblyScript mirror, `packages/wasm-sdk/assembly/index.ts`)
+ * already define, so an existing WASM rule reads this exactly the way it
+ * reads the Rust LLM-traffic proxy's context.
+ *
+ * Deliberately incomplete: `harness`, `model`, every budget/cost field, every
+ * graph/node-identity field, and every SOP-declaration field
+ * (`denied_tools`/`plan_steps`/`scope_paths`/...) are OMITTED — not sent as
+ * `null`, simply absent — because this proxy has no honest value for them.
+ * AssemblyScript's `JSON.parse`-based `readContext` (assembly/index.ts)
+ * leaves a missing field at its class default (empty string / 0 / empty
+ * array), which is the "unknown" reading a well-written rule already has to
+ * handle for the Rust proxy's own `-1`-sentinelled fields — never a
+ * fabricated value.
+ *
+ * @module
+ */
+import type { ToolsListEntry } from '../session.js';
+export interface WasmContextInput {
+    sessionId: string;
+    workspaceId: string;
+    /** The post-curation `tools/list` this session last saw (SessionState). */
+    tools: readonly ToolsListEntry[];
+    /**
+     * A synthesized identifier for the CURRENT tool call — MCP has no
+     * server-assigned call id the way Anthropic's `tool_use_id` is; this
+     * proxy mints one for context-building purposes only, honestly labeled
+     * as this proxy's own synthesized value, not claimed to be anything the
+     * harness itself asserted.
+     */
+    toolCallId: string;
+    toolName: string;
+    toolArguments: unknown;
+    /** The prospective sequence (current call included) — same array Phase 2's detectors evaluate against. */
+    toolSequence: readonly string[];
+    callsLast60s: number;
+    /** This call's OWN DLP scan findings — see dlpEscalation's callers: by
+     *  pipeline position, a non-empty result here would already have blocked
+     *  the request at interceptor.ts's DLP step, so this is honestly almost
+     *  always empty by construction, not a bug in this builder. */
+    dlpFindingDescriptions: readonly string[];
+    injectionFindings: readonly string[];
+    injectionSources: readonly string[];
+    corroboratingDetectors: number;
+    /** `undefined` when no `tools/list` response has been TOFU-checked yet this session. */
+    toolContractChanged: boolean | undefined;
+}
+/**
+ * Builds the plain object to `JSON.stringify` and hand to a WASM rule's
+ * `evaluate(offset, len)` export. Field names match `context.rs`/
+ * `assembly/index.ts` exactly; fields this proxy has no honest data for are
+ * not present as keys at all.
+ */
+export declare function buildWasmContext(input: WasmContextInput): Record<string, unknown>;
+//# sourceMappingURL=context.d.ts.map

package/dist/wasm/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/wasm/context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAEnD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,2EAA2E;IAC3E,KAAK,EAAE,SAAS,cAAc,EAAE,CAAA;IAChC;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,OAAO,CAAA;IACtB,0GAA0G;IAC1G,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B,YAAY,EAAE,MAAM,CAAA;IACpB;;;mEAG+D;IAC/D,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,sBAAsB,EAAE,MAAM,CAAA;IAC9B,wFAAwF;IACxF,mBAAmB,EAAE,OAAO,GAAG,SAAS,CAAA;CACzC;AASD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyBjF"}

package/dist/wasm/context.js

@@ -0,0 +1,59 @@
+/**
+ * wasm/context.ts — Builds the `RequestContext` JSON this proxy honestly has
+ * data for, matching the field NAMES `packages/proxy/src/wasm/context.rs`
+ * (and its AssemblyScript mirror, `packages/wasm-sdk/assembly/index.ts`)
+ * already define, so an existing WASM rule reads this exactly the way it
+ * reads the Rust LLM-traffic proxy's context.
+ *
+ * Deliberately incomplete: `harness`, `model`, every budget/cost field, every
+ * graph/node-identity field, and every SOP-declaration field
+ * (`denied_tools`/`plan_steps`/`scope_paths`/...) are OMITTED — not sent as
+ * `null`, simply absent — because this proxy has no honest value for them.
+ * AssemblyScript's `JSON.parse`-based `readContext` (assembly/index.ts)
+ * leaves a missing field at its class default (empty string / 0 / empty
+ * array), which is the "unknown" reading a well-written rule already has to
+ * handle for the Rust proxy's own `-1`-sentinelled fields — never a
+ * fabricated value.
+ *
+ * @module
+ */
+/** `(tool, count)` pairs, wire-shaped as 2-element arrays — see context.ts's module doc. */
+function foldToolCallCounts(sequence) {
+    const counts = new Map();
+    for (const tool of sequence)
+        counts.set(tool, (counts.get(tool) ?? 0) + 1);
+    return Array.from(counts.entries());
+}
+/**
+ * Builds the plain object to `JSON.stringify` and hand to a WASM rule's
+ * `evaluate(offset, len)` export. Field names match `context.rs`/
+ * `assembly/index.ts` exactly; fields this proxy has no honest data for are
+ * not present as keys at all.
+ */
+export function buildWasmContext(input) {
+    const ctx = {
+        session_id: input.sessionId,
+        workspace_id: input.workspaceId,
+        tools: input.tools.map((t) => ({ name: t.name, description: t.description ?? '' })),
+        tool_calls: [{ id: input.toolCallId, name: input.toolName, arguments: input.toolArguments ?? {} }],
+        tool_sequence: [...input.toolSequence],
+        tool_call_counts: foldToolCallCounts(input.toolSequence),
+        calls_last_60s: input.callsLast60s,
+        // Our own DLP scanner has no offset/length tracking (dlp.ts never
+        // recorded match spans), so `pattern_name` is the only field populated
+        // — mapped from the finding's human-readable description (the closest
+        // honest analogue this scanner has to a pattern identity).
+        // `category`/`action`/`offset`/`length` are left absent rather than
+        // fabricated; the AssemblyScript `DlpFinding` class defaults them to
+        // `""`/0, the same "unknown" reading every other absent field gets.
+        dlp_findings: input.dlpFindingDescriptions.map((description) => ({ pattern_name: description })),
+        injection_findings: [...input.injectionFindings],
+        injection_sources: [...input.injectionSources],
+        corroborating_detectors: input.corroboratingDetectors,
+    };
+    if (input.toolContractChanged !== undefined) {
+        ctx['tool_contract_changed'] = input.toolContractChanged;
+    }
+    return ctx;
+}
+//# sourceMappingURL=context.js.map

package/dist/wasm/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/wasm/context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAkCH,4FAA4F;AAC5F,SAAS,kBAAkB,CAAC,QAA2B;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,KAAK,MAAM,IAAI,IAAI,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1E,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IACtD,MAAM,GAAG,GAA4B;QACnC,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;QACnF,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAClG,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;QACtC,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC;QACxD,cAAc,EAAE,KAAK,CAAC,YAAY;QAClC,kEAAkE;QAClE,uEAAuE;QACvE,sEAAsE;QACtE,2DAA2D;QAC3D,oEAAoE;QACpE,qEAAqE;QACrE,oEAAoE;QACpE,YAAY,EAAE,KAAK,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;QAChG,kBAAkB,EAAE,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC;QAChD,iBAAiB,EAAE,CAAC,GAAG,KAAK,CAAC,gBAAgB,CAAC;QAC9C,uBAAuB,EAAE,KAAK,CAAC,sBAAsB;KACtD,CAAA;IACD,IAAI,KAAK,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC5C,GAAG,CAAC,uBAAuB,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAA;IAC1D,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/wasm/hostImports.d.ts

@@ -0,0 +1,43 @@
+/**
+ * wasm/hostImports.ts — The 4 frozen host imports (`WASM_HOST_IMPORTS` from
+ * `@intutic/shared-types`), implemented for this proxy's `worker_threads`
+ * sandbox.
+ *
+ * Built from `packages/proxy/src/wasm/host.rs` (the Rust behavior each
+ * import must match) and from `packages/wasm-sdk/__tests__/generatedRules.test.ts`'s
+ * `HOST_IMPL` (the reference Node-side implementation the task named as the
+ * base to build from). `log_info`/`abort`/`trace` mirror `host.rs`'s
+ * tracing-log behavior, routed through this package's own `createStderrLogger`
+ * (never `console.log`/stdout — the same stdio-isolation rule every other
+ * module in this package follows). `read_referenced_file` resolves against
+ * the per-evaluation table the runner pre-reads through `referencedFiles.ts`
+ * (TD-441) — the port of `host.rs`'s `read_referenced_file_impl`, code for
+ * code: the read budget is charged before argument validation, a refusal is
+ * a value the rule can act on, and nothing here traps. With no table (no
+ * `INTUTIC_WASM_MANIFEST_ROOT`, or a rule that does not import the function)
+ * every call gets `ERR_REFUSED`, which is what the Rust proxy answers with no
+ * root configured.
+ *
+ * @module
+ */
+import { ReferencedFiles } from './referencedFiles.js';
+/** `referenced_files.rs`'s `ERR_REFUSED` (-2), kept exported here for the callers that imported it before the resolver existed. */
+export declare const ERR_REFUSED = -2;
+/** What one evaluation's host imports need beyond the guest memory. */
+export interface HostImportState {
+    /** The pre-read table; `ReferencedFiles.empty()` refuses everything. */
+    files: ReferencedFiles;
+    /** Reads left this evaluation, decremented by every call. */
+    fileReadsRemaining: number;
+}
+export declare function newHostImportState(files?: ReferencedFiles): HostImportState;
+/**
+ * Builds the `env.*` import object for one WASM instance. `getMemory` is a
+ * thunk rather than a captured value because the memory export does not
+ * exist until AFTER `WebAssembly.instantiate` returns, while the import
+ * object has to be supplied BEFORE it — the same ordering `host.rs` avoids
+ * entirely by reading `caller.get_export("memory")` inside each call; this
+ * is the Node-side equivalent of that lazy lookup.
+ */
+export declare function createHostImports(getMemory: () => WebAssembly.Memory | undefined, state?: HostImportState): WebAssembly.ModuleImports;
+//# sourceMappingURL=hostImports.d.ts.map