@intutic/mcp-governance-proxy 2.0.0 → 2.2.0

package/dist/interceptor.d.ts

@@ -2,6 +2,7 @@
  * interceptor.ts — tools/call decision engine.
  *
  * Given a tool name and arguments, evaluates:
+ * 0. The MCP server registry, server/tool allowlists and SSO group clearance
  * 1. DLP scan (credential / destructive pattern detection)
  * 2. SOP policy rules (fetched from control plane via PolicyClient)
  *
@@ -13,7 +14,8 @@ import type { AnomalyMode, Disposition } from './anomaly/index.js';
 import { SessionState } from './session.js';
 import type { WasmRunner } from './wasm/runner.js';
 import type { PolicyClient } from './policy.js';
-import type { GovernanceEmitter } from './emitter.js';
+import { type GovernanceEmitter } from './emitter.js';
+import type { ApprovalHolds } from './approvalHold.js';
 export type Decision = {
     action: 'allow';
 } | {
@@ -23,11 +25,26 @@ export type Decision = {
     action: 'redact';
     reason: string;
     redactedInput: unknown;
+}
+/**
+ * Refused for now, pending a person's approval (`require_approval`). Not a
+ * block: the agent is told the hold id and that an identical retry passes
+ * once approved — see approvalHold.ts.
+ */
+ | {
+    action: 'hold';
+    reason: string;
+    holdId: string;
 };
 export declare class ToolCallInterceptor {
     private readonly policy;
     private readonly emitter;
-    private readonly failOpen;
+    /**
+     * The local fail setting (`INTUTIC_MCP_FAIL_OPEN`, config.ts). The
+     * workspace's `mcpProxyFailBehavior`, once a policy has delivered it,
+     * takes precedence — see {@link failOpen}.
+     */
+    private readonly localFailOpen;
     /**
      * The real MCP server this proxy process fronts, from `--server-name`
      * (config.ts, threaded since Phase D's `wrapWithProxy` but unconsumed
@@ -87,7 +104,20 @@ export declare class ToolCallInterceptor {
      * belongs to).
      */
     private readonly workspaceId;
-    constructor(policy: PolicyClient, emitter: GovernanceEmitter, failOpen?: boolean, 
+    /**
+     * Turns a `require_approval` rule into a hold through the control
+     * plane's decisions API. `undefined` (construction sites that predate
+     * holds) leaves such a call held with nothing recorded, which is still a
+     * refusal — never an allow.
+     */
+    private readonly holds;
+    constructor(policy: PolicyClient, emitter: GovernanceEmitter, 
+    /**
+     * The local fail setting (`INTUTIC_MCP_FAIL_OPEN`, config.ts). The
+     * workspace's `mcpProxyFailBehavior`, once a policy has delivered it,
+     * takes precedence — see {@link failOpen}.
+     */
+    localFailOpen?: boolean, 
     /**
      * The real MCP server this proxy process fronts, from `--server-name`
      * (config.ts, threaded since Phase D's `wrapWithProxy` but unconsumed
@@ -146,7 +176,21 @@ export declare class ToolCallInterceptor {
      * identity: the MCP SERVER this process fronts, not the WORKSPACE it
      * belongs to).
      */
-    workspaceId?: string);
+    workspaceId?: string, 
+    /**
+     * Turns a `require_approval` rule into a hold through the control
+     * plane's decisions API. `undefined` (construction sites that predate
+     * holds) leaves such a call held with nothing recorded, which is still a
+     * refusal — never an allow.
+     */
+    holds?: ApprovalHolds | undefined);
+    /**
+     * Whether a governance check that cannot complete lets the call through:
+     * the workspace's `mcpProxyFailBehavior` when the control plane has sent
+     * it, the local `INTUTIC_MCP_FAIL_OPEN` until then (and for a workspace
+     * that never chose).
+     */
+    get failOpen(): boolean;
     /**
      * Applies the shared reask ladder (Phase 2 anomaly detectors AND Phase 3
      * WASM rules both use this): a session-lifetime attempt counter keyed by
@@ -156,6 +200,46 @@ export declare class ToolCallInterceptor {
      * it, exactly like every other new block reason in this package.
      */
     private applyReaskLadder;
+    /**
+     * A `require_approval` rule matched. Returns the hold decision, or `null`
+     * when an approved bypass for this exact call lets it continue. Every hold
+     * reason names the hold id and the command that approves it, the same
+     * wording the hook gates print, so a person reading the agent's transcript
+     * knows what to run.
+     */
+    private hold;
+    /**
+     * Refuses the call when the registry says this server — or this tool on it —
+     * may not be used. Returns `null` to let the call continue.
+     *
+     * A blocked server is refused under either default; under `deny`, so is any
+     * server not approved (a candidate, or one the registry has never seen);
+     * a disabled tool is refused within any server. All three are definite
+     * operator decisions and do not depend on `failOpen`.
+     *
+     * What does depend on it is a registry this process has never loaded — the
+     * control plane unreachable since start, or only the MCP daemon's snapshot
+     * seed so far. The last-known registry is kept for as long as the process
+     * runs, so this is only ever the never-loaded case. Fail-open lets the call continue
+     * unchecked against the registry, exactly as a workspace with no registry;
+     * fail-closed refuses it, because a `deny` workspace cannot be told apart
+     * from an `allow` one without the registry.
+     */
+    private checkRegistry;
+    /**
+     * The workspace's SSO group policy, applied to the member this proxy's API
+     * key resolves to, by `evaluateSsoGroupClearance` — the function the
+     * server-side hook gate (`resolveSsoGroupPrivilege`) and the policy snapshot
+     * use, so all of them answer alike. A tool matches by its bare MCP name or
+     * as `mcp__<server>__<tool>`, the name the harness hooks see for the same
+     * call. A tool on the `requireOboFor` list is refused: a proxy has no
+     * on-behalf-of token to present.
+     *
+     * With a policy but no resolved member the groups are unknown, and a
+     * high-risk tool is refused rather than allowed — unknown is never granted.
+     * Without a policy there is nothing to apply.
+     */
+    private checkSsoGroupClearance;
     /**
      * Evaluate a tools/call request and return a governance decision.
      *

package/dist/interceptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interceptor.d.ts","sourceRoot":"","sources":["../src/interceptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAIrD,MAAM,MAAM,QAAQ,GAChB;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAE,CAAA;AAEhE,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW;gBA7DX,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,GAAE,OAAc;IACzC;;;;;;OAMG;IACc,UAAU,GAAE,MAAkB;IAC/C;;;;;;;OAOG;IACc,sBAAsB,GAAE,MAAM,GAAG,OAAgB;IAClE;;;;;;;;OAQG;IACc,OAAO,GAAE,YAAiC;IAC3D;;;;;;;OAOG;IACc,kBAAkB,GAAE,WAAuB;IAC5D;;;;;;OAMG;IACc,uBAAuB,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,KAAK,CAAC,CAAM;IAC5F;;;;;OAKG;IACc,UAAU,GAAE,UAAU,GAAG,SAAqB;IAC/D;;;;;;OAMG;IACc,WAAW,GAAE,MAAkB;IAGlD;;;;;;;OAOG;YACW,gBAAgB;IAmB9B;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CAiRtE"}
+{"version":3,"file":"interceptor.d.ts","sourceRoot":"","sources":["../src/interceptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAW,MAAM,aAAa,CAAA;AACxD,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAA;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAItD,MAAM,MAAM,QAAQ,GAChB;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAE;AAC9D;;;;GAIG;GACD;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEtD,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAzEL,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,iBAAiB;IAC3C;;;;OAIG;IACc,aAAa,GAAE,OAAc;IAC9C;;;;;;OAMG;IACc,UAAU,GAAE,MAAkB;IAC/C;;;;;;;OAOG;IACc,sBAAsB,GAAE,MAAM,GAAG,OAAgB;IAClE;;;;;;;;OAQG;IACc,OAAO,GAAE,YAAiC;IAC3D;;;;;;;OAOG;IACc,kBAAkB,GAAE,WAAuB;IAC5D;;;;;;OAMG;IACc,uBAAuB,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,KAAK,CAAC,CAAM;IAC5F;;;;;OAKG;IACc,UAAU,GAAE,UAAU,GAAG,SAAqB;IAC/D;;;;;;OAMG;IACc,WAAW,GAAE,MAAkB;IAChD;;;;;OAKG;IACc,KAAK,GAAE,aAAa,GAAG,SAAqB;IAG/D;;;;;OAKG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;;;;;;OAOG;YACW,gBAAgB;IAmB9B;;;;;;OAMG;YACW,IAAI;IAwBlB;;;;;;;;;;;;;;;;OAgBG;YACW,aAAa;IAmC3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,sBAAsB;IAkB9B;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CA8RtE"}

package/dist/interceptor.js

@@ -2,6 +2,7 @@
  * interceptor.ts — tools/call decision engine.
  *
  * Given a tool name and arguments, evaluates:
+ * 0. The MCP server registry, server/tool allowlists and SSO group clearance
  * 1. DLP scan (credential / destructive pattern detection)
  * 2. SOP policy rules (fetched from control plane via PolicyClient)
  *
@@ -11,15 +12,17 @@
  */
 import * as node_crypto from 'node:crypto';
 import { createStderrLogger as createLogger } from './stderrLog.js';
+import { evaluateSsoGroupClearance } from '@intutic/shared-types';
 import { scanToolInput, formatDlpBlockReason, setDynamicPatterns } from './dlp.js';
 import { scanText, injectionSeverity, setDynamicInjectionPatterns } from './injection.js';
 import { evaluateSequenceDetectors, resolveEffectiveDisposition, REASK_MAX_ATTEMPTS } from './anomaly/index.js';
 import { SessionState } from './session.js';
+import { detectionFinding } from './emitter.js';
 const log = createLogger('mcp-proxy-interceptor');
 export class ToolCallInterceptor {
     policy;
     emitter;
-    failOpen;
+    localFailOpen;
     serverName;
     injectionActionDefault;
     session;
@@ -27,7 +30,14 @@ export class ToolCallInterceptor {
     anomalyOverridesDefault;
     wasmRunner;
     workspaceId;
-    constructor(policy, emitter, failOpen = true, 
+    holds;
+    constructor(policy, emitter, 
+    /**
+     * The local fail setting (`INTUTIC_MCP_FAIL_OPEN`, config.ts). The
+     * workspace's `mcpProxyFailBehavior`, once a policy has delivered it,
+     * takes precedence — see {@link failOpen}.
+     */
+    localFailOpen = true, 
     /**
      * The real MCP server this proxy process fronts, from `--server-name`
      * (config.ts, threaded since Phase D's `wrapWithProxy` but unconsumed
@@ -86,10 +96,17 @@ export class ToolCallInterceptor {
      * identity: the MCP SERVER this process fronts, not the WORKSPACE it
      * belongs to).
      */
-    workspaceId = 'unknown') {
+    workspaceId = 'unknown', 
+    /**
+     * Turns a `require_approval` rule into a hold through the control
+     * plane's decisions API. `undefined` (construction sites that predate
+     * holds) leaves such a call held with nothing recorded, which is still a
+     * refusal — never an allow.
+     */
+    holds = undefined) {
         this.policy = policy;
         this.emitter = emitter;
-        this.failOpen = failOpen;
+        this.localFailOpen = localFailOpen;
         this.serverName = serverName;
         this.injectionActionDefault = injectionActionDefault;
         this.session = session;
@@ -97,6 +114,16 @@ export class ToolCallInterceptor {
         this.anomalyOverridesDefault = anomalyOverridesDefault;
         this.wasmRunner = wasmRunner;
         this.workspaceId = workspaceId;
+        this.holds = holds;
+    }
+    /**
+     * Whether a governance check that cannot complete lets the call through:
+     * the workspace's `mcpProxyFailBehavior` when the control plane has sent
+     * it, the local `INTUTIC_MCP_FAIL_OPEN` until then (and for a workspace
+     * that never chose).
+     */
+    get failOpen() {
+        return this.policy.getFailOpen() ?? this.localFailOpen;
     }
     /**
      * Applies the shared reask ladder (Phase 2 anomaly detectors AND Phase 3
@@ -122,6 +149,115 @@ export class ToolCallInterceptor {
         this.emitter.emit('tool_blocked', toolName, toolInput, reaskReason);
         return { action: 'block', reason: reaskReason };
     }
+    /**
+     * A `require_approval` rule matched. Returns the hold decision, or `null`
+     * when an approved bypass for this exact call lets it continue. Every hold
+     * reason names the hold id and the command that approves it, the same
+     * wording the hook gates print, so a person reading the agent's transcript
+     * knows what to run.
+     */
+    async hold(rule, toolName, toolInput) {
+        const outcome = this.holds
+            ? await this.holds.request(rule, toolName, toolInput)
+            : { kind: 'held', holdId: '', recorded: false };
+        if (outcome.kind === 'bypassed') {
+            const reason = `Approved bypass for ${rule.id} — approved by ${outcome.decidedBy || 'an approver'} on hold ${outcome.holdId}`;
+            log.warn({ action: 'hold_approved_bypass_used', toolName, ruleId: rule.id, holdId: outcome.holdId }, reason);
+            this.emitter.emit('hold_approved_bypass_used', toolName, toolInput, reason);
+            return null;
+        }
+        const reason = outcome.recorded
+            ? `HELD for approval: ${rule.reason} [${rule.id}]. Hold id: ${outcome.holdId}. ` +
+                `An approver can run: intutic decision approve ${outcome.holdId} (or reject it). ` +
+                `Retry this exact call after it is approved.`
+            : `HELD for approval: ${rule.reason} [${rule.id}], but the hold could not be recorded ` +
+                `(Intutic control plane unreachable), so there is nothing to approve yet. Retry once the ` +
+                `control plane is reachable to request approval.`;
+        log.warn({ action: 'tool_held', toolName, ruleId: rule.id, holdId: outcome.holdId, recorded: outcome.recorded }, reason);
+        this.emitter.emit('tool_held', toolName, toolInput, `${rule.reason} [${rule.id}]`);
+        return { action: 'hold', reason, holdId: outcome.holdId };
+    }
+    /**
+     * Refuses the call when the registry says this server — or this tool on it —
+     * may not be used. Returns `null` to let the call continue.
+     *
+     * A blocked server is refused under either default; under `deny`, so is any
+     * server not approved (a candidate, or one the registry has never seen);
+     * a disabled tool is refused within any server. All three are definite
+     * operator decisions and do not depend on `failOpen`.
+     *
+     * What does depend on it is a registry this process has never loaded — the
+     * control plane unreachable since start, or only the MCP daemon's snapshot
+     * seed so far. The last-known registry is kept for as long as the process
+     * runs, so this is only ever the never-loaded case. Fail-open lets the call continue
+     * unchecked against the registry, exactly as a workspace with no registry;
+     * fail-closed refuses it, because a `deny` workspace cannot be told apart
+     * from an `allow` one without the registry.
+     */
+    async checkRegistry(toolName, toolInput) {
+        await this.policy.ready();
+        const registry = this.policy.getRegistry();
+        if (!registry) {
+            if (this.failOpen)
+                return null;
+            const reason = `MCP server registry for this workspace has not loaded (Intutic control plane unreachable ` +
+                `since this proxy started), so whether "${this.serverName}" is approved is unknown. ` +
+                `Tool call blocked (fail-closed mode: mcpProxyFailBehavior or INTUTIC_MCP_FAIL_OPEN=false).`;
+            log.warn({ action: 'registry_unknown_block', serverName: this.serverName, toolName }, reason);
+            this.emitter.emit('tool_blocked', toolName, toolInput, reason);
+            return { action: 'block', reason };
+        }
+        let reason = null;
+        if (registry.blockedServers.includes(this.serverName)) {
+            reason =
+                `MCP server "${this.serverName}" is blocked in this workspace's MCP server registry. ` +
+                    `An owner or admin can change that on the MCP Servers page.`;
+        }
+        else if (registry.defaultPolicy === 'deny' && !registry.approvedServers.includes(this.serverName)) {
+            reason =
+                `MCP server "${this.serverName}" is not approved in this workspace's MCP server registry, ` +
+                    `and the workspace refuses unapproved servers (mcpDefaultPolicy: deny). It is waiting in ` +
+                    `the approval queue on the MCP Servers page for an owner or admin.`;
+        }
+        else if ((registry.disabledTools[this.serverName] ?? []).includes(toolName)) {
+            reason =
+                `Tool "${toolName}" is disabled on MCP server "${this.serverName}" in this workspace's ` +
+                    `MCP server registry. An owner or admin can re-enable it on the MCP Servers page.`;
+        }
+        if (!reason)
+            return null;
+        log.warn({ action: 'registry_block', serverName: this.serverName, toolName }, reason);
+        this.emitter.emit('tool_blocked', toolName, toolInput, reason);
+        return { action: 'block', reason };
+    }
+    /**
+     * The workspace's SSO group policy, applied to the member this proxy's API
+     * key resolves to, by `evaluateSsoGroupClearance` — the function the
+     * server-side hook gate (`resolveSsoGroupPrivilege`) and the policy snapshot
+     * use, so all of them answer alike. A tool matches by its bare MCP name or
+     * as `mcp__<server>__<tool>`, the name the harness hooks see for the same
+     * call. A tool on the `requireOboFor` list is refused: a proxy has no
+     * on-behalf-of token to present.
+     *
+     * With a policy but no resolved member the groups are unknown, and a
+     * high-risk tool is refused rather than allowed — unknown is never granted.
+     * Without a policy there is nothing to apply.
+     */
+    checkSsoGroupClearance(toolName, toolInput) {
+        const policy = this.policy.getSsoGroupPolicy();
+        if (!policy)
+            return null;
+        const principal = this.policy.getPrincipal();
+        const decision = evaluateSsoGroupClearance(policy, [toolName, `mcp__${this.serverName}__${toolName}`], principal ? principal.ssoGroups : null);
+        if (decision.clearance === 'GRANTED')
+            return null;
+        // The bracketed rule id is how hook-events and the SIEM export name the
+        // rule that decided — the same id every other gate gives this decision.
+        const reason = `${decision.reason} [${decision.ruleId}]`;
+        log.warn({ action: 'sso_group_block', toolName, memberId: principal?.memberId ?? null, ruleId: decision.ruleId }, reason);
+        this.emitter.emit('tool_blocked', toolName, toolInput, reason);
+        return { action: 'block', reason };
+    }
     /**
      * Evaluate a tools/call request and return a governance decision.
      *
@@ -138,6 +274,11 @@ export class ToolCallInterceptor {
         let injectionFindingsForContext = [];
         let injectionSourcesForContext = [];
         let corroboratingDetectorsForContext = 0;
+        // -2. The MCP server registry: operator decisions on this server, and the
+        // workspace's default for servers nobody has decided on yet.
+        const registryDecision = await this.checkRegistry(toolName, toolInput);
+        if (registryDecision)
+            return registryDecision;
         // -1. Additive SERVER scoping. When the workspace declares a server
         // allowlist (mcpAllowedServers), ONLY calls proxied to those servers may
         // proceed — checked ahead of the per-tool allowlist below since a
@@ -175,6 +316,10 @@ export class ToolCallInterceptor {
             this.emitter.emit('tool_blocked', toolName, toolInput, reason);
             return { action: 'block', reason };
         }
+        // 0.5. SSO group clearance, after the scoping checks and before DLP.
+        const clearance = this.checkSsoGroupClearance(toolName, toolInput);
+        if (clearance)
+            return clearance;
         // 1. DLP scan — with the workspace's own patterns loaded first, so a
         // control-plane-defined pattern reaches the same scanner as the floor.
         try {
@@ -225,12 +370,11 @@ export class ToolCallInterceptor {
                     // SHADOW guardrail's evidence (LLD #71) counts this proxy's traffic.
                     this.emitter.emit('tool_flagged', toolName, toolInput, `${rule.reason} [${rule.id}]`);
                 }
-                // 'require_approval' treated as block in headless proxy (no interactive UI)
                 if (rule.action === 'require_approval') {
-                    const reason = `Tool requires human approval per SOP rule ${rule.id}: ${rule.reason}`;
-                    log.warn({ action: 'policy_approval_required', toolName, ruleId: rule.id }, reason);
-                    this.emitter.emit('tool_blocked', toolName, toolInput, reason);
-                    return { action: 'block', reason };
+                    const held = await this.hold(rule, toolName, toolInput);
+                    if (held)
+                        return held;
+                    // An approved bypass: the remaining checks still apply.
                 }
             }
         }
@@ -263,7 +407,13 @@ export class ToolCallInterceptor {
                 const reason = `Prompt-injection pattern(s) detected in tool input: ${findings.join(', ')}`;
                 log.warn({ action: 'injection_detected', toolName, patterns: findings, source: 'tool_input', severity }, 'Prompt-injection pattern matched in tool call input');
                 const injectionAction = this.policy.getInjectionAction() ?? this.injectionActionDefault;
-                this.emitter.emit('injection_detected', toolName, toolInput, reason, severity);
+                this.emitter.emit('injection_detected', toolName, toolInput, reason, {
+                    detectorId: 'injection:tool_input',
+                    kind: 'prompt_injection',
+                    disposition: injectionAction === 'block' ? 'kill' : 'steer',
+                    severity,
+                    confidence: 1,
+                });
                 if (injectionAction === 'block') {
                     this.emitter.emit('tool_blocked', toolName, toolInput, reason);
                     return { action: 'block', reason };
@@ -314,7 +464,7 @@ export class ToolCallInterceptor {
                         disposition: effective,
                         confidence: finding.confidence,
                     }, 'Anomaly detector fired');
-                    this.emitter.emit('anomaly_detected', toolName, toolInput, finding.reason, severity);
+                    this.emitter.emit('anomaly_detected', toolName, toolInput, finding.reason, detectionFinding(finding, effective, severity));
                     if (effective === 'kill') {
                         this.emitter.emit('tool_blocked', toolName, toolInput, finding.reason);
                         return { action: 'block', reason: finding.reason };

package/dist/interceptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"interceptor.js","sourceRoot":"","sources":["../src/interceptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,WAAW,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAElF,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAA;AACzF,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE/G,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAK3C,MAAM,GAAG,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAOjD,MAAM,OAAO,mBAAmB;IAEX;IACA;IACA;IAQA;IASA;IAUA;IASA;IAQA;IAOA;IAQA;IA9DnB,YACmB,MAAoB,EACpB,OAA0B,EAC1B,WAAoB,IAAI;IACzC;;;;;;OAMG;IACc,aAAqB,SAAS;IAC/C;;;;;;;OAOG;IACc,yBAA2C,MAAM;IAClE;;;;;;;;OAQG;IACc,UAAwB,IAAI,YAAY,EAAE;IAC3D;;;;;;;OAOG;IACc,qBAAkC,SAAS;IAC5D;;;;;;OAMG;IACc,0BAAyE,EAAE;IAC5F;;;;;OAKG;IACc,aAAqC,SAAS;IAC/D;;;;;;OAMG;IACc,cAAsB,SAAS;QA7D/B,WAAM,GAAN,MAAM,CAAc;QACpB,YAAO,GAAP,OAAO,CAAmB;QAC1B,aAAQ,GAAR,QAAQ,CAAgB;QAQxB,eAAU,GAAV,UAAU,CAAoB;QAS9B,2BAAsB,GAAtB,sBAAsB,CAA2B;QAUjD,YAAO,GAAP,OAAO,CAAmC;QAS1C,uBAAkB,GAAlB,kBAAkB,CAAyB;QAQ3C,4BAAuB,GAAvB,uBAAuB,CAAoD;QAO3E,eAAU,GAAV,UAAU,CAAoC;QAQ9C,gBAAW,GAAX,WAAW,CAAoB;IAC/C,CAAC;IAEJ;;;;;;;OAOG;IACK,KAAK,CAAC,gBAAgB,CAAC,GAAW,EAAE,UAAkB,EAAE,QAAgB,EAAE,SAAkB;QAClG,qEAAqE;QACrE,qEAAqE;QACrE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAA;QAC/D,IAAI,QAAQ,GAAG,kBAAkB,EAAE,CAAC;YAClC,MAAM,cAAc,GAClB,GAAG,UAAU,+CAA+C,kBAAkB,SAAS;gBACvF,8BAA8B,CAAA;YAChC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,sDAAsD,CAAC,CAAA;YACvH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;YACtE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;QACpD,CAAC;QACD,MAAM,WAAW,GACf,GAAG,UAAU,aAAa,QAAQ,IAAI,kBAAkB,kCAAkC;YAC1F,+BAA+B,CAAA;QACjC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;QACnE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IACjD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,SAAkB;QAC/C,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,EAAE,sBAAsB,CAAC,CAAA;QAE7E,wEAAwE;QACxE,qEAAqE;QACrE,8DAA8D;QAC9D,IAAI,qBAAqB,GAAiB,EAAE,CAAA;QAC5C,IAAI,2BAA2B,GAAa,EAAE,CAAA;QAC9C,IAAI,0BAA0B,GAAa,EAAE,CAAA;QAC7C,IAAI,gCAAgC,GAAG,CAAC,CAAA;QAExC,oEAAoE;QACpE,yEAAyE;QACzE,kEAAkE;QAClE,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,kEAAkE;QAClE,mEAAmE;QACnE,sEAAsE;QACtE,uEAAuE;QACvE,SAAS;QACT,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAA;QACtD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3E,MAAM,MAAM,GACV,eAAe,IAAI,CAAC,UAAU,oDAAoD;gBAClF,IAAI,cAAc,CAAC,MAAM,mDAAmD;gBAC5E,sDAAsD,CAAA;YACxD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;YAC7F,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;YAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;QACpC,CAAC;QAED,sEAAsE;QACtE,yEAAyE;QACzE,wEAAwE;QACxE,kEAAkE;QAClE,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAA;QAClD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChE,MAAM,MAAM,GACV,SAAS,QAAQ,kDAAkD;gBACnE,IAAI,YAAY,CAAC,MAAM,iDAAiD;gBACxE,oDAAoD,CAAA;YACtD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;YACzD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;YAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;QACpC,CAAC;QAED,qEAAqE;QACrE,uEAAuE;QACvE,IAAI,CAAC;YACH,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAA;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;QACzE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;YACpC,qEAAqE;YACrE,iEAAiE;YACjE,8DAA8D;YAC9D,8DAA8D;YAC9D,qBAAqB,GAAG,GAAG,CAAC,QAAQ,CAAA;YACpC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;gBACnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBACjD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAA;gBAChF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;gBAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;YACpC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,2BAA2B,CAAC,CAAA;YAC5F,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,OAAO;oBACL,MAAM,EAAE,OAAO;oBACf,MAAM,EACJ,+DAA+D;wBAC/D,4DAA4D;wBAC5D,oEAAoE;iBACvE,CAAA;YACH,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;YACrD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;YAC3D,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAA;oBACpG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;oBACnE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;gBACjD,CAAC;gBACD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC3B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAA;oBAChH,qEAAqE;oBACrE,8DAA8D;oBAC9D,qEAAqE;oBACrE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,GAAG,CAAC,CAAA;gBACvF,CAAC;gBACD,4EAA4E;gBAC5E,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;oBACvC,MAAM,MAAM,GAAG,6CAA6C,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,EAAE,CAAA;oBACrF,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;oBACnF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;oBAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,yBAAyB,CAAC,CAAA;YAC7F,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,OAAO;oBACL,MAAM,EAAE,OAAO;oBACf,MAAM,EACJ,+DAA+D;wBAC/D,4DAA4D;wBAC5D,oEAAoE;iBACvE,CAAA;YACH,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,qEAAqE;QACrE,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,wBAAwB;QACxB,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;YACrD,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAA;YAC/D,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAA;YACxC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,2BAA2B,GAAG,QAAQ,CAAA;gBACtC,0BAA0B,GAAG,CAAC,YAAY,CAAC,CAAA;gBAC3C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;gBAC1D,MAAM,MAAM,GAAG,uDAAuD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;gBAC3F,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,EAC9F,qDAAqD,CACtD,CAAA;gBACD,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAA;gBACvF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;gBAC9E,IAAI,eAAe,KAAK,OAAO,EAAE,CAAC;oBAChC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;oBAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;gBACpC,CAAC;gBACD,wDAAwD;YAC1D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,uEAAuE;YACvE,iEAAiE;YACjE,oEAAoE;YACpE,uDAAuD;YACvD,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,iCAAiC,CAAC,CAAA;QAC/G,CAAC;QAED,+DAA+D;QAC/D,yDAAyD;QACzD,qEAAqE;QACrE,+DAA+D;QAC/D,wEAAwE;QACxE,qEAAqE;QACrE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,oBAAoB;QACpB,MAAM,WAAW,GAAgB,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,kBAAkB,CAAA;QACxF,oEAAoE;QACpE,qEAAqE;QACrE,wEAAwE;QACxE,yCAAyC;QACzC,MAAM,MAAM,GAAG,WAAW,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC7G,IAAI,WAAW,KAAK,KAAK,IAAI,MAAM,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAA;gBACtC,MAAM,QAAQ,GAAG,yBAAyB,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;gBAC5E,gCAAgC,GAAG,QAAQ,CAAC,MAAM,CAAA;gBAClD,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC,uBAAuB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAA;gBAC3F,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC/B,MAAM,SAAS,GAAwB,2BAA2B,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAA;oBACnG,IAAI,SAAS,KAAK,KAAK;wBAAE,SAAQ,CAAC,mDAAmD;oBAErF,MAAM,QAAQ,GAAG,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAA;oBACzF,GAAG,CAAC,IAAI,CACN;wBACE,MAAM,EAAE,kBAAkB;wBAC1B,QAAQ;wBACR,UAAU,EAAE,OAAO,CAAC,UAAU;wBAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,WAAW,EAAE,SAAS;wBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;qBAC/B,EACD,wBAAwB,CACzB,CAAA;oBACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;oBAEpF,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;wBACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;wBACtE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;oBACpD,CAAC;oBAED,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;wBAC1B,+DAA+D;wBAC/D,8DAA8D;wBAC9D,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;oBAC7F,CAAC;oBAED,8DAA8D;oBAC9D,kEAAkE;oBAClE,mEAAmE;oBACnE,8BAA8B;gBAChC,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,oEAAoE;gBACpE,kEAAkE;gBAClE,kEAAkE;gBAClE,yDAAyD;gBACzD,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,oCAAoC,CAAC,CAAA;YACrH,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,wEAAwE;QACxE,wEAAwE;QACxE,2DAA2D;QAC3D,wEAAwE;QACxE,8DAA8D;QAC9D,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAC7C,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;oBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE;oBAClC,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE;oBACpC,QAAQ;oBACR,aAAa,EAAE,SAAS;oBACxB,YAAY,EAAE,MAAM,EAAE,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC;oBAC/E,YAAY,EAAE,MAAM,EAAE,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE;oBAClE,sBAAsB,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;oBACvE,iBAAiB,EAAE,2BAA2B;oBAC9C,gBAAgB,EAAE,0BAA0B;oBAC5C,sBAAsB,EAAE,gCAAgC;oBACxD,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE;iBAC3D,CAAC,CAAA;gBAEF,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,2CAA2C,CAAC,CAAA;oBACjH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;oBACtE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;gBACpD,CAAC;gBACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC7B,iEAAiE;oBACjE,gDAAgD;oBAChD,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;gBACnG,CAAC;gBACD,yBAAyB;YAC3B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,iEAAiE;gBACjE,mEAAmE;gBACnE,+DAA+D;gBAC/D,0DAA0D;gBAC1D,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,uCAAuC,CAAC,CAAA;YACpH,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QACtD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAC5B,CAAC;CACF"}
+{"version":3,"file":"interceptor.js","sourceRoot":"","sources":["../src/interceptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,WAAW,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAElF,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAA;AACzF,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE/G,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAG3C,OAAO,EAAE,gBAAgB,EAA0B,MAAM,cAAc,CAAA;AAGvE,MAAM,GAAG,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAajD,MAAM,OAAO,mBAAmB;IAEX;IACA;IAMA;IAQA;IASA;IAUA;IASA;IAQA;IAOA;IAQA;IAOA;IA1EnB,YACmB,MAAoB,EACpB,OAA0B;IAC3C;;;;OAIG;IACc,gBAAyB,IAAI;IAC9C;;;;;;OAMG;IACc,aAAqB,SAAS;IAC/C;;;;;;;OAOG;IACc,yBAA2C,MAAM;IAClE;;;;;;;;OAQG;IACc,UAAwB,IAAI,YAAY,EAAE;IAC3D;;;;;;;OAOG;IACc,qBAAkC,SAAS;IAC5D;;;;;;OAMG;IACc,0BAAyE,EAAE;IAC5F;;;;;OAKG;IACc,aAAqC,SAAS;IAC/D;;;;;;OAMG;IACc,cAAsB,SAAS;IAChD;;;;;OAKG;IACc,QAAmC,SAAS;QAzE5C,WAAM,GAAN,MAAM,CAAc;QACpB,YAAO,GAAP,OAAO,CAAmB;QAM1B,kBAAa,GAAb,aAAa,CAAgB;QAQ7B,eAAU,GAAV,UAAU,CAAoB;QAS9B,2BAAsB,GAAtB,sBAAsB,CAA2B;QAUjD,YAAO,GAAP,OAAO,CAAmC;QAS1C,uBAAkB,GAAlB,kBAAkB,CAAyB;QAQ3C,4BAAuB,GAAvB,uBAAuB,CAAoD;QAO3E,eAAU,GAAV,UAAU,CAAoC;QAQ9C,gBAAW,GAAX,WAAW,CAAoB;QAO/B,UAAK,GAAL,KAAK,CAAuC;IAC5D,CAAC;IAEJ;;;;;OAKG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,aAAa,CAAA;IACxD,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,gBAAgB,CAAC,GAAW,EAAE,UAAkB,EAAE,QAAgB,EAAE,SAAkB;QAClG,qEAAqE;QACrE,qEAAqE;QACrE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAA;QAC/D,IAAI,QAAQ,GAAG,kBAAkB,EAAE,CAAC;YAClC,MAAM,cAAc,GAClB,GAAG,UAAU,+CAA+C,kBAAkB,SAAS;gBACvF,8BAA8B,CAAA;YAChC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,sDAAsD,CAAC,CAAA;YACvH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;YACtE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;QACpD,CAAC;QACD,MAAM,WAAW,GACf,GAAG,UAAU,aAAa,QAAQ,IAAI,kBAAkB,kCAAkC;YAC1F,+BAA+B,CAAA;QACjC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;QACnE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IACjD,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,IAAI,CAAC,IAAa,EAAE,QAAgB,EAAE,SAAkB;QACpE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK;YACxB,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC;YACrD,CAAC,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;QAE1D,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,uBAAuB,IAAI,CAAC,EAAE,kBAAkB,OAAO,CAAC,SAAS,IAAI,aAAa,YAAY,OAAO,CAAC,MAAM,EAAE,CAAA;YAC7H,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAA;YAC5G,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,2BAA2B,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;YAC3E,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ;YAC7B,CAAC,CAAC,sBAAsB,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,eAAe,OAAO,CAAC,MAAM,IAAI;gBAC9E,iDAAiD,OAAO,CAAC,MAAM,mBAAmB;gBAClF,6CAA6C;YAC/C,CAAC,CAAC,sBAAsB,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,wCAAwC;gBACrF,0FAA0F;gBAC1F,iDAAiD,CAAA;QACrD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;QACxH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,GAAG,CAAC,CAAA;QAClF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;IAC3D,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,SAAkB;QAC9D,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAA;QAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAA;YAC9B,MAAM,MAAM,GACV,2FAA2F;gBAC3F,0CAA0C,IAAI,CAAC,UAAU,4BAA4B;gBACrF,4FAA4F,CAAA;YAC9F,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;YAC7F,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;YAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;QACpC,CAAC;QAED,IAAI,MAAM,GAAkB,IAAI,CAAA;QAChC,IAAI,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,MAAM;gBACJ,eAAe,IAAI,CAAC,UAAU,wDAAwD;oBACtF,4DAA4D,CAAA;QAChE,CAAC;aAAM,IAAI,QAAQ,CAAC,aAAa,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACpG,MAAM;gBACJ,eAAe,IAAI,CAAC,UAAU,6DAA6D;oBAC3F,0FAA0F;oBAC1F,mEAAmE,CAAA;QACvE,CAAC;aAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9E,MAAM;gBACJ,SAAS,QAAQ,gCAAgC,IAAI,CAAC,UAAU,wBAAwB;oBACxF,kFAAkF,CAAA;QACtF,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;QACrF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;QAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;IACpC,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,sBAAsB,CAAC,QAAgB,EAAE,SAAkB;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAA;QAC9C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAA;QAC5C,MAAM,QAAQ,GAAG,yBAAyB,CACxC,MAAM,EACN,CAAC,QAAQ,EAAE,QAAQ,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC,EAClD,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CACvC,CAAA;QACD,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QACjD,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAA;QACxD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,IAAI,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAA;QACzH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;QAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;IACpC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,SAAkB;QAC/C,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,EAAE,sBAAsB,CAAC,CAAA;QAE7E,wEAAwE;QACxE,qEAAqE;QACrE,8DAA8D;QAC9D,IAAI,qBAAqB,GAAiB,EAAE,CAAA;QAC5C,IAAI,2BAA2B,GAAa,EAAE,CAAA;QAC9C,IAAI,0BAA0B,GAAa,EAAE,CAAA;QAC7C,IAAI,gCAAgC,GAAG,CAAC,CAAA;QAExC,0EAA0E;QAC1E,6DAA6D;QAC7D,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QACtE,IAAI,gBAAgB;YAAE,OAAO,gBAAgB,CAAA;QAE7C,oEAAoE;QACpE,yEAAyE;QACzE,kEAAkE;QAClE,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,kEAAkE;QAClE,mEAAmE;QACnE,sEAAsE;QACtE,uEAAuE;QACvE,SAAS;QACT,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAA;QACtD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3E,MAAM,MAAM,GACV,eAAe,IAAI,CAAC,UAAU,oDAAoD;gBAClF,IAAI,cAAc,CAAC,MAAM,mDAAmD;gBAC5E,sDAAsD,CAAA;YACxD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;YAC7F,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;YAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;QACpC,CAAC;QAED,sEAAsE;QACtE,yEAAyE;QACzE,wEAAwE;QACxE,kEAAkE;QAClE,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAA;QAClD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChE,MAAM,MAAM,GACV,SAAS,QAAQ,kDAAkD;gBACnE,IAAI,YAAY,CAAC,MAAM,iDAAiD;gBACxE,oDAAoD,CAAA;YACtD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;YACzD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;YAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;QACpC,CAAC;QAED,qEAAqE;QACrE,MAAM,SAAS,GAAG,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QAClE,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;QAE/B,qEAAqE;QACrE,uEAAuE;QACvE,IAAI,CAAC;YACH,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAA;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;QACzE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;YACpC,qEAAqE;YACrE,iEAAiE;YACjE,8DAA8D;YAC9D,8DAA8D;YAC9D,qBAAqB,GAAG,GAAG,CAAC,QAAQ,CAAA;YACpC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;gBACnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBACjD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAA;gBAChF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;gBAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;YACpC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,2BAA2B,CAAC,CAAA;YAC5F,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,OAAO;oBACL,MAAM,EAAE,OAAO;oBACf,MAAM,EACJ,+DAA+D;wBAC/D,4DAA4D;wBAC5D,oEAAoE;iBACvE,CAAA;YACH,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;YACrD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;YAC3D,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAA;oBACpG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;oBACnE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;gBACjD,CAAC;gBACD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC3B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAA;oBAChH,qEAAqE;oBACrE,8DAA8D;oBAC9D,qEAAqE;oBACrE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,GAAG,CAAC,CAAA;gBACvF,CAAC;gBACD,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;oBACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;oBACvD,IAAI,IAAI;wBAAE,OAAO,IAAI,CAAA;oBACrB,wDAAwD;gBAC1D,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,yBAAyB,CAAC,CAAA;YAC7F,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,OAAO;oBACL,MAAM,EAAE,OAAO;oBACf,MAAM,EACJ,+DAA+D;wBAC/D,4DAA4D;wBAC5D,oEAAoE;iBACvE,CAAA;YACH,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,qEAAqE;QACrE,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,wBAAwB;QACxB,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;YACrD,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAA;YAC/D,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAA;YACxC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,2BAA2B,GAAG,QAAQ,CAAA;gBACtC,0BAA0B,GAAG,CAAC,YAAY,CAAC,CAAA;gBAC3C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;gBAC1D,MAAM,MAAM,GAAG,uDAAuD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;gBAC3F,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,EAC9F,qDAAqD,CACtD,CAAA;gBACD,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAA;gBACvF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE;oBACnE,UAAU,EAAE,sBAAsB;oBAClC,IAAI,EAAE,kBAAkB;oBACxB,WAAW,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;oBAC3D,QAAQ;oBACR,UAAU,EAAE,CAAC;iBACd,CAAC,CAAA;gBACF,IAAI,eAAe,KAAK,OAAO,EAAE,CAAC;oBAChC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;oBAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;gBACpC,CAAC;gBACD,wDAAwD;YAC1D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,uEAAuE;YACvE,iEAAiE;YACjE,oEAAoE;YACpE,uDAAuD;YACvD,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,iCAAiC,CAAC,CAAA;QAC/G,CAAC;QAED,+DAA+D;QAC/D,yDAAyD;QACzD,qEAAqE;QACrE,+DAA+D;QAC/D,wEAAwE;QACxE,qEAAqE;QACrE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,oBAAoB;QACpB,MAAM,WAAW,GAAgB,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,kBAAkB,CAAA;QACxF,oEAAoE;QACpE,qEAAqE;QACrE,wEAAwE;QACxE,yCAAyC;QACzC,MAAM,MAAM,GAAG,WAAW,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC7G,IAAI,WAAW,KAAK,KAAK,IAAI,MAAM,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAA;gBACtC,MAAM,QAAQ,GAAG,yBAAyB,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;gBAC5E,gCAAgC,GAAG,QAAQ,CAAC,MAAM,CAAA;gBAClD,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC,uBAAuB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAA;gBAC3F,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC/B,MAAM,SAAS,GAAwB,2BAA2B,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAA;oBACnG,IAAI,SAAS,KAAK,KAAK;wBAAE,SAAQ,CAAC,mDAAmD;oBAErF,MAAM,QAAQ,GAAG,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAA;oBACzF,GAAG,CAAC,IAAI,CACN;wBACE,MAAM,EAAE,kBAAkB;wBAC1B,QAAQ;wBACR,UAAU,EAAE,OAAO,CAAC,UAAU;wBAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,WAAW,EAAE,SAAS;wBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;qBAC/B,EACD,wBAAwB,CACzB,CAAA;oBACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAA;oBAE1H,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;wBACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;wBACtE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;oBACpD,CAAC;oBAED,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;wBAC1B,+DAA+D;wBAC/D,8DAA8D;wBAC9D,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;oBAC7F,CAAC;oBAED,8DAA8D;oBAC9D,kEAAkE;oBAClE,mEAAmE;oBACnE,8BAA8B;gBAChC,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,oEAAoE;gBACpE,kEAAkE;gBAClE,kEAAkE;gBAClE,yDAAyD;gBACzD,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,oCAAoC,CAAC,CAAA;YACrH,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,wEAAwE;QACxE,wEAAwE;QACxE,2DAA2D;QAC3D,wEAAwE;QACxE,8DAA8D;QAC9D,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAC7C,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;oBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE;oBAClC,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE;oBACpC,QAAQ;oBACR,aAAa,EAAE,SAAS;oBACxB,YAAY,EAAE,MAAM,EAAE,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC;oBAC/E,YAAY,EAAE,MAAM,EAAE,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE;oBAClE,sBAAsB,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;oBACvE,iBAAiB,EAAE,2BAA2B;oBAC9C,gBAAgB,EAAE,0BAA0B;oBAC5C,sBAAsB,EAAE,gCAAgC;oBACxD,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE;iBAC3D,CAAC,CAAA;gBAEF,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,2CAA2C,CAAC,CAAA;oBACjH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;oBACtE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;gBACpD,CAAC;gBACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC7B,iEAAiE;oBACjE,gDAAgD;oBAChD,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;gBACnG,CAAC;gBACD,yBAAyB;YAC3B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,iEAAiE;gBACjE,mEAAmE;gBACnE,+DAA+D;gBAC/D,0DAA0D;gBAC1D,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,uCAAuC,CAAC,CAAA;YACpH,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QACtD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAC5B,CAAC;CACF"}

package/dist/policy.d.ts

@@ -39,6 +39,49 @@ export interface SopRule {
  * two-copies-of-one-rule failure the harness gates were just rebuilt to remove.
  */
 export declare function isSopRule(value: unknown): value is SopRule;
+/**
+ * The workspace's MCP server registry decisions, as the control plane sends
+ * them (`mcpRegistry`). A blocked server is refused always; under a `deny`
+ * default, so is every server not approved; a disabled tool is hidden from
+ * tools/list and refused within any server.
+ */
+export interface McpRegistryPolicy {
+    defaultPolicy: 'allow' | 'deny';
+    approvedServers: string[];
+    blockedServers: string[];
+    disabledTools: Record<string, string[]>;
+}
+/**
+ * What an older control plane — one that sends no `mcpRegistry` at all —
+ * means: no registry, so nothing is refused on its account. Distinct from an
+ * UNKNOWN registry (no policy loaded yet), which the interceptor resolves
+ * through the fail-open/fail-closed setting instead.
+ */
+export declare const UNRESTRICTED_REGISTRY: McpRegistryPolicy;
+/**
+ * The workspace member this proxy's API key resolves to, as the control
+ * plane resolved it. Never derived locally: the proxy can know the OS user it
+ * runs as, but only the control plane can say which member a key belongs to.
+ */
+export interface McpPrincipal {
+    memberId: string;
+    email: string;
+    role: string;
+    ssoGroups: string[];
+}
+/** The workspace's SSO group policy — the one the server-side hook gate applies. */
+export interface SsoGroupPolicy {
+    highRiskTools: string[];
+    requiredGroups: string[];
+    requireOboFor: string[];
+}
+/**
+ * Parses `mcpRegistry`. Returns `undefined` for anything that is not a
+ * registry object, so the caller decides what absence means for its source.
+ */
+export declare function parseRegistry(value: unknown): McpRegistryPolicy | undefined;
+export declare function parsePrincipal(value: unknown): McpPrincipal | undefined;
+export declare function parseSsoGroupPolicy(value: unknown): SsoGroupPolicy | undefined;
 export declare class PolicyClient {
     private readonly controlPlaneUrl;
     private readonly apiKey;
@@ -97,7 +140,26 @@ export declare class PolicyClient {
      * above uses.
      */
     private anomalyOverrides;
-    private lastFetchAt;
+    /**
+     * Registry decisions from the last policy that carried them. `undefined`
+     * until then — no policy has loaded in this process, or the only one so far
+     * was the MCP daemon's snapshot seed, which carries none. The interceptor
+     * resolves that state through the fail-open/fail-closed setting.
+     */
+    private registry;
+    private principal;
+    /**
+     * The workspace's `mcpProxyFailBehavior` as a fail-open flag, or
+     * `undefined` when the control plane did not send it (the workspace never
+     * chose, or no policy has loaded) — then `INTUTIC_MCP_FAIL_OPEN` decides.
+     */
+    private failOpen;
+    private ssoGroupPolicy;
+    /** The first refresh `start()` kicks off, so the first tool call can wait for it. */
+    private firstRefresh;
+    private lastRefreshAttemptAt;
+    /** Whether a policy that came from the control plane (directly or through the daemon's fetch) has loaded. */
+    private loadedFromControlPlane;
     private refreshTimer;
     constructor(controlPlaneUrl: string, apiKey: string, workspaceId: string, ttlMs?: number, mcpProxyMode?: string);
     /**
@@ -114,6 +176,27 @@ export declare class PolicyClient {
     start(onTick?: () => void | Promise<void>): void;
     /** Stop the background refresh timer. */
     stop(): void;
+    /**
+     * Resolves once the policy is as loaded as it is going to get for this call.
+     *
+     * The first tool call of a process can arrive before `start()`'s first
+     * fetch has answered; without this wait, a `deny` workspace's very first
+     * call would be decided against no registry at all. After that, while the
+     * registry is still unknown (control plane unreachable, or only the
+     * daemon's snapshot seed so far), a call triggers one more refresh at most
+     * every {@link UNKNOWN_REGISTRY_RETRY_MS} — so a proxy started offline
+     * picks the registry up as soon as it can, not at the next 60-second tick.
+     * Never rejects; every wait is bounded by the 5-second fetch timeout.
+     */
+    ready(): Promise<void>;
+    /** Registry decisions, or `undefined` while none has loaded (see the field). */
+    getRegistry(): McpRegistryPolicy | undefined;
+    /** The member this proxy's key resolves to, when the control plane said. */
+    getPrincipal(): McpPrincipal | undefined;
+    /** The workspace's SSO group policy, when it has one. */
+    getSsoGroupPolicy(): SsoGroupPolicy | undefined;
+    /** The workspace's fail-open choice, or `undefined` to fall back to the local setting (see the field). */
+    getFailOpen(): boolean | undefined;
     /** Return the current cached rule set. */
     getRules(): readonly SopRule[];
     /** Workspace DLP regex sources from the last successful refresh. */

package/dist/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAA;IACnB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2CAA2C;IAC3C,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,CAAA;IAC7C,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;;;;;GAaG;AACH;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAU1D;AAMD,qBAAa,YAAY;IAyDrB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY;IA5D/B,OAAO,CAAC,KAAK,CAAgB;IAC7B;;;;;OAKG;IACH,OAAO,CAAC,WAAW,CAAe;IAClC,gGAAgG;IAChG,OAAO,CAAC,iBAAiB,CAAe;IACxC;;;;;;OAMG;IACH,OAAO,CAAC,YAAY,CAAe;IACnC,2EAA2E;IAC3E,OAAO,CAAC,wBAAwB,CAA6B;IAC7D;;;;;;OAMG;IACH,OAAO,CAAC,cAAc,CAAe;IACrC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe,CAA8B;IACrD;;;;OAIG;IACH,OAAO,CAAC,WAAW,CAAwC;IAC3D;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB,CAAyD;IACjF,OAAO,CAAC,WAAW,CAAI;IACvB,OAAO,CAAC,YAAY,CAA8B;gBAG/B,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,KAAK,GAAE,MAAe,EACtB,YAAY,GAAE,MAAsB;IAGvD;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAehD,yCAAyC;IACzC,IAAI,IAAI,IAAI;IAOZ,0CAA0C;IAC1C,QAAQ,IAAI,SAAS,OAAO,EAAE;IAI9B,oEAAoE;IACpE,gGAAgG;IAChG,oBAAoB,IAAI,SAAS,MAAM,EAAE;IAIzC,cAAc,IAAI,SAAS,MAAM,EAAE;IAInC,6DAA6D;IAC7D,eAAe,IAAI,SAAS,MAAM,EAAE;IAIpC,mEAAmE;IACnE,iBAAiB,IAAI,SAAS,MAAM,EAAE;IAItC,8DAA8D;IAC9D,2BAA2B,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAI/D;;;;;;;OAOG;IACH,kBAAkB,IAAI,MAAM,GAAG,OAAO,GAAG,SAAS;IAIlD,yFAAyF;IACzF,cAAc,IAAI,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS;IAIxD,8EAA8E;IAC9E,mBAAmB,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC;IAInF,uEAAuE;IACvE,OAAO,CAAC,cAAc;IAmCtB,4EAA4E;IAC5E,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI;IAiBlE,gDAAgD;IAC1C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CA6D/B"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAA;IACnB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2CAA2C;IAC3C,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,CAAA;IAC7C,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;;;;;GAaG;AACH;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAU1D;AAMD;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,OAAO,GAAG,MAAM,CAAA;IAC/B,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;CACxC;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,iBAKb,CAAA;AAEvB;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,EAAE,CAAA;CACpB;AAED,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,aAAa,EAAE,MAAM,EAAE,CAAA;CACxB;AAUD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,GAAG,SAAS,CAe3E;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAQvE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,SAAS,CAO9E;AAKD,qBAAa,YAAY;IA4ErB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY;IA/E/B,OAAO,CAAC,KAAK,CAAgB;IAC7B;;;;;OAKG;IACH,OAAO,CAAC,WAAW,CAAe;IAClC,gGAAgG;IAChG,OAAO,CAAC,iBAAiB,CAAe;IACxC;;;;;;OAMG;IACH,OAAO,CAAC,YAAY,CAAe;IACnC,2EAA2E;IAC3E,OAAO,CAAC,wBAAwB,CAA6B;IAC7D;;;;;;OAMG;IACH,OAAO,CAAC,cAAc,CAAe;IACrC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe,CAA8B;IACrD;;;;OAIG;IACH,OAAO,CAAC,WAAW,CAAwC;IAC3D;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB,CAAyD;IACjF;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAA+B;IAC/C,OAAO,CAAC,SAAS,CAA0B;IAC3C;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,cAAc,CAA4B;IAClD,qFAAqF;IACrF,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,oBAAoB,CAAI;IAChC,6GAA6G;IAC7G,OAAO,CAAC,sBAAsB,CAAQ;IACtC,OAAO,CAAC,YAAY,CAA8B;gBAG/B,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,KAAK,GAAE,MAAe,EACtB,YAAY,GAAE,MAAsB;IAGvD;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAgBhD,yCAAyC;IACzC,IAAI,IAAI,IAAI;IAOZ;;;;;;;;;;;OAWG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAO5B,gFAAgF;IAChF,WAAW,IAAI,iBAAiB,GAAG,SAAS;IAI5C,4EAA4E;IAC5E,YAAY,IAAI,YAAY,GAAG,SAAS;IAIxC,yDAAyD;IACzD,iBAAiB,IAAI,cAAc,GAAG,SAAS;IAI/C,0GAA0G;IAC1G,WAAW,IAAI,OAAO,GAAG,SAAS;IAIlC,0CAA0C;IAC1C,QAAQ,IAAI,SAAS,OAAO,EAAE;IAI9B,oEAAoE;IACpE,gGAAgG;IAChG,oBAAoB,IAAI,SAAS,MAAM,EAAE;IAIzC,cAAc,IAAI,SAAS,MAAM,EAAE;IAInC,6DAA6D;IAC7D,eAAe,IAAI,SAAS,MAAM,EAAE;IAIpC,mEAAmE;IACnE,iBAAiB,IAAI,SAAS,MAAM,EAAE;IAItC,8DAA8D;IAC9D,2BAA2B,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAI/D;;;;;;;OAOG;IACH,kBAAkB,IAAI,MAAM,GAAG,OAAO,GAAG,SAAS;IAIlD,yFAAyF;IACzF,cAAc,IAAI,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS;IAIxD,8EAA8E;IAC9E,mBAAmB,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC;IAInF,uEAAuE;IACvE,OAAO,CAAC,cAAc;IAuCtB,4EAA4E;IAC5E,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI;IAiBlE,gDAAgD;IAC1C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAwF/B"}