@intutic/mcp-governance-proxy 2.0.0 → 2.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (75) hide show
  1. package/README.md +33 -18
  2. package/dist/anomaly/index.d.ts +2 -1
  3. package/dist/anomaly/index.d.ts.map +1 -1
  4. package/dist/anomaly/index.js.map +1 -1
  5. package/dist/approvalHold.d.ts +65 -0
  6. package/dist/approvalHold.d.ts.map +1 -0
  7. package/dist/approvalHold.js +142 -0
  8. package/dist/approvalHold.js.map +1 -0
  9. package/dist/config.d.ts +6 -1
  10. package/dist/config.d.ts.map +1 -1
  11. package/dist/config.js +1 -1
  12. package/dist/config.js.map +1 -1
  13. package/dist/daemon/healthMonitor.d.ts +2 -0
  14. package/dist/daemon/healthMonitor.d.ts.map +1 -1
  15. package/dist/daemon/healthMonitor.js +60 -26
  16. package/dist/daemon/healthMonitor.js.map +1 -1
  17. package/dist/daemon/instrumentation.d.ts +2 -2
  18. package/dist/daemon/instrumentation.js +2 -2
  19. package/dist/daemon/policyCache.d.ts +23 -0
  20. package/dist/daemon/policyCache.d.ts.map +1 -1
  21. package/dist/daemon/policyCache.js +28 -7
  22. package/dist/daemon/policyCache.js.map +1 -1
  23. package/dist/emitter.d.ts +43 -9
  24. package/dist/emitter.d.ts.map +1 -1
  25. package/dist/emitter.js +23 -43
  26. package/dist/emitter.js.map +1 -1
  27. package/dist/httpJson.d.ts +19 -0
  28. package/dist/httpJson.d.ts.map +1 -0
  29. package/dist/httpJson.js +62 -0
  30. package/dist/httpJson.js.map +1 -0
  31. package/dist/identity.d.ts +27 -0
  32. package/dist/identity.d.ts.map +1 -0
  33. package/dist/identity.js +36 -0
  34. package/dist/identity.js.map +1 -0
  35. package/dist/interceptor.d.ts +88 -4
  36. package/dist/interceptor.d.ts.map +1 -1
  37. package/dist/interceptor.js +161 -11
  38. package/dist/interceptor.js.map +1 -1
  39. package/dist/policy.d.ts +84 -1
  40. package/dist/policy.d.ts.map +1 -1
  41. package/dist/policy.js +160 -39
  42. package/dist/policy.js.map +1 -1
  43. package/dist/proxy.d.ts +12 -7
  44. package/dist/proxy.d.ts.map +1 -1
  45. package/dist/proxy.js +81 -26
  46. package/dist/proxy.js.map +1 -1
  47. package/dist/registryObserver.d.ts +33 -0
  48. package/dist/registryObserver.d.ts.map +1 -0
  49. package/dist/registryObserver.js +59 -0
  50. package/dist/registryObserver.js.map +1 -0
  51. package/dist/version.d.ts +12 -0
  52. package/dist/version.d.ts.map +1 -0
  53. package/dist/version.js +13 -0
  54. package/dist/version.js.map +1 -0
  55. package/dist/wasm/fuel.d.ts +35 -0
  56. package/dist/wasm/fuel.d.ts.map +1 -0
  57. package/dist/wasm/fuel.js +299 -0
  58. package/dist/wasm/fuel.js.map +1 -0
  59. package/dist/wasm/memoryCap.d.ts +21 -0
  60. package/dist/wasm/memoryCap.d.ts.map +1 -0
  61. package/dist/wasm/memoryCap.js +54 -0
  62. package/dist/wasm/memoryCap.js.map +1 -0
  63. package/dist/wasm/runner.d.ts +16 -15
  64. package/dist/wasm/runner.d.ts.map +1 -1
  65. package/dist/wasm/runner.js +36 -22
  66. package/dist/wasm/runner.js.map +1 -1
  67. package/dist/wasm/wasmBinary.d.ts +25 -0
  68. package/dist/wasm/wasmBinary.d.ts.map +1 -0
  69. package/dist/wasm/wasmBinary.js +100 -0
  70. package/dist/wasm/wasmBinary.js.map +1 -0
  71. package/dist/wasm/worker.d.ts +5 -8
  72. package/dist/wasm/worker.d.ts.map +1 -1
  73. package/dist/wasm/worker.js +23 -16
  74. package/dist/wasm/worker.js.map +1 -1
  75. package/package.json +5 -5
@@ -0,0 +1 @@
1
+ {"version":3,"file":"wasmBinary.d.ts","sourceRoot":"","sources":["../../src/wasm/wasmBinary.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;CACjC;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAE7C;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAUtF;AAED,kEAAkE;AAClE,wBAAgB,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAK7D;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAShD;AAED,iDAAiD;AACjD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAShD;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,OAAO,EAAE,CAYtE;AAKD,kFAAkF;AAClF,wBAAgB,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,CAYlG;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC,CAM/F;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC,CAQnE"}
@@ -0,0 +1,100 @@
1
+ /**
2
+ * The few pieces of the WebAssembly binary format the load-time rewrites
3
+ * (`memoryCap.ts`, `fuel.ts`) share: LEB128 integers, the section list, and
4
+ * reassembly. Not a general decoder; each rewrite parses only what it changes.
5
+ */
6
+ const HEADER_BYTES = 8; // `\0asm` + version
7
+ export function malformed(what) {
8
+ return new Error(`malformed WASM module: ${what}`);
9
+ }
10
+ export function readU32(bytes, at) {
11
+ let value = 0;
12
+ let shift = 0;
13
+ for (let i = at; i < bytes.length && i < at + 5; i++) {
14
+ const byte = bytes[i];
15
+ value += (byte & 0x7f) * 2 ** shift;
16
+ if ((byte & 0x80) === 0)
17
+ return { value, next: i + 1 };
18
+ shift += 7;
19
+ }
20
+ throw malformed('truncated or oversized LEB128 integer');
21
+ }
22
+ /** Skip any LEB128 integer, signed or unsigned, up to 64 bits. */
23
+ export function skipLeb(bytes, at) {
24
+ for (let i = at; i < bytes.length && i < at + 10; i++) {
25
+ if ((bytes[i] & 0x80) === 0)
26
+ return i + 1;
27
+ }
28
+ throw malformed('truncated or oversized LEB128 integer');
29
+ }
30
+ export function writeU32(value) {
31
+ const out = [];
32
+ do {
33
+ let byte = value & 0x7f;
34
+ value = Math.floor(value / 128);
35
+ if (value !== 0)
36
+ byte |= 0x80;
37
+ out.push(byte);
38
+ } while (value !== 0);
39
+ return out;
40
+ }
41
+ /** Signed LEB128, for `i32.const` immediates. */
42
+ export function writeS32(value) {
43
+ const out = [];
44
+ for (;;) {
45
+ const byte = value & 0x7f;
46
+ value >>= 7;
47
+ const done = (value === 0 && (byte & 0x40) === 0) || (value === -1 && (byte & 0x40) !== 0);
48
+ out.push(done ? byte : byte | 0x80);
49
+ if (done)
50
+ return out;
51
+ }
52
+ }
53
+ export function readSections(bytes) {
54
+ const sections = [];
55
+ let at = HEADER_BYTES;
56
+ while (at < bytes.length) {
57
+ const id = bytes[at];
58
+ const size = readU32(bytes, at + 1);
59
+ const end = size.next + size.value;
60
+ if (end > bytes.length)
61
+ throw malformed('section runs past the end');
62
+ sections.push({ id, payload: bytes.subarray(size.next, end) });
63
+ at = end;
64
+ }
65
+ return sections;
66
+ }
67
+ /** Section order the spec requires; custom sections (id 0) may sit anywhere. */
68
+ const SECTION_RANK = { 1: 1, 2: 2, 3: 3, 4: 4, 5: 5, 13: 6, 6: 7, 7: 8, 8: 9, 9: 10, 12: 11, 10: 12, 11: 13 };
69
+ /** Replace the section with `id`, or insert it where the spec's order puts it. */
70
+ export function putSection(sections, id, payload) {
71
+ const existing = sections.findIndex((s) => s.id === id);
72
+ if (existing >= 0) {
73
+ sections[existing] = { id, payload };
74
+ return;
75
+ }
76
+ const rank = SECTION_RANK[id];
77
+ let insertAt = 0;
78
+ sections.forEach((s, i) => {
79
+ if (s.id !== 0 && SECTION_RANK[s.id] < rank)
80
+ insertAt = i + 1;
81
+ });
82
+ sections.splice(insertAt, 0, { id, payload });
83
+ }
84
+ export function assembleModule(header, sections) {
85
+ const parts = [header.subarray(0, HEADER_BYTES)];
86
+ for (const s of sections) {
87
+ parts.push(Uint8Array.from([s.id, ...writeU32(s.payload.length)]), s.payload);
88
+ }
89
+ return concat(parts);
90
+ }
91
+ export function concat(parts) {
92
+ const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
93
+ let at = 0;
94
+ for (const p of parts) {
95
+ out.set(p, at);
96
+ at += p.length;
97
+ }
98
+ return out;
99
+ }
100
+ //# sourceMappingURL=wasmBinary.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"wasmBinary.js","sourceRoot":"","sources":["../../src/wasm/wasmBinary.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,YAAY,GAAG,CAAC,CAAA,CAAC,oBAAoB;AAO3C,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,IAAI,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAA;AACpD,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,KAAiB,EAAE,EAAU;IACnD,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACtB,KAAK,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAA;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAA;QACtD,KAAK,IAAI,CAAC,CAAA;IACZ,CAAC;IACD,MAAM,SAAS,CAAC,uCAAuC,CAAC,CAAA;AAC1D,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,OAAO,CAAC,KAAiB,EAAE,EAAU;IACnD,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QACtD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAA;IAC5C,CAAC;IACD,MAAM,SAAS,CAAC,uCAAuC,CAAC,CAAA;AAC1D,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,GAAG,CAAC;QACF,IAAI,IAAI,GAAG,KAAK,GAAG,IAAI,CAAA;QACvB,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAA;QAC/B,IAAI,KAAK,KAAK,CAAC;YAAE,IAAI,IAAI,IAAI,CAAA;QAC7B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChB,CAAC,QAAQ,KAAK,KAAK,CAAC,EAAC;IACrB,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,KAAK,GAAG,IAAI,CAAA;QACzB,KAAK,KAAK,CAAC,CAAA;QACX,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;QAC1F,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;QACnC,IAAI,IAAI;YAAE,OAAO,GAAG,CAAA;IACtB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAA8B;IACzD,MAAM,QAAQ,GAAc,EAAE,CAAA;IAC9B,IAAI,EAAE,GAAG,YAAY,CAAA;IACrB,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAE,CAAA;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAA;QAClC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM;YAAE,MAAM,SAAS,CAAC,2BAA2B,CAAC,CAAA;QACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;QAC9D,EAAE,GAAG,GAAG,CAAA;IACV,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,gFAAgF;AAChF,MAAM,YAAY,GAA2B,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAA;AAErI,kFAAkF;AAClF,MAAM,UAAU,UAAU,CAAC,QAAmB,EAAE,EAAU,EAAE,OAAgC;IAC1F,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IACvD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,CAAA;QACpC,OAAM;IACR,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAE,CAAA;IAC9B,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,CAAE,GAAG,IAAI;YAAE,QAAQ,GAAG,CAAC,GAAG,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IACF,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAkB,EAAE,QAAmB;IACpE,MAAM,KAAK,GAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAA;IAC9D,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;AACtB,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAmB;IACxC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAA;IACnE,IAAI,EAAE,GAAG,CAAC,CAAA;IACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACd,EAAE,IAAI,CAAC,CAAC,MAAM,CAAA;IAChB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}
@@ -26,14 +26,11 @@
26
26
  * @module
27
27
  */
28
28
  /**
29
- * Guest memory ceiling, `runner.rs`'s 16MB `StoreLimits` (TD-440). V8 offers
30
- * no grow hook on a memory the module itself exports and `unsupportedWasmImports`
31
- * refuses an imported one, so this is enforced AFTER the call: a rule whose
32
- * memory grew past the ceiling has its verdict discarded and reported as a
33
- * failure (fail-open, like a trap), rather than being stopped mid-growth.
34
- * What it cannot do is bound the growth itself; that remainder stays in
35
- * TD-440. Checked before the call too, so a module that declares more than
36
- * the ceiling as its initial size never runs.
29
+ * Guest memory ceiling, `runner.rs`'s 16MB `StoreLimits` (TD-440). Enforced at
30
+ * load by `capDeclaredMemory`: the module's own memory is rewritten to declare
31
+ * this as its maximum, so V8 refuses any `memory.grow` past it (the call
32
+ * returns -1) instead of growing. A module whose initial size is already over
33
+ * it is refused, and so is an imported memory, which would sit outside the cap.
37
34
  */
38
35
  export declare const MAX_GUEST_MEMORY_BYTES: number;
39
36
  //# sourceMappingURL=worker.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../src/wasm/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAOH;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,QAAmB,CAAA"}
1
+ {"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../src/wasm/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AASH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,QAAmB,CAAA"}
@@ -29,15 +29,14 @@ import { parentPort } from 'node:worker_threads';
29
29
  import { unsupportedWasmImports, WASM_HOST_IMPORTS } from '@intutic/shared-types';
30
30
  import { createHostImports, newHostImportState } from './hostImports.js';
31
31
  import { ReferencedFiles } from './referencedFiles.js';
32
+ import { capDeclaredMemory, WASM_PAGE_BYTES } from './memoryCap.js';
33
+ import { DEFAULT_FUEL_BUDGET, FUEL_EXPORT, meterFuel } from './fuel.js';
32
34
  /**
33
- * Guest memory ceiling, `runner.rs`'s 16MB `StoreLimits` (TD-440). V8 offers
34
- * no grow hook on a memory the module itself exports and `unsupportedWasmImports`
35
- * refuses an imported one, so this is enforced AFTER the call: a rule whose
36
- * memory grew past the ceiling has its verdict discarded and reported as a
37
- * failure (fail-open, like a trap), rather than being stopped mid-growth.
38
- * What it cannot do is bound the growth itself; that remainder stays in
39
- * TD-440. Checked before the call too, so a module that declares more than
40
- * the ceiling as its initial size never runs.
35
+ * Guest memory ceiling, `runner.rs`'s 16MB `StoreLimits` (TD-440). Enforced at
36
+ * load by `capDeclaredMemory`: the module's own memory is rewritten to declare
37
+ * this as its maximum, so V8 refuses any `memory.grow` past it (the call
38
+ * returns -1) instead of growing. A module whose initial size is already over
39
+ * it is refused, and so is an imported memory, which would sit outside the cap.
41
40
  */
42
41
  export const MAX_GUEST_MEMORY_BYTES = 16 * 1024 * 1024;
43
42
  /**
@@ -72,7 +71,11 @@ function importsUsingReadReferencedFile(module) {
72
71
  }
73
72
  function handleCompile(msg) {
74
73
  try {
75
- const module = new WebAssembly.Module(new Uint8Array(msg.bytes));
74
+ const capped = capDeclaredMemory(new Uint8Array(msg.bytes), MAX_GUEST_MEMORY_BYTES / WASM_PAGE_BYTES);
75
+ const module = new WebAssembly.Module(meterFuel(capped, DEFAULT_FUEL_BUDGET));
76
+ if (WebAssembly.Module.imports(module).some((i) => i.kind === 'memory')) {
77
+ throw new Error('WASM rule imports its memory; a rule must define and export its own');
78
+ }
76
79
  const unsupported = unsupportedWasmImports(module);
77
80
  if (unsupported.length > 0) {
78
81
  parentPort?.postMessage({
@@ -159,6 +162,9 @@ function handleEvaluate(msg) {
159
162
  parentPort?.postMessage({ type: 'evaluate-result', id: msg.id, ruleId: msg.ruleId, ok: false, error: 'rule not loaded' });
160
163
  return;
161
164
  }
165
+ // Read in the catch below: a trap with the counter below zero is the
166
+ // instruction budget running out, not the rule's own `unreachable`.
167
+ let fuel;
162
168
  try {
163
169
  // A holder object, not a reassigned `let`: the import object (needed by
164
170
  // `WebAssembly.Instance` below) has to exist BEFORE the instance's own
@@ -169,15 +175,15 @@ function handleEvaluate(msg) {
169
175
  const env = createHostImports(() => memoryHolder.current, hostState);
170
176
  const instance = new WebAssembly.Instance(module, { env });
171
177
  const exportsObj = instance.exports;
178
+ const fuelExport = exportsObj[FUEL_EXPORT];
179
+ if (fuelExport instanceof WebAssembly.Global)
180
+ fuel = fuelExport;
172
181
  const memExport = exportsObj['memory'];
173
182
  if (!(memExport instanceof WebAssembly.Memory)) {
174
183
  throw new Error("WASM module missing 'memory' export");
175
184
  }
176
185
  memoryHolder.current = memExport;
177
186
  const memory = memExport;
178
- if (memory.buffer.byteLength > MAX_GUEST_MEMORY_BYTES) {
179
- throw new Error(`WASM module declares ${memory.buffer.byteLength} bytes of initial memory, over the ${MAX_GUEST_MEMORY_BYTES}-byte ceiling`);
180
- }
181
187
  const contextBytes = new Uint8Array(msg.bytes);
182
188
  // allocate() primary, __new(size, id) AssemblyScript fallback — same
183
189
  // fallback order as runner.rs.
@@ -205,21 +211,22 @@ function handleEvaluate(msg) {
205
211
  // hostile length must not be able to buy extra time by doing so after
206
212
  // the verdict — same reasoning runner.rs states for its own placement.
207
213
  const reason = readGuestReason(exportsObj, memory);
208
- if (memory.buffer.byteLength > MAX_GUEST_MEMORY_BYTES) {
209
- throw new Error(`WASM rule grew guest memory to ${memory.buffer.byteLength} bytes, over the ${MAX_GUEST_MEMORY_BYTES}-byte ceiling; verdict discarded`);
210
- }
211
214
  parentPort?.postMessage({ type: 'evaluate-result', id: msg.id, ruleId: msg.ruleId, ok: true, code, reason });
212
215
  }
213
216
  catch (err) {
214
217
  // A guest trap (including one following an `abort` call) lands here.
215
218
  // Reported as a failure, never re-thrown — the worker process must
216
219
  // survive one hostile or buggy rule to keep evaluating every other one.
220
+ const fuelExhausted = fuel !== undefined && fuel.value < 0;
217
221
  parentPort?.postMessage({
218
222
  type: 'evaluate-result',
219
223
  id: msg.id,
220
224
  ruleId: msg.ruleId,
221
225
  ok: false,
222
- error: err instanceof Error ? err.message : String(err),
226
+ fuelExhausted,
227
+ error: fuelExhausted
228
+ ? `WASM rule ran out of its ${DEFAULT_FUEL_BUDGET}-instruction budget`
229
+ : err instanceof Error ? err.message : String(err),
223
230
  });
224
231
  }
225
232
  }
@@ -1 +1 @@
1
- {"version":3,"file":"worker.js","sourceRoot":"","sources":["../../src/wasm/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACxE,OAAO,EAAE,eAAe,EAA6B,MAAM,sBAAsB,CAAA;AAEjF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAEtD;;;GAGG;AACH,MAAM,gBAAgB,GAAG,GAAG,CAAA;AAE5B;;;;;;;;GAQG;AACH,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAChC,MAAM,QAAQ,GAAG,IAAI,CAAA;AAErB,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,IAAI,IAAI,mBAAmB,IAAI,IAAI,KAAK,QAAQ;YAAE,SAAQ;QAC9D,GAAG,IAAI,EAAE,CAAA;IACX,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAqBD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAA;AAErD,SAAS,8BAA8B,CAAC,MAA0B;IAChE,OAAO,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAC5C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,sBAAsB,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CACxF,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAmB;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QAChE,MAAM,WAAW,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;QAClD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,UAAU,EAAE,WAAW,CAAC;gBACtB,IAAI,EAAE,gBAAgB;gBACtB,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,EAAE,EAAE,KAAK;gBACT,kBAAkB,EAAE,WAAW;aAChC,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC/B,UAAU,EAAE,WAAW,CAAC;YACtB,IAAI,EAAE,gBAAgB;YACtB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,EAAE,EAAE,IAAI;YACR,oBAAoB,EAAE,8BAA8B,CAAC,MAAM,CAAC;SAC7D,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,EAAE,WAAW,CAAC;YACtB,IAAI,EAAE,gBAAgB;YACtB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAkB;IACtC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;AAC5B,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,UAAmC,EAAE,MAA0B;IACtF,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,CAAA;IACtC,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,CAAA;IACtC,IAAI,OAAO,KAAK,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,UAAU;QAAE,OAAO,SAAS,CAAA;IAEhF,IAAI,GAAY,CAAA;IAChB,IAAI,GAAY,CAAA;IAChB,IAAI,CAAC;QACH,GAAG,GAAI,KAAsB,EAAE,CAAA;QAC/B,GAAG,GAAI,KAAsB,EAAE,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IACxE,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IAE1C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;IACjD,MAAM,GAAG,GAAG,GAAG,GAAG,SAAS,CAAA;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAExC,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAClB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACvC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;IAC7C,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;AACnD,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,UAAU,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAA;QACzH,OAAM;IACR,CAAC;IAED,IAAI,CAAC;QACH,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,YAAY,GAAgD,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;QACxF,MAAM,SAAS,GAAG,kBAAkB,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QAC1E,MAAM,GAAG,GAA8B,iBAAiB,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAC/F,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;QAC1D,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAkC,CAAA;QAE9D,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;QACtC,IAAI,CAAC,CAAC,SAAS,YAAY,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACxD,CAAC;QACD,YAAY,CAAC,OAAO,GAAG,SAAS,CAAA;QAChC,MAAM,MAAM,GAAG,SAAS,CAAA;QACxB,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,sBAAsB,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,CAAC,MAAM,CAAC,UAAU,sCAAsC,sBAAsB,eAAe,CAAC,CAAA;QAC9I,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAE9C,qEAAqE;QACrE,+BAA+B;QAC/B,IAAI,MAAc,CAAA;QAClB,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;YACrC,MAAM,GAAI,UAAoC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;QACrE,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;YACvC,MAAM,GAAI,KAA8C,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QAClF,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;QACrE,CAAC;QAED,qEAAqE;QACrE,sDAAsD;QACtD,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QAE5E,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;QACzC,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC1D,CAAC;QACD,MAAM,IAAI,GAAI,UAAsD,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAA;QAEjG,kEAAkE;QAClE,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;QAElD,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,sBAAsB,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,MAAM,CAAC,UAAU,oBAAoB,sBAAsB,kCAAkC,CAAC,CAAA;QACzJ,CAAC;QAED,UAAU,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IAC9G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,qEAAqE;QACrE,mEAAmE;QACnE,wEAAwE;QACxE,UAAU,EAAE,WAAW,CAAC;YACtB,IAAI,EAAE,iBAAiB;YACvB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,UAAU,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,GAAc,EAAE,EAAE;IAC3C,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,SAAS;YACZ,aAAa,CAAC,GAAG,CAAC,CAAA;YAClB,MAAK;QACP,KAAK,QAAQ;YACX,YAAY,CAAC,GAAG,CAAC,CAAA;YACjB,MAAK;QACP,KAAK,UAAU;YACb,cAAc,CAAC,GAAG,CAAC,CAAA;YACnB,MAAK;IACT,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,4EAA4E;AAC5E,yEAAyE;AACzE,qEAAqE;AACrE,gEAAgE;AAChE,yDAAyD;AACzD,KAAK,iBAAiB,CAAA"}
1
+ {"version":3,"file":"worker.js","sourceRoot":"","sources":["../../src/wasm/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACxE,OAAO,EAAE,eAAe,EAA6B,MAAM,sBAAsB,CAAA;AACjF,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAEvE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAEtD;;;GAGG;AACH,MAAM,gBAAgB,GAAG,GAAG,CAAA;AAE5B;;;;;;;;GAQG;AACH,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAChC,MAAM,QAAQ,GAAG,IAAI,CAAA;AAErB,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,IAAI,IAAI,mBAAmB,IAAI,IAAI,KAAK,QAAQ;YAAE,SAAQ;QAC9D,GAAG,IAAI,EAAE,CAAA;IACX,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAqBD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAA;AAErD,SAAS,8BAA8B,CAAC,MAA0B;IAChE,OAAO,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAC5C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,sBAAsB,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CACxF,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAmB;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,sBAAsB,GAAG,eAAe,CAAC,CAAA;QACrG,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAA;QAC7E,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAA;QACxF,CAAC;QACD,MAAM,WAAW,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;QAClD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,UAAU,EAAE,WAAW,CAAC;gBACtB,IAAI,EAAE,gBAAgB;gBACtB,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,EAAE,EAAE,KAAK;gBACT,kBAAkB,EAAE,WAAW;aAChC,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC/B,UAAU,EAAE,WAAW,CAAC;YACtB,IAAI,EAAE,gBAAgB;YACtB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,EAAE,EAAE,IAAI;YACR,oBAAoB,EAAE,8BAA8B,CAAC,MAAM,CAAC;SAC7D,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,EAAE,WAAW,CAAC;YACtB,IAAI,EAAE,gBAAgB;YACtB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAkB;IACtC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;AAC5B,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,UAAmC,EAAE,MAA0B;IACtF,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,CAAA;IACtC,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,CAAA;IACtC,IAAI,OAAO,KAAK,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,UAAU;QAAE,OAAO,SAAS,CAAA;IAEhF,IAAI,GAAY,CAAA;IAChB,IAAI,GAAY,CAAA;IAChB,IAAI,CAAC;QACH,GAAG,GAAI,KAAsB,EAAE,CAAA;QAC/B,GAAG,GAAI,KAAsB,EAAE,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IACxE,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IAE1C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;IACjD,MAAM,GAAG,GAAG,GAAG,GAAG,SAAS,CAAA;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAExC,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAClB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACvC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;IAC7C,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;AACnD,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,UAAU,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAA;QACzH,OAAM;IACR,CAAC;IAED,qEAAqE;IACrE,oEAAoE;IACpE,IAAI,IAAoC,CAAA;IACxC,IAAI,CAAC;QACH,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,YAAY,GAAgD,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;QACxF,MAAM,SAAS,GAAG,kBAAkB,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QAC1E,MAAM,GAAG,GAA8B,iBAAiB,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAC/F,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;QAC1D,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAkC,CAAA;QAC9D,MAAM,UAAU,GAAG,UAAU,CAAC,WAAW,CAAC,CAAA;QAC1C,IAAI,UAAU,YAAY,WAAW,CAAC,MAAM;YAAE,IAAI,GAAG,UAAU,CAAA;QAE/D,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;QACtC,IAAI,CAAC,CAAC,SAAS,YAAY,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACxD,CAAC;QACD,YAAY,CAAC,OAAO,GAAG,SAAS,CAAA;QAChC,MAAM,MAAM,GAAG,SAAS,CAAA;QAExB,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAE9C,qEAAqE;QACrE,+BAA+B;QAC/B,IAAI,MAAc,CAAA;QAClB,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;YACrC,MAAM,GAAI,UAAoC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;QACrE,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;YACvC,MAAM,GAAI,KAA8C,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QAClF,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;QACrE,CAAC;QAED,qEAAqE;QACrE,sDAAsD;QACtD,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QAE5E,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;QACzC,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC1D,CAAC;QACD,MAAM,IAAI,GAAI,UAAsD,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAA;QAEjG,kEAAkE;QAClE,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;QAElD,UAAU,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IAC9G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,qEAAqE;QACrE,mEAAmE;QACnE,wEAAwE;QACxE,MAAM,aAAa,GAAG,IAAI,KAAK,SAAS,IAAK,IAAI,CAAC,KAAgB,GAAG,CAAC,CAAA;QACtE,UAAU,EAAE,WAAW,CAAC;YACtB,IAAI,EAAE,iBAAiB;YACvB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,EAAE,EAAE,KAAK;YACT,aAAa;YACb,KAAK,EAAE,aAAa;gBAClB,CAAC,CAAC,4BAA4B,mBAAmB,qBAAqB;gBACtE,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACrD,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,UAAU,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,GAAc,EAAE,EAAE;IAC3C,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,SAAS;YACZ,aAAa,CAAC,GAAG,CAAC,CAAA;YAClB,MAAK;QACP,KAAK,QAAQ;YACX,YAAY,CAAC,GAAG,CAAC,CAAA;YACjB,MAAK;QACP,KAAK,UAAU;YACb,cAAc,CAAC,GAAG,CAAC,CAAA;YACnB,MAAK;IACT,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,4EAA4E;AAC5E,yEAAyE;AACzE,qEAAqE;AACrE,gEAAgE;AAChE,yDAAyD;AACzD,KAAK,iBAAiB,CAAA"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@intutic/mcp-governance-proxy",
3
- "version": "2.0.0",
3
+ "version": "2.2.0",
4
4
  "description": "Intutic MCP Governance Proxy — transparent stdio proxy that intercepts all tools/call JSON-RPC messages and applies workspace SOP policy before forwarding to real MCP servers",
5
5
  "type": "module",
6
6
  "license": "MIT",
@@ -22,7 +22,7 @@
22
22
  "LICENSE"
23
23
  ],
24
24
  "dependencies": {
25
- "@modelcontextprotocol/sdk": "^1.30.0",
25
+ "@modelcontextprotocol/sdk": "^1.31.0",
26
26
  "@opentelemetry/api": "^1.9.1",
27
27
  "@opentelemetry/auto-instrumentations-node": "^0.79.0",
28
28
  "@opentelemetry/exporter-metrics-otlp-http": "^0.221.0",
@@ -33,9 +33,9 @@
33
33
  "@opentelemetry/semantic-conventions": "^1.43.0",
34
34
  "ioredis": "^5",
35
35
  "zod": "^3",
36
- "@intutic/id": "2.0.0",
37
- "@intutic/shared-types": "2.0.0",
38
- "@intutic/logger": "2.0.0"
36
+ "@intutic/id": "2.2.0",
37
+ "@intutic/logger": "2.2.0",
38
+ "@intutic/shared-types": "2.2.0"
39
39
  },
40
40
  "devDependencies": {
41
41
  "@types/node": "^22",