@intutic/mcp-governance-proxy 2.1.0 → 2.3.0

package/dist/policy.d.ts

@@ -6,6 +6,7 @@
  *
  * @module
  */
+import { type McpBudgetPolicy, type WorkspacePiiDetectors } from '@intutic/shared-types';
 export interface SopRule {
     id: string;
     /** Regex pattern matched against tool name (e.g. "mcp__github__.*" or "Bash") */
@@ -39,6 +40,55 @@ export interface SopRule {
  * two-copies-of-one-rule failure the harness gates were just rebuilt to remove.
  */
 export declare function isSopRule(value: unknown): value is SopRule;
+/**
+ * The workspace's MCP server registry decisions, as the control plane sends
+ * them (`mcpRegistry`). A blocked server is refused always; under a `deny`
+ * default, so is every server not approved; a disabled tool is hidden from
+ * tools/list and refused within any server.
+ */
+export interface McpRegistryPolicy {
+    defaultPolicy: 'allow' | 'deny';
+    approvedServers: string[];
+    blockedServers: string[];
+    /**
+     * Servers a high-risk tool-set change sent back to the approval queue
+     * (`mcpHighRiskToolChange: hold`). Refused under either default until an
+     * owner or admin decides again.
+     */
+    heldServers: string[];
+    disabledTools: Record<string, string[]>;
+}
+/**
+ * What an older control plane — one that sends no `mcpRegistry` at all —
+ * means: no registry, so nothing is refused on its account. Distinct from an
+ * UNKNOWN registry (no policy loaded yet), which the interceptor resolves
+ * through the fail-open/fail-closed setting instead.
+ */
+export declare const UNRESTRICTED_REGISTRY: McpRegistryPolicy;
+/**
+ * The workspace member this proxy's API key resolves to, as the control
+ * plane resolved it. Never derived locally: the proxy can know the OS user it
+ * runs as, but only the control plane can say which member a key belongs to.
+ */
+export interface McpPrincipal {
+    memberId: string;
+    email: string;
+    role: string;
+    ssoGroups: string[];
+}
+/** The workspace's SSO group policy — the one the server-side hook gate applies. */
+export interface SsoGroupPolicy {
+    highRiskTools: string[];
+    requiredGroups: string[];
+    requireOboFor: string[];
+}
+/**
+ * Parses `mcpRegistry`. Returns `undefined` for anything that is not a
+ * registry object, so the caller decides what absence means for its source.
+ */
+export declare function parseRegistry(value: unknown): McpRegistryPolicy | undefined;
+export declare function parsePrincipal(value: unknown): McpPrincipal | undefined;
+export declare function parseSsoGroupPolicy(value: unknown): SsoGroupPolicy | undefined;
 export declare class PolicyClient {
     private readonly controlPlaneUrl;
     private readonly apiKey;
@@ -53,7 +103,7 @@ export declare class PolicyClient {
      * wired to nothing.
      */
     private dlpPatterns;
-    /** Workspace injection-pattern sources (`mcpInjectionPatterns`, TD-436); empty = floor only. */
+    /** Workspace injection-pattern sources (`mcpInjectionPatterns`); empty = floor only. */
     private injectionPatterns;
     /**
      * Additive tool scoping: when non-empty, ONLY these tools may be called
@@ -97,7 +147,35 @@ export declare class PolicyClient {
      * above uses.
      */
     private anomalyOverrides;
-    private lastFetchAt;
+    /**
+     * Registry decisions from the last policy that carried them. `undefined`
+     * until then — no policy has loaded in this process, or the only one so far
+     * was the MCP daemon's snapshot seed, which carries none. The interceptor
+     * resolves that state through the fail-open/fail-closed setting.
+     */
+    private registry;
+    private principal;
+    /**
+     * The workspace's `mcpProxyFailBehavior` as a fail-open flag, or
+     * `undefined` when the control plane did not send it (the workspace never
+     * chose, or no policy has loaded) — then `INTUTIC_MCP_FAIL_OPEN` decides.
+     */
+    private failOpen;
+    private ssoGroupPolicy;
+    /** The workspace's MCP call budgets (`mcpBudgets`); no budgets until a policy says otherwise. */
+    private mcpBudgets;
+    /**
+     * The workspace's `piiDetectors` setting, read as the LLM proxy reads it
+     * from key-context (`parseWorkspacePiiDetectors`). `none` until a policy
+     * carries one. `unreadable` when the control plane says it could not read
+     * the stored value; the interceptor applies the fail setting to that.
+     */
+    private piiDetectors;
+    /** The first refresh `start()` kicks off, so the first tool call can wait for it. */
+    private firstRefresh;
+    private lastRefreshAttemptAt;
+    /** Whether a policy that came from the control plane (directly or through the daemon's fetch) has loaded. */
+    private loadedFromControlPlane;
     private refreshTimer;
     constructor(controlPlaneUrl: string, apiKey: string, workspaceId: string, ttlMs?: number, mcpProxyMode?: string);
     /**
@@ -114,6 +192,31 @@ export declare class PolicyClient {
     start(onTick?: () => void | Promise<void>): void;
     /** Stop the background refresh timer. */
     stop(): void;
+    /**
+     * Resolves once the policy is as loaded as it is going to get for this call.
+     *
+     * The first tool call of a process can arrive before `start()`'s first
+     * fetch has answered; without this wait, a `deny` workspace's very first
+     * call would be decided against no registry at all. After that, while the
+     * registry is still unknown (control plane unreachable, or only the
+     * daemon's snapshot seed so far), a call triggers one more refresh at most
+     * every {@link UNKNOWN_REGISTRY_RETRY_MS} — so a proxy started offline
+     * picks the registry up as soon as it can, not at the next 60-second tick.
+     * Never rejects; every wait is bounded by the 5-second fetch timeout.
+     */
+    ready(): Promise<void>;
+    /** Registry decisions, or `undefined` while none has loaded (see the field). */
+    getRegistry(): McpRegistryPolicy | undefined;
+    /** The member this proxy's key resolves to, when the control plane said. */
+    getPrincipal(): McpPrincipal | undefined;
+    /** The workspace's SSO group policy, when it has one. */
+    getSsoGroupPolicy(): SsoGroupPolicy | undefined;
+    /** The workspace's MCP call budgets; an empty list means no limits. */
+    getMcpBudgets(): McpBudgetPolicy;
+    /** The workspace's PII detector actions (see the field). */
+    getPiiDetectors(): WorkspacePiiDetectors;
+    /** The workspace's fail-open choice, or `undefined` to fall back to the local setting (see the field). */
+    getFailOpen(): boolean | undefined;
     /** Return the current cached rule set. */
     getRules(): readonly SopRule[];
     /** Workspace DLP regex sources from the last successful refresh. */

package/dist/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAA;IACnB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2CAA2C;IAC3C,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,CAAA;IAC7C,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;;;;;GAaG;AACH;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAU1D;AAMD,qBAAa,YAAY;IAyDrB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY;IA5D/B,OAAO,CAAC,KAAK,CAAgB;IAC7B;;;;;OAKG;IACH,OAAO,CAAC,WAAW,CAAe;IAClC,gGAAgG;IAChG,OAAO,CAAC,iBAAiB,CAAe;IACxC;;;;;;OAMG;IACH,OAAO,CAAC,YAAY,CAAe;IACnC,2EAA2E;IAC3E,OAAO,CAAC,wBAAwB,CAA6B;IAC7D;;;;;;OAMG;IACH,OAAO,CAAC,cAAc,CAAe;IACrC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe,CAA8B;IACrD;;;;OAIG;IACH,OAAO,CAAC,WAAW,CAAwC;IAC3D;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB,CAAyD;IACjF,OAAO,CAAC,WAAW,CAAI;IACvB,OAAO,CAAC,YAAY,CAA8B;gBAG/B,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,KAAK,GAAE,MAAe,EACtB,YAAY,GAAE,MAAsB;IAGvD;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAehD,yCAAyC;IACzC,IAAI,IAAI,IAAI;IAOZ,0CAA0C;IAC1C,QAAQ,IAAI,SAAS,OAAO,EAAE;IAI9B,oEAAoE;IACpE,gGAAgG;IAChG,oBAAoB,IAAI,SAAS,MAAM,EAAE;IAIzC,cAAc,IAAI,SAAS,MAAM,EAAE;IAInC,6DAA6D;IAC7D,eAAe,IAAI,SAAS,MAAM,EAAE;IAIpC,mEAAmE;IACnE,iBAAiB,IAAI,SAAS,MAAM,EAAE;IAItC,8DAA8D;IAC9D,2BAA2B,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAI/D;;;;;;;OAOG;IACH,kBAAkB,IAAI,MAAM,GAAG,OAAO,GAAG,SAAS;IAIlD,yFAAyF;IACzF,cAAc,IAAI,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS;IAIxD,8EAA8E;IAC9E,mBAAmB,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC;IAInF,uEAAuE;IACvE,OAAO,CAAC,cAAc;IAmCtB,4EAA4E;IAC5E,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI;IAiBlE,gDAAgD;IAC1C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CA6D/B"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAA;AAI9B,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAA;IACnB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2CAA2C;IAC3C,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,CAAA;IAC7C,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;;;;;GAaG;AACH;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAU1D;AAMD;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,OAAO,GAAG,MAAM,CAAA;IAC/B,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB;;;;OAIG;IACH,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;CACxC;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,iBAMb,CAAA;AAEvB;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,EAAE,CAAA;CACpB;AAED,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,aAAa,EAAE,MAAM,EAAE,CAAA;CACxB;AAUD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,GAAG,SAAS,CAgB3E;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAQvE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,SAAS,CAO9E;AAKD,qBAAa,YAAY;IAqFrB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAxF/B,OAAO,CAAC,KAAK,CAAgB;IAC7B;;;;;OAKG;IACH,OAAO,CAAC,WAAW,CAAe;IAClC,wFAAwF;IACxF,OAAO,CAAC,iBAAiB,CAAe;IACxC;;;;;;OAMG;IACH,OAAO,CAAC,YAAY,CAAe;IACnC,2EAA2E;IAC3E,OAAO,CAAC,wBAAwB,CAA6B;IAC7D;;;;;;OAMG;IACH,OAAO,CAAC,cAAc,CAAe;IACrC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe,CAA8B;IACrD;;;;OAIG;IACH,OAAO,CAAC,WAAW,CAAwC;IAC3D;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB,CAAyD;IACjF;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAA+B;IAC/C,OAAO,CAAC,SAAS,CAA0B;IAC3C;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,cAAc,CAA4B;IAClD,iGAAiG;IACjG,OAAO,CAAC,UAAU,CAAmD;IACrE;;;;;OAKG;IACH,OAAO,CAAC,YAAY,CAA0C;IAC9D,qFAAqF;IACrF,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,oBAAoB,CAAI;IAChC,6GAA6G;IAC7G,OAAO,CAAC,sBAAsB,CAAQ;IACtC,OAAO,CAAC,YAAY,CAA8B;gBAG/B,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,KAAK,GAAE,MAAe,EACtB,YAAY,GAAE,MAAsB;IAGvD;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAgBhD,yCAAyC;IACzC,IAAI,IAAI,IAAI;IAOZ;;;;;;;;;;;OAWG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAO5B,gFAAgF;IAChF,WAAW,IAAI,iBAAiB,GAAG,SAAS;IAI5C,4EAA4E;IAC5E,YAAY,IAAI,YAAY,GAAG,SAAS;IAIxC,yDAAyD;IACzD,iBAAiB,IAAI,cAAc,GAAG,SAAS;IAI/C,uEAAuE;IACvE,aAAa,IAAI,eAAe;IAIhC,4DAA4D;IAC5D,eAAe,IAAI,qBAAqB;IAIxC,0GAA0G;IAC1G,WAAW,IAAI,OAAO,GAAG,SAAS;IAIlC,0CAA0C;IAC1C,QAAQ,IAAI,SAAS,OAAO,EAAE;IAI9B,oEAAoE;IACpE,gGAAgG;IAChG,oBAAoB,IAAI,SAAS,MAAM,EAAE;IAIzC,cAAc,IAAI,SAAS,MAAM,EAAE;IAInC,6DAA6D;IAC7D,eAAe,IAAI,SAAS,MAAM,EAAE;IAIpC,mEAAmE;IACnE,iBAAiB,IAAI,SAAS,MAAM,EAAE;IAItC,8DAA8D;IAC9D,2BAA2B,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAI/D;;;;;;;OAOG;IACH,kBAAkB,IAAI,MAAM,GAAG,OAAO,GAAG,SAAS;IAIlD,yFAAyF;IACzF,cAAc,IAAI,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS;IAIxD,8EAA8E;IAC9E,mBAAmB,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC;IAInF,uEAAuE;IACvE,OAAO,CAAC,cAAc;IA4CtB,4EAA4E;IAC5E,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI;IAiBlE,gDAAgD;IAC1C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CA0F/B"}

package/dist/policy.js

@@ -6,10 +6,10 @@
  *
  * @module
  */
-import * as node_https from 'node:https';
-import * as node_http from 'node:http';
 import { createStderrLogger as createLogger } from './stderrLog.js';
 import { callDaemonSocket } from './daemonClient.js';
+import { HttpStatusError, httpRequest } from './httpJson.js';
+import { parseMcpBudgetPolicy, parseWorkspacePiiDetectors, } from '@intutic/shared-types';
 const log = createLogger('mcp-proxy-policy');
 /**
  * Is this unvalidated object actually a policy rule?
@@ -42,6 +42,69 @@ export function isSopRule(value) {
         (r['argPattern'] === undefined || typeof r['argPattern'] === 'string') &&
         (r['action'] === 'block' || r['action'] === 'warn' || r['action'] === 'require_approval'));
 }
+/**
+ * What an older control plane — one that sends no `mcpRegistry` at all —
+ * means: no registry, so nothing is refused on its account. Distinct from an
+ * UNKNOWN registry (no policy loaded yet), which the interceptor resolves
+ * through the fail-open/fail-closed setting instead.
+ */
+export const UNRESTRICTED_REGISTRY = Object.freeze({
+    defaultPolicy: 'allow',
+    approvedServers: [],
+    blockedServers: [],
+    heldServers: [],
+    disabledTools: {},
+});
+function stringList(value) {
+    return Array.isArray(value) ? value.filter((v) => typeof v === 'string') : [];
+}
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Parses `mcpRegistry`. Returns `undefined` for anything that is not a
+ * registry object, so the caller decides what absence means for its source.
+ */
+export function parseRegistry(value) {
+    if (!isPlainObject(value))
+        return undefined;
+    const disabledTools = {};
+    if (isPlainObject(value['disabledTools'])) {
+        for (const [server, tools] of Object.entries(value['disabledTools'])) {
+            const list = stringList(tools);
+            if (list.length > 0)
+                disabledTools[server] = list;
+        }
+    }
+    return {
+        defaultPolicy: value['defaultPolicy'] === 'deny' ? 'deny' : 'allow',
+        approvedServers: stringList(value['approvedServers']),
+        blockedServers: stringList(value['blockedServers']),
+        heldServers: stringList(value['heldServers']),
+        disabledTools,
+    };
+}
+export function parsePrincipal(value) {
+    if (!isPlainObject(value) || typeof value['memberId'] !== 'string' || !value['memberId'])
+        return undefined;
+    return {
+        memberId: value['memberId'],
+        email: typeof value['email'] === 'string' ? value['email'] : '',
+        role: typeof value['role'] === 'string' ? value['role'] : '',
+        ssoGroups: stringList(value['ssoGroups']),
+    };
+}
+export function parseSsoGroupPolicy(value) {
+    if (!isPlainObject(value))
+        return undefined;
+    return {
+        highRiskTools: stringList(value['highRiskTools']),
+        requiredGroups: stringList(value['requiredGroups']),
+        requireOboFor: stringList(value['requireOboFor']),
+    };
+}
+/** How long a proxy waits between on-demand refreshes while it has no registry. */
+const UNKNOWN_REGISTRY_RETRY_MS = 5_000;
 export class PolicyClient {
     controlPlaneUrl;
     apiKey;
@@ -56,7 +119,7 @@ export class PolicyClient {
      * wired to nothing.
      */
     dlpPatterns = [];
-    /** Workspace injection-pattern sources (`mcpInjectionPatterns`, TD-436); empty = floor only. */
+    /** Workspace injection-pattern sources (`mcpInjectionPatterns`); empty = floor only. */
     injectionPatterns = [];
     /**
      * Additive tool scoping: when non-empty, ONLY these tools may be called
@@ -100,7 +163,35 @@ export class PolicyClient {
      * above uses.
      */
     anomalyOverrides = {};
-    lastFetchAt = 0;
+    /**
+     * Registry decisions from the last policy that carried them. `undefined`
+     * until then — no policy has loaded in this process, or the only one so far
+     * was the MCP daemon's snapshot seed, which carries none. The interceptor
+     * resolves that state through the fail-open/fail-closed setting.
+     */
+    registry;
+    principal;
+    /**
+     * The workspace's `mcpProxyFailBehavior` as a fail-open flag, or
+     * `undefined` when the control plane did not send it (the workspace never
+     * chose, or no policy has loaded) — then `INTUTIC_MCP_FAIL_OPEN` decides.
+     */
+    failOpen;
+    ssoGroupPolicy;
+    /** The workspace's MCP call budgets (`mcpBudgets`); no budgets until a policy says otherwise. */
+    mcpBudgets = parseMcpBudgetPolicy(undefined);
+    /**
+     * The workspace's `piiDetectors` setting, read as the LLM proxy reads it
+     * from key-context (`parseWorkspacePiiDetectors`). `none` until a policy
+     * carries one. `unreadable` when the control plane says it could not read
+     * the stored value; the interceptor applies the fail setting to that.
+     */
+    piiDetectors = { kind: 'none' };
+    /** The first refresh `start()` kicks off, so the first tool call can wait for it. */
+    firstRefresh = null;
+    lastRefreshAttemptAt = 0;
+    /** Whether a policy that came from the control plane (directly or through the daemon's fetch) has loaded. */
+    loadedFromControlPlane = false;
     refreshTimer = null;
     constructor(controlPlaneUrl, apiKey, workspaceId, ttlMs = 60_000, mcpProxyMode = 'per-session') {
         this.controlPlaneUrl = controlPlaneUrl;
@@ -130,8 +221,9 @@ export class PolicyClient {
         }, this.ttlMs);
         // Don't block Node.js exit on this timer
         this.refreshTimer.unref();
-        // Kick off initial fetch (non-blocking — proxy starts immediately)
-        void this.refresh().catch(() => { });
+        // Kick off initial fetch (non-blocking — proxy starts immediately; the
+        // first tool call waits for it through `ready()`).
+        this.firstRefresh = this.refresh().catch(() => { });
         if (onTick)
             void Promise.resolve(onTick()).catch(() => { });
     }
@@ -142,6 +234,51 @@ export class PolicyClient {
             this.refreshTimer = null;
         }
     }
+    /**
+     * Resolves once the policy is as loaded as it is going to get for this call.
+     *
+     * The first tool call of a process can arrive before `start()`'s first
+     * fetch has answered; without this wait, a `deny` workspace's very first
+     * call would be decided against no registry at all. After that, while the
+     * registry is still unknown (control plane unreachable, or only the
+     * daemon's snapshot seed so far), a call triggers one more refresh at most
+     * every {@link UNKNOWN_REGISTRY_RETRY_MS} — so a proxy started offline
+     * picks the registry up as soon as it can, not at the next 60-second tick.
+     * Never rejects; every wait is bounded by the 5-second fetch timeout.
+     */
+    async ready() {
+        if (this.firstRefresh)
+            await this.firstRefresh;
+        if (this.registry !== undefined)
+            return;
+        if (Date.now() - this.lastRefreshAttemptAt < UNKNOWN_REGISTRY_RETRY_MS)
+            return;
+        await this.refresh().catch(() => { });
+    }
+    /** Registry decisions, or `undefined` while none has loaded (see the field). */
+    getRegistry() {
+        return this.registry;
+    }
+    /** The member this proxy's key resolves to, when the control plane said. */
+    getPrincipal() {
+        return this.principal;
+    }
+    /** The workspace's SSO group policy, when it has one. */
+    getSsoGroupPolicy() {
+        return this.ssoGroupPolicy;
+    }
+    /** The workspace's MCP call budgets; an empty list means no limits. */
+    getMcpBudgets() {
+        return this.mcpBudgets;
+    }
+    /** The workspace's PII detector actions (see the field). */
+    getPiiDetectors() {
+        return this.piiDetectors;
+    }
+    /** The workspace's fail-open choice, or `undefined` to fall back to the local setting (see the field). */
+    getFailOpen() {
+        return this.failOpen;
+    }
     /** Return the current cached rule set. */
     getRules() {
         return this.rules;
@@ -221,6 +358,15 @@ export class PolicyClient {
                     this.anomalyOverrides[k] = v;
             }
         }
+        this.principal = parsePrincipal(source['principal']);
+        this.ssoGroupPolicy = parseSsoGroupPolicy(source['ssoGroupPolicy']);
+        this.mcpBudgets = parseMcpBudgetPolicy(source['mcpBudgets']);
+        const failBehavior = source['mcpProxyFailBehavior'];
+        this.failOpen = failBehavior === 'open' ? true : failBehavior === 'closed' ? false : undefined;
+        this.piiDetectors = parseWorkspacePiiDetectors(source['piiDetectors']);
+        if (this.piiDetectors.kind === 'unreadable') {
+            log.warn({ action: 'pii_detectors_unreadable', reason: this.piiDetectors.reason }, 'Workspace PII detector actions unreadable');
+        }
     }
     /** Find the first matching rule for a given tool name + serialized args. */
     matchRule(toolName, toolInputJson) {
@@ -244,6 +390,7 @@ export class PolicyClient {
     }
     /** Fetch fresh rules from the control plane. */
     async refresh() {
+        this.lastRefreshAttemptAt = Date.now();
         if (this.mcpProxyMode === 'daemon') {
             try {
                 // The socket returns whatever the daemon serialised, so the caller
@@ -268,9 +415,27 @@ export class PolicyClient {
                     if (dropped > 0) {
                         log.warn({ action: 'policy_rules_malformed', dropped, kept: this.rules.length }, 'Dropped malformed SOP rules from the daemon — they cannot be enforced');
                     }
+                    // A restarted daemon answers from the sync daemon's snapshot until
+                    // its first fetch, and the snapshot carries the rules and the server
+                    // allowlist but no tool allowlist, description overrides, DLP or
+                    // injection patterns, registry or dispositions. Absorbing that over
+                    // a policy this process already loaded would lift every restriction
+                    // the snapshot lacks — a daemon restart as a way to disarm curation.
+                    // So once a control-plane policy has loaded, a snapshot answer
+                    // updates the rules and nothing else; before that, it is the best
+                    // policy there is.
+                    if (policy.fromSnapshot && this.loadedFromControlPlane) {
+                        log.info({ action: 'policy_snapshot_rules_only', ruleCount: this.rules.length }, 'Daemon answered from its snapshot; kept the loaded curation');
+                        return;
+                    }
                     this.dlpPatterns = (policy.dlpPatterns ?? []).filter((p) => typeof p === 'string');
                     this.absorbCuration(policy);
-                    this.lastFetchAt = Date.now();
+                    // Re-parsed, not trusted: a daemon on an older version, or an entry it
+                    // cached before a field existed, can carry a registry without one.
+                    if (policy.mcpRegistry)
+                        this.registry = parseRegistry(policy.mcpRegistry) ?? this.registry;
+                    if (!policy.fromSnapshot)
+                        this.loadedFromControlPlane = true;
                     log.info({ action: 'policy_refreshed_from_daemon', ruleCount: this.rules.length }, 'SOP rules refreshed from daemon');
                     return;
                 }
@@ -284,7 +449,19 @@ export class PolicyClient {
         }
         const url = `${this.controlPlaneUrl}/api/v1/sop/rules?workspaceId=${encodeURIComponent(this.workspaceId)}&active=true`;
         log.debug({ action: 'policy_refresh', url }, 'Fetching SOP rules from control plane');
-        const body = await httpGet(url, this.apiKey);
+        let body;
+        try {
+            body = await httpRequest('GET', url, this.apiKey);
+        }
+        catch (err) {
+            // The control plane refused this proxy's key: revoked, or its member
+            // deactivated or offboarded. Every other rule stays as loaded, but the
+            // member's SSO groups were vouched for by that key, so the proxy stops
+            // knowing them — a high-risk tool is refused until a key works again.
+            if (err instanceof HttpStatusError && (err.status === 401 || err.status === 403))
+                this.principal = undefined;
+            throw err;
+        }
         const parsed = JSON.parse(body);
         const rules = Array.isArray(parsed.rules) ? parsed.rules : [];
         this.rules = rules;
@@ -293,39 +470,10 @@ export class PolicyClient {
             ? dlp.filter((p) => typeof p === 'string')
             : [];
         this.absorbCuration(parsed);
-        this.lastFetchAt = Date.now();
+        // A control plane that sends no registry has none: unrestricted, not unknown.
+        this.registry = parseRegistry(parsed['mcpRegistry']) ?? UNRESTRICTED_REGISTRY;
+        this.loadedFromControlPlane = true;
         log.info({ action: 'policy_refreshed', ruleCount: rules.length }, 'SOP rules refreshed');
     }
 }
-/** Minimal HTTP/HTTPS GET helper (avoids fetch / node-fetch dep). */
-function httpGet(url, apiKey) {
-    return new Promise((resolve, reject) => {
-        const parsed = new URL(url);
-        const lib = parsed.protocol === 'https:' ? node_https : node_http;
-        const req = lib.get(url, {
-            headers: {
-                Authorization: `Bearer ${apiKey}`,
-                Accept: 'application/json',
-            },
-            timeout: 5000,
-        }, (res) => {
-            const chunks = [];
-            res.on('data', (c) => chunks.push(c));
-            res.on('end', () => {
-                const body = Buffer.concat(chunks).toString('utf-8');
-                if ((res.statusCode ?? 0) >= 400) {
-                    reject(new Error(`HTTP ${res.statusCode ?? 'unknown'}: ${body}`));
-                }
-                else {
-                    resolve(body);
-                }
-            });
-        });
-        req.on('error', reject);
-        req.on('timeout', () => {
-            req.destroy();
-            reject(new Error('Policy fetch timed out'));
-        });
-    });
-}
 //# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,UAAU,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAGpD,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAA;AAc5C;;;;;;;;;;;;;GAaG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO,CACL,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ;QAC3B,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ;QACpC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAC/B,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC;QACtE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,kBAAkB,CAAC,CAC1F,CAAA;AACH,CAAC;AAMD,MAAM,OAAO,YAAY;IAyDJ;IACA;IACA;IACA;IACA;IA5DX,KAAK,GAAc,EAAE,CAAA;IAC7B;;;;;OAKG;IACK,WAAW,GAAa,EAAE,CAAA;IAClC,gGAAgG;IACxF,iBAAiB,GAAa,EAAE,CAAA;IACxC;;;;;;OAMG;IACK,YAAY,GAAa,EAAE,CAAA;IACnC,2EAA2E;IACnE,wBAAwB,GAA2B,EAAE,CAAA;IAC7D;;;;;;OAMG;IACK,cAAc,GAAa,EAAE,CAAA;IACrC;;;;;;;OAOG;IACK,eAAe,CAA8B;IACrD;;;;OAIG;IACK,WAAW,CAAwC;IAC3D;;;;;;;OAOG;IACK,gBAAgB,GAAuD,EAAE,CAAA;IACzE,WAAW,GAAG,CAAC,CAAA;IACf,YAAY,GAA0B,IAAI,CAAA;IAElD,YACmB,eAAuB,EACvB,MAAc,EACd,WAAmB,EACnB,QAAgB,MAAM,EACtB,eAAuB,aAAa;QAJpC,oBAAe,GAAf,eAAe,CAAQ;QACvB,WAAM,GAAN,MAAM,CAAQ;QACd,gBAAW,GAAX,WAAW,CAAQ;QACnB,UAAK,GAAL,KAAK,CAAiB;QACtB,iBAAY,GAAZ,YAAY,CAAwB;IACpD,CAAC;IAEJ;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAmC;QACvC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;YACnC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC7B,yCAAyC;YAC3C,CAAC,CAAC,CAAA;YACF,IAAI,MAAM;gBAAE,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC5D,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QACd,yCAAyC;QACzC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAA;QAEzB,mEAAmE;QACnE,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACnC,IAAI,MAAM;YAAE,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,yCAAyC;IACzC,IAAI;QACF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAED,oEAAoE;IACpE,gGAAgG;IAChG,oBAAoB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAA;IAC/B,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAED,6DAA6D;IAC7D,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAA;IAC1B,CAAC;IAED,mEAAmE;IACnE,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAED,8DAA8D;IAC9D,2BAA2B;QACzB,OAAO,IAAI,CAAC,wBAAwB,CAAA;IACtC,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAA;IAC7B,CAAC;IAED,yFAAyF;IACzF,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAED,8EAA8E;IAC9E,mBAAmB;QACjB,OAAO,IAAI,CAAC,gBAAgB,CAAA;IAC9B,CAAC;IAED,uEAAuE;IAC/D,cAAc,CAAC,MAA+B;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAA;QACnE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACxC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAC3D,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,SAAS,GAAG,MAAM,CAAC,0BAA0B,CAAC,IAAI,MAAM,CAAC,6BAA6B,CAAC,CAAA;QAC7F,IAAI,CAAC,wBAAwB,GAAG,EAAE,CAAA;QAClC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACrF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAoC,CAAC,EAAE,CAAC;gBAC1E,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YACjE,CAAC;QACH,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,mBAAmB,CAAC,CAAA;QAC9E,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;YACjD,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAClE,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,iBAAiB,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;QACxD,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC;YACvD,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACrE,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,eAAe,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAA;QACpD,IAAI,CAAC,eAAe;YAClB,eAAe,KAAK,MAAM,IAAI,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;QACzF,MAAM,WAAW,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAA;QAC5C,IAAI,CAAC,WAAW;YACd,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAA;QACxG,MAAM,gBAAgB,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAA;QACtD,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAA;QAC1B,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC1G,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAA2C,CAAC,EAAE,CAAC;gBACjF,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK;oBAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YACjG,CAAC;QACH,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,SAAS,CAAC,QAAgB,EAAE,aAAqB;QAC/C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;gBAC9C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,SAAQ;gBACvC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBACpB,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;oBAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC;wBAAE,SAAQ;gBAC7C,CAAC;gBACD,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,mEAAmE;gBACnE,0EAA0E;gBAC1E,yEAAyE;gBACzE,uDAAuD;gBACvD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAwB,YAAY,EAAE;oBACzE,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B,CAAC,CAAA;gBACF,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAA;oBACxC,qEAAqE;oBACrE,uEAAuE;oBACvE,mEAAmE;oBACnE,MAAM,QAAQ,GAAc,EAAE,CAAA;oBAC9B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;wBACnC,IAAI,SAAS,CAAC,SAAS,CAAC;4BAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;oBACpD,CAAC;oBACD,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAA;oBACrB,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;oBACnD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;wBAChB,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EACtE,uEAAuE,CACxE,CAAA;oBACH,CAAC;oBACD,IAAI,CAAC,WAAW,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAClD,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C,CAAA;oBACD,IAAI,CAAC,cAAc,CAAC,MAA4C,CAAC,CAAA;oBACjE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;oBAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAA;oBACrH,OAAM;gBACR,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CACN;oBACE,MAAM,EAAE,sBAAsB;oBAC9B,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACtD,EACD,oEAAoE,CACrE,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,iCAAiC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAA;QACtH,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE,uCAAuC,CAAC,CAAA;QAErF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA+C,CAAA;QAC7E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QAC7D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;QACjC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YACnC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACvD,CAAC,CAAC,EAAE,CAAA;QACN,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAA;IAC1F,CAAC;CACF;AAED,qEAAqE;AACrE,SAAS,OAAO,CAAC,GAAW,EAAE,MAAc;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;QACjE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CACjB,GAAG,EACH;YACE,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,EAAE;gBACjC,MAAM,EAAE,kBAAkB;aAC3B;YACD,OAAO,EAAE,IAAI;SACd,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;YAC7C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBACpD,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;oBACjC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,UAAU,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC,CAAC,CAAA;gBACnE,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,CAAA;gBACf,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,GAAG,CAAC,OAAO,EAAE,CAAA;YACb,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAE5D,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAG3B,MAAM,uBAAuB,CAAA;AAE9B,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAA;AAc5C;;;;;;;;;;;;;GAaG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO,CACL,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ;QAC3B,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ;QACpC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAC/B,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC;QACtE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,kBAAkB,CAAC,CAC1F,CAAA;AACH,CAAC;AAyBD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACpE,aAAa,EAAE,OAAO;IACtB,eAAe,EAAE,EAAE;IACnB,cAAc,EAAE,EAAE;IAClB,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE;CAClB,CAAsB,CAAA;AAqBvB,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC5F,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3C,MAAM,aAAa,GAA6B,EAAE,CAAA;IAClD,IAAI,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;YAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;QACnD,CAAC;IACH,CAAC;IACD,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,eAAe,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QACnE,eAAe,EAAE,UAAU,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrD,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACnD,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC7C,aAAa;KACd,CAAA;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAA;IAC1G,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC;QAC3B,KAAK,EAAE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;QAC/D,IAAI,EAAE,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;QAC5D,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;KAC1C,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3C,OAAO;QACL,aAAa,EAAE,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACjD,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACnD,aAAa,EAAE,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;KAClD,CAAA;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,yBAAyB,GAAG,KAAK,CAAA;AAEvC,MAAM,OAAO,YAAY;IAqFJ;IACA;IACA;IACA;IACA;IAxFX,KAAK,GAAc,EAAE,CAAA;IAC7B;;;;;OAKG;IACK,WAAW,GAAa,EAAE,CAAA;IAClC,wFAAwF;IAChF,iBAAiB,GAAa,EAAE,CAAA;IACxC;;;;;;OAMG;IACK,YAAY,GAAa,EAAE,CAAA;IACnC,2EAA2E;IACnE,wBAAwB,GAA2B,EAAE,CAAA;IAC7D;;;;;;OAMG;IACK,cAAc,GAAa,EAAE,CAAA;IACrC;;;;;;;OAOG;IACK,eAAe,CAA8B;IACrD;;;;OAIG;IACK,WAAW,CAAwC;IAC3D;;;;;;;OAOG;IACK,gBAAgB,GAAuD,EAAE,CAAA;IACjF;;;;;OAKG;IACK,QAAQ,CAA+B;IACvC,SAAS,CAA0B;IAC3C;;;;OAIG;IACK,QAAQ,CAAqB;IAC7B,cAAc,CAA4B;IAClD,iGAAiG;IACzF,UAAU,GAAoB,oBAAoB,CAAC,SAAS,CAAC,CAAA;IACrE;;;;;OAKG;IACK,YAAY,GAA0B,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAC9D,qFAAqF;IAC7E,YAAY,GAAyB,IAAI,CAAA;IACzC,oBAAoB,GAAG,CAAC,CAAA;IAChC,6GAA6G;IACrG,sBAAsB,GAAG,KAAK,CAAA;IAC9B,YAAY,GAA0B,IAAI,CAAA;IAElD,YACmB,eAAuB,EACvB,MAAc,EACd,WAAmB,EACnB,QAAgB,MAAM,EACtB,eAAuB,aAAa;QAJpC,oBAAe,GAAf,eAAe,CAAQ;QACvB,WAAM,GAAN,MAAM,CAAQ;QACd,gBAAW,GAAX,WAAW,CAAQ;QACnB,UAAK,GAAL,KAAK,CAAiB;QACtB,iBAAY,GAAZ,YAAY,CAAwB;IACpD,CAAC;IAEJ;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAmC;QACvC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;YACnC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC7B,yCAAyC;YAC3C,CAAC,CAAC,CAAA;YACF,IAAI,MAAM;gBAAE,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC5D,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QACd,yCAAyC;QACzC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAA;QAEzB,uEAAuE;QACvE,mDAAmD;QACnD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAClD,IAAI,MAAM;YAAE,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,yCAAyC;IACzC,IAAI;QACF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;QAC1B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,CAAC,YAAY,CAAA;QAC9C,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAM;QACvC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,oBAAoB,GAAG,yBAAyB;YAAE,OAAM;QAC9E,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACtC,CAAC;IAED,gFAAgF;IAChF,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IAED,4EAA4E;IAC5E,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED,yDAAyD;IACzD,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAED,uEAAuE;IACvE,aAAa;QACX,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED,4DAA4D;IAC5D,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAA;IAC1B,CAAC;IAED,0GAA0G;IAC1G,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IAED,0CAA0C;IAC1C,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAED,oEAAoE;IACpE,gGAAgG;IAChG,oBAAoB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAA;IAC/B,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAED,6DAA6D;IAC7D,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAA;IAC1B,CAAC;IAED,mEAAmE;IACnE,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAED,8DAA8D;IAC9D,2BAA2B;QACzB,OAAO,IAAI,CAAC,wBAAwB,CAAA;IACtC,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAA;IAC7B,CAAC;IAED,yFAAyF;IACzF,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAED,8EAA8E;IAC9E,mBAAmB;QACjB,OAAO,IAAI,CAAC,gBAAgB,CAAA;IAC9B,CAAC;IAED,uEAAuE;IAC/D,cAAc,CAAC,MAA+B;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAA;QACnE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACxC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAC3D,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,SAAS,GAAG,MAAM,CAAC,0BAA0B,CAAC,IAAI,MAAM,CAAC,6BAA6B,CAAC,CAAA;QAC7F,IAAI,CAAC,wBAAwB,GAAG,EAAE,CAAA;QAClC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACrF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAoC,CAAC,EAAE,CAAC;gBAC1E,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YACjE,CAAC;QACH,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,mBAAmB,CAAC,CAAA;QAC9E,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;YACjD,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAClE,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,iBAAiB,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;QACxD,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC;YACvD,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACrE,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,eAAe,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAA;QACpD,IAAI,CAAC,eAAe;YAClB,eAAe,KAAK,MAAM,IAAI,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;QACzF,MAAM,WAAW,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAA;QAC5C,IAAI,CAAC,WAAW;YACd,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAA;QACxG,MAAM,gBAAgB,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAA;QACtD,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAA;QAC1B,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC1G,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAA2C,CAAC,EAAE,CAAC;gBACjF,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK;oBAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YACjG,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAA;QACpD,IAAI,CAAC,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAA;QACnE,IAAI,CAAC,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAA;QAC5D,MAAM,YAAY,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;QACnD,IAAI,CAAC,QAAQ,GAAG,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;QAC9F,IAAI,CAAC,YAAY,GAAG,0BAA0B,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAA;QACtE,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,2CAA2C,CAAC,CAAA;QACjI,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,SAAS,CAAC,QAAgB,EAAE,aAAqB;QAC/C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;gBAC9C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,SAAQ;gBACvC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBACpB,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;oBAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC;wBAAE,SAAQ;gBAC7C,CAAC;gBACD,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtC,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,mEAAmE;gBACnE,0EAA0E;gBAC1E,yEAAyE;gBACzE,uDAAuD;gBACvD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAwB,YAAY,EAAE;oBACzE,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B,CAAC,CAAA;gBACF,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAA;oBACxC,qEAAqE;oBACrE,uEAAuE;oBACvE,mEAAmE;oBACnE,MAAM,QAAQ,GAAc,EAAE,CAAA;oBAC9B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;wBACnC,IAAI,SAAS,CAAC,SAAS,CAAC;4BAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;oBACpD,CAAC;oBACD,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAA;oBACrB,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;oBACnD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;wBAChB,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EACtE,uEAAuE,CACxE,CAAA;oBACH,CAAC;oBACD,mEAAmE;oBACnE,qEAAqE;oBACrE,iEAAiE;oBACjE,oEAAoE;oBACpE,oEAAoE;oBACpE,qEAAqE;oBACrE,+DAA+D;oBAC/D,kEAAkE;oBAClE,mBAAmB;oBACnB,IAAI,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;wBACvD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,6DAA6D,CAAC,CAAA;wBAC/I,OAAM;oBACR,CAAC;oBACD,IAAI,CAAC,WAAW,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAClD,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C,CAAA;oBACD,IAAI,CAAC,cAAc,CAAC,MAA4C,CAAC,CAAA;oBACjE,uEAAuE;oBACvE,mEAAmE;oBACnE,IAAI,MAAM,CAAC,WAAW;wBAAE,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAA;oBAC1F,IAAI,CAAC,MAAM,CAAC,YAAY;wBAAE,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAA;oBAC5D,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAA;oBACrH,OAAM;gBACR,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CACN;oBACE,MAAM,EAAE,sBAAsB;oBAC9B,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACtD,EACD,oEAAoE,CACrE,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,iCAAiC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAA;QACtH,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE,uCAAuC,CAAC,CAAA;QAErF,IAAI,IAAY,CAAA;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,uEAAuE;YACvE,uEAAuE;YACvE,sEAAsE;YACtE,IAAI,GAAG,YAAY,eAAe,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;gBAAE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;YAC5G,MAAM,GAAG,CAAA;QACX,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA+C,CAAA;QAC7E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QAC7D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;QACjC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YACnC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACvD,CAAC,CAAC,EAAE,CAAA;QACN,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAC3B,8EAA8E;QAC9E,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,qBAAqB,CAAA;QAC7E,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAA;QAClC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAA;IAC1F,CAAC;CACF"}

package/dist/proxy.d.ts

@@ -7,7 +7,8 @@
  *
  * Architecture (standalone mode — the `intutic` harness entry):
  *   Harness ↔ [McpGovernanceProxy as MCP Server] ↔ Control Plane REST API
- *   Exposes governance tools: intutic_governance_status, intutic_list_sops, intutic_list_incidents.
+ *   Exposes governance tools: intutic_governance_status, intutic_list_sops, intutic_list_incidents,
+ *   intutic_hold_status, intutic_mcp_registry_status, intutic_mcp_budget_remaining.
  *
  * Architecture (remote bridge mode — `--remote-url`, see remoteBridge.ts):
  *   Harness stdin → [McpGovernanceProxy] → remote MCP server (HTTP/SSE)
@@ -29,7 +30,16 @@
 import type { ProxyConfig } from './config.js';
 import { ToolCallInterceptor } from './interceptor.js';
 import { type InjectionSource } from './injection.js';
+import { type AnomalyFinding } from './anomaly/index.js';
 import { SessionState } from './session.js';
+import { type CallerIdentity } from './identity.js';
+import { type McpToolDefinition } from '@intutic/shared-types';
+/**
+ * Who a per-member MCP budget counts when the control plane has not named the
+ * member behind this proxy's key: the key's prefix, else the OS user. Callers
+ * with neither share one allowance.
+ */
+export declare function fallbackBudgetCaller(identity: CallerIdentity): string;
 /** What the harness asked for under a given request id, awaiting its response. */
 export interface PendingRequest {
     method: 'tools/call' | 'tools/list' | 'resources/read';
@@ -55,6 +65,12 @@ export interface ServerLineOutcome {
      * other line.
      */
     toolsListTools?: Array<Record<string, unknown>>;
+    /**
+     * Every tool the upstream server declared, as it declared them — before
+     * curation hid any or an override rewrote a description. Set alongside
+     * `toolsListTools`; the registry gets these.
+     */
+    toolsListUpstream?: McpToolDefinition[];
     /** The JSON-RPC id of the `tools/list` response, needed to build a block
      *  frame in the caller if TOFU refuses it. Set alongside `toolsListTools`. */
     toolsListMsgId?: string | number | null;
@@ -90,7 +106,7 @@ export interface ServerLineOutcome {
      * any request-direction finding unconditionally, so escalating an
      * already-redacted RESPONSE protects nothing further.
      */
-    dlpEscalationReason?: string;
+    dlpEscalation?: AnomalyFinding;
     /**
      * Phase 2's `tool_poisoning` finding (anomaly/detectors.ts), set on a
      * `tools/list` response whose post-curation tool descriptions matched
@@ -98,7 +114,7 @@ export interface ServerLineOutcome {
      * `injectionFindings` on this same response type — never removes or
      * blocks a listing.
      */
-    toolPoisoningReason?: string;
+    toolPoisoning?: AnomalyFinding;
 }
 /**
  * Inspect one line of real-server output before it reaches the harness.
@@ -121,13 +137,13 @@ export interface ServerLineOutcome {
  *
  * tools/list curation (the Uber-gateway mechanism): when the workspace
  * declares an additive allowlist, tools outside it are removed from the
- * listing — an agent that never sees a tool does not hallucinate calls to
+ * listing, as are tools the registry disables on this server — an agent that never sees a tool does not hallucinate calls to
  * it, and the call-time block in the interceptor stays as the enforcement
  * backstop. Operator description overrides apply to what remains, which is
  * also the counter to a poisoned upstream description — the pin detects the
  * change; the override controls what the agent actually reads.
  */
-export declare function processServerLine(raw: string, pending: Map<string | number, PendingRequest>, allowedTools: readonly string[], overrides: Readonly<Record<string, string>>, injectionAction?: 'warn' | 'block', injectionPatterns?: readonly string[]): ServerLineOutcome;
+export declare function processServerLine(raw: string, pending: Map<string | number, PendingRequest>, allowedTools: readonly string[], overrides: Readonly<Record<string, string>>, injectionAction?: 'warn' | 'block', injectionPatterns?: readonly string[], disabledTools?: readonly string[]): ServerLineOutcome;
 /**
  * Handle one harness→upstream line — shared, byte-for-byte, between stdio
  * proxy mode (`McpGovernanceProxy.runProxy`, below) and the remote HTTP/SSE
@@ -157,12 +173,18 @@ export declare class McpGovernanceProxy {
      * (for detection + reask counting), `handleHarnessLine` (for post-decision
      * recording), and this class's own `handleServerLine` (for caching the
      * post-curation tools/list the tool_poisoning detector reads). Since Wave
-     * 5.3 (TD-437) it is also shared ACROSS the session's sibling proxy
+     * 5.3 it is also shared ACROSS the session's sibling proxy
      * processes through `sessionStore` when a Valkey URL is configured — see
      * session.ts's module doc.
      */
     private readonly session;
-    /** The Valkey-backed shared window, when `config.valkeyUrl` is set and this is not the standalone entry. */
+    /**
+     * The process's one Valkey connection, when `config.valkeyUrl` is set and
+     * this is not the standalone entry: the shared session window and the MCP
+     * call budgets both use it.
+     */
+    private readonly valkey;
+    /** The Valkey-backed shared window, on {@link valkey}. */
     private readonly sessionStore;
     /**
      * Phase 3's WASM custom-rule runner — owns the one dedicated
@@ -171,6 +193,8 @@ export declare class McpGovernanceProxy {
      * runs, not a second one (see `policy.ts`'s `start(onTick)`).
      */
     private readonly wasmRunner;
+    /** Reports this proxy's server to the registry; absent for the standalone `intutic` entry, which fronts none. */
+    private readonly registryObserver;
     private realServer;
     constructor(config: ProxyConfig);
     /**
@@ -197,7 +221,7 @@ export declare class McpGovernanceProxy {
     startPolicy(): void;
     private wasmWatch;
     /**
-     * Hot reload for `~/.intutic/wasm/` (TD-442): a directory watcher, not a
+     * Hot reload for `~/.intutic/wasm/`: a directory watcher, not a
      * second timer, so a dropped-in rule takes effect within a second instead
      * of at the next 60-second tick. Re-armed on every tick because the
      * directory may not exist when the proxy starts.
@@ -225,9 +249,9 @@ export declare class McpGovernanceProxy {
      * (tofu.ts), which does file I/O — the ONLY case this awaits before
      * writing; every other line is forwarded exactly as fast as before.
      *
-     * On a TOFU mismatch, honors `mcpProxyFailBehavior` via `config.failOpen` —
-     * the SAME field `interceptor.ts` already reads for its own fail-open/
-     * fail-closed branches, not a new mechanism: fail-open logs and forwards
+     * On a TOFU mismatch, honors `mcpProxyFailBehavior` via the interceptor's
+     * `failOpen` — the SAME value its own fail-open/fail-closed branches read,
+     * not a new mechanism: fail-open logs and forwards
      * the (possibly curated) tools/list response as normal; fail-closed
      * replaces it with a JSON-RPC error naming the server and the setting,
      * mirroring `buildBlockResponse`'s existing wording style.

package/dist/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAG9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAEtD,OAAO,EAA4D,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAE/G,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAmD3C,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,YAAY,GAAG,YAAY,GAAG,gBAAgB,CAAA;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAA;IACZ,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,kFAAkF;IAClF,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;IAChD;;;;;OAKG;IACH,cAAc,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/C;kFAC8E;IAC9E,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IACvC;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,eAAe,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;IAC5F;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,EAC7C,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC3C,eAAe,GAAE,MAAM,GAAG,OAAgB,EAC1C,iBAAiB,GAAE,SAAS,MAAM,EAAO,GACxC,iBAAiB,CAqLnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,EAC7C,WAAW,EAAE,mBAAmB,EAChC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC/B,OAAO,CAAC,EAAE,YAAY,GACrB,IAAI,CA2DN;AAED,qBAAa,kBAAkB;IA0BjB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAzBnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmB;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC,4GAA4G;IAC5G,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAY;IACvC,OAAO,CAAC,UAAU,CAAuC;gBAE5B,MAAM,EAAE,WAAW;IA4ChD;;;;;OAKG;IACH,cAAc,IAAI,mBAAmB;IAIrC;;;;;OAKG;IACH,eAAe,IAAI,YAAY;IAI/B;;;;;;OAMG;IACH,WAAW,IAAI,IAAI;IAOnB,OAAO,CAAC,SAAS,CAA8B;IAE/C;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAKvB;;;OAGG;IACH,UAAU,IAAI,IAAI;IAQlB;;OAEG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAS1B;;;;OAIG;YACW,aAAa;IAuI3B;;;;;;;;;;;;;;;;;;;OAmBG;IACG,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,GAC5C,OAAO,CAAC,IAAI,CAAC;IAwJhB;;;OAGG;YACW,QAAQ;CAoFvB"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAG9C,OAAO,EAAE,mBAAmB,EAAc,MAAM,kBAAkB,CAAA;AAIlE,OAAO,EAA4D,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAC/G,OAAO,EAAgC,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAQ3C,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAA;AACnE,OAAO,EAA2B,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAmEvF;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAIrE;AASD,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,YAAY,GAAG,YAAY,GAAG,gBAAgB,CAAA;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAA;IACZ,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,kFAAkF;IAClF,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;IAChD;;;;;OAKG;IACH,cAAc,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/C;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,CAAA;IACvC;kFAC8E;IAC9E,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IACvC;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,eAAe,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;IAC5F;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,cAAc,CAAA;IAC9B;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,cAAc,CAAA;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,EAC7C,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC3C,eAAe,GAAE,MAAM,GAAG,OAAgB,EAC1C,iBAAiB,GAAE,SAAS,MAAM,EAAO,EACzC,aAAa,GAAE,SAAS,MAAM,EAAO,GACpC,iBAAiB,CAiMnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,EAC7C,WAAW,EAAE,mBAAmB,EAChC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC/B,OAAO,CAAC,EAAE,YAAY,GACrB,IAAI,CA6DN;AAED,qBAAa,kBAAkB;IAkCjB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAjCnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmB;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAClD,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAY;IACvC,iHAAiH;IACjH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA8B;IAC/D,OAAO,CAAC,UAAU,CAAuC;gBAE5B,MAAM,EAAE,WAAW;IA0DhD;;;;;OAKG;IACH,cAAc,IAAI,mBAAmB;IAIrC;;;;;OAKG;IACH,eAAe,IAAI,YAAY;IAI/B;;;;;;OAMG;IACH,WAAW,IAAI,IAAI;IAQnB,OAAO,CAAC,SAAS,CAA8B;IAE/C;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAKvB;;;OAGG;IACH,UAAU,IAAI,IAAI;IAQlB;;OAEG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAS1B;;;;OAIG;YACW,aAAa;IA2K3B;;;;;;;;;;;;;;;;;;;OAmBG;IACG,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,GAC5C,OAAO,CAAC,IAAI,CAAC;IA4LhB;;;OAGG;YACW,QAAQ;CAoFvB"}