@intutic/mcp-governance-proxy 2.2.0 → 2.4.0

package/dist/wasm/cloudRules.js

@@ -0,0 +1,242 @@
+/**
+ * wasm/cloudRules.ts — the workspace's custom rules from the control plane:
+ * the rules uploaded from the dashboard, the CLI or Terraform, which the LLM
+ * proxy enforces too.
+ *
+ * Port of the control-plane half of `packages/proxy/src/wasm/registry.rs`
+ * (`ensure_up_to_date`, `load_descriptor`, `report_refusal`). The descriptors
+ * arrive with the workspace policy this proxy already fetches (`wasmRules` on
+ * `GET /api/v1/sop/rules`, or on the MCP daemon's cached
+ * `GET /api/v1/policy/resolve`), so they refresh when the policy does. Each
+ * binary is fetched by the SHA-256 its descriptor names, only when no loaded
+ * rule already has that hash, and must hash to it before it is compiled:
+ * whoever can answer for that hash could otherwise swap a governance rule for
+ * one that allows everything.
+ *
+ * A version that cannot load — binary missing, hash mismatch, or a module the
+ * worker refuses — is reported once per hash and reason, and the version of
+ * that rule already loaded, if any, keeps enforcing. A control plane that
+ * cannot be reached for a binary leaves the whole loaded set as it was, as
+ * `registry.rs` does when its fetch fails.
+ *
+ * @module
+ */
+import { createHash } from 'node:crypto';
+import { createStderrLogger as createLogger } from '../stderrLog.js';
+import { HttpStatusError, getBytes } from '../httpJson.js';
+import { MAX_RULE_FILE_BYTES } from './loader.js';
+const log = createLogger('mcp-proxy-wasm-cloud');
+/**
+ * Minimum time between attempts after a sync that could not reach the control
+ * plane or refused a version — the Rust proxy's 5-second rescan, so a binary
+ * published a moment after its descriptor is picked up as quickly there.
+ */
+export const CLOUD_RETRY_MS = 5_000;
+/**
+ * Fetches binaries from the control plane's rule store by hash. A 404 is a
+ * binary the control plane does not have; any other failure means it could
+ * not be asked.
+ */
+export function fetchRuleBinaryFrom(controlPlaneUrl, apiKey) {
+    return async (sha256) => {
+        const url = `${controlPlaneUrl}/api/v1/wasm-rules/binaries/${encodeURIComponent(sha256)}`;
+        try {
+            return await getBytes(url, apiKey, MAX_RULE_FILE_BYTES);
+        }
+        catch (err) {
+            if (err instanceof HttpStatusError && err.status === 404)
+                return null;
+            throw err;
+        }
+    };
+}
+/** A refusal as the `wasm_rule_refused` event carries it. */
+export function refusalDetail(report) {
+    const { descriptor, refusal } = report;
+    return {
+        ruleId: descriptor.ruleId,
+        name: descriptor.name,
+        sha256: descriptor.sha256,
+        refusal: refusal.kind,
+        ...(refusal.kind === 'hash_mismatch' ? { actualSha256: refusal.actual } : {}),
+        previousInForce: report.hasPrevious,
+    };
+}
+/** Whether `bytes` are the binary `sha256` names; case is not significant in hex. */
+export function binaryMatches(bytes, sha256) {
+    const actual = createHash('sha256').update(bytes).digest('hex');
+    return { matches: actual === sha256.toLowerCase(), actual };
+}
+/** What makes two refusals of one version the same report (`Refusal::key`). */
+function refusalKey(refusal) {
+    if (refusal.kind === 'hash_mismatch')
+        return refusal.actual;
+    return refusal.kind;
+}
+export function describeRefusal(descriptor, refusal, hasPrevious) {
+    const why = refusal.kind === 'missing'
+        ? "its binary is missing from the control plane"
+        : refusal.kind === 'hash_mismatch'
+            ? `its binary hashes to ${refusal.actual} but its descriptor names ${descriptor.sha256}`
+            : `it cannot be loaded: ${refusal.error}`;
+    const consequence = hasPrevious
+        ? 'The previously loaded version stays in force.'
+        : 'No version of this rule has loaded on this proxy, so it enforces nothing until one does.';
+    return `WASM rule '${descriptor.name}' (${descriptor.ruleId}) was refused: ${why}. ${consequence}`;
+}
+export class CloudRuleSet {
+    fetchBinary;
+    report;
+    rules = [];
+    /** The descriptor list last applied, serialized; `undefined` until one has been. */
+    appliedKey;
+    /** The list of the last attempt, applied or not, and when it ran. */
+    attemptedKey;
+    attemptedAt = 0;
+    /** Whether the applied list left a version unloaded, so it is retried. */
+    incomplete = false;
+    syncing = null;
+    refusalsReported = new Set();
+    constructor(fetchBinary, report) {
+        this.fetchBinary = fetchBinary;
+        this.report = report;
+    }
+    /** Whether a descriptor list has been applied, so the loaded set is the workspace's. */
+    isLoaded() {
+        return this.appliedKey !== undefined;
+    }
+    /** The loaded rules, in descriptor order. */
+    getRules() {
+        return this.rules;
+    }
+    /**
+     * Brings the loaded set in line with `descriptors`.
+     *
+     * A changed list is applied before this resolves, so the call that follows
+     * a policy refresh is judged by the new set. Retrying versions the applied
+     * list refused, at most every {@link CLOUD_RETRY_MS}, runs in the
+     * background: the loaded set is already the workspace's. A list that could
+     * not be applied is retried no sooner either, so an unreachable control
+     * plane costs a call one fetch timeout at most every few seconds rather
+     * than on every call.
+     */
+    async sync(descriptors, bridge) {
+        while (this.syncing)
+            await this.syncing;
+        const key = JSON.stringify(descriptors);
+        const due = Date.now() - this.attemptedAt >= CLOUD_RETRY_MS;
+        if (key === this.appliedKey) {
+            if (this.incomplete && due)
+                void this.run(descriptors, key, bridge);
+            return;
+        }
+        if (key === this.attemptedKey && !due)
+            return;
+        await this.run(descriptors, key, bridge);
+    }
+    /**
+     * Recompiles every loaded rule from its kept bytes — the worker that held
+     * them was replaced. Waits for a sync in flight, which may have compiled
+     * into the old worker.
+     */
+    async reload(bridge) {
+        while (this.syncing)
+            await this.syncing;
+        for (const rule of this.rules)
+            await bridge.compile(rule.ruleId, rule.bytes);
+    }
+    run(descriptors, key, bridge) {
+        const run = this.apply(descriptors, key, bridge)
+            .catch((err) => {
+            // The worker itself failed under the sync; the loaded set is unchanged
+            // and the next sync tries again.
+            log.warn({ action: 'wasm_cloud_sync_failed', err: err.message }, "Syncing the workspace's custom rules failed");
+        })
+            .finally(() => {
+            if (this.syncing === run)
+                this.syncing = null;
+        });
+        this.syncing = run;
+        return run;
+    }
+    async apply(descriptors, key, bridge) {
+        this.attemptedKey = key;
+        this.attemptedAt = Date.now();
+        const previousBySha = new Map(this.rules.map((r) => [r.sha256, r]));
+        const previousByRule = new Map(this.rules.map((r) => [r.ruleId, r]));
+        // Every binary no loaded rule already has, fetched before anything
+        // changes: a control plane that cannot be reached leaves the loaded set
+        // exactly as it was.
+        const wanted = [...new Set(descriptors.map((d) => d.sha256).filter((sha) => !previousBySha.has(sha)))];
+        let fetched;
+        try {
+            fetched = new Map(await Promise.all(wanted.map(async (sha) => [sha, await this.fetchBinary(sha)])));
+        }
+        catch (err) {
+            log.warn({ action: 'wasm_cloud_fetch_failed', err: err.message, loaded: this.rules.length }, this.isLoaded()
+                ? "Could not fetch the workspace's custom rules; the loaded set stays in force"
+                : "Could not fetch the workspace's custom rules; none have loaded yet");
+            return;
+        }
+        const next = [];
+        let incomplete = false;
+        for (const descriptor of descriptors) {
+            const reuse = previousBySha.get(descriptor.sha256);
+            const outcome = reuse
+                ? await this.reuse(descriptor, reuse, bridge)
+                : await this.load(descriptor, fetched.get(descriptor.sha256) ?? null, bridge);
+            if ('kind' in outcome) {
+                incomplete = true;
+                const previous = previousByRule.get(descriptor.ruleId);
+                this.reportOnce(descriptor, outcome, previous !== undefined);
+                if (previous)
+                    next.push(previous);
+                continue;
+            }
+            if (previousByRule.get(descriptor.ruleId)?.sha256 !== descriptor.sha256)
+                bridge.replaced(descriptor.ruleId);
+            next.push(outcome);
+        }
+        // A rule no longer listed — deleted, or switched off — stops enforcing.
+        const kept = new Set(next.map((r) => r.ruleId));
+        for (const rule of this.rules) {
+            if (!kept.has(rule.ruleId))
+                bridge.remove(rule.ruleId);
+        }
+        this.rules = next;
+        this.appliedKey = key;
+        this.incomplete = incomplete;
+        log.info({ action: 'wasm_cloud_rules_loaded', rules: next.length, listed: descriptors.length }, "Workspace's custom rules loaded");
+    }
+    /** A binary some loaded rule already has: compiled again only when it is new to this rule id. */
+    async reuse(descriptor, loaded, bridge) {
+        if (loaded.ruleId !== descriptor.ruleId) {
+            const result = await bridge.compile(descriptor.ruleId, loaded.bytes);
+            if (!result.ok)
+                return { kind: result.reason, error: result.error };
+        }
+        return { ...loaded, ...descriptor };
+    }
+    /** `load_descriptor`: the hash, then the same load checks as a local rule. */
+    async load(descriptor, bytes, bridge) {
+        if (!bytes)
+            return { kind: 'missing' };
+        const { matches, actual } = binaryMatches(bytes, descriptor.sha256);
+        if (!matches)
+            return { kind: 'hash_mismatch', actual };
+        const result = await bridge.compile(descriptor.ruleId, bytes);
+        if (!result.ok)
+            return { kind: result.reason, error: result.error };
+        return { ...descriptor, readsReferencedFiles: result.readsReferencedFiles, rego: result.rego, bytes };
+    }
+    reportOnce(descriptor, refusal, hasPrevious) {
+        const id = [descriptor.sha256, refusalKey(refusal)].join('\u0000');
+        if (this.refusalsReported.has(id))
+            return;
+        this.refusalsReported.add(id);
+        const description = describeRefusal(descriptor, refusal, hasPrevious);
+        log.error({ action: 'wasm_cloud_rule_refused', ruleId: descriptor.ruleId, sha256: descriptor.sha256, refusal: refusal.kind }, description);
+        this.report({ descriptor, refusal, hasPrevious, description });
+    }
+}
+//# sourceMappingURL=cloudRules.js.map

package/dist/wasm/cloudRules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudRules.js","sourceRoot":"","sources":["../../src/wasm/cloudRules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACpE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE1D,OAAO,EAAE,mBAAmB,EAAiD,MAAM,aAAa,CAAA;AAEhG,MAAM,GAAG,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAA;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAA;AAiDnC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,eAAuB,EAAE,MAAc;IACzE,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE;QACtB,MAAM,GAAG,GAAG,GAAG,eAAe,+BAA+B,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAA;QACzF,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAA;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAA;YACrE,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,aAAa,CAAC,MAA8B;IAC1D,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,CAAA;IACtC,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,OAAO,CAAC,IAAI;QACrB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,eAAe,EAAE,MAAM,CAAC,WAAW;KACpC,CAAA;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,KAAiB,EAAE,MAAc;IAC7D,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAA;AAC7D,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,OAAyB;IAC3C,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,OAAO,CAAC,MAAM,CAAA;IAC3D,OAAO,OAAO,CAAC,IAAI,CAAA;AACrB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAA8B,EAAE,OAAyB,EAAE,WAAoB;IAC7G,MAAM,GAAG,GACP,OAAO,CAAC,IAAI,KAAK,SAAS;QACxB,CAAC,CAAC,8CAA8C;QAChD,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,eAAe;YAChC,CAAC,CAAC,wBAAwB,OAAO,CAAC,MAAM,6BAA6B,UAAU,CAAC,MAAM,EAAE;YACxF,CAAC,CAAC,wBAAwB,OAAO,CAAC,KAAK,EAAE,CAAA;IAC/C,MAAM,WAAW,GAAG,WAAW;QAC7B,CAAC,CAAC,+CAA+C;QACjD,CAAC,CAAC,0FAA0F,CAAA;IAC9F,OAAO,cAAc,UAAU,CAAC,IAAI,MAAM,UAAU,CAAC,MAAM,kBAAkB,GAAG,KAAK,WAAW,EAAE,CAAA;AACpG,CAAC;AAED,MAAM,OAAO,YAAY;IAaJ;IACA;IAbX,KAAK,GAAoB,EAAE,CAAA;IACnC,oFAAoF;IAC5E,UAAU,CAAoB;IACtC,qEAAqE;IAC7D,YAAY,CAAoB;IAChC,WAAW,GAAG,CAAC,CAAA;IACvB,0EAA0E;IAClE,UAAU,GAAG,KAAK,CAAA;IAClB,OAAO,GAAyB,IAAI,CAAA;IAC3B,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAA;IAErD,YACmB,WAA4B,EAC5B,MAAgD;QADhD,gBAAW,GAAX,WAAW,CAAiB;QAC5B,WAAM,GAAN,MAAM,CAA0C;IAChE,CAAC;IAEJ,wFAAwF;IACxF,QAAQ;QACN,OAAO,IAAI,CAAC,UAAU,KAAK,SAAS,CAAA;IACtC,CAAC;IAED,6CAA6C;IAC7C,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,IAAI,CAAC,WAA0C,EAAE,MAAuB;QAC5E,OAAO,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,CAAC,OAAO,CAAA;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,IAAI,cAAc,CAAA;QAC3D,IAAI,GAAG,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,UAAU,IAAI,GAAG;gBAAE,KAAK,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;YACnE,OAAM;QACR,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,CAAC,YAAY,IAAI,CAAC,GAAG;YAAE,OAAM;QAC7C,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;IAC1C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,MAAqB;QAChC,OAAO,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,CAAC,OAAO,CAAA;QACvC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9E,CAAC;IAEO,GAAG,CAAC,WAA0C,EAAE,GAAW,EAAE,MAAuB;QAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC;aAC7C,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,uEAAuE;YACvE,iCAAiC;YACjC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,6CAA6C,CAAC,CAAA;QAC5H,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,IAAI,CAAC,OAAO,KAAK,GAAG;gBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QAC/C,CAAC,CAAC,CAAA;QACJ,IAAI,CAAC,OAAO,GAAG,GAAG,CAAA;QAClB,OAAO,GAAG,CAAA;IACZ,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,WAA0C,EAAE,GAAW,EAAE,MAAuB;QAClG,IAAI,CAAC,YAAY,GAAG,GAAG,CAAA;QACvB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAE7B,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACnE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAEpE,mEAAmE;QACnE,wEAAwE;QACxE,qBAAqB;QACrB,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACtG,IAAI,OAAuC,CAAA;QAC3C,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAU,CAAC,CAAC,CAAC,CAAA;QAC9G,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAC7F,IAAI,CAAC,QAAQ,EAAE;gBACb,CAAC,CAAC,6EAA6E;gBAC/E,CAAC,CAAC,oEAAoE,CACzE,CAAA;YACD,OAAM;QACR,CAAC;QAED,MAAM,IAAI,GAAoB,EAAE,CAAA;QAChC,IAAI,UAAU,GAAG,KAAK,CAAA;QACtB,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YAClD,MAAM,OAAO,GAAG,KAAK;gBACnB,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC;gBAC7C,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,MAAM,CAAC,CAAA;YAC/E,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;gBACtB,UAAU,GAAG,IAAI,CAAA;gBACjB,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;gBACtD,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAA;gBAC5D,IAAI,QAAQ;oBAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;gBACjC,SAAQ;YACV,CAAC;YACD,IAAI,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,UAAU,CAAC,MAAM;gBAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YAC3G,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACpB,CAAC;QAED,wEAAwE;QACxE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;QAC/C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACxD,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QACjB,IAAI,CAAC,UAAU,GAAG,GAAG,CAAA;QACrB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,yBAAyB,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,EACrF,iCAAiC,CAClC,CAAA;IACH,CAAC;IAED,iGAAiG;IACzF,KAAK,CAAC,KAAK,CACjB,UAA8B,EAC9B,MAAqB,EACrB,MAAqB;QAErB,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;YACpE,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;QACrE,CAAC;QACD,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,UAAU,EAAE,CAAA;IACrC,CAAC;IAED,8EAA8E;IACtE,KAAK,CAAC,IAAI,CAChB,UAA8B,EAC9B,KAAwB,EACxB,MAAqB;QAErB,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;QACtC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;QACnE,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAA;QACtD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAC7D,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;QACnE,OAAO,EAAE,GAAG,UAAU,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;IACvG,CAAC;IAEO,UAAU,CAAC,UAA8B,EAAE,OAAyB,EAAE,WAAoB;QAChG,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAClE,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAM;QACzC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC7B,MAAM,WAAW,GAAG,eAAe,CAAC,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,CAAA;QACrE,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAA;QAC1I,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAA;IAChE,CAAC;CACF"}

package/dist/wasm/context.d.ts

@@ -46,6 +46,8 @@ export interface WasmContextInput {
     corroboratingDetectors: number;
     /** `undefined` when no `tools/list` response has been TOFU-checked yet this session. */
     toolContractChanged: boolean | undefined;
+    /** The MCP server this proxy fronts (`--server-name`); a Rego rule reads it as `input.server`. */
+    serverName?: string;
 }
 /**
  * Builds the plain object to `JSON.stringify` and hand to a WASM rule's
@@ -54,4 +56,12 @@ export interface WasmContextInput {
  * not present as keys at all.
  */
 export declare function buildWasmContext(input: WasmContextInput): Record<string, unknown>;
+/**
+ * The `input` document a Rego rule is evaluated against — version 1, the shape
+ * `packages/proxy/src/wasm/opa.rs`'s `policy_input` builds for the LLM proxy,
+ * less the fields this proxy has no honest value for (`model`, `risk_tier`,
+ * the budget), plus `server`. Bounded and serialised by `boundedRegoInput`,
+ * which cuts long strings in `args` exactly as the Rust host does.
+ */
+export declare function buildRegoInput(input: WasmContextInput): string;
 //# sourceMappingURL=context.d.ts.map

package/dist/wasm/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/wasm/context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAEnD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,2EAA2E;IAC3E,KAAK,EAAE,SAAS,cAAc,EAAE,CAAA;IAChC;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,OAAO,CAAA;IACtB,0GAA0G;IAC1G,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B,YAAY,EAAE,MAAM,CAAA;IACpB;;;mEAG+D;IAC/D,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,sBAAsB,EAAE,MAAM,CAAA;IAC9B,wFAAwF;IACxF,mBAAmB,EAAE,OAAO,GAAG,SAAS,CAAA;CACzC;AASD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyBjF"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/wasm/context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAEnD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,2EAA2E;IAC3E,KAAK,EAAE,SAAS,cAAc,EAAE,CAAA;IAChC;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,OAAO,CAAA;IACtB,0GAA0G;IAC1G,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B,YAAY,EAAE,MAAM,CAAA;IACpB;;;mEAG+D;IAC/D,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,sBAAsB,EAAE,MAAM,CAAA;IAC9B,wFAAwF;IACxF,mBAAmB,EAAE,OAAO,GAAG,SAAS,CAAA;IACxC,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AASD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyBjF;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAkB9D"}

package/dist/wasm/context.js

@@ -17,6 +17,7 @@
  *
  * @module
  */
+import { REGO_INPUT_VERSION, boundedRegoInput } from '@intutic/shared-types';
 /** `(tool, count)` pairs, wire-shaped as 2-element arrays — see context.ts's module doc. */
 function foldToolCallCounts(sequence) {
     const counts = new Map();
@@ -56,4 +57,30 @@ export function buildWasmContext(input) {
     }
     return ctx;
 }
+/**
+ * The `input` document a Rego rule is evaluated against — version 1, the shape
+ * `packages/proxy/src/wasm/opa.rs`'s `policy_input` builds for the LLM proxy,
+ * less the fields this proxy has no honest value for (`model`, `risk_tier`,
+ * the budget), plus `server`. Bounded and serialised by `boundedRegoInput`,
+ * which cuts long strings in `args` exactly as the Rust host does.
+ */
+export function buildRegoInput(input) {
+    return boundedRegoInput({
+        v: REGO_INPUT_VERSION,
+        host: 'mcp',
+        tool: input.toolName,
+        args: input.toolArguments ?? {},
+        ...(input.serverName ? { server: input.serverName } : {}),
+        session: {
+            id: input.sessionId,
+            workspace_id: input.workspaceId,
+            tool_sequence: [...input.toolSequence],
+            calls_last_60s: input.callsLast60s,
+        },
+        request: {
+            dlp_findings: input.dlpFindingDescriptions.map((description) => ({ pattern_name: description })),
+            injection_findings: [...input.injectionFindings],
+        },
+    });
+}
 //# sourceMappingURL=context.js.map

package/dist/wasm/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/wasm/context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAkCH,4FAA4F;AAC5F,SAAS,kBAAkB,CAAC,QAA2B;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,KAAK,MAAM,IAAI,IAAI,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1E,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IACtD,MAAM,GAAG,GAA4B;QACnC,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;QACnF,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAClG,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;QACtC,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC;QACxD,cAAc,EAAE,KAAK,CAAC,YAAY;QAClC,kEAAkE;QAClE,uEAAuE;QACvE,sEAAsE;QACtE,2DAA2D;QAC3D,oEAAoE;QACpE,qEAAqE;QACrE,oEAAoE;QACpE,YAAY,EAAE,KAAK,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;QAChG,kBAAkB,EAAE,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC;QAChD,iBAAiB,EAAE,CAAC,GAAG,KAAK,CAAC,gBAAgB,CAAC;QAC9C,uBAAuB,EAAE,KAAK,CAAC,sBAAsB;KACtD,CAAA;IACD,IAAI,KAAK,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC5C,GAAG,CAAC,uBAAuB,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAA;IAC1D,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/wasm/context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAmC5E,4FAA4F;AAC5F,SAAS,kBAAkB,CAAC,QAA2B;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,KAAK,MAAM,IAAI,IAAI,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1E,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IACtD,MAAM,GAAG,GAA4B;QACnC,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;QACnF,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAClG,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;QACtC,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC;QACxD,cAAc,EAAE,KAAK,CAAC,YAAY;QAClC,kEAAkE;QAClE,uEAAuE;QACvE,sEAAsE;QACtE,2DAA2D;QAC3D,oEAAoE;QACpE,qEAAqE;QACrE,oEAAoE;QACpE,YAAY,EAAE,KAAK,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;QAChG,kBAAkB,EAAE,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC;QAChD,iBAAiB,EAAE,CAAC,GAAG,KAAK,CAAC,gBAAgB,CAAC;QAC9C,uBAAuB,EAAE,KAAK,CAAC,sBAAsB;KACtD,CAAA;IACD,IAAI,KAAK,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC5C,GAAG,CAAC,uBAAuB,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAA;IAC1D,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,KAAuB;IACpD,OAAO,gBAAgB,CAAC;QACtB,CAAC,EAAE,kBAAkB;QACrB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,KAAK,CAAC,QAAQ;QACpB,IAAI,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE;QAC/B,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE;YACP,EAAE,EAAE,KAAK,CAAC,SAAS;YACnB,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;YACtC,cAAc,EAAE,KAAK,CAAC,YAAY;SACnC;QACD,OAAO,EAAE;YACP,YAAY,EAAE,KAAK,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;YAChG,kBAAkB,EAAE,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC;SACjD;KACF,CAAC,CAAA;AACJ,CAAC"}

package/dist/wasm/hostImports.d.ts

@@ -11,9 +11,9 @@
  * (never `console.log`/stdout — the same stdio-isolation rule every other
  * module in this package follows). `read_referenced_file` resolves against
  * the per-evaluation table the runner pre-reads through `referencedFiles.ts`
- * (TD-441) — the port of `host.rs`'s `read_referenced_file_impl`, code for
- * code: the read budget is charged before argument validation, a refusal is
- * a value the rule can act on, and nothing here traps. With no table (no
+ * — the port of `host.rs`'s `read_referenced_file_impl`, code for code: the
+ * read budget is charged before argument validation, a refusal is a value
+ * the rule can act on, and nothing here traps. With no table (no
  * `INTUTIC_WASM_MANIFEST_ROOT`, or a rule that does not import the function)
  * every call gets `ERR_REFUSED`, which is what the Rust proxy answers with no
  * root configured.

package/dist/wasm/hostImports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hostImports.d.ts","sourceRoot":"","sources":["../../src/wasm/hostImports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EACL,eAAe,EAOhB,MAAM,sBAAsB,CAAA;AAI7B,mIAAmI;AACnI,eAAO,MAAM,WAAW,KAAU,CAAA;AAElC,uEAAuE;AACvE,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,KAAK,EAAE,eAAe,CAAA;IACtB,6DAA6D;IAC7D,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED,wBAAgB,kBAAkB,CAAC,KAAK,GAAE,eAAyC,GAAG,eAAe,CAEpG;AAoBD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,WAAW,CAAC,MAAM,GAAG,SAAS,EAC/C,KAAK,GAAE,eAAsC,GAC5C,WAAW,CAAC,aAAa,CA0G3B"}
+{"version":3,"file":"hostImports.d.ts","sourceRoot":"","sources":["../../src/wasm/hostImports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EACL,eAAe,EAOhB,MAAM,sBAAsB,CAAA;AAI7B,mIAAmI;AACnI,eAAO,MAAM,WAAW,KAAU,CAAA;AAElC,uEAAuE;AACvE,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,KAAK,EAAE,eAAe,CAAA;IACtB,6DAA6D;IAC7D,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED,wBAAgB,kBAAkB,CAAC,KAAK,GAAE,eAAyC,GAAG,eAAe,CAEpG;AAoBD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,WAAW,CAAC,MAAM,GAAG,SAAS,EAC/C,KAAK,GAAE,eAAsC,GAC5C,WAAW,CAAC,aAAa,CA2G3B"}

package/dist/wasm/hostImports.js

@@ -11,9 +11,9 @@
  * (never `console.log`/stdout — the same stdio-isolation rule every other
  * module in this package follows). `read_referenced_file` resolves against
  * the per-evaluation table the runner pre-reads through `referencedFiles.ts`
- * (TD-441) — the port of `host.rs`'s `read_referenced_file_impl`, code for
- * code: the read budget is charged before argument validation, a refusal is
- * a value the rule can act on, and nothing here traps. With no table (no
+ * — the port of `host.rs`'s `read_referenced_file_impl`, code for code: the
+ * read budget is charged before argument validation, a refusal is a value
+ * the rule can act on, and nothing here traps. With no table (no
  * `INTUTIC_WASM_MANIFEST_ROOT`, or a rule that does not import the function)
  * every call gets `ERR_REFUSED`, which is what the Rust proxy answers with no
  * root configured.
@@ -74,7 +74,8 @@ export function createHostImports(getMemory, state = newHostImportState()) {
         // Mirrors host.rs's `abort` import: log only, never throw/trap. A guest
         // unhandled-exception calling `abort` must not crash the evaluation —
         // the caller (worker.ts) still wraps the whole `evaluate` call so any
-        // resulting trap fails open, but this import itself is inert.
+        // resulting trap is a rule that reached no verdict, but this import itself
+        // is inert.
         abort: (msgPtr, filePtr, line, col) => {
             log.warn({ action: 'wasm_abort', msgPtr, filePtr, line, col }, 'WASM rule called abort (AssemblyScript unhandled exception)');
         },
@@ -110,9 +111,9 @@ export function createHostImports(getMemory, state = newHostImportState()) {
         },
         // Ported from host.rs's `read_referenced_file_impl`. Returns a length or
         // one of the negative codes; never throws — a host trap would unwind the
-        // guest, fail the whole evaluation and land in the runner's fail-open
-        // arm, so one malformed call would silently switch off every OTHER
-        // check the rule performs.
+        // guest and leave the whole evaluation without a verdict, so one malformed
+        // call would override every OTHER check the rule performs with the fail
+        // setting.
         read_referenced_file: (pathPtr, pathLen, outPtr, outCap) => {
             // Charged before anything else, including argument validation, so a
             // guest cannot spin on cheap malformed calls any more than on

package/dist/wasm/hostImports.js.map

@@ -1 +1 @@
-{"version":3,"file":"hostImports.js","sourceRoot":"","sources":["../../src/wasm/hostImports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACpE,OAAO,EACL,eAAe,EACf,YAAY,EACZ,UAAU,EACV,oBAAoB,EACpB,WAAW,IAAI,OAAO,EACtB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA;AAE7B,MAAM,GAAG,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAA;AAE/C,mIAAmI;AACnI,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAA;AAUlC,MAAM,UAAU,kBAAkB,CAAC,QAAyB,eAAe,CAAC,KAAK,EAAE;IACjF,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,CAAA;AAChE,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,MAA0B,EAAE,GAAW,EAAE,GAAW;IACpE,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,MAAM,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;IACrB,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAA+C,EAC/C,QAAyB,kBAAkB,EAAE;IAE7C,OAAO;QACL,QAAQ,EAAE,CAAC,GAAW,EAAE,GAAW,EAAQ,EAAE;YAC3C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;YAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,iDAAiD,CAAC,CAAA;gBAChH,OAAM;YACR,CAAC;YACD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YACtC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,EAAE,6DAA6D,CAAC,CAAA;gBAC7G,OAAM;YACR,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5C,CAAC;QAED,wEAAwE;QACxE,sEAAsE;QACtE,sEAAsE;QACtE,8DAA8D;QAC9D,KAAK,EAAE,CAAC,MAAc,EAAE,OAAe,EAAE,IAAY,EAAE,GAAW,EAAQ,EAAE;YAC1E,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,EACpD,6DAA6D,CAC9D,CAAA;QACH,CAAC;QAED,mEAAmE;QACnE,qEAAqE;QACrE,sEAAsE;QACtE,uEAAuE;QACvE,YAAY;QACZ,KAAK,EAAE,CAAC,GAAW,EAAE,CAAS,EAAQ,EAAE;YACtC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;YAC1B,IAAI,CAAC,MAAM;gBAAE,OAAM;YACnB,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBAC3C,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;oBAC7C,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;oBACpF,MAAM,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;oBACrB,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;wBACxB,IAAI,CAAC;4BACH,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,CAAA;4BAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAA;4BACzC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;4BAC1C,OAAM;wBACR,CAAC;wBAAC,MAAM,CAAC;4BACP,yCAAyC;wBAC3C,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAA;QAC1E,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,mEAAmE;QACnE,2BAA2B;QAC3B,oBAAoB,EAAE,CAAC,OAAe,EAAE,OAAe,EAAE,MAAc,EAAE,MAAc,EAAU,EAAE;YACjG,oEAAoE;YACpE,8DAA8D;YAC9D,uBAAuB;YACvB,IAAI,KAAK,CAAC,kBAAkB,IAAI,CAAC,EAAE,CAAC;gBAClC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,iCAAiC,EAAE,MAAM,EAAE,wBAAwB,EAAE,EAC/E,iEAAiE,CAClE,CAAA;gBACD,OAAO,UAAU,CAAA;YACnB,CAAC;YACD,KAAK,CAAC,kBAAkB,IAAI,CAAC,CAAA;YAE7B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;YAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE,6DAA6D,CAAC,CAAA;gBACxI,OAAO,YAAY,CAAA;YACrB,CAAC;YACD,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,GAAG,oBAAoB,IAAI,MAAM,GAAG,CAAC;gBAAE,OAAO,YAAY,CAAA;YACpG,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;YACpD,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,YAAY,CAAA;YAE3C,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YACzC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,qEAAqE;gBACrE,0CAA0C;gBAC1C,GAAG,CAAC,KAAK,CACP,EAAE,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,EACzH,4CAA4C,CAC7C,CAAA;gBACD,OAAO,GAAG,CAAC,IAAI,CAAA;YACjB,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAA,CAAC,oDAAoD;YACjF,IAAI,MAAM,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAA;YAC5B,IAAI,MAAM,GAAG,GAAG;gBAAE,OAAO,oBAAoB,CAAA;YAC7C,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC1C,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC7C,yDAAyD;gBACzD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kCAAkC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,iDAAiD,CAAC,CAAA;gBACxH,OAAO,YAAY,CAAA;YACrB,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YAC3B,OAAO,GAAG,CAAA;QACZ,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"hostImports.js","sourceRoot":"","sources":["../../src/wasm/hostImports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACpE,OAAO,EACL,eAAe,EACf,YAAY,EACZ,UAAU,EACV,oBAAoB,EACpB,WAAW,IAAI,OAAO,EACtB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA;AAE7B,MAAM,GAAG,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAA;AAE/C,mIAAmI;AACnI,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAA;AAUlC,MAAM,UAAU,kBAAkB,CAAC,QAAyB,eAAe,CAAC,KAAK,EAAE;IACjF,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,CAAA;AAChE,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,MAA0B,EAAE,GAAW,EAAE,GAAW;IACpE,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,MAAM,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;IACrB,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAA+C,EAC/C,QAAyB,kBAAkB,EAAE;IAE7C,OAAO;QACL,QAAQ,EAAE,CAAC,GAAW,EAAE,GAAW,EAAQ,EAAE;YAC3C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;YAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,iDAAiD,CAAC,CAAA;gBAChH,OAAM;YACR,CAAC;YACD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YACtC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,EAAE,6DAA6D,CAAC,CAAA;gBAC7G,OAAM;YACR,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5C,CAAC;QAED,wEAAwE;QACxE,sEAAsE;QACtE,sEAAsE;QACtE,2EAA2E;QAC3E,YAAY;QACZ,KAAK,EAAE,CAAC,MAAc,EAAE,OAAe,EAAE,IAAY,EAAE,GAAW,EAAQ,EAAE;YAC1E,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,EACpD,6DAA6D,CAC9D,CAAA;QACH,CAAC;QAED,mEAAmE;QACnE,qEAAqE;QACrE,sEAAsE;QACtE,uEAAuE;QACvE,YAAY;QACZ,KAAK,EAAE,CAAC,GAAW,EAAE,CAAS,EAAQ,EAAE;YACtC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;YAC1B,IAAI,CAAC,MAAM;gBAAE,OAAM;YACnB,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBAC3C,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;oBAC7C,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;oBACpF,MAAM,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;oBACrB,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;wBACxB,IAAI,CAAC;4BACH,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,CAAA;4BAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAA;4BACzC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;4BAC1C,OAAM;wBACR,CAAC;wBAAC,MAAM,CAAC;4BACP,yCAAyC;wBAC3C,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAA;QAC1E,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,WAAW;QACX,oBAAoB,EAAE,CAAC,OAAe,EAAE,OAAe,EAAE,MAAc,EAAE,MAAc,EAAU,EAAE;YACjG,oEAAoE;YACpE,8DAA8D;YAC9D,uBAAuB;YACvB,IAAI,KAAK,CAAC,kBAAkB,IAAI,CAAC,EAAE,CAAC;gBAClC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,iCAAiC,EAAE,MAAM,EAAE,wBAAwB,EAAE,EAC/E,iEAAiE,CAClE,CAAA;gBACD,OAAO,UAAU,CAAA;YACnB,CAAC;YACD,KAAK,CAAC,kBAAkB,IAAI,CAAC,CAAA;YAE7B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;YAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE,6DAA6D,CAAC,CAAA;gBACxI,OAAO,YAAY,CAAA;YACrB,CAAC;YACD,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,GAAG,oBAAoB,IAAI,MAAM,GAAG,CAAC;gBAAE,OAAO,YAAY,CAAA;YACpG,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;YACpD,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,YAAY,CAAA;YAE3C,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YACzC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,qEAAqE;gBACrE,0CAA0C;gBAC1C,GAAG,CAAC,KAAK,CACP,EAAE,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,EACzH,4CAA4C,CAC7C,CAAA;gBACD,OAAO,GAAG,CAAC,IAAI,CAAA;YACjB,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAA,CAAC,oDAAoD;YACjF,IAAI,MAAM,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAA;YAC5B,IAAI,MAAM,GAAG,GAAG;gBAAE,OAAO,oBAAoB,CAAA;YAC7C,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC1C,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC7C,yDAAyD;gBACzD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kCAAkC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,iDAAiD,CAAC,CAAA;gBACxH,OAAO,YAAY,CAAA;YACrB,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YAC3B,OAAO,GAAG,CAAA;QACZ,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/wasm/loader.d.ts

@@ -12,6 +12,7 @@
  *
  * @module
  */
+import type { RuleLoadFailureReason } from '@intutic/shared-types';
 /** Ported from `local_loader.rs`'s `MAX_RULE_FILE_BYTES`. */
 export declare const MAX_RULE_FILE_BYTES: number;
 /** Ported from `local_loader.rs`'s `DEFAULT_PRIORITY`. */
@@ -54,16 +55,24 @@ export interface LoadedRuleMeta {
     name: string;
     priority: number;
     readsReferencedFiles: boolean;
+    /** A Rego policy compiled by OPA: evaluated against `buildRegoInput`'s document, not the native context. */
+    rego: boolean;
     /** Cached raw bytes, so a worker respawn (wasm/runner.ts) can resend every
      *  currently-loaded rule without re-reading the directory from disk. */
     bytes: Uint8Array;
 }
+/** Why a module did not compile or load: the reasons a compile can reach, never a missing binary or a hash mismatch. */
+export type CompileFailureReason = Exclude<RuleLoadFailureReason, 'missing' | 'hash_mismatch'>;
 export type CompileOutcome = {
     ok: true;
     readsReferencedFiles: boolean;
-} | {
+    rego: boolean;
+}
+/** `reason` names the failure as the Rust proxy and the control plane do (`RULE_LOAD_FAILURE_REASONS`). */
+ | {
     ok: false;
     error: string;
+    reason: CompileFailureReason;
     unsupportedImports?: string[];
 };
 /** What `WasmLoader` needs from the worker to load/unload a rule — implemented by `WasmRunner`. */

package/dist/wasm/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/wasm/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,6DAA6D;AAC7D,eAAO,MAAM,mBAAmB,QAAmB,CAAA;AAEnD,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,MAAM,CAAA;AAEnC;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAK9D;AAOD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAWlF;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAsBrF;AAWD,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,oBAAoB,EAAE,OAAO,CAAA;IAC7B;4EACwE;IACxE,KAAK,EAAE,UAAU,CAAA;CAClB;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,oBAAoB,EAAE,OAAO,CAAA;CAAE,GAC3C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAA;AAE/D,mGAAmG;AACnG,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IACnE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED;;;;GAIG;AACH,qBAAa,UAAU;IAIT,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHhC,OAAO,CAAC,UAAU,CAAmC;IACrD,OAAO,CAAC,MAAM,CAAoC;gBAErB,GAAG,EAAE,MAAM;IAExC,MAAM,IAAI,MAAM;IAIhB,0FAA0F;IAC1F,QAAQ,IAAI,cAAc,EAAE;IAI5B;;;;;OAKG;IACG,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CA+ElE"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/wasm/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAKlE,6DAA6D;AAC7D,eAAO,MAAM,mBAAmB,QAAmB,CAAA;AAEnD,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,MAAM,CAAA;AAEnC;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAK9D;AAOD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAWlF;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAsBrF;AAWD,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,oBAAoB,EAAE,OAAO,CAAA;IAC7B,4GAA4G;IAC5G,IAAI,EAAE,OAAO,CAAA;IACb;4EACwE;IACxE,KAAK,EAAE,UAAU,CAAA;CAClB;AAED,wHAAwH;AACxH,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,EAAE,SAAS,GAAG,eAAe,CAAC,CAAA;AAE9F,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,oBAAoB,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE;AAC5D,2GAA2G;GACzG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAA;AAE7F,mGAAmG;AACnG,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IACnE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED;;;;GAIG;AACH,qBAAa,UAAU;IAIT,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHhC,OAAO,CAAC,UAAU,CAAmC;IACrD,OAAO,CAAC,MAAM,CAAoC;gBAErB,GAAG,EAAE,MAAM;IAExC,MAAM,IAAI,MAAM;IAIhB,0FAA0F;IAC1F,QAAQ,IAAI,cAAc,EAAE;IAI5B;;;;;OAKG;IACG,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAiFlE"}

package/dist/wasm/loader.js

@@ -178,6 +178,7 @@ export class WasmLoader {
                     name,
                     priority,
                     readsReferencedFiles: result.readsReferencedFiles,
+                    rego: result.rego,
                     bytes,
                 });
             }
@@ -185,6 +186,7 @@ export class WasmLoader {
                 log.warn({
                     action: 'wasm_rule_load_error',
                     file: filePath,
+                    reason: result.reason,
                     error: result.error,
                     unsupportedImports: result.unsupportedImports,
                 }, 'local WASM rule failed to load — retaining previous version if any');

package/dist/wasm/loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/wasm/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEpE,MAAM,GAAG,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAEjD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAEnD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAA;AAEnC;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,cAAuB;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC9C,IAAI,MAAM;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;IACrC,IAAI,cAAc;QAAE,OAAO,UAAU,CAAC,cAAc,CAAC,CAAA;IACrD,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAChF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;IACvF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;QAChC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AACnD,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAA;IACnD,IAAI,OAAmC,CAAA;IACvC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAA;QACvE,MAAM,GAAG,CAAA;IACX,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAQ;QAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QAC5C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACrC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;YAC5D,mEAAmE;YACnE,iBAAiB;QACnB,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,CAA6B,EAAE,CAA6B;IACnF,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACnC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACxB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI;YAAE,OAAO,KAAK,CAAA;IACtF,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAwBD;;;;GAIG;AACH,MAAM,OAAO,UAAU;IAIQ;IAHrB,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC7C,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAA,CAAC,qBAAqB;IAExE,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IAE5C,MAAM;QACJ,OAAO,IAAI,CAAC,GAAG,CAAA;IACjB,CAAC;IAED,0FAA0F;IAC1F,QAAQ;QACN,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC1E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,MAAqB,EAAE,KAAK,GAAG,KAAK;QAC/C,IAAI,aAAyC,CAAA;QAC7C,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EACzE,yEAAyE,CAC1E,CAAA;YACD,OAAM;QACR,CAAC;QAED,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC;YAAE,OAAM;QAErE,iBAAiB;QACjB,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBACtC,IAAI,IAAI;oBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;gBACpC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC9B,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,aAAa,EAAE,CAAC;YAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACjD,MAAM,OAAO,GAAG,KAAK,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,IAAI,WAAW,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAA;YAC7G,IAAI,CAAC,OAAO;gBAAE,SAAQ;YAEtB,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAC7C,MAAM,MAAM,GAAG,SAAS,QAAQ,EAAE,CAAA;YAElC,IAAI,GAAG,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;gBACnC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,mBAAmB,EAAE,EACrG,4CAA4C,CAC7C,CAAA;gBACD,SAAQ,CAAC,sFAAsF;YACjG,CAAC;YAED,IAAI,KAAa,CAAA;YACjB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAC/E,oEAAoE,CACrE,CAAA;gBACD,SAAQ;YACV,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YAClD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;gBAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE;oBACxB,MAAM;oBACN,QAAQ;oBACR,IAAI;oBACJ,QAAQ;oBACR,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;oBACjD,KAAK;iBACN,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CACN;oBACE,MAAM,EAAE,sBAAsB;oBAC9B,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;iBAC9C,EACD,oEAAoE,CACrE,CAAA;gBACD,mEAAmE;gBACnE,oEAAoE;YACtE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,aAAa,CAAA;IACjC,CAAC;CACF"}
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/wasm/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AAEtC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEpE,MAAM,GAAG,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAEjD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAEnD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAA;AAEnC;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,cAAuB;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC9C,IAAI,MAAM;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;IACrC,IAAI,cAAc;QAAE,OAAO,UAAU,CAAC,cAAc,CAAC,CAAA;IACrD,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAChF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;IACvF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;QAChC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AACnD,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAA;IACnD,IAAI,OAAmC,CAAA;IACvC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAA;QACvE,MAAM,GAAG,CAAA;IACX,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAQ;QAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QAC5C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACrC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;YAC5D,mEAAmE;YACnE,iBAAiB;QACnB,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,CAA6B,EAAE,CAA6B;IACnF,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACnC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACxB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI;YAAE,OAAO,KAAK,CAAA;IACtF,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AA8BD;;;;GAIG;AACH,MAAM,OAAO,UAAU;IAIQ;IAHrB,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC7C,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAA,CAAC,qBAAqB;IAExE,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IAE5C,MAAM;QACJ,OAAO,IAAI,CAAC,GAAG,CAAA;IACjB,CAAC;IAED,0FAA0F;IAC1F,QAAQ;QACN,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC1E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,MAAqB,EAAE,KAAK,GAAG,KAAK;QAC/C,IAAI,aAAyC,CAAA;QAC7C,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EACzE,yEAAyE,CAC1E,CAAA;YACD,OAAM;QACR,CAAC;QAED,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC;YAAE,OAAM;QAErE,iBAAiB;QACjB,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBACtC,IAAI,IAAI;oBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;gBACpC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC9B,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,aAAa,EAAE,CAAC;YAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACjD,MAAM,OAAO,GAAG,KAAK,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,IAAI,WAAW,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAA;YAC7G,IAAI,CAAC,OAAO;gBAAE,SAAQ;YAEtB,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAC7C,MAAM,MAAM,GAAG,SAAS,QAAQ,EAAE,CAAA;YAElC,IAAI,GAAG,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;gBACnC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,mBAAmB,EAAE,EACrG,4CAA4C,CAC7C,CAAA;gBACD,SAAQ,CAAC,sFAAsF;YACjG,CAAC;YAED,IAAI,KAAa,CAAA;YACjB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAC/E,oEAAoE,CACrE,CAAA;gBACD,SAAQ;YACV,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YAClD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;gBAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE;oBACxB,MAAM;oBACN,QAAQ;oBACR,IAAI;oBACJ,QAAQ;oBACR,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;oBACjD,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,KAAK;iBACN,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CACN;oBACE,MAAM,EAAE,sBAAsB;oBAC9B,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;iBAC9C,EACD,oEAAoE,CACrE,CAAA;gBACD,mEAAmE;gBACnE,oEAAoE;YACtE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,aAAa,CAAA;IACjC,CAAC;CACF"}

package/dist/wasm/referencedFiles.d.ts

@@ -1,6 +1,6 @@
 /**
  * wasm/referencedFiles.ts — The MCP-side resolver behind the
- * `read_referenced_file` host import (TD-441). A 1:1 port of
+ * `read_referenced_file` host import. A 1:1 port of
  * `packages/proxy/src/wasm/referenced_files.rs`: same constants, same error
  * codes, same candidate-token rules, same six guards, same realpath
  * confinement. Where the two differ it is stated at the site.
@@ -46,6 +46,14 @@ export declare const ERR_NOT_FOUND = -3;
 export declare const ERR_TOO_LARGE = -4;
 export declare const ERR_BUFFER_TOO_SMALL = -5;
 export declare const ERR_BUDGET = -6;
+/**
+ * Not read, and not because the call never named it: the tool calls name
+ * more manifests than the host reads (`MAX_REFERENCED_FILES`), or carry a
+ * command longer than it scans, and this path is not among those read. Kept
+ * apart from `ERR_REFUSED` so decoy paths cannot make the manifest that
+ * matters look like one the call never named.
+ */
+export declare const ERR_NOT_READ = -7;
 /** Host calls one evaluation may make, charged before argument validation. */
 export declare const MAX_READS_PER_EVALUATION = 64;
 /** The operator-configured root. Unset means the capability is off. */
@@ -64,7 +72,18 @@ export type Outcome = {
     size: number;
 };
 /** The structured-clone-safe wire form the runner posts to the worker. */
-export type ReferencedFilesTable = Array<[string, Outcome]>;
+export interface ReferencedFilesTable {
+    entries: Array<[string, Outcome]>;
+    /** The request named more than was read: a missing path answers `ERR_NOT_READ`. */
+    pastLimits: boolean;
+}
+/** The paths a request's tool calls name, and whether it named more than the host reads. */
+export interface Candidates {
+    /** At most `MAX_REFERENCED_FILES`, deduped, in first-seen order. */
+    tokens: string[];
+    /** A manifest-shaped path past `MAX_REFERENCED_FILES`, or a command longer than the scan. */
+    pastLimits: boolean;
+}
 export interface ToolCallLike {
     name: string;
     arguments: unknown;
@@ -75,10 +94,13 @@ export interface ToolCallLike {
  */
 export declare class ReferencedFiles {
     private readonly entries;
+    private readonly pastLimits;
     private constructor();
     static empty(): ReferencedFiles;
     static fromTable(table: ReferencedFilesTable | undefined): ReferencedFiles;
     toTable(): ReferencedFilesTable;
+    /** The same entries, recording whether the request named more than was read. */
+    withPastLimits(pastLimits: boolean): ReferencedFiles;
     isEmpty(): boolean;
     readableCount(): number;
     /** The bytes for `requested`, or the error code the guest gets. */
@@ -98,9 +120,10 @@ export declare class ReferencedFiles {
 export declare function resolveRoot(env?: NodeJS.ProcessEnv): string | undefined;
 /**
  * Guard 1 and 2: every manifest-shaped path the tool calls literally name,
- * deduped, capped at `MAX_REFERENCED_FILES`, in first-seen order.
+ * deduped, capped at `MAX_REFERENCED_FILES`, in first-seen order, and whether
+ * they named more than that.
  */
-export declare function candidateTokens(toolCalls: readonly ToolCallLike[]): string[];
+export declare function candidateTokens(toolCalls: readonly ToolCallLike[]): Candidates;
 /**
  * Split a command into shell words. Quotes group; whitespace and the
  * metacharacters that end a word separate. Deliberately does NOT expand
@@ -110,6 +133,8 @@ export declare function candidateTokens(toolCalls: readonly ToolCallLike[]): str
 export declare function shellTokens(command: string): string[];
 /** Resolve and read every candidate under `root`. Async, so the runner awaits it once per evaluation. */
 export declare function readTokens(tokens: readonly string[], root: string): Promise<ReferencedFiles>;
+/** `readTokens` for a request's candidates, keeping whether it named more than was read. */
+export declare function readCandidates(candidates: Candidates, root: string): Promise<ReferencedFiles>;
 /** Convenience for callers with tool calls in hand. */
 export declare function prefetch(toolCalls: readonly ToolCallLike[], root: string): Promise<ReferencedFiles>;
 //# sourceMappingURL=referencedFiles.d.ts.map

package/dist/wasm/referencedFiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"referencedFiles.d.ts","sourceRoot":"","sources":["../../src/wasm/referencedFiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAUH,iFAAiF;AACjF,eAAO,MAAM,yBAAyB,QAAa,CAAA;AACnD,iDAAiD;AACjD,eAAO,MAAM,oBAAoB,IAAI,CAAA;AACrC,wCAAwC;AACxC,eAAO,MAAM,oBAAoB,OAAO,CAAA;AAMxC,eAAO,MAAM,YAAY,KAAK,CAAA;AAC9B,eAAO,MAAM,WAAW,KAAK,CAAA;AAC7B,eAAO,MAAM,aAAa,KAAK,CAAA;AAC/B,eAAO,MAAM,aAAa,KAAK,CAAA;AAC/B,eAAO,MAAM,oBAAoB,KAAK,CAAA;AACtC,eAAO,MAAM,UAAU,KAAK,CAAA;AAE5B,8EAA8E;AAC9E,eAAO,MAAM,wBAAwB,KAAK,CAAA;AAE1C,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,+BAA+B,CAAA;AAO7D,6EAA6E;AAC7E,MAAM,MAAM,OAAO,GACf;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAEvC,0EAA0E;AAC1E,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;AAE3D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,OAAO,CAAA;CACnB;AAED;;;GAGG;AACH,qBAAa,eAAe;IACN,OAAO,CAAC,QAAQ,CAAC,OAAO;IAA5C,OAAO;IAEP,MAAM,CAAC,KAAK,IAAI,eAAe;IAI/B,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,oBAAoB,GAAG,SAAS,GAAG,eAAe;IAI1E,OAAO,IAAI,oBAAoB;IAI/B,OAAO,IAAI,OAAO;IAIlB,aAAa,IAAI,MAAM;IAIvB,mEAAmE;IACnE,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE;IAgBxF,yDAAyD;IACzD,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAgBxC,+CAA+C;IAC/C,QAAQ,IAAI,MAAM;CAgBnB;AAED,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAKpF;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,EAAE,CAoB5E;AAsBD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA0BrD;AAED,yGAAyG;AACzG,wBAAsB,UAAU,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CA2ClG;AAeD,uDAAuD;AACvD,wBAAgB,QAAQ,CAAC,SAAS,EAAE,SAAS,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAEnG"}
+{"version":3,"file":"referencedFiles.d.ts","sourceRoot":"","sources":["../../src/wasm/referencedFiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAUH,iFAAiF;AACjF,eAAO,MAAM,yBAAyB,QAAa,CAAA;AACnD,iDAAiD;AACjD,eAAO,MAAM,oBAAoB,IAAI,CAAA;AACrC,wCAAwC;AACxC,eAAO,MAAM,oBAAoB,OAAO,CAAA;AAMxC,eAAO,MAAM,YAAY,KAAK,CAAA;AAC9B,eAAO,MAAM,WAAW,KAAK,CAAA;AAC7B,eAAO,MAAM,aAAa,KAAK,CAAA;AAC/B,eAAO,MAAM,aAAa,KAAK,CAAA;AAC/B,eAAO,MAAM,oBAAoB,KAAK,CAAA;AACtC,eAAO,MAAM,UAAU,KAAK,CAAA;AAC5B;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,KAAK,CAAA;AAE9B,8EAA8E;AAC9E,eAAO,MAAM,wBAAwB,KAAK,CAAA;AAE1C,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,+BAA+B,CAAA;AAO7D,6EAA6E;AAC7E,MAAM,MAAM,OAAO,GACf;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAEvC,0EAA0E;AAC1E,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACjC,mFAAmF;IACnF,UAAU,EAAE,OAAO,CAAA;CACpB;AAED,4FAA4F;AAC5F,MAAM,WAAW,UAAU;IACzB,oEAAoE;IACpE,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,6FAA6F;IAC7F,UAAU,EAAE,OAAO,CAAA;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,OAAO,CAAA;CACnB;AAED;;;GAGG;AACH,qBAAa,eAAe;IAExB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAF7B,OAAO;IAKP,MAAM,CAAC,KAAK,IAAI,eAAe;IAI/B,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,oBAAoB,GAAG,SAAS,GAAG,eAAe;IAI1E,OAAO,IAAI,oBAAoB;IAI/B,gFAAgF;IAChF,cAAc,CAAC,UAAU,EAAE,OAAO,GAAG,eAAe;IAIpD,OAAO,IAAI,OAAO;IAIlB,aAAa,IAAI,MAAM;IAIvB,mEAAmE;IACnE,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE;IAgBxF,yDAAyD;IACzD,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAoBxC,+CAA+C;IAC/C,QAAQ,IAAI,MAAM;CAgBnB;AAED,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAKpF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,SAAS,YAAY,EAAE,GAAG,UAAU,CAoB9E;AAyBD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA0BrD;AAED,yGAAyG;AACzG,wBAAsB,UAAU,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CA4ClG;AAeD,4FAA4F;AAC5F,wBAAsB,cAAc,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAEnG;AAED,uDAAuD;AACvD,wBAAgB,QAAQ,CAAC,SAAS,EAAE,SAAS,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAEnG"}