@intutic/mcp-governance-proxy 2.3.0 → 2.5.0

package/dist/wasm/cloudRules.js

@@ -0,0 +1,242 @@
+/**
+ * wasm/cloudRules.ts — the workspace's custom rules from the control plane:
+ * the rules uploaded from the dashboard, the CLI or Terraform, which the LLM
+ * proxy enforces too.
+ *
+ * Port of the control-plane half of `packages/proxy/src/wasm/registry.rs`
+ * (`ensure_up_to_date`, `load_descriptor`, `report_refusal`). The descriptors
+ * arrive with the workspace policy this proxy already fetches (`wasmRules` on
+ * `GET /api/v1/sop/rules`, or on the MCP daemon's cached
+ * `GET /api/v1/policy/resolve`), so they refresh when the policy does. Each
+ * binary is fetched by the SHA-256 its descriptor names, only when no loaded
+ * rule already has that hash, and must hash to it before it is compiled:
+ * whoever can answer for that hash could otherwise swap a governance rule for
+ * one that allows everything.
+ *
+ * A version that cannot load — binary missing, hash mismatch, or a module the
+ * worker refuses — is reported once per hash and reason, and the version of
+ * that rule already loaded, if any, keeps enforcing. A control plane that
+ * cannot be reached for a binary leaves the whole loaded set as it was, as
+ * `registry.rs` does when its fetch fails.
+ *
+ * @module
+ */
+import { createHash } from 'node:crypto';
+import { createStderrLogger as createLogger } from '../stderrLog.js';
+import { HttpStatusError, getBytes } from '../httpJson.js';
+import { MAX_RULE_FILE_BYTES } from './loader.js';
+const log = createLogger('mcp-proxy-wasm-cloud');
+/**
+ * Minimum time between attempts after a sync that could not reach the control
+ * plane or refused a version — the Rust proxy's 5-second rescan, so a binary
+ * published a moment after its descriptor is picked up as quickly there.
+ */
+export const CLOUD_RETRY_MS = 5_000;
+/**
+ * Fetches binaries from the control plane's rule store by hash. A 404 is a
+ * binary the control plane does not have; any other failure means it could
+ * not be asked.
+ */
+export function fetchRuleBinaryFrom(controlPlaneUrl, apiKey) {
+    return async (sha256) => {
+        const url = `${controlPlaneUrl}/api/v1/wasm-rules/binaries/${encodeURIComponent(sha256)}`;
+        try {
+            return await getBytes(url, apiKey, MAX_RULE_FILE_BYTES);
+        }
+        catch (err) {
+            if (err instanceof HttpStatusError && err.status === 404)
+                return null;
+            throw err;
+        }
+    };
+}
+/** A refusal as the `wasm_rule_refused` event carries it. */
+export function refusalDetail(report) {
+    const { descriptor, refusal } = report;
+    return {
+        ruleId: descriptor.ruleId,
+        name: descriptor.name,
+        sha256: descriptor.sha256,
+        refusal: refusal.kind,
+        ...(refusal.kind === 'hash_mismatch' ? { actualSha256: refusal.actual } : {}),
+        previousInForce: report.hasPrevious,
+    };
+}
+/** Whether `bytes` are the binary `sha256` names; case is not significant in hex. */
+export function binaryMatches(bytes, sha256) {
+    const actual = createHash('sha256').update(bytes).digest('hex');
+    return { matches: actual === sha256.toLowerCase(), actual };
+}
+/** What makes two refusals of one version the same report (`Refusal::key`). */
+function refusalKey(refusal) {
+    if (refusal.kind === 'hash_mismatch')
+        return refusal.actual;
+    return refusal.kind;
+}
+export function describeRefusal(descriptor, refusal, hasPrevious) {
+    const why = refusal.kind === 'missing'
+        ? "its binary is missing from the control plane"
+        : refusal.kind === 'hash_mismatch'
+            ? `its binary hashes to ${refusal.actual} but its descriptor names ${descriptor.sha256}`
+            : `it cannot be loaded: ${refusal.error}`;
+    const consequence = hasPrevious
+        ? 'The previously loaded version stays in force.'
+        : 'No version of this rule has loaded on this proxy, so it enforces nothing until one does.';
+    return `WASM rule '${descriptor.name}' (${descriptor.ruleId}) was refused: ${why}. ${consequence}`;
+}
+export class CloudRuleSet {
+    fetchBinary;
+    report;
+    rules = [];
+    /** The descriptor list last applied, serialized; `undefined` until one has been. */
+    appliedKey;
+    /** The list of the last attempt, applied or not, and when it ran. */
+    attemptedKey;
+    attemptedAt = 0;
+    /** Whether the applied list left a version unloaded, so it is retried. */
+    incomplete = false;
+    syncing = null;
+    refusalsReported = new Set();
+    constructor(fetchBinary, report) {
+        this.fetchBinary = fetchBinary;
+        this.report = report;
+    }
+    /** Whether a descriptor list has been applied, so the loaded set is the workspace's. */
+    isLoaded() {
+        return this.appliedKey !== undefined;
+    }
+    /** The loaded rules, in descriptor order. */
+    getRules() {
+        return this.rules;
+    }
+    /**
+     * Brings the loaded set in line with `descriptors`.
+     *
+     * A changed list is applied before this resolves, so the call that follows
+     * a policy refresh is judged by the new set. Retrying versions the applied
+     * list refused, at most every {@link CLOUD_RETRY_MS}, runs in the
+     * background: the loaded set is already the workspace's. A list that could
+     * not be applied is retried no sooner either, so an unreachable control
+     * plane costs a call one fetch timeout at most every few seconds rather
+     * than on every call.
+     */
+    async sync(descriptors, bridge) {
+        while (this.syncing)
+            await this.syncing;
+        const key = JSON.stringify(descriptors);
+        const due = Date.now() - this.attemptedAt >= CLOUD_RETRY_MS;
+        if (key === this.appliedKey) {
+            if (this.incomplete && due)
+                void this.run(descriptors, key, bridge);
+            return;
+        }
+        if (key === this.attemptedKey && !due)
+            return;
+        await this.run(descriptors, key, bridge);
+    }
+    /**
+     * Recompiles every loaded rule from its kept bytes — the worker that held
+     * them was replaced. Waits for a sync in flight, which may have compiled
+     * into the old worker.
+     */
+    async reload(bridge) {
+        while (this.syncing)
+            await this.syncing;
+        for (const rule of this.rules)
+            await bridge.compile(rule.ruleId, rule.bytes);
+    }
+    run(descriptors, key, bridge) {
+        const run = this.apply(descriptors, key, bridge)
+            .catch((err) => {
+            // The worker itself failed under the sync; the loaded set is unchanged
+            // and the next sync tries again.
+            log.warn({ action: 'wasm_cloud_sync_failed', err: err.message }, "Syncing the workspace's custom rules failed");
+        })
+            .finally(() => {
+            if (this.syncing === run)
+                this.syncing = null;
+        });
+        this.syncing = run;
+        return run;
+    }
+    async apply(descriptors, key, bridge) {
+        this.attemptedKey = key;
+        this.attemptedAt = Date.now();
+        const previousBySha = new Map(this.rules.map((r) => [r.sha256, r]));
+        const previousByRule = new Map(this.rules.map((r) => [r.ruleId, r]));
+        // Every binary no loaded rule already has, fetched before anything
+        // changes: a control plane that cannot be reached leaves the loaded set
+        // exactly as it was.
+        const wanted = [...new Set(descriptors.map((d) => d.sha256).filter((sha) => !previousBySha.has(sha)))];
+        let fetched;
+        try {
+            fetched = new Map(await Promise.all(wanted.map(async (sha) => [sha, await this.fetchBinary(sha)])));
+        }
+        catch (err) {
+            log.warn({ action: 'wasm_cloud_fetch_failed', err: err.message, loaded: this.rules.length }, this.isLoaded()
+                ? "Could not fetch the workspace's custom rules; the loaded set stays in force"
+                : "Could not fetch the workspace's custom rules; none have loaded yet");
+            return;
+        }
+        const next = [];
+        let incomplete = false;
+        for (const descriptor of descriptors) {
+            const reuse = previousBySha.get(descriptor.sha256);
+            const outcome = reuse
+                ? await this.reuse(descriptor, reuse, bridge)
+                : await this.load(descriptor, fetched.get(descriptor.sha256) ?? null, bridge);
+            if ('kind' in outcome) {
+                incomplete = true;
+                const previous = previousByRule.get(descriptor.ruleId);
+                this.reportOnce(descriptor, outcome, previous !== undefined);
+                if (previous)
+                    next.push(previous);
+                continue;
+            }
+            if (previousByRule.get(descriptor.ruleId)?.sha256 !== descriptor.sha256)
+                bridge.replaced(descriptor.ruleId);
+            next.push(outcome);
+        }
+        // A rule no longer listed — deleted, or switched off — stops enforcing.
+        const kept = new Set(next.map((r) => r.ruleId));
+        for (const rule of this.rules) {
+            if (!kept.has(rule.ruleId))
+                bridge.remove(rule.ruleId);
+        }
+        this.rules = next;
+        this.appliedKey = key;
+        this.incomplete = incomplete;
+        log.info({ action: 'wasm_cloud_rules_loaded', rules: next.length, listed: descriptors.length }, "Workspace's custom rules loaded");
+    }
+    /** A binary some loaded rule already has: compiled again only when it is new to this rule id. */
+    async reuse(descriptor, loaded, bridge) {
+        if (loaded.ruleId !== descriptor.ruleId) {
+            const result = await bridge.compile(descriptor.ruleId, loaded.bytes);
+            if (!result.ok)
+                return { kind: result.reason, error: result.error };
+        }
+        return { ...loaded, ...descriptor };
+    }
+    /** `load_descriptor`: the hash, then the same load checks as a local rule. */
+    async load(descriptor, bytes, bridge) {
+        if (!bytes)
+            return { kind: 'missing' };
+        const { matches, actual } = binaryMatches(bytes, descriptor.sha256);
+        if (!matches)
+            return { kind: 'hash_mismatch', actual };
+        const result = await bridge.compile(descriptor.ruleId, bytes);
+        if (!result.ok)
+            return { kind: result.reason, error: result.error };
+        return { ...descriptor, readsReferencedFiles: result.readsReferencedFiles, rego: result.rego, bytes };
+    }
+    reportOnce(descriptor, refusal, hasPrevious) {
+        const id = [descriptor.sha256, refusalKey(refusal)].join('\u0000');
+        if (this.refusalsReported.has(id))
+            return;
+        this.refusalsReported.add(id);
+        const description = describeRefusal(descriptor, refusal, hasPrevious);
+        log.error({ action: 'wasm_cloud_rule_refused', ruleId: descriptor.ruleId, sha256: descriptor.sha256, refusal: refusal.kind }, description);
+        this.report({ descriptor, refusal, hasPrevious, description });
+    }
+}
+//# sourceMappingURL=cloudRules.js.map

package/dist/wasm/cloudRules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudRules.js","sourceRoot":"","sources":["../../src/wasm/cloudRules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACpE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE1D,OAAO,EAAE,mBAAmB,EAAiD,MAAM,aAAa,CAAA;AAEhG,MAAM,GAAG,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAA;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAA;AAiDnC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,eAAuB,EAAE,MAAc;IACzE,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE;QACtB,MAAM,GAAG,GAAG,GAAG,eAAe,+BAA+B,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAA;QACzF,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAA;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAA;YACrE,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,aAAa,CAAC,MAA8B;IAC1D,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,CAAA;IACtC,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,OAAO,CAAC,IAAI;QACrB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,eAAe,EAAE,MAAM,CAAC,WAAW;KACpC,CAAA;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,KAAiB,EAAE,MAAc;IAC7D,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAA;AAC7D,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,OAAyB;IAC3C,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,OAAO,CAAC,MAAM,CAAA;IAC3D,OAAO,OAAO,CAAC,IAAI,CAAA;AACrB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAA8B,EAAE,OAAyB,EAAE,WAAoB;IAC7G,MAAM,GAAG,GACP,OAAO,CAAC,IAAI,KAAK,SAAS;QACxB,CAAC,CAAC,8CAA8C;QAChD,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,eAAe;YAChC,CAAC,CAAC,wBAAwB,OAAO,CAAC,MAAM,6BAA6B,UAAU,CAAC,MAAM,EAAE;YACxF,CAAC,CAAC,wBAAwB,OAAO,CAAC,KAAK,EAAE,CAAA;IAC/C,MAAM,WAAW,GAAG,WAAW;QAC7B,CAAC,CAAC,+CAA+C;QACjD,CAAC,CAAC,0FAA0F,CAAA;IAC9F,OAAO,cAAc,UAAU,CAAC,IAAI,MAAM,UAAU,CAAC,MAAM,kBAAkB,GAAG,KAAK,WAAW,EAAE,CAAA;AACpG,CAAC;AAED,MAAM,OAAO,YAAY;IAaJ;IACA;IAbX,KAAK,GAAoB,EAAE,CAAA;IACnC,oFAAoF;IAC5E,UAAU,CAAoB;IACtC,qEAAqE;IAC7D,YAAY,CAAoB;IAChC,WAAW,GAAG,CAAC,CAAA;IACvB,0EAA0E;IAClE,UAAU,GAAG,KAAK,CAAA;IAClB,OAAO,GAAyB,IAAI,CAAA;IAC3B,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAA;IAErD,YACmB,WAA4B,EAC5B,MAAgD;QADhD,gBAAW,GAAX,WAAW,CAAiB;QAC5B,WAAM,GAAN,MAAM,CAA0C;IAChE,CAAC;IAEJ,wFAAwF;IACxF,QAAQ;QACN,OAAO,IAAI,CAAC,UAAU,KAAK,SAAS,CAAA;IACtC,CAAC;IAED,6CAA6C;IAC7C,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,IAAI,CAAC,WAA0C,EAAE,MAAuB;QAC5E,OAAO,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,CAAC,OAAO,CAAA;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,IAAI,cAAc,CAAA;QAC3D,IAAI,GAAG,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,UAAU,IAAI,GAAG;gBAAE,KAAK,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;YACnE,OAAM;QACR,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,CAAC,YAAY,IAAI,CAAC,GAAG;YAAE,OAAM;QAC7C,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;IAC1C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,MAAqB;QAChC,OAAO,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,CAAC,OAAO,CAAA;QACvC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9E,CAAC;IAEO,GAAG,CAAC,WAA0C,EAAE,GAAW,EAAE,MAAuB;QAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC;aAC7C,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,uEAAuE;YACvE,iCAAiC;YACjC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,6CAA6C,CAAC,CAAA;QAC5H,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,IAAI,CAAC,OAAO,KAAK,GAAG;gBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QAC/C,CAAC,CAAC,CAAA;QACJ,IAAI,CAAC,OAAO,GAAG,GAAG,CAAA;QAClB,OAAO,GAAG,CAAA;IACZ,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,WAA0C,EAAE,GAAW,EAAE,MAAuB;QAClG,IAAI,CAAC,YAAY,GAAG,GAAG,CAAA;QACvB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAE7B,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACnE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAEpE,mEAAmE;QACnE,wEAAwE;QACxE,qBAAqB;QACrB,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACtG,IAAI,OAAuC,CAAA;QAC3C,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAU,CAAC,CAAC,CAAC,CAAA;QAC9G,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAC7F,IAAI,CAAC,QAAQ,EAAE;gBACb,CAAC,CAAC,6EAA6E;gBAC/E,CAAC,CAAC,oEAAoE,CACzE,CAAA;YACD,OAAM;QACR,CAAC;QAED,MAAM,IAAI,GAAoB,EAAE,CAAA;QAChC,IAAI,UAAU,GAAG,KAAK,CAAA;QACtB,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YAClD,MAAM,OAAO,GAAG,KAAK;gBACnB,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC;gBAC7C,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,MAAM,CAAC,CAAA;YAC/E,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;gBACtB,UAAU,GAAG,IAAI,CAAA;gBACjB,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;gBACtD,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAA;gBAC5D,IAAI,QAAQ;oBAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;gBACjC,SAAQ;YACV,CAAC;YACD,IAAI,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,UAAU,CAAC,MAAM;gBAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YAC3G,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACpB,CAAC;QAED,wEAAwE;QACxE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;QAC/C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACxD,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QACjB,IAAI,CAAC,UAAU,GAAG,GAAG,CAAA;QACrB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,yBAAyB,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,EACrF,iCAAiC,CAClC,CAAA;IACH,CAAC;IAED,iGAAiG;IACzF,KAAK,CAAC,KAAK,CACjB,UAA8B,EAC9B,MAAqB,EACrB,MAAqB;QAErB,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;YACpE,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;QACrE,CAAC;QACD,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,UAAU,EAAE,CAAA;IACrC,CAAC;IAED,8EAA8E;IACtE,KAAK,CAAC,IAAI,CAChB,UAA8B,EAC9B,KAAwB,EACxB,MAAqB;QAErB,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;QACtC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;QACnE,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAA;QACtD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAC7D,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;QACnE,OAAO,EAAE,GAAG,UAAU,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;IACvG,CAAC;IAEO,UAAU,CAAC,UAA8B,EAAE,OAAyB,EAAE,WAAoB;QAChG,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAClE,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAM;QACzC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC7B,MAAM,WAAW,GAAG,eAAe,CAAC,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,CAAA;QACrE,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAA;QAC1I,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAA;IAChE,CAAC;CACF"}

package/dist/wasm/loader.d.ts

@@ -61,6 +61,8 @@ export interface LoadedRuleMeta {
      *  currently-loaded rule without re-reading the directory from disk. */
     bytes: Uint8Array;
 }
+/** Why a module did not compile or load: the reasons a compile can reach, never a missing binary or a hash mismatch. */
+export type CompileFailureReason = Exclude<RuleLoadFailureReason, 'missing' | 'hash_mismatch'>;
 export type CompileOutcome = {
     ok: true;
     readsReferencedFiles: boolean;
@@ -70,7 +72,7 @@ export type CompileOutcome = {
  | {
     ok: false;
     error: string;
-    reason: RuleLoadFailureReason;
+    reason: CompileFailureReason;
     unsupportedImports?: string[];
 };
 /** What `WasmLoader` needs from the worker to load/unload a rule — implemented by `WasmRunner`. */

package/dist/wasm/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/wasm/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAKlE,6DAA6D;AAC7D,eAAO,MAAM,mBAAmB,QAAmB,CAAA;AAEnD,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,MAAM,CAAA;AAEnC;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAK9D;AAOD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAWlF;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAsBrF;AAWD,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,oBAAoB,EAAE,OAAO,CAAA;IAC7B,4GAA4G;IAC5G,IAAI,EAAE,OAAO,CAAA;IACb;4EACwE;IACxE,KAAK,EAAE,UAAU,CAAA;CAClB;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,oBAAoB,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE;AAC5D,2GAA2G;GACzG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAA;AAE9F,mGAAmG;AACnG,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IACnE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED;;;;GAIG;AACH,qBAAa,UAAU;IAIT,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHhC,OAAO,CAAC,UAAU,CAAmC;IACrD,OAAO,CAAC,MAAM,CAAoC;gBAErB,GAAG,EAAE,MAAM;IAExC,MAAM,IAAI,MAAM;IAIhB,0FAA0F;IAC1F,QAAQ,IAAI,cAAc,EAAE;IAI5B;;;;;OAKG;IACG,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAiFlE"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/wasm/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAKlE,6DAA6D;AAC7D,eAAO,MAAM,mBAAmB,QAAmB,CAAA;AAEnD,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,MAAM,CAAA;AAEnC;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAK9D;AAOD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAWlF;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAsBrF;AAWD,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,oBAAoB,EAAE,OAAO,CAAA;IAC7B,4GAA4G;IAC5G,IAAI,EAAE,OAAO,CAAA;IACb;4EACwE;IACxE,KAAK,EAAE,UAAU,CAAA;CAClB;AAED,wHAAwH;AACxH,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,EAAE,SAAS,GAAG,eAAe,CAAC,CAAA;AAE9F,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,oBAAoB,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE;AAC5D,2GAA2G;GACzG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAA;AAE7F,mGAAmG;AACnG,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IACnE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED;;;;GAIG;AACH,qBAAa,UAAU;IAIT,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHhC,OAAO,CAAC,UAAU,CAAmC;IACrD,OAAO,CAAC,MAAM,CAAoC;gBAErB,GAAG,EAAE,MAAM;IAExC,MAAM,IAAI,MAAM;IAIhB,0FAA0F;IAC1F,QAAQ,IAAI,cAAc,EAAE;IAI5B;;;;;OAKG;IACG,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAiFlE"}

package/dist/wasm/loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/wasm/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AAEtC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEpE,MAAM,GAAG,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAEjD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAEnD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAA;AAEnC;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,cAAuB;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC9C,IAAI,MAAM;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;IACrC,IAAI,cAAc;QAAE,OAAO,UAAU,CAAC,cAAc,CAAC,CAAA;IACrD,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAChF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;IACvF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;QAChC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AACnD,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAA;IACnD,IAAI,OAAmC,CAAA;IACvC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAA;QACvE,MAAM,GAAG,CAAA;IACX,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAQ;QAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QAC5C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACrC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;YAC5D,mEAAmE;YACnE,iBAAiB;QACnB,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,CAA6B,EAAE,CAA6B;IACnF,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACnC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACxB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI;YAAE,OAAO,KAAK,CAAA;IACtF,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AA2BD;;;;GAIG;AACH,MAAM,OAAO,UAAU;IAIQ;IAHrB,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC7C,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAA,CAAC,qBAAqB;IAExE,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IAE5C,MAAM;QACJ,OAAO,IAAI,CAAC,GAAG,CAAA;IACjB,CAAC;IAED,0FAA0F;IAC1F,QAAQ;QACN,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC1E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,MAAqB,EAAE,KAAK,GAAG,KAAK;QAC/C,IAAI,aAAyC,CAAA;QAC7C,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EACzE,yEAAyE,CAC1E,CAAA;YACD,OAAM;QACR,CAAC;QAED,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC;YAAE,OAAM;QAErE,iBAAiB;QACjB,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBACtC,IAAI,IAAI;oBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;gBACpC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC9B,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,aAAa,EAAE,CAAC;YAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACjD,MAAM,OAAO,GAAG,KAAK,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,IAAI,WAAW,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAA;YAC7G,IAAI,CAAC,OAAO;gBAAE,SAAQ;YAEtB,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAC7C,MAAM,MAAM,GAAG,SAAS,QAAQ,EAAE,CAAA;YAElC,IAAI,GAAG,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;gBACnC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,mBAAmB,EAAE,EACrG,4CAA4C,CAC7C,CAAA;gBACD,SAAQ,CAAC,sFAAsF;YACjG,CAAC;YAED,IAAI,KAAa,CAAA;YACjB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAC/E,oEAAoE,CACrE,CAAA;gBACD,SAAQ;YACV,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YAClD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;gBAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE;oBACxB,MAAM;oBACN,QAAQ;oBACR,IAAI;oBACJ,QAAQ;oBACR,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;oBACjD,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,KAAK;iBACN,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CACN;oBACE,MAAM,EAAE,sBAAsB;oBAC9B,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;iBAC9C,EACD,oEAAoE,CACrE,CAAA;gBACD,mEAAmE;gBACnE,oEAAoE;YACtE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,aAAa,CAAA;IACjC,CAAC;CACF"}
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/wasm/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AAEtC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEpE,MAAM,GAAG,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAEjD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAEnD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAA;AAEnC;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,cAAuB;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC9C,IAAI,MAAM;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;IACrC,IAAI,cAAc;QAAE,OAAO,UAAU,CAAC,cAAc,CAAC,CAAA;IACrD,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAChF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;IACvF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;QAChC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AACnD,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAA;IACnD,IAAI,OAAmC,CAAA;IACvC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAA;QACvE,MAAM,GAAG,CAAA;IACX,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAQ;QAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QAC5C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACrC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;YAC5D,mEAAmE;YACnE,iBAAiB;QACnB,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,CAA6B,EAAE,CAA6B;IACnF,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACnC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACxB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI;YAAE,OAAO,KAAK,CAAA;IACtF,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AA8BD;;;;GAIG;AACH,MAAM,OAAO,UAAU;IAIQ;IAHrB,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC7C,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAA,CAAC,qBAAqB;IAExE,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IAE5C,MAAM;QACJ,OAAO,IAAI,CAAC,GAAG,CAAA;IACjB,CAAC;IAED,0FAA0F;IAC1F,QAAQ;QACN,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC1E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,MAAqB,EAAE,KAAK,GAAG,KAAK;QAC/C,IAAI,aAAyC,CAAA;QAC7C,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EACzE,yEAAyE,CAC1E,CAAA;YACD,OAAM;QACR,CAAC;QAED,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC;YAAE,OAAM;QAErE,iBAAiB;QACjB,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBACtC,IAAI,IAAI;oBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;gBACpC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC9B,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,aAAa,EAAE,CAAC;YAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACjD,MAAM,OAAO,GAAG,KAAK,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,IAAI,WAAW,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAA;YAC7G,IAAI,CAAC,OAAO;gBAAE,SAAQ;YAEtB,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAC7C,MAAM,MAAM,GAAG,SAAS,QAAQ,EAAE,CAAA;YAElC,IAAI,GAAG,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;gBACnC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,mBAAmB,EAAE,EACrG,4CAA4C,CAC7C,CAAA;gBACD,SAAQ,CAAC,sFAAsF;YACjG,CAAC;YAED,IAAI,KAAa,CAAA;YACjB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAC/E,oEAAoE,CACrE,CAAA;gBACD,SAAQ;YACV,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YAClD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;gBAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE;oBACxB,MAAM;oBACN,QAAQ;oBACR,IAAI;oBACJ,QAAQ;oBACR,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;oBACjD,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,KAAK;iBACN,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CACN;oBACE,MAAM,EAAE,sBAAsB;oBAC9B,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;iBAC9C,EACD,oEAAoE,CACrE,CAAA;gBACD,mEAAmE;gBACnE,oEAAoE;YACtE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,aAAa,CAAA;IACjC,CAAC;CACF"}

package/dist/wasm/runner.d.ts

@@ -1,9 +1,17 @@
 /**
  * wasm/runner.ts — WasmRunner: owns the one dedicated `worker_threads`
- * Worker (worker.ts), the local-rules loader (loader.ts), and the
- * evaluate-all-rules union logic ported from
- * `packages/proxy/src/wasm/registry.rs`'s `evaluate_inner` (most-restrictive-
- * wins, short-circuit on a block, carry the first reask through).
+ * Worker (worker.ts), the local-rules loader (loader.ts), the workspace's
+ * control-plane rules (cloudRules.ts), and the evaluate-all-rules union logic
+ * ported from `packages/proxy/src/wasm/registry.rs`'s `evaluate_inner`
+ * (most-restrictive-wins, short-circuit on a block, carry the first reask
+ * through).
+ *
+ * Both sources run as one list in priority order, lower first; on a tie a
+ * control-plane rule runs before a local one, as in `registry.rs`. Local rules
+ * are `local:<file name>`; a control-plane rule keeps the control plane's id,
+ * the one the LLM proxy and the dashboard name it by. A control-plane rule in
+ * `SHADOW` mode is evaluated like any other and logged, and never decides the
+ * call — not even when it reaches no verdict.
  *
  * ## Divergences from the Rust runner (all recorded as TD entries)
  *
@@ -35,7 +43,9 @@
  *
  * @module
  */
-import { type CompileBridge, type CompileOutcome } from './loader.js';
+import type { WasmRuleDescriptor } from '@intutic/shared-types';
+import { type CompileOutcome } from './loader.js';
+import type { CloudRuleBridge, CloudRuleSet } from './cloudRules.js';
 import { type WasmContextInput } from './context.js';
 /**
  * A native rule's deadline: a backstop for stalls the instruction budget
@@ -98,7 +108,18 @@ export type WasmVerdict = {
     ruleId: string;
     stop: RuleStop;
 };
-export declare class WasmRunner implements CompileBridge {
+/**
+ * One shadowed rule's outcome on one call, as the LLM proxy reports it on a
+ * trace (`registry.rs`'s `ShadowReport`): the bypasses are reported too,
+ * because they are the denominator promotion divides by.
+ */
+export interface ShadowReport {
+    ruleId: string;
+    /** False when the rule allowed the call; true for a block, a reask, a hold, or no verdict. */
+    wouldAct: boolean;
+}
+export declare class WasmRunner implements CloudRuleBridge {
+    private readonly cloud?;
     private readonly loader;
     private worker;
     private nextRequestId;
@@ -107,17 +128,43 @@ export declare class WasmRunner implements CompileBridge {
     /** The worker replacing one that missed a deadline, while its rules recompile. */
     private respawning;
     private quarantined;
-    constructor(dirOverride?: string);
+    /**
+     * @param dirOverride - the local rules directory (see `resolveWasmDir`).
+     * @param cloud - the workspace's control-plane rules; absent where there is
+     *   no control plane to fetch them from (tests, local-only use).
+     */
+    constructor(dirOverride?: string, cloud?: CloudRuleSet | undefined);
     /** The resolved local rules directory, for logging. */
     getDir(): string;
-    /** Currently loaded rule ids (`local:<file name>`), priority order — observability for callers/tests. */
+    /** Currently loaded rule ids, in evaluation order — observability for callers/tests. */
     getLoadedRuleIds(): string[];
+    /**
+     * Every loaded rule in evaluation order: by priority, and on a tie the
+     * control-plane rules first (a stable sort over cloud-then-local, as
+     * `registry.rs` sorts).
+     */
+    private activeRules;
+    /**
+     * Brings the control-plane rules in line with the descriptors the policy
+     * carries. `undefined` — no policy from the control plane yet — leaves them
+     * as they are. See `CloudRuleSet.sync` for when this waits.
+     */
+    syncCloudRules(descriptors: readonly WasmRuleDescriptor[] | undefined): Promise<void>;
+    /**
+     * Whether the workspace's control-plane rules are known: a descriptor list
+     * has been applied (or this runner has no control plane to ask). Until then,
+     * a call is judged without them, which the interceptor allows only under
+     * the fail-open setting.
+     */
+    cloudRulesLoaded(): boolean;
     private ensureWorker;
     /** Send one message and wait for its correlated reply, or `null` on timeout. */
     private send;
     private allocId;
     compile(ruleId: string, bytes: Uint8Array): Promise<CompileOutcome>;
     remove(ruleId: string): void;
+    /** A control-plane rule's version changed: the old version's runaways do not count against the new one. */
+    replaced(ruleId: string): void;
     /**
      * Rescans `~/.intutic/wasm/` and (re)compiles anything changed. Also
      * releases every quarantined rule — "quarantined until the next
@@ -154,8 +201,15 @@ export declare class WasmRunner implements CompileBridge {
      *
      * A quarantined rule (see {@link countRunaway}) refuses at once, without
      * anything being evaluated, until the next rescan.
+     *
+     * A `SHADOW` rule is evaluated in its place and decides nothing: what it
+     * would have done, a refusal for reaching no verdict included, leaves the
+     * call as the other rules decide it. Each evaluation is appended to
+     * `shadowOut`, the evidence promotion out of shadow is judged on, and a
+     * would-act is logged. A quarantined one is skipped, and reported as
+     * nothing, since nothing ran.
      */
-    evaluate(input: WasmContextInput): Promise<WasmVerdict>;
+    evaluate(input: WasmContextInput, shadowOut?: ShadowReport[]): Promise<WasmVerdict>;
     /**
      * The referenced-files table for this evaluation. With no
      * `INTUTIC_WASM_MANIFEST_ROOT` the table is empty and every read refuses.

package/dist/wasm/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/wasm/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAOH,OAAO,EAA8B,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AACjG,OAAO,EAAoC,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAKtF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,OAAQ,CAAA;AAExC;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAA;AAM9C;;;GAGG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAA;AAEzC;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,aAAa,CAAA;AAEjF,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACnD,qFAAqF;GACnF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE;AACrE;;;GAGG;GACD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAA;AAoD3E,qBAAa,UAAW,YAAW,aAAa;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,aAAa,CAAI;IACzB,OAAO,CAAC,OAAO,CAAkC;IACjD,OAAO,CAAC,mBAAmB,CAA4B;IACvD,kFAAkF;IAClF,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,WAAW,CAAoB;gBAE3B,WAAW,CAAC,EAAE,MAAM;IAIhC,uDAAuD;IACvD,MAAM,IAAI,MAAM;IAIhB,yGAAyG;IACzG,gBAAgB,IAAI,MAAM,EAAE;IAI5B,OAAO,CAAC,YAAY;IAmBpB,gFAAgF;IAChF,OAAO,CAAC,IAAI;IAYZ,OAAO,CAAC,OAAO;IAQT,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IA0BzE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAQ5B;;;;OAIG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAO7B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,aAAa;IA0BrB;;;;;;;;;;;;;;;;;;OAkBG;IACG,QAAQ,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC;IA2G7D;;;OAGG;YACW,uBAAuB;IAUrC,6FAA6F;YAC/E,WAAW;IA8DzB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAYpB,yEAAyE;IACnE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAUhC;AAyBD,YAAY,EAAE,gBAAgB,EAAE,CAAA"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/wasm/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAMH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAC/D,OAAO,EAAyD,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AACxG,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACpE,OAAO,EAAoC,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAKtF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,OAAQ,CAAA;AAExC;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAA;AAM9C;;;GAGG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAA;AAEzC;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,aAAa,CAAA;AAEjF,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACnD,qFAAqF;GACnF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE;AACrE;;;GAGG;GACD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAA;AAa3E;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,8FAA8F;IAC9F,QAAQ,EAAE,OAAO,CAAA;CAClB;AAmDD,qBAAa,UAAW,YAAW,eAAe;IAiB9C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAhBzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,aAAa,CAAI;IACzB,OAAO,CAAC,OAAO,CAAkC;IACjD,OAAO,CAAC,mBAAmB,CAA4B;IACvD,kFAAkF;IAClF,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,WAAW,CAAoB;IAEvC;;;;OAIG;gBAED,WAAW,CAAC,EAAE,MAAM,EACH,KAAK,CAAC,EAAE,YAAY,YAAA;IAKvC,uDAAuD;IACvD,MAAM,IAAI,MAAM;IAIhB,wFAAwF;IACxF,gBAAgB,IAAI,MAAM,EAAE;IAI5B;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAkBnB;;;;OAIG;IACG,cAAc,CAAC,WAAW,EAAE,SAAS,kBAAkB,EAAE,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAM3F;;;;;OAKG;IACH,gBAAgB,IAAI,OAAO;IAI3B,OAAO,CAAC,YAAY;IAmBpB,gFAAgF;IAChF,OAAO,CAAC,IAAI;IAYZ,OAAO,CAAC,OAAO;IAQT,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IA0BzE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAK5B,2GAA2G;IAC3G,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAO9B;;;;OAIG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAO7B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,aAAa;IA6BrB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,QAAQ,CAAC,KAAK,EAAE,gBAAgB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAoHzF;;;OAGG;YACW,uBAAuB;IAUrC,6FAA6F;YAC/E,WAAW;IA8DzB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAYpB,yEAAyE;IACnE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAUhC;AAyCD,YAAY,EAAE,gBAAgB,EAAE,CAAA"}

package/dist/wasm/runner.js

@@ -1,9 +1,17 @@
 /**
  * wasm/runner.ts — WasmRunner: owns the one dedicated `worker_threads`
- * Worker (worker.ts), the local-rules loader (loader.ts), and the
- * evaluate-all-rules union logic ported from
- * `packages/proxy/src/wasm/registry.rs`'s `evaluate_inner` (most-restrictive-
- * wins, short-circuit on a block, carry the first reask through).
+ * Worker (worker.ts), the local-rules loader (loader.ts), the workspace's
+ * control-plane rules (cloudRules.ts), and the evaluate-all-rules union logic
+ * ported from `packages/proxy/src/wasm/registry.rs`'s `evaluate_inner`
+ * (most-restrictive-wins, short-circuit on a block, carry the first reask
+ * through).
+ *
+ * Both sources run as one list in priority order, lower first; on a tie a
+ * control-plane rule runs before a local one, as in `registry.rs`. Local rules
+ * are `local:<file name>`; a control-plane rule keeps the control plane's id,
+ * the one the LLM proxy and the dashboard name it by. A control-plane rule in
+ * `SHADOW` mode is evaluated like any other and logged, and never decides the
+ * call — not even when it reaches no verdict.
  *
  * ## Divergences from the Rust runner (all recorded as TD entries)
  *
@@ -107,6 +115,7 @@ function workerScriptSpec() {
     return { url, execArgv: isSource ? ['--import', 'tsx/esm'] : [] };
 }
 export class WasmRunner {
+    cloud;
     loader;
     worker = null;
     nextRequestId = 1;
@@ -115,16 +124,64 @@ export class WasmRunner {
     /** The worker replacing one that missed a deadline, while its rules recompile. */
     respawning = null;
     quarantined = new Set();
-    constructor(dirOverride) {
+    /**
+     * @param dirOverride - the local rules directory (see `resolveWasmDir`).
+     * @param cloud - the workspace's control-plane rules; absent where there is
+     *   no control plane to fetch them from (tests, local-only use).
+     */
+    constructor(dirOverride, cloud) {
+        this.cloud = cloud;
         this.loader = new WasmLoader(resolveWasmDir(dirOverride));
     }
     /** The resolved local rules directory, for logging. */
     getDir() {
         return this.loader.getDir();
     }
-    /** Currently loaded rule ids (`local:<file name>`), priority order — observability for callers/tests. */
+    /** Currently loaded rule ids, in evaluation order — observability for callers/tests. */
     getLoadedRuleIds() {
-        return this.loader.getRules().map((r) => r.ruleId);
+        return this.activeRules().map((r) => r.ruleId);
+    }
+    /**
+     * Every loaded rule in evaluation order: by priority, and on a tie the
+     * control-plane rules first (a stable sort over cloud-then-local, as
+     * `registry.rs` sorts).
+     */
+    activeRules() {
+        const cloud = (this.cloud?.getRules() ?? []).map((r) => ({
+            ruleId: r.ruleId,
+            priority: r.priority,
+            rego: r.rego,
+            readsReferencedFiles: r.readsReferencedFiles,
+            shadow: r.mode === 'SHADOW',
+        }));
+        const local = this.loader.getRules().map((r) => ({
+            ruleId: r.ruleId,
+            priority: r.priority,
+            rego: r.rego,
+            readsReferencedFiles: r.readsReferencedFiles,
+            shadow: false,
+        }));
+        return [...cloud, ...local].sort((a, b) => a.priority - b.priority);
+    }
+    /**
+     * Brings the control-plane rules in line with the descriptors the policy
+     * carries. `undefined` — no policy from the control plane yet — leaves them
+     * as they are. See `CloudRuleSet.sync` for when this waits.
+     */
+    async syncCloudRules(descriptors) {
+        if (!this.cloud || !descriptors)
+            return;
+        await this.respawning;
+        await this.cloud.sync(descriptors, this);
+    }
+    /**
+     * Whether the workspace's control-plane rules are known: a descriptor list
+     * has been applied (or this runner has no control plane to ask). Until then,
+     * a call is judged without them, which the interceptor allows only under
+     * the fail-open setting.
+     */
+    cloudRulesLoaded() {
+        return !this.cloud || this.cloud.isLoaded();
     }
     ensureWorker() {
         if (this.worker)
@@ -185,6 +242,10 @@ export class WasmRunner {
     }
     remove(ruleId) {
         this.ensureWorker().postMessage({ type: 'remove', ruleId });
+        this.replaced(ruleId);
+    }
+    /** A control-plane rule's version changed: the old version's runaways do not count against the new one. */
+    replaced(ruleId) {
         this.consecutiveRunaways.delete(ruleId);
         this.quarantined.delete(ruleId);
     }
@@ -228,8 +289,11 @@ export class WasmRunner {
         }
         // Force-reload every currently-known file into the new worker — its
         // module cache started empty. `force: true` mirrors this loader's own
-        // "worker cache was lost, nothing on disk moved" case.
-        const respawning = this.loader.rescan(this, true).finally(() => {
+        // "worker cache was lost, nothing on disk moved" case. The control-plane
+        // rules recompile from the bytes they were fetched with.
+        const respawning = Promise.all([this.loader.rescan(this, true), this.cloud?.reload(this)])
+            .then(() => undefined)
+            .finally(() => {
             if (this.respawning === respawning)
                 this.respawning = null;
         });
@@ -254,10 +318,17 @@ export class WasmRunner {
      *
      * A quarantined rule (see {@link countRunaway}) refuses at once, without
      * anything being evaluated, until the next rescan.
+     *
+     * A `SHADOW` rule is evaluated in its place and decides nothing: what it
+     * would have done, a refusal for reaching no verdict included, leaves the
+     * call as the other rules decide it. Each evaluation is appended to
+     * `shadowOut`, the evidence promotion out of shadow is judged on, and a
+     * would-act is logged. A quarantined one is skipped, and reported as
+     * nothing, since nothing ran.
      */
-    async evaluate(input) {
-        const rules = this.loader.getRules();
-        const held = rules.find((r) => this.quarantined.has(r.ruleId));
+    async evaluate(input, shadowOut) {
+        const rules = this.activeRules();
+        const held = rules.find((r) => !r.shadow && this.quarantined.has(r.ruleId));
         if (held) {
             return {
                 code: 'unavailable',
@@ -281,8 +352,18 @@ export class WasmRunner {
         // deadline covers guest execution only — and only when a rule will ask.
         const files = rules.some((r) => r.readsReferencedFiles) ? await this.prefetchReferencedFiles(input) : undefined;
         for (const rule of rules) {
+            if (rule.shadow && this.quarantined.has(rule.ruleId))
+                continue;
             const outcome = await this.evaluateOne(rule.ruleId, bytesFor(rule.rego), rule.rego ? REGO_EVALUATE_TIMEOUT_MS : EVALUATE_TIMEOUT_MS, rule.readsReferencedFiles ? files : undefined);
             const failure = 'stop' in outcome ? outcome : undefinedVerdict(outcome);
+            if (rule.shadow) {
+                // A rule that reached no verdict would have refused the call, so it
+                // counts as acting, as the LLM proxy counts its `Unavailable`.
+                const wouldDo = failure ? `no verdict (${failure.stop}): ${failure.detail}` : describeResult(outcome);
+                logShadow(rule.ruleId, wouldDo);
+                shadowOut?.push({ ruleId: rule.ruleId, wouldAct: wouldDo !== undefined });
+                continue;
+            }
             if (failure) {
                 const quarantinedNow = this.quarantined.has(rule.ruleId);
                 const detail = quarantinedNow
@@ -422,6 +503,20 @@ export class WasmRunner {
             await worker.terminate();
     }
 }
+/** What a rule's answer would do to the call, for the shadow log; `undefined` when it allows. */
+function describeResult(result) {
+    if ('decision' in result)
+        return result.decision === 'allow' ? undefined : result.decision;
+    if (result.code === 0)
+        return undefined;
+    return result.code === 3 ? 'reask' : 'block';
+}
+/** A shadowed rule's outcome, logged when it would have acted. */
+function logShadow(ruleId, wouldDo) {
+    if (wouldDo === undefined)
+        return;
+    log.info({ action: 'wasm_shadow_would_act', ruleId, shadowed: true, verdict: wouldDo }, 'WASM rule would have acted; shadow mode, call unchanged');
+}
 /** A native code that is not a verdict: the rule reached none. */
 function undefinedVerdict(result) {
     if ('decision' in result || [0, 1, 2, 3].includes(result.code))