@intutic/mcp-governance-proxy 2.4.0 → 2.5.1

package/dist/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAE5D,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,0BAA0B,GAI3B,MAAM,uBAAuB,CAAA;AAE9B,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAA;AAc5C;;;;;;;;;;;;;GAaG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO,CACL,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ;QAC3B,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ;QACpC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAC/B,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC;QACtE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,kBAAkB,CAAC,CAC1F,CAAA;AACH,CAAC;AAyBD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACpE,aAAa,EAAE,OAAO;IACtB,eAAe,EAAE,EAAE;IACnB,cAAc,EAAE,EAAE;IAClB,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE;CAClB,CAAsB,CAAA;AAqBvB,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC5F,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3C,MAAM,aAAa,GAA6B,EAAE,CAAA;IAClD,IAAI,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;YAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;QACnD,CAAC;IACH,CAAC;IACD,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,eAAe,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QACnE,eAAe,EAAE,UAAU,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrD,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACnD,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC7C,aAAa;KACd,CAAA;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAA;IAC1G,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC;QAC3B,KAAK,EAAE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;QAC/D,IAAI,EAAE,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;QAC5D,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;KAC1C,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3C,OAAO;QACL,aAAa,EAAE,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACjD,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACnD,aAAa,EAAE,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;KAClD,CAAA;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,yBAAyB,GAAG,KAAK,CAAA;AAEvC,MAAM,OAAO,YAAY;IA4FJ;IACA;IACA;IACA;IACA;IA/FX,KAAK,GAAc,EAAE,CAAA;IAC7B;;;;;OAKG;IACK,WAAW,GAAa,EAAE,CAAA;IAClC,wFAAwF;IAChF,iBAAiB,GAAa,EAAE,CAAA;IACxC;;;;;;OAMG;IACK,YAAY,GAAa,EAAE,CAAA;IACnC,2EAA2E;IACnE,wBAAwB,GAA2B,EAAE,CAAA;IAC7D;;;;;;OAMG;IACK,cAAc,GAAa,EAAE,CAAA;IACrC;;;;;;;OAOG;IACK,eAAe,CAA8B;IACrD;;;;OAIG;IACK,WAAW,CAAwC;IAC3D;;;;;;;OAOG;IACK,gBAAgB,GAAuD,EAAE,CAAA;IACjF;;;;;OAKG;IACK,QAAQ,CAA+B;IACvC,SAAS,CAA0B;IAC3C;;;;OAIG;IACK,QAAQ,CAAqB;IAC7B,cAAc,CAA4B;IAClD,iGAAiG;IACzF,UAAU,GAAoB,oBAAoB,CAAC,SAAS,CAAC,CAAA;IACrE;;;;;OAKG;IACK,YAAY,GAA0B,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAC9D;;;;;OAKG;IACK,SAAS,CAAkC;IACnD,qFAAqF;IAC7E,YAAY,GAAyB,IAAI,CAAA;IACzC,oBAAoB,GAAG,CAAC,CAAA;IAChC,6GAA6G;IACrG,sBAAsB,GAAG,KAAK,CAAA;IAC9B,YAAY,GAA0B,IAAI,CAAA;IAElD,YACmB,eAAuB,EACvB,MAAc,EACd,WAAmB,EACnB,QAAgB,MAAM,EACtB,eAAuB,aAAa;QAJpC,oBAAe,GAAf,eAAe,CAAQ;QACvB,WAAM,GAAN,MAAM,CAAQ;QACd,gBAAW,GAAX,WAAW,CAAQ;QACnB,UAAK,GAAL,KAAK,CAAiB;QACtB,iBAAY,GAAZ,YAAY,CAAwB;IACpD,CAAC;IAEJ;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAmC;QACvC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;YACnC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC7B,yCAAyC;YAC3C,CAAC,CAAC,CAAA;YACF,IAAI,MAAM;gBAAE,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC5D,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QACd,yCAAyC;QACzC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAA;QAEzB,uEAAuE;QACvE,mDAAmD;QACnD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAClD,IAAI,MAAM;YAAE,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,yCAAyC;IACzC,IAAI;QACF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;QAC1B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,CAAC,YAAY,CAAA;QAC9C,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAM;QACvC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,oBAAoB,GAAG,yBAAyB;YAAE,OAAM;QAC9E,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACtC,CAAC;IAED,gFAAgF;IAChF,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IAED,4EAA4E;IAC5E,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED,yDAAyD;IACzD,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAED,uEAAuE;IACvE,aAAa;QACX,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED,4DAA4D;IAC5D,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAA;IAC1B,CAAC;IAED,6GAA6G;IAC7G,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED,0GAA0G;IAC1G,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IAED,0CAA0C;IAC1C,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAED,oEAAoE;IACpE,gGAAgG;IAChG,oBAAoB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAA;IAC/B,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAED,6DAA6D;IAC7D,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAA;IAC1B,CAAC;IAED,mEAAmE;IACnE,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAED,8DAA8D;IAC9D,2BAA2B;QACzB,OAAO,IAAI,CAAC,wBAAwB,CAAA;IACtC,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAA;IAC7B,CAAC;IAED,yFAAyF;IACzF,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAED,8EAA8E;IAC9E,mBAAmB;QACjB,OAAO,IAAI,CAAC,gBAAgB,CAAA;IAC9B,CAAC;IAED,uEAAuE;IAC/D,cAAc,CAAC,MAA+B;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAA;QACnE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACxC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAC3D,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,SAAS,GAAG,MAAM,CAAC,0BAA0B,CAAC,IAAI,MAAM,CAAC,6BAA6B,CAAC,CAAA;QAC7F,IAAI,CAAC,wBAAwB,GAAG,EAAE,CAAA;QAClC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACrF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAoC,CAAC,EAAE,CAAC;gBAC1E,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YACjE,CAAC;QACH,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,mBAAmB,CAAC,CAAA;QAC9E,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;YACjD,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAClE,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,iBAAiB,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;QACxD,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC;YACvD,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACrE,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,eAAe,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAA;QACpD,IAAI,CAAC,eAAe;YAClB,eAAe,KAAK,MAAM,IAAI,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;QACzF,MAAM,WAAW,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAA;QAC5C,IAAI,CAAC,WAAW;YACd,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAA;QACxG,MAAM,gBAAgB,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAA;QACtD,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAA;QAC1B,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC1G,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAA2C,CAAC,EAAE,CAAC;gBACjF,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK;oBAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YACjG,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAA;QACpD,IAAI,CAAC,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAA;QACnE,IAAI,CAAC,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAA;QAC5D,MAAM,YAAY,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;QACnD,IAAI,CAAC,QAAQ,GAAG,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;QAC9F,IAAI,CAAC,YAAY,GAAG,0BAA0B,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAA;QACtE,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,2CAA2C,CAAC,CAAA;QACjI,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,eAAe,CAAC,KAAc;QACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,SAAS,GAAG,EAAE,CAAA;YACnB,OAAM;QACR,CAAC;QACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAA;QAC9C,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,KAAK,CAAA;YAC7B,OAAM;QACR,CAAC;QACD,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,IAAI,IAAI,EAAE,EAChG,oFAAoF,CACrF,CAAA;IACH,CAAC;IAED,4EAA4E;IAC5E,SAAS,CAAC,QAAgB,EAAE,aAAqB;QAC/C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;gBAC9C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,SAAQ;gBACvC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBACpB,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;oBAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC;wBAAE,SAAQ;gBAC7C,CAAC;gBACD,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtC,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,mEAAmE;gBACnE,0EAA0E;gBAC1E,yEAAyE;gBACzE,uDAAuD;gBACvD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAwB,YAAY,EAAE;oBACzE,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B,CAAC,CAAA;gBACF,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAA;oBACxC,qEAAqE;oBACrE,uEAAuE;oBACvE,mEAAmE;oBACnE,MAAM,QAAQ,GAAc,EAAE,CAAA;oBAC9B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;wBACnC,IAAI,SAAS,CAAC,SAAS,CAAC;4BAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;oBACpD,CAAC;oBACD,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAA;oBACrB,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;oBACnD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;wBAChB,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EACtE,uEAAuE,CACxE,CAAA;oBACH,CAAC;oBACD,mEAAmE;oBACnE,qEAAqE;oBACrE,iEAAiE;oBACjE,oEAAoE;oBACpE,oEAAoE;oBACpE,qEAAqE;oBACrE,+DAA+D;oBAC/D,kEAAkE;oBAClE,mBAAmB;oBACnB,IAAI,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;wBACvD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,6DAA6D,CAAC,CAAA;wBAC/I,OAAM;oBACR,CAAC;oBACD,IAAI,CAAC,WAAW,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAClD,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C,CAAA;oBACD,IAAI,CAAC,cAAc,CAAC,MAA4C,CAAC,CAAA;oBACjE,uEAAuE;oBACvE,mEAAmE;oBACnE,IAAI,MAAM,CAAC,WAAW;wBAAE,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAA;oBAC1F,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;wBACzB,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;wBACtC,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAA;oBACpC,CAAC;oBACD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAA;oBACrH,OAAM;gBACR,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CACN;oBACE,MAAM,EAAE,sBAAsB;oBAC9B,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACtD,EACD,oEAAoE,CACrE,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,iCAAiC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAA;QACtH,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE,uCAAuC,CAAC,CAAA;QAErF,IAAI,IAAY,CAAA;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,uEAAuE;YACvE,uEAAuE;YACvE,sEAAsE;YACtE,IAAI,GAAG,YAAY,eAAe,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;gBAAE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;YAC5G,MAAM,GAAG,CAAA;QACX,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA+C,CAAA;QAC7E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QAC7D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;QACjC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YACnC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACvD,CAAC,CAAC,EAAE,CAAA;QACN,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAC3B,8EAA8E;QAC9E,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,qBAAqB,CAAA;QAC7E,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAA;QACzC,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAA;QAClC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAA;IAC1F,CAAC;CACF"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAE5D,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,0BAA0B,GAI3B,MAAM,uBAAuB,CAAA;AAE9B,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAA;AAE5C,wGAAwG;AACxG,MAAM,aAAa,GAAqC,EAAE,KAAK,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;AAclG;;;;;;;;;;;;;GAaG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO,CACL,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ;QAC3B,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ;QACpC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAC/B,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC;QACtE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,kBAAkB,CAAC,CAC1F,CAAA;AACH,CAAC;AAyBD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACpE,aAAa,EAAE,OAAO;IACtB,eAAe,EAAE,EAAE;IACnB,cAAc,EAAE,EAAE;IAClB,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE;CAClB,CAAsB,CAAA;AAqBvB,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC5F,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3C,MAAM,aAAa,GAA6B,EAAE,CAAA;IAClD,IAAI,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;YAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;QACnD,CAAC;IACH,CAAC;IACD,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,eAAe,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QACnE,eAAe,EAAE,UAAU,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrD,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACnD,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC7C,aAAa;KACd,CAAA;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAA;IAC1G,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC;QAC3B,KAAK,EAAE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;QAC/D,IAAI,EAAE,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;QAC5D,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;KAC1C,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3C,OAAO;QACL,aAAa,EAAE,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACjD,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACnD,aAAa,EAAE,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;KAClD,CAAA;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,yBAAyB,GAAG,KAAK,CAAA;AAEvC,MAAM,OAAO,YAAY;IAmGJ;IACA;IACA;IACA;IACA;IAtGX,KAAK,GAAc,EAAE,CAAA;IAC7B;;;;;OAKG;IACK,WAAW,GAAa,EAAE,CAAA;IAClC,wFAAwF;IAChF,iBAAiB,GAAa,EAAE,CAAA;IACxC;;;;;;OAMG;IACK,YAAY,GAAa,EAAE,CAAA;IACnC,2EAA2E;IACnE,wBAAwB,GAA2B,EAAE,CAAA;IAC7D;;;;;;OAMG;IACK,cAAc,GAAa,EAAE,CAAA;IACrC;;;;;;;OAOG;IACK,eAAe,CAA8B;IACrD;;;;OAIG;IACK,WAAW,CAAwC;IAC3D;;;;;;;OAOG;IACK,gBAAgB,GAAuD,EAAE,CAAA;IACjF;;;;;OAKG;IACK,QAAQ,CAA+B;IACvC,SAAS,CAA0B;IAC3C;;;;OAIG;IACK,QAAQ,CAAqB;IAC7B,cAAc,CAA4B;IAClD,iGAAiG;IACzF,UAAU,GAAoB,oBAAoB,CAAC,SAAS,CAAC,CAAA;IACrE;;;;;OAKG;IACK,YAAY,GAA0B,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAC9D;;;;;OAKG;IACK,SAAS,CAAkC;IACnD;;;;;OAKG;IACK,MAAM,GAAG,KAAK,CAAA;IACtB,qFAAqF;IAC7E,YAAY,GAAyB,IAAI,CAAA;IACzC,oBAAoB,GAAG,CAAC,CAAA;IAChC,6GAA6G;IACrG,sBAAsB,GAAG,KAAK,CAAA;IAC9B,YAAY,GAA0B,IAAI,CAAA;IAElD,YACmB,eAAuB,EACvB,MAAc,EACd,WAAmB,EACnB,QAAgB,MAAM,EACtB,eAAuB,aAAa;QAJpC,oBAAe,GAAf,eAAe,CAAQ;QACvB,WAAM,GAAN,MAAM,CAAQ;QACd,gBAAW,GAAX,WAAW,CAAQ;QACnB,UAAK,GAAL,KAAK,CAAiB;QACtB,iBAAY,GAAZ,YAAY,CAAwB;IACpD,CAAC;IAEJ;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAmC;QACvC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;YACnC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC7B,yCAAyC;YAC3C,CAAC,CAAC,CAAA;YACF,IAAI,MAAM;gBAAE,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC5D,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QACd,yCAAyC;QACzC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAA;QAEzB,uEAAuE;QACvE,mDAAmD;QACnD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAClD,IAAI,MAAM;YAAE,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,yCAAyC;IACzC,IAAI;QACF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;QAC1B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,CAAC,YAAY,CAAA;QAC9C,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAM;QACvC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,oBAAoB,GAAG,yBAAyB;YAAE,OAAM;QAC9E,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACtC,CAAC;IAED,gFAAgF;IAChF,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IAED,4EAA4E;IAC5E,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED,yDAAyD;IACzD,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAED,uEAAuE;IACvE,aAAa;QACX,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED,4DAA4D;IAC5D,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAA;IAC1B,CAAC;IAED,6GAA6G;IAC7G,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED,2FAA2F;IAC3F,QAAQ;QACN,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;IAED,0GAA0G;IAC1G,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IAED,0CAA0C;IAC1C,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAED,oEAAoE;IACpE,gGAAgG;IAChG,oBAAoB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAA;IAC/B,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAED,6DAA6D;IAC7D,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAA;IAC1B,CAAC;IAED,mEAAmE;IACnE,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAED,8DAA8D;IAC9D,2BAA2B;QACzB,OAAO,IAAI,CAAC,wBAAwB,CAAA;IACtC,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAA;IAC7B,CAAC;IAED,yFAAyF;IACzF,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAED,8EAA8E;IAC9E,mBAAmB;QACjB,OAAO,IAAI,CAAC,gBAAgB,CAAA;IAC9B,CAAC;IAED,uEAAuE;IAC/D,cAAc,CAAC,MAA+B;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAA;QACnE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACxC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAC3D,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,SAAS,GAAG,MAAM,CAAC,0BAA0B,CAAC,IAAI,MAAM,CAAC,6BAA6B,CAAC,CAAA;QAC7F,IAAI,CAAC,wBAAwB,GAAG,EAAE,CAAA;QAClC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACrF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAoC,CAAC,EAAE,CAAC;gBAC1E,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YACjE,CAAC;QACH,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,mBAAmB,CAAC,CAAA;QAC9E,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;YACjD,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAClE,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,iBAAiB,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;QACxD,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC;YACvD,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACrE,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,eAAe,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAA;QACpD,IAAI,CAAC,eAAe;YAClB,eAAe,KAAK,MAAM,IAAI,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;QACzF,MAAM,WAAW,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAA;QAC5C,IAAI,CAAC,WAAW;YACd,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAA;QACxG,MAAM,gBAAgB,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAA;QACtD,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAA;QAC1B,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC1G,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAA2C,CAAC,EAAE,CAAC;gBACjF,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK;oBAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YACjG,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAA;QACpD,IAAI,CAAC,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAA;QACnE,IAAI,CAAC,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAA;QAC5D,MAAM,YAAY,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;QACnD,IAAI,CAAC,QAAQ,GAAG,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;QAC9F,IAAI,CAAC,YAAY,GAAG,0BAA0B,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAA;QACtE,IAAI,CAAC,MAAM,GAAG,wBAAwB,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAA;QAClE,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,2CAA2C,CAAC,CAAA;QACjI,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,eAAe,CAAC,KAAc;QACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,SAAS,GAAG,EAAE,CAAA;YACnB,OAAM;QACR,CAAC;QACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAA;QAC9C,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,KAAK,CAAA;YAC7B,OAAM;QACR,CAAC;QACD,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,IAAI,IAAI,EAAE,EAChG,oFAAoF,CACrF,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,QAAgB,EAAE,aAAqB;QAC/C,IAAI,OAAO,GAAmB,IAAI,CAAA;QAClC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAAE,SAAQ;YAC3G,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;gBAC9C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,SAAQ;gBACvC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBACpB,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;oBAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC;wBAAE,SAAQ;gBAC7C,CAAC;gBACD,OAAO,GAAG,IAAI,CAAA;gBACd,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO;oBAAE,MAAK;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtC,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,mEAAmE;gBACnE,0EAA0E;gBAC1E,yEAAyE;gBACzE,uDAAuD;gBACvD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAwB,YAAY,EAAE;oBACzE,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B,CAAC,CAAA;gBACF,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAA;oBACxC,qEAAqE;oBACrE,uEAAuE;oBACvE,mEAAmE;oBACnE,MAAM,QAAQ,GAAc,EAAE,CAAA;oBAC9B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;wBACnC,IAAI,SAAS,CAAC,SAAS,CAAC;4BAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;oBACpD,CAAC;oBACD,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAA;oBACrB,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;oBACnD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;wBAChB,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EACtE,uEAAuE,CACxE,CAAA;oBACH,CAAC;oBACD,mEAAmE;oBACnE,qEAAqE;oBACrE,iEAAiE;oBACjE,oEAAoE;oBACpE,oEAAoE;oBACpE,qEAAqE;oBACrE,+DAA+D;oBAC/D,kEAAkE;oBAClE,mEAAmE;oBACnE,iEAAiE;oBACjE,8DAA8D;oBAC9D,IAAI,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;wBACvD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,6DAA6D,CAAC,CAAA;wBAC/I,OAAM;oBACR,CAAC;oBACD,IAAI,CAAC,WAAW,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAClD,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C,CAAA;oBACD,IAAI,CAAC,cAAc,CAAC,MAA4C,CAAC,CAAA;oBACjE,uEAAuE;oBACvE,mEAAmE;oBACnE,IAAI,MAAM,CAAC,WAAW;wBAAE,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAA;oBAC1F,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;wBACzB,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;wBACtC,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAA;oBACpC,CAAC;oBACD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAA;oBACrH,OAAM;gBACR,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CACN;oBACE,MAAM,EAAE,sBAAsB;oBAC9B,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACtD,EACD,oEAAoE,CACrE,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,iCAAiC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAA;QACtH,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE,uCAAuC,CAAC,CAAA;QAErF,IAAI,IAAY,CAAA;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,uEAAuE;YACvE,uEAAuE;YACvE,sEAAsE;YACtE,IAAI,GAAG,YAAY,eAAe,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;gBAAE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;YAC5G,MAAM,GAAG,CAAA;QACX,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA+C,CAAA;QAC7E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QAC7D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;QACjC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YACnC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACvD,CAAC,CAAC,EAAE,CAAA;QACN,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAC3B,8EAA8E;QAC9E,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,qBAAqB,CAAA;QAC7E,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAA;QACzC,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAA;QAClC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAA;IAC1F,CAAC;CACF"}

package/dist/proxy.d.ts

@@ -32,8 +32,10 @@ import { ToolCallInterceptor } from './interceptor.js';
 import { type InjectionSource } from './injection.js';
 import { type AnomalyFinding } from './anomaly/index.js';
 import { SessionState } from './session.js';
+import { type ToolDefinition } from './tofu.js';
 import { type CallerIdentity } from './identity.js';
 import { type McpToolDefinition } from '@intutic/shared-types';
+import type { ChaosInjector } from './chaos.js';
 /**
  * Who a per-member MCP budget counts when the control plane has not named the
  * member behind this proxy's key: the key's prefix, else the OS user. Callers
@@ -44,6 +46,17 @@ export declare function fallbackBudgetCaller(identity: CallerIdentity): string;
 export interface PendingRequest {
     method: 'tools/call' | 'tools/list' | 'resources/read';
     toolName?: string;
+    /** A chaos `inject.tool_result` chosen for this call: appended to the server's result (chaos.ts). */
+    inject?: {
+        payload: string;
+        call: number;
+    };
+}
+/** What `handleHarnessLine` needs to inject faults when a chaos plan is loaded (chaos.ts). */
+export interface ChaosHooks {
+    injector: ChaosInjector;
+    /** Hand a synthesized upstream line to the response path, as if the server had sent it. */
+    respond: (line: string) => void;
 }
 /** The outcome of inspecting one server→harness line. */
 export interface ServerLineOutcome {
@@ -71,6 +84,13 @@ export interface ServerLineOutcome {
      * `toolsListTools`; the registry gets these.
      */
     toolsListUpstream?: McpToolDefinition[];
+    /**
+     * The upstream server's own `{name, description, inputSchema}` per tool,
+     * untruncated, before curation hid any or an override rewrote a
+     * description — what TOFU pins (tofu.ts), so an owner's own curation change
+     * never reads as the server's. Set alongside `toolsListTools`.
+     */
+    toolsListPinned?: ToolDefinition[];
     /** The JSON-RPC id of the `tools/list` response, needed to build a block
      *  frame in the caller if TOFU refuses it. Set alongside `toolsListTools`. */
     toolsListMsgId?: string | number | null;
@@ -143,7 +163,9 @@ export interface ServerLineOutcome {
  * also the counter to a poisoned upstream description — the pin detects the
  * change; the override controls what the agent actually reads.
  */
-export declare function processServerLine(raw: string, pending: Map<string | number, PendingRequest>, allowedTools: readonly string[], overrides: Readonly<Record<string, string>>, injectionAction?: 'warn' | 'block', injectionPatterns?: readonly string[], disabledTools?: readonly string[]): ServerLineOutcome;
+export declare function processServerLine(raw: string, pending: Map<string | number, PendingRequest>, allowedTools: readonly string[], overrides: Readonly<Record<string, string>>, injectionAction?: 'warn' | 'block', injectionPatterns?: readonly string[], disabledTools?: readonly string[], 
+/** The workspace is OPAQUE: a withheld result does not say which pattern withheld it. */
+opaque?: boolean): ServerLineOutcome;
 /**
  * Handle one harness→upstream line — shared, byte-for-byte, between stdio
  * proxy mode (`McpGovernanceProxy.runProxy`, below) and the remote HTTP/SSE
@@ -161,9 +183,11 @@ export declare function processServerLine(raw: string, pending: Map<string | num
  * so `remoteBridge.ts` can call it without needing a `McpGovernanceProxy`
  * instance shaped for the stdio child-process lifecycle it doesn't have.
  */
-export declare function handleHarnessLine(line: string, pending: Map<string | number, PendingRequest>, interceptor: ToolCallInterceptor, forward: (line: string) => void, session?: SessionState): void;
+export declare function handleHarnessLine(line: string, pending: Map<string | number, PendingRequest>, interceptor: ToolCallInterceptor, forward: (line: string) => void, session?: SessionState, chaos?: ChaosHooks): void;
 export declare class McpGovernanceProxy {
     private readonly config;
+    /** The loaded chaos plan's injector; null (no plan) leaves every path as it is. */
+    private readonly chaos;
     private readonly policy;
     private readonly emitter;
     private readonly interceptor;
@@ -198,7 +222,9 @@ export declare class McpGovernanceProxy {
     /** Reports this proxy's server to the registry; absent for the standalone `intutic` entry, which fronts none. */
     private readonly registryObserver;
     private realServer;
-    constructor(config: ProxyConfig);
+    constructor(config: ProxyConfig, 
+    /** The loaded chaos plan's injector; null (no plan) leaves every path as it is. */
+    chaos?: ChaosInjector | null);
     /**
      * The tools/call decision engine — exposed so `remoteBridge.ts` can drive
      * `handleHarnessLine` (the exported free function above) against the SAME
@@ -213,6 +239,12 @@ export declare class McpGovernanceProxy {
      * `handleHarnessLine` records into are never two different objects.
      */
     getSessionState(): SessionState;
+    /**
+     * The chaos hooks for `handleHarnessLine`, bound to this proxy's response
+     * path and `pending` map; undefined without a plan. Shared by stdio mode
+     * and `remoteBridge.ts` for the same reason `getInterceptor` is.
+     */
+    chaosHooks(pending: Map<string | number, PendingRequest>): ChaosHooks | undefined;
     /**
      * Start the policy client's background refresh timer. Exposed alongside
      * `stopPolicy` so `remoteBridge.ts` can drive the same policy lifecycle

package/dist/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAG9C,OAAO,EAAE,mBAAmB,EAAc,MAAM,kBAAkB,CAAA;AAYlE,OAAO,EAA4D,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAC/G,OAAO,EAAgC,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAS3C,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAA;AACnE,OAAO,EAA2B,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAmEvF;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAIrE;AASD,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,YAAY,GAAG,YAAY,GAAG,gBAAgB,CAAA;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAA;IACZ,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,kFAAkF;IAClF,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;IAChD;;;;;OAKG;IACH,cAAc,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/C;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,CAAA;IACvC;kFAC8E;IAC9E,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IACvC;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,eAAe,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;IAC5F;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,cAAc,CAAA;IAC9B;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,cAAc,CAAA;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,EAC7C,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC3C,eAAe,GAAE,MAAM,GAAG,OAAgB,EAC1C,iBAAiB,GAAE,SAAS,MAAM,EAAO,EACzC,aAAa,GAAE,SAAS,MAAM,EAAO,GACpC,iBAAiB,CAiMnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,EAC7C,WAAW,EAAE,mBAAmB,EAChC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC/B,OAAO,CAAC,EAAE,YAAY,GACrB,IAAI,CA6DN;AAED,qBAAa,kBAAkB;IAoCjB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAnCnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmB;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAClD,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAY;IACvC,iHAAiH;IACjH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA8B;IAC/D,OAAO,CAAC,UAAU,CAAuC;gBAE5B,MAAM,EAAE,WAAW;IAkEhD;;;;;OAKG;IACH,cAAc,IAAI,mBAAmB;IAIrC;;;;;OAKG;IACH,eAAe,IAAI,YAAY;IAI/B;;;;;;OAMG;IACH,WAAW,IAAI,IAAI;IAQnB,OAAO,CAAC,SAAS,CAA8B;IAE/C;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAKvB;;;OAGG;IACH,UAAU,IAAI,IAAI;IAQlB;;OAEG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAS1B;;;;OAIG;YACW,aAAa;IAyK3B;;;;;;;;;;;;;;;;;;;OAmBG;IACG,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,GAC5C,OAAO,CAAC,IAAI,CAAC;IA4LhB;;;OAGG;YACW,QAAQ;CAoFvB"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAG9C,OAAO,EAAE,mBAAmB,EAA0B,MAAM,kBAAkB,CAAA;AAc9E,OAAO,EAA4D,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAC/G,OAAO,EAAgC,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAM3C,OAAO,EAA2C,KAAK,cAAc,EAAE,MAAM,WAAW,CAAA;AAGxF,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAA;AACnE,OAAO,EAAmD,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAM/G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AA2F/C;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAIrE;AASD,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,YAAY,GAAG,YAAY,GAAG,gBAAgB,CAAA;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qGAAqG;IACrG,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3C;AAED,8FAA8F;AAC9F,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,aAAa,CAAA;IACvB,2FAA2F;IAC3F,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAED,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAA;IACZ,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,kFAAkF;IAClF,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;IAChD;;;;;OAKG;IACH,cAAc,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/C;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,CAAA;IACvC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,cAAc,EAAE,CAAA;IAClC;kFAC8E;IAC9E,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IACvC;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,eAAe,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;IAC5F;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,cAAc,CAAA;IAC9B;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,cAAc,CAAA;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,EAC7C,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC3C,eAAe,GAAE,MAAM,GAAG,OAAgB,EAC1C,iBAAiB,GAAE,SAAS,MAAM,EAAO,EACzC,aAAa,GAAE,SAAS,MAAM,EAAO;AACrC,yFAAyF;AACzF,MAAM,UAAQ,GACb,iBAAiB,CAkMnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,EAC7C,WAAW,EAAE,mBAAmB,EAChC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC/B,OAAO,CAAC,EAAE,YAAY,EACtB,KAAK,CAAC,EAAE,UAAU,GACjB,IAAI,CAgFN;AAED,qBAAa,kBAAkB;IAqC3B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,KAAK;IAtCxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmB;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAClD,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAY;IACvC,iHAAiH;IACjH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA8B;IAC/D,OAAO,CAAC,UAAU,CAAuC;gBAGtC,MAAM,EAAE,WAAW;IACpC,mFAAmF;IAClE,KAAK,GAAE,aAAa,GAAG,IAAW;IAmErD;;;;;OAKG;IACH,cAAc,IAAI,mBAAmB;IAIrC;;;;;OAKG;IACH,eAAe,IAAI,YAAY;IAI/B;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,GAAG,UAAU,GAAG,SAAS;IAMjF;;;;;;OAMG;IACH,WAAW,IAAI,IAAI;IAQnB,OAAO,CAAC,SAAS,CAA8B;IAE/C;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAKvB;;;OAGG;IACH,UAAU,IAAI,IAAI;IAQlB;;OAEG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAS1B;;;;OAIG;YACW,aAAa;IA4J3B;;;;;;;;;;;;;;;;;;;OAmBG;IACG,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,GAC5C,OAAO,CAAC,IAAI,CAAC;IAoOhB;;;OAGG;YACW,QAAQ;CAqFvB"}

package/dist/proxy.js

@@ -32,8 +32,9 @@ import * as node_readline from 'node:readline';
 import { createStderrLogger as createLogger } from './stderrLog.js';
 import { PolicyClient } from './policy.js';
 import { GovernanceEmitter, detectionFinding } from './emitter.js';
-import { ToolCallInterceptor } from './interceptor.js';
-import { LIST_INCIDENTS_ARGS, budgetRemaining, describeFailure, holdStatus, incidentListPath, readControlPlane, registryStatus, } from './agentTools.js';
+import { ToolCallInterceptor, holdReason } from './interceptor.js';
+import { LIST_INCIDENTS_ARGS, budgetRemaining, describeFailure, governanceStatus, sopListPath, holdStatus, incidentListPath, readControlPlane, registryStatus, } from './agentTools.js';
+import { isOpaqueRefusal, opaqueRefusalData } from './refusals.js';
 import { redactText as redactMcpText, setWorkspacePii } from './dlp.js';
 import { scanText, injectionSeverity, setDynamicInjectionPatterns } from './injection.js';
 import { toolPoisoning, dlpEscalation } from './anomaly/index.js';
@@ -43,11 +44,11 @@ import { GuardedValkey } from './guardedValkey.js';
 import { McpBudgetEnforcer, ValkeyBudgetStore } from './budget.js';
 import { WasmRunner } from './wasm/runner.js';
 import { CloudRuleSet, fetchRuleBinaryFrom, refusalDetail } from './wasm/cloudRules.js';
-import { checkTofu, decideTofuAction } from './tofu.js';
+import { checkTofu, decideTofuAction, tofuReport } from './tofu.js';
 import { RegistryObserver } from './registryObserver.js';
 import { ApprovalHolds } from './approvalHold.js';
 import { callerIdentity } from './identity.js';
-import { normalizeToolDefinition } from '@intutic/shared-types';
+import { OPAQUE_REFUSAL_MESSAGE, normalizeToolDefinition } from '@intutic/shared-types';
 import { PACKAGE_VERSION } from './version.js';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
@@ -55,20 +56,40 @@ import { z } from 'zod';
 import { watchWasmDir } from './wasm/watch.js';
 const log = createLogger('mcp-governance-proxy');
 /**
- * Build a JSON-RPC 2.0 error response for a blocked tool call. `data` names
- * the refusal for a client that reads it programmatically (refusals.ts).
+ * A refusal frame, the one place that decides what the agent is told. In an
+ * OPAQUE workspace (`opaque`) a refusal on workspace policy
+ * (`isOpaqueRefusal`) is sent as `opaqueMessage`, built around
+ * `OPAQUE_REFUSAL_MESSAGE`, with `opaqueRefusalData`: the same JSON-RPC code
+ * and `error.data.code`, no rule. Otherwise `message` and `data`, exactly as
+ * before the mode existed. Only the frame changes; logs and emitted events
+ * keep the full reason.
  */
-function buildBlockResponse(id, reason, data) {
+function refusalResponse(id, data, opaque, message, opaqueMessage) {
+    const hide = opaque && isOpaqueRefusal(data);
     return {
         jsonrpc: '2.0',
         id,
         error: {
             code: -32603, // Internal error (closest standard code to "blocked")
-            message: `[Intutic Governance] Tool call blocked: ${reason}`,
-            data,
+            message: hide ? opaqueMessage : message,
+            data: hide ? opaqueRefusalData(data) : data,
         },
     };
 }
+const BLOCKED = '[Intutic Governance] Tool call blocked: ';
+/**
+ * A withheld result in an OPAQUE workspace: not which pattern, but still that
+ * the call already ran, so the agent does not run it again expecting output.
+ */
+const RESULT_WITHHELD_OPAQUE = `[Intutic Governance] Result withheld: ${OPAQUE_REFUSAL_MESSAGE} The tool call already ran; ` +
+    `its output was not delivered.`;
+/**
+ * Build a JSON-RPC 2.0 error response for a blocked tool call. `data` names
+ * the refusal for a client that reads it programmatically (refusals.ts).
+ */
+function buildBlockResponse(id, reason, data, opaque) {
+    return refusalResponse(id, data, opaque, BLOCKED + reason, BLOCKED + OPAQUE_REFUSAL_MESSAGE);
+}
 /** The `error.data` of a block decision: its code, rule id and detail. */
 function blockData(decision) {
     return { code: decision.code, ruleId: decision.ruleId, ...decision.detail };
@@ -79,16 +100,10 @@ function blockData(decision) {
  * the hold id in `data` for a client that reads it programmatically — empty
  * when the hold could not be recorded, so there is nothing to approve yet.
  */
-function buildHoldResponse(id, reason, holdId, ruleId) {
-    return {
-        jsonrpc: '2.0',
-        id,
-        error: {
-            code: -32603,
-            message: `[Intutic Governance] Tool call ${reason}`,
-            data: { code: 'HELD', ruleId, status: 'pending_approval', holdId },
-        },
-    };
+function buildHoldResponse(id, reason, holdId, ruleId, opaque) {
+    return refusalResponse(id, { code: 'HELD', ruleId, status: 'pending_approval', holdId }, opaque, `[Intutic Governance] Tool call ${reason}`, 
+    // An OPAQUE workspace's hold names the hold, not the rule.
+    `[Intutic Governance] Tool call ${holdReason(OPAQUE_REFUSAL_MESSAGE, holdId)}`);
 }
 /**
  * Who a per-member MCP budget counts when the control plane has not named the
@@ -135,7 +150,9 @@ function writeFrame(frame) {
  * also the counter to a poisoned upstream description — the pin detects the
  * change; the override controls what the agent actually reads.
  */
-export function processServerLine(raw, pending, allowedTools, overrides, injectionAction = 'warn', injectionPatterns = [], disabledTools = []) {
+export function processServerLine(raw, pending, allowedTools, overrides, injectionAction = 'warn', injectionPatterns = [], disabledTools = [], 
+/** The workspace is OPAQUE: a withheld result does not say which pattern withheld it. */
+opaque = false) {
     // Workspace-supplied injection patterns, on top of the floor.
     // Idempotent when the list has not changed, so this is cheap per line.
     setDynamicInjectionPatterns(injectionPatterns);
@@ -178,17 +195,9 @@ export function processServerLine(raw, pending, allowedTools, overrides, injecti
                 resultText = redacted;
             }
             catch {
-                const withheld = {
-                    jsonrpc: '2.0',
-                    id: msg.id,
-                    error: {
-                        code: -32603,
-                        message: `[Intutic Governance] Result withheld: it contained sensitive data ` +
-                            `whose redaction did not survive re-parsing. The tool ran; its output ` +
-                            `was not delivered. (${findings.map((f) => f.description).join('; ')})`,
-                        data: { code: 'RESULT_WITHHELD_DLP', ruleId: `dlp.${findings[0]?.pattern ?? 'output'}` },
-                    },
-                };
+                const withheld = refusalResponse(msg.id, { code: 'RESULT_WITHHELD_DLP', ruleId: `dlp.${findings[0]?.pattern ?? 'output'}` }, opaque, `[Intutic Governance] Result withheld: it contained sensitive data ` +
+                    `whose redaction did not survive re-parsing. The tool ran; its output ` +
+                    `was not delivered. (${findings.map((f) => f.description).join('; ')})`, RESULT_WITHHELD_OPAQUE);
                 return { line: JSON.stringify(withheld), redactedTool, redactions };
             }
         }
@@ -205,17 +214,9 @@ export function processServerLine(raw, pending, allowedTools, overrides, injecti
                 // Response-side block never claims the CALL was refused — it
                 // already ran. Only the delivered output is withheld, worded the
                 // same way the DLP reparse-withheld frame above is.
-                const withheldInjection = {
-                    jsonrpc: '2.0',
-                    id: msg.id,
-                    error: {
-                        code: -32603,
-                        message: `[Intutic Governance] Result withheld: it triggered prompt-injection ` +
-                            `pattern(s) (${injectionPatterns.join(', ')}). The tool call already ran; ` +
-                            `its output was not delivered.`,
-                        data: { code: 'RESULT_WITHHELD_INJECTION', ruleId: 'injection.tool_result' },
-                    },
-                };
+                const withheldInjection = refusalResponse(msg.id, { code: 'RESULT_WITHHELD_INJECTION', ruleId: 'injection.tool_result' }, opaque, `[Intutic Governance] Result withheld: it triggered prompt-injection ` +
+                    `pattern(s) (${injectionPatterns.join(', ')}). The tool call already ran; ` +
+                    `its output was not delivered.`, RESULT_WITHHELD_OPAQUE);
                 return {
                     line: JSON.stringify(withheldInjection),
                     redactedTool,
@@ -249,6 +250,11 @@ export function processServerLine(raw, pending, allowedTools, overrides, injecti
         let hidden = 0;
         let overridden = 0;
         // Copied before the overrides below rewrite descriptions in place.
+        const pinned = tools.map((t) => ({
+            name: t?.['name'],
+            description: t?.['description'],
+            inputSchema: t?.['inputSchema'],
+        }));
         const upstream = tools
             .map(normalizeToolDefinition)
             .filter((t) => t !== null);
@@ -298,14 +304,15 @@ export function processServerLine(raw, pending, allowedTools, overrides, injecti
             .filter((t) => typeof t['name'] === 'string')
             .map((t) => ({ name: t['name'], description: typeof t['description'] === 'string' ? t['description'] : undefined })));
         // toolsListTools/toolsListMsgId are set on EVERY tools/list response,
-        // curated or not — TOFU pinning (tofu.ts) needs the full post-curation
-        // tool set regardless of whether allowlist filtering or description
-        // overrides touched it this time.
+        // curated or not — the session cache and TOFU pinning (tofu.ts, over
+        // `toolsListPinned`) need them whether or not allowlist filtering or
+        // description overrides touched the list this time.
         if (hidden === 0 && overridden === 0) {
             return {
                 line: raw,
                 toolsListTools: kept,
                 toolsListUpstream: upstream,
+                toolsListPinned: pinned,
                 toolsListMsgId: msg.id,
                 injectionFindings,
                 toolPoisoning: toolPoisoningFinding ?? undefined,
@@ -317,6 +324,7 @@ export function processServerLine(raw, pending, allowedTools, overrides, injecti
             curated: { hidden, overridden },
             toolsListTools: kept,
             toolsListUpstream: upstream,
+            toolsListPinned: pinned,
             toolsListMsgId: msg.id,
             injectionFindings,
             toolPoisoning: toolPoisoningFinding ?? undefined,
@@ -341,7 +349,7 @@ export function processServerLine(raw, pending, allowedTools, overrides, injecti
  * so `remoteBridge.ts` can call it without needing a `McpGovernanceProxy`
  * instance shaped for the stdio child-process lifecycle it doesn't have.
  */
-export function handleHarnessLine(line, pending, interceptor, forward, session) {
+export function handleHarnessLine(line, pending, interceptor, forward, session, chaos) {
     const trimmed = line.trim();
     if (!trimmed)
         return;
@@ -371,10 +379,14 @@ export function handleHarnessLine(line, pending, interceptor, forward, session)
         interceptor.decide(toolName, toolInput).then((decision) => {
             if (decision.action === 'block') {
                 log.warn({ action: 'tool_blocked', toolName, reason: decision.reason }, 'Tool call blocked by governance proxy');
-                writeFrame(buildBlockResponse(msg.id, decision.reason, blockData(decision)));
+                // Recorded before the answer goes out, as on the allowed path: a
+                // reader that acts on the answer must find the event already written.
+                chaos?.injector.emit({ type: 'tool_call', tool: toolName, ok: false });
+                writeFrame(buildBlockResponse(msg.id, decision.reason, blockData(decision), interceptor.opaque));
             }
             else if (decision.action === 'hold') {
-                writeFrame(buildHoldResponse(msg.id, decision.reason, decision.holdId, decision.ruleId));
+                chaos?.injector.emit({ type: 'tool_call', tool: toolName, ok: false });
+                writeFrame(buildHoldResponse(msg.id, decision.reason, decision.holdId, decision.ruleId, interceptor.opaque));
             }
             else {
                 // Allow: the response now needs inspecting on the way back —
@@ -389,6 +401,19 @@ export function handleHarnessLine(line, pending, interceptor, forward, session)
                 // tool_diversity_collapse, or an agent could be penalized for calls
                 // that never ran.
                 session?.recordCall(toolName);
+                // Chaos faults stand in for the upstream server, so they are
+                // considered only here, after governance allowed the call, and
+                // their results go back through the response path like a real one.
+                if (chaos && decision.action === 'allow' && msg.id !== null && msg.id !== undefined) {
+                    const fault = chaos.injector.onAllowedCall(toolName, () => writeFrame({ jsonrpc: '2.0', method: 'notifications/tools/list_changed' }));
+                    if (fault?.kind === 'respond') {
+                        chaos.respond(JSON.stringify({ jsonrpc: '2.0', id: msg.id, result: fault.result }));
+                        return;
+                    }
+                    if (fault?.kind === 'append') {
+                        pending.set(msg.id, { method: 'tools/call', toolName, inject: { payload: fault.payload, call: fault.call } });
+                    }
+                }
                 forward(line);
             }
         }).catch((err) => {
@@ -404,6 +429,7 @@ export function handleHarnessLine(line, pending, interceptor, forward, session)
 }
 export class McpGovernanceProxy {
     config;
+    chaos;
     policy;
     emitter;
     interceptor;
@@ -438,8 +464,11 @@ export class McpGovernanceProxy {
     /** Reports this proxy's server to the registry; absent for the standalone `intutic` entry, which fronts none. */
     registryObserver;
     realServer = null;
-    constructor(config) {
+    constructor(config, 
+    /** The loaded chaos plan's injector; null (no plan) leaves every path as it is. */
+    chaos = null) {
         this.config = config;
+        this.chaos = chaos;
         this.policy = new PolicyClient(config.controlPlaneUrl, config.apiKey, config.workspaceId, config.policyTtlMs, config.mcpProxyMode);
         const identity = callerIdentity(config.apiKey, config.serverName, config.sessionScope);
         this.emitter = new GovernanceEmitter(config.controlPlaneUrl, config.apiKey, config.eventsFilePath, config.workspaceId, config.mcpProxyMode, identity);
@@ -482,6 +511,17 @@ export class McpGovernanceProxy {
     getSessionState() {
         return this.session;
     }
+    /**
+     * The chaos hooks for `handleHarnessLine`, bound to this proxy's response
+     * path and `pending` map; undefined without a plan. Shared by stdio mode
+     * and `remoteBridge.ts` for the same reason `getInterceptor` is.
+     */
+    chaosHooks(pending) {
+        const injector = this.chaos;
+        if (!injector)
+            return undefined;
+        return { injector, respond: (line) => void this.handleServerLine(line, pending) };
+    }
     /**
      * Start the policy client's background refresh timer. Exposed alongside
      * `stopPolicy` so `remoteBridge.ts` can drive the same policy lifecycle
@@ -545,25 +585,15 @@ export class McpGovernanceProxy {
         const workspaceId = this.config.workspaceId;
         const callControlPlane = (path) => readControlPlane(cpUrl, apiKey, workspaceId, path);
         // Tool: intutic_governance_status
-        server.tool('intutic_governance_status', 'Returns the current governance status and health of the Intutic control plane for this workspace.', {}, async () => {
-            const health = await callControlPlane('/healthz');
-            const status = health.ok
-                ? { connected: true, controlPlane: cpUrl, workspaceId, ...health.data }
-                : {
-                    connected: false,
-                    controlPlane: cpUrl,
-                    workspaceId,
-                    error: health.reason === 'forbidden'
-                        ? 'Control plane rejected this API key'
-                        : 'Control plane unreachable',
-                };
+        server.tool('intutic_governance_status', 'Returns whether the Intutic control plane is reachable and accepts this API key, for this workspace.', {}, async () => {
+            const status = await governanceStatus(cpUrl, apiKey, workspaceId);
             return {
                 content: [{ type: 'text', text: JSON.stringify(status, null, 2) }],
             };
         });
         // Tool: intutic_list_sops
-        server.tool('intutic_list_sops', 'Lists Standard Operating Procedures (SOPs) active in this workspace.', { limit: z.number().int().min(1).max(50).default(10).describe('Number of SOPs to return (1–50)') }, async ({ limit }) => {
-            const result = await callControlPlane(`/api/v1/sops?workspaceId=${workspaceId}&limit=${limit}`);
+        server.tool('intutic_list_sops', 'Lists the Standard Operating Procedures (SOPs) in force in this workspace: the VALIDATED ones.', { limit: z.number().int().min(1).max(50).default(10).describe('Number of SOPs to return (1–50)') }, async ({ limit }) => {
+            const result = await callControlPlane(sopListPath(workspaceId, limit));
             const text = result.ok
                 ? JSON.stringify(result.data, null, 2)
                 : describeFailure(result, 'list SOPs');
@@ -666,7 +696,15 @@ export class McpGovernanceProxy {
         // Results are redacted with the workspace's PII detector actions too —
         // a resources/read answer can arrive before any tools/call set them.
         setWorkspacePii(this.policy.getPiiDetectors());
-        const outcome = processServerLine(rawLine, pending, this.policy.getAllowedTools(), this.policy.getToolDescriptionOverrides(), injectionAction, this.policy.getInjectionPatterns(), this.policy.getRegistry()?.disabledTools[this.config.serverName] ?? []);
+        // A chaos plan's response-side faults rewrite the upstream line first,
+        // so every check below inspects the faulted response.
+        let chaosToolCall;
+        if (this.chaos) {
+            const faulted = this.chaos.faultServerLine(rawLine, pending);
+            rawLine = faulted.line;
+            chaosToolCall = faulted.toolCall;
+        }
+        const outcome = processServerLine(rawLine, pending, this.policy.getAllowedTools(), this.policy.getToolDescriptionOverrides(), injectionAction, this.policy.getInjectionPatterns(), this.policy.getRegistry()?.disabledTools[this.config.serverName] ?? [], this.policy.isOpaque());
         if (outcome.injectionFindings) {
             for (const finding of outcome.injectionFindings) {
                 const severity = injectionSeverity(finding.patterns, finding.source);
@@ -696,6 +734,8 @@ export class McpGovernanceProxy {
                 }
             }
         }
+        if (chaosToolCall !== undefined)
+            this.chaos?.recordToolCall(chaosToolCall, outcome.line);
         if (outcome.redactedTool) {
             log.warn({
                 action: 'result_redacted',
@@ -742,7 +782,9 @@ export class McpGovernanceProxy {
             const serverName = this.config.serverName;
             let tofu;
             try {
-                tofu = await checkTofu(this.config.workspaceId, serverName, outcome.toolsListTools);
+                // Pinned over the server's own definitions; the curated list is read
+                // only to migrate a pin taken over it by an earlier version.
+                tofu = await checkTofu(this.config.workspaceId, serverName, outcome.toolsListPinned ?? outcome.toolsListTools, outcome.toolsListTools);
             }
             catch (err) {
                 // Pin storage I/O failed (disk full, permissions, ~/.intutic
@@ -753,7 +795,7 @@ export class McpGovernanceProxy {
                 if (!this.interceptor.failOpen) {
                     writeFrame(buildBlockResponse(outcome.toolsListMsgId ?? null, `TOFU pin check for MCP server "${serverName}" failed (could not read/write ` +
                         `~/.intutic/mcp-pins/). Blocked by workspace policy (fail-closed mode). ` +
-                        `Contact your administrator or update mcpProxyFailBehavior to open.`, { code: 'TOFU_UNAVAILABLE', ruleId: 'mcpProxyFailBehavior' }));
+                        `Contact your administrator or update mcpProxyFailBehavior to open.`, { code: 'TOFU_UNAVAILABLE', ruleId: 'mcpProxyFailBehavior' }, this.interceptor.opaque));
                     return;
                 }
                 process.stdout.write(outcome.line + '\n');
@@ -764,7 +806,7 @@ export class McpGovernanceProxy {
             // the mismatch even in fail-open mode, where `action.block` is false.
             // 'skipped' (no tools declared) deliberately leaves the session's
             // cached flag untouched; see SessionState.setToolContractChanged's doc.
-            if (tofu.status === 'first_contact' || tofu.status === 'match') {
+            if (tofu.status === 'first_contact' || tofu.status === 'match' || tofu.status === 'repinned') {
                 this.session.setToolContractChanged(false);
             }
             else if (tofu.status === 'mismatch') {
@@ -773,6 +815,27 @@ export class McpGovernanceProxy {
             if (tofu.status === 'first_contact') {
                 log.info({ action: 'tofu_first_contact', serverName, fingerprint: tofu.fingerprint }, 'MCP server tool definitions pinned on first contact');
             }
+            else if (tofu.status === 'repinned') {
+                const fields = {
+                    action: 'tofu_repinned',
+                    serverName,
+                    previousFingerprint: tofu.previousFingerprint,
+                    fingerprint: tofu.fingerprint,
+                    verified: tofu.verified,
+                };
+                if (tofu.verified) {
+                    log.info(fields, 'MCP server pin moved to the upstream definitions; the old pin still matched');
+                }
+                else {
+                    log.warn(fields, 'MCP server pin moved to the upstream definitions; the old pin, taken over the curated list, no longer ' +
+                        'matched it, and cannot tell a curation change from a server change');
+                }
+                // Visible, never blocking: a LOW finding with both fingerprints when
+                // the old pin did not match; nothing when it did.
+                const report = tofuReport(tofu, serverName, false);
+                if (report)
+                    this.emitter.emit('mcp_server_definition_changed', serverName, undefined, report.reason, report.finding);
+            }
             else if (tofu.status === 'mismatch') {
                 const action = decideTofuAction(tofu, serverName, this.interceptor.failOpen);
                 const reason = action.reason ?? 'MCP server tool definitions changed since first pinned.';
@@ -783,9 +846,10 @@ export class McpGovernanceProxy {
                     fingerprint: tofu.fingerprint,
                     blocked: action.block,
                 }, reason);
-                this.emitter.emit('mcp_server_definition_changed', serverName, undefined, reason);
+                const report = tofuReport(tofu, serverName, action.block, reason);
+                this.emitter.emit('mcp_server_definition_changed', serverName, undefined, reason, report?.finding);
                 if (action.block) {
-                    writeFrame(buildBlockResponse(outcome.toolsListMsgId ?? null, reason, { code: 'TOOL_DEFINITIONS_CHANGED', ruleId: `tofu.${serverName}` }));
+                    writeFrame(buildBlockResponse(outcome.toolsListMsgId ?? null, reason, { code: 'TOOL_DEFINITIONS_CHANGED', ruleId: `tofu.${serverName}` }, this.interceptor.opaque));
                     return;
                 }
             }
@@ -840,10 +904,11 @@ export class McpGovernanceProxy {
         // remoteBridge.ts's remote bridge mode — only `forward` differs: here it
         // writes to the spawned child process's stdin.
         const rl = node_readline.createInterface({ input: process.stdin, terminal: false });
+        const chaosHooks = this.chaosHooks(pending);
         rl.on('line', (line) => {
             handleHarnessLine(line, pending, this.interceptor, (l) => {
                 realServer.stdin.write(l + '\n');
-            }, this.session);
+            }, this.session, chaosHooks);
         });
         rl.on('close', () => {
             log.info({ action: 'stdin_closed' }, 'Harness stdin closed — shutting down');