@intutic/shared-types 1.10.0 → 2.0.0

package/dist/wasmHost.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The host functions a WASM governance rule may import — one definition.
+ *
+ * The Rust source of truth is `HOST_IMPORTS` in
+ * `packages/proxy/src/wasm/host.rs`; this is its TypeScript mirror, kept honest
+ * by `tools/scripts/check-wasm-host-imports.js`, which reads both from source
+ * and fails the build if they disagree.
+ *
+ * ## Why there is a mirror at all
+ *
+ * Three TypeScript surfaces have to know this list — the CLI's validation
+ * sandbox, the control plane's rule-upload endpoint, and the SDK's own test
+ * harness — and each of them had its own copy. That is exactly how the original
+ * defect happened: the CLI offered a fourth import, `seed`, that the proxy had
+ * never registered, so a rule reaching `Math.random()` passed
+ * `intutic policy test`, passed `intutic policy install`, and then failed to
+ * link inside the proxy. The WASM runner fails **open**, so the rule enforced
+ * nothing and nothing said so.
+ *
+ * Adding a copy is the failure mode. Import this.
+ *
+ * ## Why `seed` is absent, permanently
+ *
+ * AssemblyScript emits `env.seed` for anything reaching `Math.random()`. It is
+ * refused on purpose rather than registered: a governance verdict that can
+ * differ on identical input cannot be audited, and the replay and mutation
+ * corpus gates both assume determinism.
+ *
+ * @module
+ */
+/**
+ * ## Why `read_referenced_file` is present
+ *
+ * It is not a filesystem import, and the distinction is the whole design. The
+ * proxy resolves and reads the file **before** the sandbox is instantiated,
+ * from paths derived from the tool call under evaluation, confined to a
+ * configured root, extension-allowlisted and size-capped. The guest passes a
+ * path as a *lookup key* into that fixed table; there is no code path from a
+ * guest string to an `open(2)`. WASI stays unavailable, and a rule still cannot
+ * name a file the agent did not.
+ *
+ * `packages/proxy/src/wasm/referenced_files.rs` documents every guard and what
+ * each one costs.
+ */
+/** Exactly what `env` provides to a rule. Nothing else resolves. */
+export declare const WASM_HOST_IMPORTS: readonly ["log_info", "abort", "trace", "read_referenced_file"];
+export type WasmHostImport = (typeof WASM_HOST_IMPORTS)[number];
+/**
+ * Names every function a compiled rule imports that the host will not provide.
+ *
+ * Returns `[]` for a rule that links. Callers should refuse anything else:
+ * loading such a rule produces a plugin that is listed, counted, and silently
+ * bypassed on every request.
+ */
+export declare function unsupportedWasmImports(module: WebAssembly.Module): string[];
+/** A remedy for the imports authors actually hit, not just a refusal. */
+export declare function explainWasmImport(name: string): string;
+//# sourceMappingURL=wasmHost.d.ts.map

package/dist/wasmHost.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wasmHost.d.ts","sourceRoot":"","sources":["../src/wasmHost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH;;;;;;;;;;;;;GAaG;AAEH,oEAAoE;AACpE,eAAO,MAAM,iBAAiB,iEAAkE,CAAA;AAEhG,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE/D;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,GAAG,MAAM,EAAE,CAM3E;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgBtD"}

package/dist/wasmHost.js

@@ -0,0 +1,80 @@
+"use strict";
+/**
+ * The host functions a WASM governance rule may import — one definition.
+ *
+ * The Rust source of truth is `HOST_IMPORTS` in
+ * `packages/proxy/src/wasm/host.rs`; this is its TypeScript mirror, kept honest
+ * by `tools/scripts/check-wasm-host-imports.js`, which reads both from source
+ * and fails the build if they disagree.
+ *
+ * ## Why there is a mirror at all
+ *
+ * Three TypeScript surfaces have to know this list — the CLI's validation
+ * sandbox, the control plane's rule-upload endpoint, and the SDK's own test
+ * harness — and each of them had its own copy. That is exactly how the original
+ * defect happened: the CLI offered a fourth import, `seed`, that the proxy had
+ * never registered, so a rule reaching `Math.random()` passed
+ * `intutic policy test`, passed `intutic policy install`, and then failed to
+ * link inside the proxy. The WASM runner fails **open**, so the rule enforced
+ * nothing and nothing said so.
+ *
+ * Adding a copy is the failure mode. Import this.
+ *
+ * ## Why `seed` is absent, permanently
+ *
+ * AssemblyScript emits `env.seed` for anything reaching `Math.random()`. It is
+ * refused on purpose rather than registered: a governance verdict that can
+ * differ on identical input cannot be audited, and the replay and mutation
+ * corpus gates both assume determinism.
+ *
+ * @module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WASM_HOST_IMPORTS = void 0;
+exports.unsupportedWasmImports = unsupportedWasmImports;
+exports.explainWasmImport = explainWasmImport;
+/**
+ * ## Why `read_referenced_file` is present
+ *
+ * It is not a filesystem import, and the distinction is the whole design. The
+ * proxy resolves and reads the file **before** the sandbox is instantiated,
+ * from paths derived from the tool call under evaluation, confined to a
+ * configured root, extension-allowlisted and size-capped. The guest passes a
+ * path as a *lookup key* into that fixed table; there is no code path from a
+ * guest string to an `open(2)`. WASI stays unavailable, and a rule still cannot
+ * name a file the agent did not.
+ *
+ * `packages/proxy/src/wasm/referenced_files.rs` documents every guard and what
+ * each one costs.
+ */
+/** Exactly what `env` provides to a rule. Nothing else resolves. */
+exports.WASM_HOST_IMPORTS = ['log_info', 'abort', 'trace', 'read_referenced_file'];
+/**
+ * Names every function a compiled rule imports that the host will not provide.
+ *
+ * Returns `[]` for a rule that links. Callers should refuse anything else:
+ * loading such a rule produces a plugin that is listed, counted, and silently
+ * bypassed on every request.
+ */
+function unsupportedWasmImports(module) {
+    const allowed = new Set(exports.WASM_HOST_IMPORTS);
+    return WebAssembly.Module.imports(module)
+        .filter((i) => i.kind === 'function')
+        .filter((i) => i.module !== 'env' || !allowed.has(i.name))
+        .map((i) => `${i.module}.${i.name}`);
+}
+/** A remedy for the imports authors actually hit, not just a refusal. */
+function explainWasmImport(name) {
+    if (name === 'env.seed') {
+        return ('env.seed — emitted by Math.random(). Randomness is refused on purpose: a ' +
+            'verdict that can differ on identical input cannot be audited. Derive any ' +
+            'variation you need from the request context instead.');
+    }
+    if (name.startsWith('wasi_') || name.includes('fd_') || name.includes('clock_')) {
+        return (`${name} — WASI is not available. A rule that needs to look inside a file a tool ` +
+            'call references should import env.read_referenced_file, which the host resolves, ' +
+            'confines to a configured root and reads on the rule’s behalf.');
+    }
+    return `${name} — not provided by the proxy sandbox.`;
+}
+//# sourceMappingURL=wasmHost.js.map

package/dist/wasmHost.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wasmHost.js","sourceRoot":"","sources":["../src/wasmHost.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;;;AA6BH,wDAMC;AAGD,8CAgBC;AApDD;;;;;;;;;;;;;GAaG;AAEH,oEAAoE;AACvD,QAAA,iBAAiB,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,sBAAsB,CAAU,CAAA;AAIhG;;;;;;GAMG;AACH,SAAgB,sBAAsB,CAAC,MAA0B;IAC/D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,yBAAiB,CAAC,CAAA;IAClD,OAAO,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;SACpC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SACzD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;AACxC,CAAC;AAED,yEAAyE;AACzE,SAAgB,iBAAiB,CAAC,IAAY;IAC5C,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,OAAO,CACL,2EAA2E;YAC3E,2EAA2E;YAC3E,sDAAsD,CACvD,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,OAAO,CACL,GAAG,IAAI,2EAA2E;YAClF,mFAAmF;YACnF,+DAA+D,CAChE,CAAA;IACH,CAAC;IACD,OAAO,GAAG,IAAI,uCAAuC,CAAA;AACvD,CAAC"}