@intutic/shared-types 2.0.0 → 2.2.0

package/dist/scriptScan.d.ts

@@ -120,6 +120,42 @@ export declare const MAX_SKILL_DIR_DEPTH = 3;
 export declare const MAX_FILES_PER_SKILL = 40;
 /** 256 KiB. */
 export declare const MAX_SCRIPT_SCAN_BYTES = 262144;
+/**
+ * 8 MiB. Largest bundled file the sync daemon will read to sha256-hash for
+ * its `scripts` facet (TD-486). Larger than {@link MAX_SCRIPT_SCAN_BYTES} on
+ * purpose: a file too big to content-scan is still worth a hash-only
+ * VirusTotal lookup. A file over this cap is counted in `total` and neither
+ * hashed nor scanned — the daemon re-walks every skill on every sync cycle,
+ * so its reads stay bounded. The CLI's `auditScriptFile` hashes whatever it
+ * reads, uncapped; it runs on demand, not on a loop.
+ */
+export declare const MAX_SCRIPT_HASH_BYTES: number;
+/**
+ * A skill's bundled-script summary, as the sync daemon reports it in the
+ * `skills[].scripts` facet of `POST /api/v1/agents/report`. Shared so the
+ * daemon (`collectSkillScripts`) and the control plane
+ * (`agentPosture.ts`, `virusTotalService.ts`) agree on the wire shape.
+ */
+export interface SkillScriptsFacet {
+    /** Every bundled file the walk found, scanned or not. */
+    total: number;
+    /** How many of `total` were content-scanned — excludes unreadable files,
+     *  files over the byte cap, and files whose language could not be
+     *  determined. */
+    scanned: number;
+    /** How many of `scanned` came back with at least one finding. */
+    flagged: number;
+    /**
+     * sha256 (lowercase hex) of each bundled file the daemon could read
+     * within {@link MAX_SCRIPT_HASH_BYTES}, one entry per file in walk order
+     * (TD-486). Hashes only — file content never leaves the machine. The
+     * control plane joins VirusTotal verdicts to the skill on these. ABSENT
+     * (not empty) from a daemon build that predates TD-486; the control
+     * plane falls back to a name-keyed join only in that case. An empty
+     * array means nothing was hashable, and gets no fallback.
+     */
+    sha256?: string[];
+}
 /**
  * Infer a bundled file's script language from its path (extension) and,
  * when given, its first line (shebang). Extension wins when recognized —

package/dist/scriptScan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scriptScan.d.ts","sourceRoot":"","sources":["../src/scriptScan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAc,MAAM,gBAAgB,CAAA;AAEhH,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,CAAA;AAElD;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GACtB,OAAO,GACP,QAAQ,GACR,YAAY,GACZ,YAAY,GACZ,MAAM,GACN,YAAY,GACZ,MAAM,GACN,SAAS,CAAA;AAEb;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD;;;oBAGgB;IAChB,SAAS,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;CACtC;AAED;;8CAE8C;AAC9C,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,iBAAiB,CAAA;IAC3B;sCACkC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;mCAC+B;IAC/B,MAAM,CAAC,EAAE,eAAe,CAAA;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,0CAA0C;IAC1C,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,iBAAiB,EAAE,CAAA;IAC7B,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAA;AACpC,eAAO,MAAM,mBAAmB,KAAK,CAAA;AACrC,eAAe;AACf,eAAO,MAAM,qBAAqB,SAAU,CAAA;AAoC5C;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,cAAc,CAarF;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,iBAAiB,EA6I5D,CAAA;AAgED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,gBAAgB,CAe7F"}
+{"version":3,"file":"scriptScan.d.ts","sourceRoot":"","sources":["../src/scriptScan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAc,MAAM,gBAAgB,CAAA;AAEhH,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,CAAA;AAElD;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GACtB,OAAO,GACP,QAAQ,GACR,YAAY,GACZ,YAAY,GACZ,MAAM,GACN,YAAY,GACZ,MAAM,GACN,SAAS,CAAA;AAEb;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD;;;oBAGgB;IAChB,SAAS,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;CACtC;AAED;;8CAE8C;AAC9C,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,iBAAiB,CAAA;IAC3B;sCACkC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;mCAC+B;IAC/B,MAAM,CAAC,EAAE,eAAe,CAAA;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,0CAA0C;IAC1C,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,iBAAiB,EAAE,CAAA;IAC7B,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAA;AACpC,eAAO,MAAM,mBAAmB,KAAK,CAAA;AACrC,eAAe;AACf,eAAO,MAAM,qBAAqB,SAAU,CAAA;AAE5C;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,QAAkB,CAAA;AAEpD;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAA;IACb;;sBAEkB;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAA;IACf;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAoCD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,cAAc,CAarF;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,iBAAiB,EA6I5D,CAAA;AAgED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,gBAAgB,CAe7F"}

package/dist/scriptScan.js

@@ -51,7 +51,7 @@
  * @module
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SCRIPT_SCAN_PATTERNS = exports.MAX_SCRIPT_SCAN_BYTES = exports.MAX_FILES_PER_SKILL = exports.MAX_SKILL_DIR_DEPTH = void 0;
+exports.SCRIPT_SCAN_PATTERNS = exports.MAX_SCRIPT_HASH_BYTES = exports.MAX_SCRIPT_SCAN_BYTES = exports.MAX_FILES_PER_SKILL = exports.MAX_SKILL_DIR_DEPTH = void 0;
 exports.detectScriptLanguage = detectScriptLanguage;
 exports.scanScriptContent = scanScriptContent;
 const skillScan_js_1 = require("./skillScan.js");
@@ -75,6 +75,16 @@ exports.MAX_SKILL_DIR_DEPTH = 3;
 exports.MAX_FILES_PER_SKILL = 40;
 /** 256 KiB. */
 exports.MAX_SCRIPT_SCAN_BYTES = 262_144;
+/**
+ * 8 MiB. Largest bundled file the sync daemon will read to sha256-hash for
+ * its `scripts` facet (TD-486). Larger than {@link MAX_SCRIPT_SCAN_BYTES} on
+ * purpose: a file too big to content-scan is still worth a hash-only
+ * VirusTotal lookup. A file over this cap is counted in `total` and neither
+ * hashed nor scanned — the daemon re-walks every skill on every sync cycle,
+ * so its reads stay bounded. The CLI's `auditScriptFile` hashes whatever it
+ * reads, uncapped; it runs on demand, not on a loop.
+ */
+exports.MAX_SCRIPT_HASH_BYTES = 8 * 1024 * 1024;
 /** Extensions this module recognizes, lowercase, without the leading dot. */
 const EXTENSION_LANGUAGE = {
     sh: 'shell',

package/dist/scriptScan.js.map

@@ -1 +1 @@
-{"version":3,"file":"scriptScan.js","sourceRoot":"","sources":["../src/scriptScan.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;;;AAoIH,oDAaC;AAyOD,8CAeC;AAvYD,iDAAgH;AAiEhH;;;;;;;;;;;;;;;GAeG;AACU,QAAA,mBAAmB,GAAG,CAAC,CAAA;AACvB,QAAA,mBAAmB,GAAG,EAAE,CAAA;AACrC,eAAe;AACF,QAAA,qBAAqB,GAAG,OAAO,CAAA;AAE5C,6EAA6E;AAC7E,MAAM,kBAAkB,GAA6C;IACnE,EAAE,EAAE,OAAO;IACX,IAAI,EAAE,OAAO;IACb,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,OAAO;IACZ,EAAE,EAAE,QAAQ;IACZ,GAAG,EAAE,QAAQ;IACb,EAAE,EAAE,YAAY;IAChB,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,YAAY;IACjB,EAAE,EAAE,YAAY;IAChB,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,YAAY;IACjB,EAAE,EAAE,MAAM;IACV,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,EAAE,EAAE,MAAM;CACX,CAAA;AAED,yEAAyE;AACzE,MAAM,gBAAgB,GAAgE;IACpF,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACxC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE;IACrC,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE;IACpC,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE;IACpC,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE;IACpC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE;IAC1C,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE;IACpC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE;IAC1C,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE;IAChD,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE;CACrC,CAAA;AAED;;;;;;;;;GASG;AACH,SAAgB,oBAAoB,CAAC,IAAY,EAAE,SAAkB;IACnE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/C,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAA;IACxC,IAAI,GAAG,IAAI,kBAAkB,CAAC,GAAG,CAAC;QAAE,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAA;IAElE,IAAI,SAAS,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,EAAE,CAAA;QACvC,KAAK,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,gBAAgB,EAAE,CAAC;YACpD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,QAAQ,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;GAOG;AACU,QAAA,oBAAoB,GAAiC;IAChE;QACE,EAAE,EAAE,iBAAiB;QACrB,QAAQ,EAAE,gBAAgB;QAC1B,uEAAuE;QACvE,sEAAsE;QACtE,wEAAwE;QACxE,oCAAoC;QACpC,MAAM,EAAE,mEAAmE;QAC3E,WAAW,EACT,uFAAuF;YACvF,iFAAiF;QACnF,OAAO,EAAE;YACP,+CAA+C;YAC/C,gDAAgD;SACjD;QACD,UAAU,EAAE;YACV,4CAA4C;YAC5C,0CAA0C;YAC1C,mDAAmD;SACpD;KACF;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,QAAQ,EAAE,gBAAgB;QAC1B,uEAAuE;QACvE,qDAAqD;QACrD,uEAAuE;QACvE,MAAM,EAAE,2DAA2D;QACnE,WAAW,EACT,0FAA0F;YAC1F,wDAAwD;QAC1D,OAAO,EAAE,CAAC,kCAAkC,EAAE,wCAAwC,CAAC;QACvF,UAAU,EAAE;YACV,qCAAqC;YACrC,0CAA0C;YAC1C,oCAAoC;SACrC;KACF;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,QAAQ,EAAE,mBAAmB;QAC7B,gEAAgE;QAChE,kEAAkE;QAClE,sEAAsE;QACtE,uEAAuE;QACvE,4CAA4C;QAC5C,MAAM,EACJ,yEAAyE;YACzE,sEAAsE;QACxE,WAAW,EAAE,sFAAsF;QACnG,OAAO,EAAE,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;QACrD,UAAU,EAAE,CAAC,eAAe,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,0BAA0B,CAAC;KAChH;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,QAAQ,EAAE,mBAAmB;QAC7B,kEAAkE;QAClE,qEAAqE;QACrE,sEAAsE;QACtE,wEAAwE;QACxE,sEAAsE;QACtE,MAAM;QACJ,kEAAkE;QAClE,+DAA+D;QAC/D,mEAAmE;QACnE,+BAA+B;QAC/B,oFAAoF;YACpF,gDAAgD;QAClD,WAAW,EACT,wFAAwF;YACxF,uCAAuC;QACzC,OAAO,EAAE;YACP,oEAAoE;YACpE,sEAAsE;SACvE;QACD,UAAU,EAAE;YACV,qCAAqC;YACrC,4CAA4C;YAC5C,qCAAqC;SACtC;KACF;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,QAAQ,EAAE,gBAAgB;QAC1B,6DAA6D;QAC7D,qEAAqE;QACrE,yEAAyE;QACzE,4CAA4C;QAC5C,MAAM,EAAE,kHAAkH;QAC1H,WAAW,EACT,4FAA4F;YAC5F,uEAAuE;QACzE,OAAO,EAAE;YACP,8EAA8E;YAC9E,mCAAmC;SACpC;QACD,UAAU,EAAE,CAAC,oBAAoB,EAAE,uBAAuB,EAAE,wCAAwC,CAAC;KACtG;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,QAAQ,EAAE,gBAAgB;QAC1B,uEAAuE;QACvE,qEAAqE;QACrE,8CAA8C;QAC9C,MAAM,EAAE,qHAAqH;QAC7H,WAAW,EACT,gGAAgG;YAChG,oBAAoB;QACtB,OAAO,EAAE;YACP,+CAA+C;YAC/C,2DAA2D;SAC5D;QACD,UAAU,EAAE;YACV,+BAA+B;YAC/B,yBAAyB;YACzB,mDAAmD;SACpD;QACD,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,QAAQ,EAAE,gBAAgB;QAC1B,2DAA2D;QAC3D,kEAAkE;QAClE,oBAAoB;QACpB,MAAM,EAAE,wFAAwF;QAChG,WAAW,EACT,8FAA8F;YAC9F,wFAAwF;QAC1F,OAAO,EAAE;YACP,4CAA4C;YAC5C,0CAA0C;SAC3C;QACD,UAAU,EAAE;YACV,kBAAkB;YAClB,gCAAgC;YAChC,mCAAmC;SACpC;QACD,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB;CACF,CAAA;AAED,mFAAmF;AACnF,MAAM,QAAQ,GAA8D,4BAAoB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjH,OAAO;IACP,EAAE,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;CACpC,CAAC,CAAC,CAAA;AAEH;;;;;;;;GAQG;AACH,SAAS,yBAAyB,CAAC,QAAsC;IACvE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAClF,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAEd,IAAI,EAAU,CAAA;QACd,IAAI,CAAC;YACH,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACnG,CAAC;QAED,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,qBAAqB,CAAC,CAAC,EAAE,gEAAgE;gBACvF,2FAA2F,CAC9F,CAAA;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,qBAAqB,CAAC,CAAC,EAAE,oBAAoB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B;oBACtF,4DAA4D,CAC/D,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,qBAAqB,CAAC,CAAC,EAAE,mEAAmE;gBAC1F,yDAAyD,CAC5D,CAAA;QACH,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YAC9B,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,qBAAqB,CAAC,CAAC,EAAE,uBAAuB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,mBAAmB;oBACnF,yEAAyE,CAC5E,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,yBAAyB,CAAC,4BAAoB,CAAC,CAAA;AAE/C;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,iBAAiB,CAAC,OAAe,EAAE,QAAwB;IACzE,MAAM,QAAQ,GAAwB,EAAE,CAAA;IACxC,KAAK,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,QAAQ,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAQ;QACxE,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC1B,IAAI,CAAC,EAAE,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,IAAA,yBAAU,EAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBAClD,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAA;AACxF,CAAC"}
+{"version":3,"file":"scriptScan.js","sourceRoot":"","sources":["../src/scriptScan.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;;;AA0KH,oDAaC;AAyOD,8CAeC;AA7aD,iDAAgH;AAiEhH;;;;;;;;;;;;;;;GAeG;AACU,QAAA,mBAAmB,GAAG,CAAC,CAAA;AACvB,QAAA,mBAAmB,GAAG,EAAE,CAAA;AACrC,eAAe;AACF,QAAA,qBAAqB,GAAG,OAAO,CAAA;AAE5C;;;;;;;;GAQG;AACU,QAAA,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AA6BpD,6EAA6E;AAC7E,MAAM,kBAAkB,GAA6C;IACnE,EAAE,EAAE,OAAO;IACX,IAAI,EAAE,OAAO;IACb,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,OAAO;IACZ,EAAE,EAAE,QAAQ;IACZ,GAAG,EAAE,QAAQ;IACb,EAAE,EAAE,YAAY;IAChB,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,YAAY;IACjB,EAAE,EAAE,YAAY;IAChB,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,YAAY;IACjB,EAAE,EAAE,MAAM;IACV,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,EAAE,EAAE,MAAM;CACX,CAAA;AAED,yEAAyE;AACzE,MAAM,gBAAgB,GAAgE;IACpF,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACxC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE;IACrC,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE;IACpC,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE;IACpC,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE;IACpC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE;IAC1C,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE;IACpC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE;IAC1C,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE;IAChD,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE;CACrC,CAAA;AAED;;;;;;;;;GASG;AACH,SAAgB,oBAAoB,CAAC,IAAY,EAAE,SAAkB;IACnE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/C,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAA;IACxC,IAAI,GAAG,IAAI,kBAAkB,CAAC,GAAG,CAAC;QAAE,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAA;IAElE,IAAI,SAAS,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,EAAE,CAAA;QACvC,KAAK,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,gBAAgB,EAAE,CAAC;YACpD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,QAAQ,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;GAOG;AACU,QAAA,oBAAoB,GAAiC;IAChE;QACE,EAAE,EAAE,iBAAiB;QACrB,QAAQ,EAAE,gBAAgB;QAC1B,uEAAuE;QACvE,sEAAsE;QACtE,wEAAwE;QACxE,oCAAoC;QACpC,MAAM,EAAE,mEAAmE;QAC3E,WAAW,EACT,uFAAuF;YACvF,iFAAiF;QACnF,OAAO,EAAE;YACP,+CAA+C;YAC/C,gDAAgD;SACjD;QACD,UAAU,EAAE;YACV,4CAA4C;YAC5C,0CAA0C;YAC1C,mDAAmD;SACpD;KACF;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,QAAQ,EAAE,gBAAgB;QAC1B,uEAAuE;QACvE,qDAAqD;QACrD,uEAAuE;QACvE,MAAM,EAAE,2DAA2D;QACnE,WAAW,EACT,0FAA0F;YAC1F,wDAAwD;QAC1D,OAAO,EAAE,CAAC,kCAAkC,EAAE,wCAAwC,CAAC;QACvF,UAAU,EAAE;YACV,qCAAqC;YACrC,0CAA0C;YAC1C,oCAAoC;SACrC;KACF;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,QAAQ,EAAE,mBAAmB;QAC7B,gEAAgE;QAChE,kEAAkE;QAClE,sEAAsE;QACtE,uEAAuE;QACvE,4CAA4C;QAC5C,MAAM,EACJ,yEAAyE;YACzE,sEAAsE;QACxE,WAAW,EAAE,sFAAsF;QACnG,OAAO,EAAE,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;QACrD,UAAU,EAAE,CAAC,eAAe,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,0BAA0B,CAAC;KAChH;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,QAAQ,EAAE,mBAAmB;QAC7B,kEAAkE;QAClE,qEAAqE;QACrE,sEAAsE;QACtE,wEAAwE;QACxE,sEAAsE;QACtE,MAAM;QACJ,kEAAkE;QAClE,+DAA+D;QAC/D,mEAAmE;QACnE,+BAA+B;QAC/B,oFAAoF;YACpF,gDAAgD;QAClD,WAAW,EACT,wFAAwF;YACxF,uCAAuC;QACzC,OAAO,EAAE;YACP,oEAAoE;YACpE,sEAAsE;SACvE;QACD,UAAU,EAAE;YACV,qCAAqC;YACrC,4CAA4C;YAC5C,qCAAqC;SACtC;KACF;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,QAAQ,EAAE,gBAAgB;QAC1B,6DAA6D;QAC7D,qEAAqE;QACrE,yEAAyE;QACzE,4CAA4C;QAC5C,MAAM,EAAE,kHAAkH;QAC1H,WAAW,EACT,4FAA4F;YAC5F,uEAAuE;QACzE,OAAO,EAAE;YACP,8EAA8E;YAC9E,mCAAmC;SACpC;QACD,UAAU,EAAE,CAAC,oBAAoB,EAAE,uBAAuB,EAAE,wCAAwC,CAAC;KACtG;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,QAAQ,EAAE,gBAAgB;QAC1B,uEAAuE;QACvE,qEAAqE;QACrE,8CAA8C;QAC9C,MAAM,EAAE,qHAAqH;QAC7H,WAAW,EACT,gGAAgG;YAChG,oBAAoB;QACtB,OAAO,EAAE;YACP,+CAA+C;YAC/C,2DAA2D;SAC5D;QACD,UAAU,EAAE;YACV,+BAA+B;YAC/B,yBAAyB;YACzB,mDAAmD;SACpD;QACD,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,QAAQ,EAAE,gBAAgB;QAC1B,2DAA2D;QAC3D,kEAAkE;QAClE,oBAAoB;QACpB,MAAM,EAAE,wFAAwF;QAChG,WAAW,EACT,8FAA8F;YAC9F,wFAAwF;QAC1F,OAAO,EAAE;YACP,4CAA4C;YAC5C,0CAA0C;SAC3C;QACD,UAAU,EAAE;YACV,kBAAkB;YAClB,gCAAgC;YAChC,mCAAmC;SACpC;QACD,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB;CACF,CAAA;AAED,mFAAmF;AACnF,MAAM,QAAQ,GAA8D,4BAAoB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjH,OAAO;IACP,EAAE,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;CACpC,CAAC,CAAC,CAAA;AAEH;;;;;;;;GAQG;AACH,SAAS,yBAAyB,CAAC,QAAsC;IACvE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAClF,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAEd,IAAI,EAAU,CAAA;QACd,IAAI,CAAC;YACH,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACnG,CAAC;QAED,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,qBAAqB,CAAC,CAAC,EAAE,gEAAgE;gBACvF,2FAA2F,CAC9F,CAAA;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,qBAAqB,CAAC,CAAC,EAAE,oBAAoB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B;oBACtF,4DAA4D,CAC/D,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,qBAAqB,CAAC,CAAC,EAAE,mEAAmE;gBAC1F,yDAAyD,CAC5D,CAAA;QACH,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YAC9B,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,qBAAqB,CAAC,CAAC,EAAE,uBAAuB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,mBAAmB;oBACnF,yEAAyE,CAC5E,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,yBAAyB,CAAC,4BAAoB,CAAC,CAAA;AAE/C;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,iBAAiB,CAAC,OAAe,EAAE,QAAwB;IACzE,MAAM,QAAQ,GAAwB,EAAE,CAAA;IACxC,KAAK,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,QAAQ,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAQ;QACxE,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC1B,IAAI,CAAC,EAAE,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,IAAA,yBAAU,EAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBAClD,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAA;AACxF,CAAC"}

package/dist/skillScan.d.ts

@@ -36,22 +36,31 @@
  * reader as much as an agent, and routinely contains the exact imperative
  * security language ("block any call that…", "never embed secrets", "do
  * not allow…") that a tool description never does — precisely the shape
- * this module's patterns key on. The false-positive rate of THESE patterns
- * on a corpus of REAL, BENIGN skill files is UNMEASURED. One known-benign
- * fixture is checked here (see the sync-daemon test referenced below), but
- * one fixture is not a corpus, and a corpus of skill markdown comparable in
- * size and provenance to `tooldesc.jsonl` does not exist yet.
- *
- * Because of that gap, this phase is deliberately REPORT-ONLY. Nothing in
- * this codebase blocks, refuses, or auto-deletes a skill on the strength of
- * a finding from this module. `enableLocalSkillAuditDelete` (the existing
+ * this module's patterns key on.
+ *
+ * **Measured since (TD-358):** `src/__tests__/corpus/skills/` vendors 350
+ * real, benign `SKILL.md` files from four MIT/Apache-2.0 skill collections
+ * at pinned commits (provenance, licences and bias statement in that
+ * directory's `PROVENANCE.md`; the reviewed result in `BASELINE.txt`).
+ * `skillScanCorpus.test.ts` runs {@link scanSkillContent} over every file
+ * and pins the result: nine of the ten patterns fire on ZERO of the 350;
+ * `read-sensitive-path` fires on 11, every one reviewed and benign (mostly
+ * skills promising NOT to load `.env`). Zero of 350 is a bound, not a proof
+ * — the rule-of-three 95% upper bound is ~0.86% of skills per pattern — and
+ * the corpus is published, curated skill collections, not the long tail of
+ * what developers write locally. RULE_AUTHOR_SKILL (see below) is still
+ * checked separately.
+ *
+ * This module itself stays REPORT-ONLY: nothing here blocks, refuses, or
+ * auto-deletes a skill. `enableLocalSkillAuditDelete` (the existing
  * workspace setting `tools/cli/src/commands/skill.ts` already consumes for
  * the legacy rule-file audit) is extended to cover these findings too, but
  * that is an explicit opt-in a workspace operator chooses, not a default —
- * see the CLI command for the exact gate. Building enforcement on top of
- * these patterns is follow-up work, gated on first measuring the
- * false-positive rate against a real benign-skill corpus the way
- * `tool_poison.rs` was. See `docs/TECH_DEBT.md` for the tracking entries.
+ * see the CLI command for the exact gate. The one enforcement built on the
+ * measurement is {@link SKILL_CONTENT_BLOCK_PATTERN_IDS}: the zero-hit
+ * patterns, shipped to the tool-call gates through the sync daemon's policy
+ * snapshot (`skill_content.*`, see `services/sync-daemon/src/lib/policySnapshot.ts`)
+ * where one sync cycle retracts them. See `docs/TECH_DEBT.md` TD-358.
  *
  * # Fixture discipline
  *
@@ -151,6 +160,25 @@ export declare function excerptFor(content: string, index: number, length: numbe
  * obfuscated decode-then-execute instruction shape.
  */
 export declare const SKILL_SCAN_PATTERNS: readonly SkillScanPattern[];
+/**
+ * The patterns licensed for a content-conditional BLOCK tier, by id.
+ *
+ * Membership is earned by measurement, not judgement: an id belongs here only
+ * if its pattern fires on ZERO files of the vendored benign-skill corpus
+ * (`src/__tests__/corpus/skills/`, ≥100 skills required).
+ * `skillScanCorpus.test.ts` enforces that in one direction — an id listed here
+ * that fires on any corpus file fails the build — so a corpus refresh that
+ * finds a false positive forces this list to shrink in the same change.
+ *
+ * `read-sensitive-path` is deliberately absent: 11 benign hits in 350 skills
+ * (see `BASELINE.txt`). It stays report-only.
+ *
+ * This list does not block anything by itself. The sync daemon turns it into
+ * `skill_content.*` gate rules (`SKILL_CONTENT_PATTERNS` in
+ * `services/sync-daemon/src/harness/protectedPaths.ts`) shipped through the
+ * policy snapshot at `SKILL_CONTENT_TIER_SEVERITY`.
+ */
+export declare const SKILL_CONTENT_BLOCK_PATTERN_IDS: readonly string[];
 /**
  * Scan skill markdown content for the patterns above.
  *

package/dist/skillScan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skillScan.d.ts","sourceRoot":"","sources":["../src/skillScan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AAEH;;4EAE4E;AAC5E,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,mBAAmB,GAAG,gBAAgB,CAAA;AAE3F;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,qBAAqB,CAAA;AAE9D,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,iBAAiB,CAAA;IAC3B,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAA;IACd,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAA;IACnB,qEAAqE;IACrE,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1B;yCACqC;IACrC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CAC9B;AAED;;;;sEAIsE;AACtE,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,iBAAiB,CAAA;IAC3B;sCACkC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,uEAAuE;IACvE,MAAM,CAAC,EAAE,eAAe,CAAA;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,gBAAgB,EAAE,CAAA;IAC5B,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;4DAI4D;AAC5D,eAAO,MAAM,cAAc,KAAK,CAAA;AAEhC;sEACsE;AACtE,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CASjF;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EA8N1D,CAAA;AA+DD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAcjE"}
+{"version":3,"file":"skillScan.d.ts","sourceRoot":"","sources":["../src/skillScan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2FG;AAEH;;4EAE4E;AAC5E,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,mBAAmB,GAAG,gBAAgB,CAAA;AAE3F;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,qBAAqB,CAAA;AAE9D,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,iBAAiB,CAAA;IAC3B,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAA;IACd,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAA;IACnB,qEAAqE;IACrE,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1B;yCACqC;IACrC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CAC9B;AAED;;;;sEAIsE;AACtE,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,iBAAiB,CAAA;IAC3B;sCACkC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,uEAAuE;IACvE,MAAM,CAAC,EAAE,eAAe,CAAA;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,gBAAgB,EAAE,CAAA;IAC5B,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;4DAI4D;AAC5D,eAAO,MAAM,cAAc,KAAK,CAAA;AAEhC;sEACsE;AACtE,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CASjF;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EA8N1D,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,+BAA+B,EAAE,SAAS,MAAM,EAU5D,CAAA;AAoED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAcjE"}

package/dist/skillScan.js

@@ -37,22 +37,31 @@
  * reader as much as an agent, and routinely contains the exact imperative
  * security language ("block any call that…", "never embed secrets", "do
  * not allow…") that a tool description never does — precisely the shape
- * this module's patterns key on. The false-positive rate of THESE patterns
- * on a corpus of REAL, BENIGN skill files is UNMEASURED. One known-benign
- * fixture is checked here (see the sync-daemon test referenced below), but
- * one fixture is not a corpus, and a corpus of skill markdown comparable in
- * size and provenance to `tooldesc.jsonl` does not exist yet.
+ * this module's patterns key on.
  *
- * Because of that gap, this phase is deliberately REPORT-ONLY. Nothing in
- * this codebase blocks, refuses, or auto-deletes a skill on the strength of
- * a finding from this module. `enableLocalSkillAuditDelete` (the existing
+ * **Measured since (TD-358):** `src/__tests__/corpus/skills/` vendors 350
+ * real, benign `SKILL.md` files from four MIT/Apache-2.0 skill collections
+ * at pinned commits (provenance, licences and bias statement in that
+ * directory's `PROVENANCE.md`; the reviewed result in `BASELINE.txt`).
+ * `skillScanCorpus.test.ts` runs {@link scanSkillContent} over every file
+ * and pins the result: nine of the ten patterns fire on ZERO of the 350;
+ * `read-sensitive-path` fires on 11, every one reviewed and benign (mostly
+ * skills promising NOT to load `.env`). Zero of 350 is a bound, not a proof
+ * — the rule-of-three 95% upper bound is ~0.86% of skills per pattern — and
+ * the corpus is published, curated skill collections, not the long tail of
+ * what developers write locally. RULE_AUTHOR_SKILL (see below) is still
+ * checked separately.
+ *
+ * This module itself stays REPORT-ONLY: nothing here blocks, refuses, or
+ * auto-deletes a skill. `enableLocalSkillAuditDelete` (the existing
  * workspace setting `tools/cli/src/commands/skill.ts` already consumes for
  * the legacy rule-file audit) is extended to cover these findings too, but
  * that is an explicit opt-in a workspace operator chooses, not a default —
- * see the CLI command for the exact gate. Building enforcement on top of
- * these patterns is follow-up work, gated on first measuring the
- * false-positive rate against a real benign-skill corpus the way
- * `tool_poison.rs` was. See `docs/TECH_DEBT.md` for the tracking entries.
+ * see the CLI command for the exact gate. The one enforcement built on the
+ * measurement is {@link SKILL_CONTENT_BLOCK_PATTERN_IDS}: the zero-hit
+ * patterns, shipped to the tool-call gates through the sync daemon's policy
+ * snapshot (`skill_content.*`, see `services/sync-daemon/src/lib/policySnapshot.ts`)
+ * where one sync cycle retracts them. See `docs/TECH_DEBT.md` TD-358.
  *
  * # Fixture discipline
  *
@@ -83,7 +92,7 @@
  * @module
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SKILL_SCAN_PATTERNS = exports.EXCERPT_RADIUS = void 0;
+exports.SKILL_CONTENT_BLOCK_PATTERN_IDS = exports.SKILL_SCAN_PATTERNS = exports.EXCERPT_RADIUS = void 0;
 exports.excerptFor = excerptFor;
 exports.scanSkillContent = scanSkillContent;
 /** Longest excerpt this module will ever surface, in characters, centered on
@@ -320,6 +329,35 @@ exports.SKILL_SCAN_PATTERNS = [
         ],
     },
 ];
+/**
+ * The patterns licensed for a content-conditional BLOCK tier, by id.
+ *
+ * Membership is earned by measurement, not judgement: an id belongs here only
+ * if its pattern fires on ZERO files of the vendored benign-skill corpus
+ * (`src/__tests__/corpus/skills/`, ≥100 skills required).
+ * `skillScanCorpus.test.ts` enforces that in one direction — an id listed here
+ * that fires on any corpus file fails the build — so a corpus refresh that
+ * finds a false positive forces this list to shrink in the same change.
+ *
+ * `read-sensitive-path` is deliberately absent: 11 benign hits in 350 skills
+ * (see `BASELINE.txt`). It stays report-only.
+ *
+ * This list does not block anything by itself. The sync daemon turns it into
+ * `skill_content.*` gate rules (`SKILL_CONTENT_PATTERNS` in
+ * `services/sync-daemon/src/harness/protectedPaths.ts`) shipped through the
+ * policy snapshot at `SKILL_CONTENT_TIER_SEVERITY`.
+ */
+exports.SKILL_CONTENT_BLOCK_PATTERN_IDS = [
+    'hidden-instruction-block',
+    'conceal-from-user',
+    'sidechannel-exfil',
+    'cross-skill-shadowing',
+    'agent-directed-precondition',
+    'instruction-override',
+    'html-comment-hidden-instruction',
+    'markdown-exfil-link',
+    'obfuscated-eval-instruction',
+];
 /** Compiled once, in table order, so a scan is one pass per pattern. */
 const COMPILED = exports.SKILL_SCAN_PATTERNS.map((pattern) => ({
     pattern,
@@ -369,6 +407,11 @@ function assertSkillScanTableSane(patterns) {
     }
 }
 assertSkillScanTableSane(exports.SKILL_SCAN_PATTERNS);
+for (const id of exports.SKILL_CONTENT_BLOCK_PATTERN_IDS) {
+    if (!exports.SKILL_SCAN_PATTERNS.some((p) => p.id === id)) {
+        throw new Error(`SKILL_CONTENT_BLOCK_PATTERN_IDS names an unknown pattern: ${id}`);
+    }
+}
 /**
  * Scan skill markdown content for the patterns above.
  *

package/dist/skillScan.js.map

@@ -1 +1 @@
-{"version":3,"file":"skillScan.js","sourceRoot":"","sources":["../src/skillScan.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;;;AAmEH,gCASC;AAmTD,4CAcC;AAnVD;;;;4DAI4D;AAC/C,QAAA,cAAc,GAAG,EAAE,CAAA;AAEhC;sEACsE;AACtE,SAAgB,UAAU,CAAC,OAAe,EAAE,KAAa,EAAE,MAAc;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,sBAAc,CAAC,CAAA;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,sBAAc,CAAC,CAAA;IACrE,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IACnC,MAAM,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9C,0EAA0E;IAC1E,gDAAgD;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IACjE,OAAO,GAAG,MAAM,GAAG,GAAG,GAAG,MAAM,EAAE,CAAA;AACnC,CAAC;AAED;;;;;;;;GAQG;AACU,QAAA,mBAAmB,GAAgC;IAC9D;QACE,EAAE,EAAE,0BAA0B;QAC9B,QAAQ,EAAE,kBAAkB;QAC5B,kEAAkE;QAClE,mEAAmE;QACnE,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,EAAE,0DAA0D;QAClE,WAAW,EACT,wFAAwF;YACxF,0DAA0D;QAC5D,OAAO,EAAE;YACP,uFAAuF;YACvF,gFAAgF;YAChF,kDAAkD;SACnD;QACD,UAAU,EAAE;YACV,wDAAwD;YACxD,mDAAmD;YACnD,6CAA6C;SAC9C;KACF;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,QAAQ,EAAE,kBAAkB;QAC5B,kEAAkE;QAClE,qEAAqE;QACrE,+DAA+D;QAC/D,MAAM,EACJ,qFAAqF;YACrF,yEAAyE;QAC3E,WAAW,EACT,0FAA0F;YAC1F,4EAA4E;QAC9E,OAAO,EAAE;YACP,6EAA6E;YAC7E,oDAAoD;SACrD;QACD,UAAU,EAAE;YACV,sCAAsC;YACtC,0DAA0D;YAC1D,qDAAqD;SACtD;KACF;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,QAAQ,EAAE,mBAAmB;QAC7B,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,kEAAkE;QAClE,MAAM,EACJ,gGAAgG;YAChG,2EAA2E;QAC7E,WAAW,EACT,2FAA2F;YAC3F,+FAA+F;QACjG,OAAO,EAAE;YACP,yEAAyE;YACzE,2DAA2D;SAC5D;QACD,UAAU,EAAE;YACV,oDAAoD;YACpD,mDAAmD;YACnD,sDAAsD;SACvD;KACF;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,QAAQ,EAAE,mBAAmB;QAC7B,oEAAoE;QACpE,kEAAkE;QAClE,mEAAmE;QACnE,kBAAkB;QAClB,MAAM,EACJ,+CAA+C;YAC/C,qEAAqE;QACvE,WAAW,EAAE,8EAA8E;QAC3F,OAAO,EAAE;YACP,uDAAuD;YACvD,kDAAkD;SACnD;QACD,UAAU,EAAE;YACV,6CAA6C;YAC7C,mCAAmC;YACnC,0CAA0C;SAC3C;KACF;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,QAAQ,EAAE,kBAAkB;QAC5B,sEAAsE;QACtE,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,EACJ,oDAAoD;YACpD,wDAAwD;YACxD,2CAA2C;QAC7C,WAAW,EACT,6FAA6F;QAC/F,OAAO,EAAE;YACP,+DAA+D;YAC/D,qEAAqE;SACtE;QACD,UAAU,EAAE;YACV,+CAA+C;YAC/C,4CAA4C;YAC5C,iEAAiE;SAClE;KACF;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,QAAQ,EAAE,kBAAkB;QAC5B,kEAAkE;QAClE,qEAAqE;QACrE,mEAAmE;QACnE,MAAM,EACJ,wFAAwF;YACxF,6DAA6D;QAC/D,WAAW,EACT,2FAA2F;YAC3F,2EAA2E;QAC7E,OAAO,EAAE;YACP,iEAAiE;YACjE,uEAAuE;SACxE;QACD,UAAU,EAAE;YACV,iEAAiE;YACjE,yDAAyD;YACzD,sDAAsD;SACvD;KACF;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,QAAQ,EAAE,kBAAkB;QAC5B,mEAAmE;QACnE,MAAM,EACJ,+CAA+C;YAC/C,iFAAiF;QACnF,WAAW,EAAE,2FAA2F;QACxG,OAAO,EAAE;YACP,yDAAyD;YACzD,4DAA4D;SAC7D;QACD,UAAU,EAAE;YACV,gDAAgD;YAChD,kDAAkD;YAClD,wEAAwE;SACzE;KACF;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,QAAQ,EAAE,kBAAkB;QAC5B,mEAAmE;QACnE,mEAAmE;QACnE,sEAAsE;QACtE,qEAAqE;QACrE,uEAAuE;QACvE,yCAAyC;QACzC,MAAM,EACJ,kFAAkF;YAClF,oFAAoF;QACtF,WAAW,EACT,uFAAuF;YACvF,wDAAwD;QAC1D,OAAO,EAAE;YACP,wEAAwE;YACxE,mDAAmD;SACpD;QACD,UAAU,EAAE;YACV,uCAAuC;YACvC,gDAAgD;YAChD,mDAAmD;SACpD;KACF;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,QAAQ,EAAE,mBAAmB;QAC7B,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,EAAE,yGAAyG;QACjH,WAAW,EACT,kFAAkF;YAClF,yFAAyF;YACzF,iBAAiB;QACnB,OAAO,EAAE;YACP,iEAAiE;YACjE,sEAAsE;SACvE;QACD,UAAU,EAAE;YACV,8CAA8C;YAC9C,6DAA6D;YAC7D,kEAAkE;SACnE;KACF;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,QAAQ,EAAE,gBAAgB;QAC1B,wEAAwE;QACxE,sEAAsE;QACtE,oEAAoE;QACpE,mEAAmE;QACnE,mBAAmB;QACnB,MAAM,EACJ,gGAAgG;YAChG,qEAAqE;QACvE,WAAW,EACT,sFAAsF;QACxF,OAAO,EAAE;YACP,uEAAuE;YACvE,mDAAmD;SACpD;QACD,UAAU,EAAE;YACV,wDAAwD;YACxD,oCAAoC;YACpC,iEAAiE;SAClE;KACF;CACF,CAAA;AAED,wEAAwE;AACxE,MAAM,QAAQ,GAA6D,2BAAmB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC/G,OAAO;IACP,EAAE,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;CACpC,CAAC,CAAC,CAAA;AAEH;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAAC,QAAqC;IACrE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACjF,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAEd,IAAI,EAAU,CAAA;QACd,IAAI,CAAC;YACH,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAClG,CAAC;QAED,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,oBAAoB,CAAC,CAAC,EAAE,gEAAgE;gBACtF,2FAA2F,CAC9F,CAAA;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,oBAAoB,CAAC,CAAC,EAAE,oBAAoB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B;oBACrF,4DAA4D,CAC/D,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,oBAAoB,CAAC,CAAC,EAAE,mEAAmE;gBACzF,yDAAyD,CAC5D,CAAA;QACH,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YAC9B,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,oBAAoB,CAAC,CAAC,EAAE,uBAAuB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,mBAAmB;oBAClF,yEAAyE,CAC5E,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,wBAAwB,CAAC,2BAAmB,CAAC,CAAA;AAE7C;;;;;;;;;;GAUG;AACH,SAAgB,gBAAgB,CAAC,OAAe;IAC9C,MAAM,QAAQ,GAAuB,EAAE,CAAA;IACvC,KAAK,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,QAAQ,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC1B,IAAI,CAAC,EAAE,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBAClD,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAA;AACxF,CAAC"}
+{"version":3,"file":"skillScan.js","sourceRoot":"","sources":["../src/skillScan.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2FG;;;AAmEH,gCASC;AAsVD,4CAcC;AAtXD;;;;4DAI4D;AAC/C,QAAA,cAAc,GAAG,EAAE,CAAA;AAEhC;sEACsE;AACtE,SAAgB,UAAU,CAAC,OAAe,EAAE,KAAa,EAAE,MAAc;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,sBAAc,CAAC,CAAA;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,sBAAc,CAAC,CAAA;IACrE,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IACnC,MAAM,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9C,0EAA0E;IAC1E,gDAAgD;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IACjE,OAAO,GAAG,MAAM,GAAG,GAAG,GAAG,MAAM,EAAE,CAAA;AACnC,CAAC;AAED;;;;;;;;GAQG;AACU,QAAA,mBAAmB,GAAgC;IAC9D;QACE,EAAE,EAAE,0BAA0B;QAC9B,QAAQ,EAAE,kBAAkB;QAC5B,kEAAkE;QAClE,mEAAmE;QACnE,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,EAAE,0DAA0D;QAClE,WAAW,EACT,wFAAwF;YACxF,0DAA0D;QAC5D,OAAO,EAAE;YACP,uFAAuF;YACvF,gFAAgF;YAChF,kDAAkD;SACnD;QACD,UAAU,EAAE;YACV,wDAAwD;YACxD,mDAAmD;YACnD,6CAA6C;SAC9C;KACF;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,QAAQ,EAAE,kBAAkB;QAC5B,kEAAkE;QAClE,qEAAqE;QACrE,+DAA+D;QAC/D,MAAM,EACJ,qFAAqF;YACrF,yEAAyE;QAC3E,WAAW,EACT,0FAA0F;YAC1F,4EAA4E;QAC9E,OAAO,EAAE;YACP,6EAA6E;YAC7E,oDAAoD;SACrD;QACD,UAAU,EAAE;YACV,sCAAsC;YACtC,0DAA0D;YAC1D,qDAAqD;SACtD;KACF;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,QAAQ,EAAE,mBAAmB;QAC7B,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,kEAAkE;QAClE,MAAM,EACJ,gGAAgG;YAChG,2EAA2E;QAC7E,WAAW,EACT,2FAA2F;YAC3F,+FAA+F;QACjG,OAAO,EAAE;YACP,yEAAyE;YACzE,2DAA2D;SAC5D;QACD,UAAU,EAAE;YACV,oDAAoD;YACpD,mDAAmD;YACnD,sDAAsD;SACvD;KACF;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,QAAQ,EAAE,mBAAmB;QAC7B,oEAAoE;QACpE,kEAAkE;QAClE,mEAAmE;QACnE,kBAAkB;QAClB,MAAM,EACJ,+CAA+C;YAC/C,qEAAqE;QACvE,WAAW,EAAE,8EAA8E;QAC3F,OAAO,EAAE;YACP,uDAAuD;YACvD,kDAAkD;SACnD;QACD,UAAU,EAAE;YACV,6CAA6C;YAC7C,mCAAmC;YACnC,0CAA0C;SAC3C;KACF;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,QAAQ,EAAE,kBAAkB;QAC5B,sEAAsE;QACtE,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,EACJ,oDAAoD;YACpD,wDAAwD;YACxD,2CAA2C;QAC7C,WAAW,EACT,6FAA6F;QAC/F,OAAO,EAAE;YACP,+DAA+D;YAC/D,qEAAqE;SACtE;QACD,UAAU,EAAE;YACV,+CAA+C;YAC/C,4CAA4C;YAC5C,iEAAiE;SAClE;KACF;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,QAAQ,EAAE,kBAAkB;QAC5B,kEAAkE;QAClE,qEAAqE;QACrE,mEAAmE;QACnE,MAAM,EACJ,wFAAwF;YACxF,6DAA6D;QAC/D,WAAW,EACT,2FAA2F;YAC3F,2EAA2E;QAC7E,OAAO,EAAE;YACP,iEAAiE;YACjE,uEAAuE;SACxE;QACD,UAAU,EAAE;YACV,iEAAiE;YACjE,yDAAyD;YACzD,sDAAsD;SACvD;KACF;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,QAAQ,EAAE,kBAAkB;QAC5B,mEAAmE;QACnE,MAAM,EACJ,+CAA+C;YAC/C,iFAAiF;QACnF,WAAW,EAAE,2FAA2F;QACxG,OAAO,EAAE;YACP,yDAAyD;YACzD,4DAA4D;SAC7D;QACD,UAAU,EAAE;YACV,gDAAgD;YAChD,kDAAkD;YAClD,wEAAwE;SACzE;KACF;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,QAAQ,EAAE,kBAAkB;QAC5B,mEAAmE;QACnE,mEAAmE;QACnE,sEAAsE;QACtE,qEAAqE;QACrE,uEAAuE;QACvE,yCAAyC;QACzC,MAAM,EACJ,kFAAkF;YAClF,oFAAoF;QACtF,WAAW,EACT,uFAAuF;YACvF,wDAAwD;QAC1D,OAAO,EAAE;YACP,wEAAwE;YACxE,mDAAmD;SACpD;QACD,UAAU,EAAE;YACV,uCAAuC;YACvC,gDAAgD;YAChD,mDAAmD;SACpD;KACF;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,QAAQ,EAAE,mBAAmB;QAC7B,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,EAAE,yGAAyG;QACjH,WAAW,EACT,kFAAkF;YAClF,yFAAyF;YACzF,iBAAiB;QACnB,OAAO,EAAE;YACP,iEAAiE;YACjE,sEAAsE;SACvE;QACD,UAAU,EAAE;YACV,8CAA8C;YAC9C,6DAA6D;YAC7D,kEAAkE;SACnE;KACF;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,QAAQ,EAAE,gBAAgB;QAC1B,wEAAwE;QACxE,sEAAsE;QACtE,oEAAoE;QACpE,mEAAmE;QACnE,mBAAmB;QACnB,MAAM,EACJ,gGAAgG;YAChG,qEAAqE;QACvE,WAAW,EACT,sFAAsF;QACxF,OAAO,EAAE;YACP,uEAAuE;YACvE,mDAAmD;SACpD;QACD,UAAU,EAAE;YACV,wDAAwD;YACxD,oCAAoC;YACpC,iEAAiE;SAClE;KACF;CACF,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACU,QAAA,+BAA+B,GAAsB;IAChE,0BAA0B;IAC1B,mBAAmB;IACnB,mBAAmB;IACnB,uBAAuB;IACvB,6BAA6B;IAC7B,sBAAsB;IACtB,iCAAiC;IACjC,qBAAqB;IACrB,6BAA6B;CAC9B,CAAA;AAED,wEAAwE;AACxE,MAAM,QAAQ,GAA6D,2BAAmB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC/G,OAAO;IACP,EAAE,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;CACpC,CAAC,CAAC,CAAA;AAEH;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAAC,QAAqC;IACrE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACjF,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAEd,IAAI,EAAU,CAAA;QACd,IAAI,CAAC;YACH,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAClG,CAAC;QAED,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,oBAAoB,CAAC,CAAC,EAAE,gEAAgE;gBACtF,2FAA2F,CAC9F,CAAA;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,oBAAoB,CAAC,CAAC,EAAE,oBAAoB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B;oBACrF,4DAA4D,CAC/D,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,oBAAoB,CAAC,CAAC,EAAE,mEAAmE;gBACzF,yDAAyD,CAC5D,CAAA;QACH,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YAC9B,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,oBAAoB,CAAC,CAAC,EAAE,uBAAuB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,mBAAmB;oBAClF,yEAAyE,CAC5E,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,wBAAwB,CAAC,2BAAmB,CAAC,CAAA;AAC7C,KAAK,MAAM,EAAE,IAAI,uCAA+B,EAAE,CAAC;IACjD,IAAI,CAAC,2BAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,6DAA6D,EAAE,EAAE,CAAC,CAAA;IACpF,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,gBAAgB,CAAC,OAAe;IAC9C,MAAM,QAAQ,GAAuB,EAAE,CAAA;IACvC,KAAK,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,QAAQ,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC1B,IAAI,CAAC,EAAE,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBAClD,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAA;AACxF,CAAC"}

package/dist/sop.d.ts

@@ -414,8 +414,19 @@ export interface AntiGamingResult {
     requiresElevatedApproval: boolean;
     impactSummary: string;
 }
-/** Deviation types during plan execution. */
-export type DeviationType = 'TOOL_SUBSTITUTION' | 'STEP_SKIP' | 'STEP_REORDER' | 'EXTRA_STEP' | 'PARAMETER_DRIFT';
+/**
+ * Deviation types during plan execution, as the gates observe them against the
+ * plan's tool-naming steps (`tool` or `toolName`):
+ *
+ * - `STEP_SKIP`    — a later planned step ran while this one had not.
+ * - `STEP_REORDER` — a step that was skipped ran after all, out of order.
+ * - `EXTRA_STEP`   — a tool the plan never names ran, or was attempted and blocked.
+ *
+ * Substituting one tool for another and changing a tool's parameters are not
+ * types: a substitution is indistinguishable from an extra step plus a skip
+ * until the run ends, and plan steps carry no parameters to compare against.
+ */
+export type DeviationType = 'STEP_SKIP' | 'STEP_REORDER' | 'EXTRA_STEP';
 /** A single deviation from a stored plan. */
 export interface PlanDeviation {
     stepIndex: number;
@@ -438,10 +449,12 @@ export interface PlanAdherenceScore {
  * The valid lifecycle transitions for a stored plan.
  *
  * REJECTED is reachable only from PENDING_APPROVAL — a plan denied before
- * execution ever starts. COMPLETED (via a closure action) is reachable
- * from every non-terminal state, since a plan can be closed with or
- * without ever having been formally approved, and with or without a
- * deviation ever having flipped it to EXECUTING.
+ * execution ever starts. EXECUTING is reachable only from APPROVED, when the
+ * gates observe the first tool call after approval; a plan whose session runs
+ * before approval stays PENDING_APPROVAL, so a reviewer can still decide it.
+ * COMPLETED (via a closure action) is reachable from every non-terminal
+ * state, since a plan can be closed with or without ever having been
+ * formally approved or observed running.
  *
  * @see HLD §3.4.1 — Stored plan compliance trail
  */

package/dist/sop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sop.d.ts","sourceRoot":"","sources":["../src/sop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,cAAc,EACd,SAAS,EACT,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AAInB;;;;;;;;GAQG;AACH,MAAM,WAAW,GAAG;IAClB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAA;IAEb,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAA;IAEnB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAA;IAEb,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAA;IAEf,+DAA+D;IAC/D,eAAe,EAAE,MAAM,CAAA;IAEvB,+CAA+C;IAC/C,QAAQ,EAAE,SAAS,CAAA;IAEnB,wCAAwC;IACxC,cAAc,EAAE,cAAc,CAAA;IAE9B,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAA;IAEjB,+BAA+B;IAC/B,cAAc,EAAE,iBAAiB,CAAA;IAEjC,oCAAoC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB,oCAAoC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IAEvB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB,yCAAyC;IACzC,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,8CAA8C;IAC9C,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAE1B,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB,uEAAuE;IACvE,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAE1B;;;OAGG;IACH,UAAU,CAAC,EAAE,aAAa,CAAA;IAE1B;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;CAClC;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,OAAO,GAAG,YAAY,CAAA;AAEjE;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,MAAM,CAAC,EAAE,mBAAmB,CAAA;CAC7B;AAED,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAA;IAChB,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAA;IACb,0FAA0F;IAC1F,UAAU,EAAE,MAAM,CAAA;IAClB,uFAAuF;IACvF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,qHAAqH;IACrH,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,+FAA+F;IAC/F,WAAW,EAAE,MAAM,CAAA;IACnB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAA;CAClB;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAA;IAEd,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAA;IAEb,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAA;IAEf,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAEjC,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAA;CACvB;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAA;IAEpB,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAA;IAEb,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAA;IAEnB,mCAAmC;IACnC,SAAS,EAAE,iBAAiB,CAAA;IAE5B,kCAAkC;IAClC,OAAO,EAAE,iBAAiB,CAAA;IAE1B,mEAAmE;IACnE,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAE3C,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAA;IAEf,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB,0CAA0C;IAC1C,gBAAgB,CAAC,EAAE;QACjB,UAAU,EAAE,OAAO,CAAA;QACnB,wBAAwB,EAAE,MAAM,CAAA;QAChC,cAAc,EAAE,OAAO,CAAA;KACxB,CAAA;IAED,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAA;CAClB;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sBAAsB;IACtB,KAAK,EAAE,MAAM,CAAA;IAEb,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAA;IAEnB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAE1B,qCAAqC;IACrC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAEzB,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAA;IAErB;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,CAAA;IAE1B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAEhC,+DAA+D;IAC/D,aAAa,EAAE,MAAM,CAAA;IAErB,kDAAkD;IAClD,eAAe,EAAE,MAAM,CAAA;IAEvB,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAA;IAEpB,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAA;IAEhB;;;;OAIG;IACH,UAAU,CAAC,EAAE;QACX,cAAc,EAAE,MAAM,CAAA;QACtB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC7F,WAAW,EAAE,MAAM,CAAA;KACpB,GAAG,IAAI,CAAA;CACT;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAA;IAEnB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAA;IAEnB,gCAAgC;IAChC,UAAU,EAAE,iBAAiB,GAAG,iBAAiB,GAAG,cAAc,CAAA;IAElE,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAA;IAEhB,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAA;IAEhB,yBAAyB;IACzB,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,WAAW,GAAG,QAAQ,CAAA;IAEzD,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAA;IAElB,+BAA+B;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAA;IAEnB,gCAAgC;IAChC,UAAU,EAAE,iBAAiB,GAAG,iBAAiB,GAAG,cAAc,CAAA;IAElE,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAA;IAEhB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAA;IAEhB,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAA;IAEb,uBAAuB;IACvB,WAAW,EAAE,MAAM,CAAA;IAEnB,0CAA0C;IAC1C,cAAc,EAAE,MAAM,CAAA;IAEtB,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEtC,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAA;IAEpB,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAA;CACpB;AAID;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qBAAqB;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd,gCAAgC;IAChC,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB,yBAAyB;IACzB,QAAQ,CAAC,EAAE,SAAS,CAAA;IAEpB,+BAA+B;IAC/B,cAAc,CAAC,EAAE,cAAc,CAAA;CAChC;AAID;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAA;IAChB,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAA;IACb,mCAAmC;IACnC,SAAS,EAAE,iBAAiB,CAAA;IAC5B,8BAA8B;IAC9B,OAAO,EAAE,iBAAiB,CAAA;IAC1B,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,EAAE,EAAE,iBAAiB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAW/G,CAAA;AAEV;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CACvC,iBAAiB,EACjB,MAAM,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAS1C,CAAA;AAID,8CAA8C;AAC9C,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,cAAc,GAAG,WAAW,CAAA;AAErE,2CAA2C;AAC3C,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,WAAW,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAID,0DAA0D;AAC1D,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,kDAAkD;AAClD,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,gBAAgB,EAAE,MAAM,CAAA;IACxB,KAAK,EAAE,MAAM,CAAA;CACd;AAID,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,oBAAoB,EAAE,oBAAoB,CAAA;IAC1C,wBAAwB,EAAE,OAAO,CAAA;IACjC,aAAa,EAAE,MAAM,CAAA;CACtB;AAID,6CAA6C;AAC7C,MAAM,MAAM,aAAa,GACrB,mBAAmB,GACnB,WAAW,GACX,cAAc,GACd,YAAY,GACZ,iBAAiB,CAAA;AAErB,6CAA6C;AAC7C,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,aAAa,CAAA;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,yCAAyC;AACzC,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,EAAE,EAAE,kBAAkB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAQlH,CAAA;AAEV,8BAA8B;AAC9B,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,kBAAkB,CAAA;IAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IAChC,gBAAgB,EAAE,oBAAoB,GAAG,IAAI,CAAA;IAC7C,YAAY,EAAE,aAAa,EAAE,CAAA;CAC9B;AAID,0DAA0D;AAC1D,MAAM,MAAM,sBAAsB,GAC9B,sBAAsB,GACtB,mBAAmB,GACnB,gBAAgB,GAChB,WAAW,CAAA;AAEf,2CAA2C;AAC3C,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,sBAAsB,CAAA;CACvC;AAID,sCAAsC;AACtC,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,gBAAgB,GAAG,WAAW,CAAA;AAExE,sDAAsD;AACtD,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC,UAAU,EAAE,eAAe,CAAA;CAC5B;AAID,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,aAAa,EAAE,MAAM,EAAE,CAAA;CACxB;AAID,iDAAiD;AACjD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,cAAc,EAAE,iBAAiB,GAAG,MAAM,CAAA;IAC1C,QAAQ,EAAE,SAAS,GAAG,MAAM,CAAA;IAC5B,cAAc,EAAE,cAAc,GAAG,MAAM,CAAA;IACvC,sFAAsF;IACtF,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,yCAAyC;AACzC,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,UAAU,EAAE,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;CACd;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB;;;;;;;;;;OAUG;IACH,kBAAkB,EAAE,OAAO,CAAA;IAC3B;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAA;IAC3B,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EACF,gBAAgB,GAChB,UAAU,GACV,UAAU,GACV,UAAU;IACZ,qEAAqE;OACnE,UAAU,GACV,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,aAAa,EAAE,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;CACd"}
+{"version":3,"file":"sop.d.ts","sourceRoot":"","sources":["../src/sop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,cAAc,EACd,SAAS,EACT,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AAInB;;;;;;;;GAQG;AACH,MAAM,WAAW,GAAG;IAClB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAA;IAEb,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAA;IAEnB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAA;IAEb,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAA;IAEf,+DAA+D;IAC/D,eAAe,EAAE,MAAM,CAAA;IAEvB,+CAA+C;IAC/C,QAAQ,EAAE,SAAS,CAAA;IAEnB,wCAAwC;IACxC,cAAc,EAAE,cAAc,CAAA;IAE9B,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAA;IAEjB,+BAA+B;IAC/B,cAAc,EAAE,iBAAiB,CAAA;IAEjC,oCAAoC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB,oCAAoC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IAEvB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB,yCAAyC;IACzC,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,8CAA8C;IAC9C,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAE1B,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB,uEAAuE;IACvE,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAE1B;;;OAGG;IACH,UAAU,CAAC,EAAE,aAAa,CAAA;IAE1B;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;CAClC;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,OAAO,GAAG,YAAY,CAAA;AAEjE;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,MAAM,CAAC,EAAE,mBAAmB,CAAA;CAC7B;AAED,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAA;IAChB,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAA;IACb,0FAA0F;IAC1F,UAAU,EAAE,MAAM,CAAA;IAClB,uFAAuF;IACvF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,qHAAqH;IACrH,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,+FAA+F;IAC/F,WAAW,EAAE,MAAM,CAAA;IACnB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAA;CAClB;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAA;IAEd,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAA;IAEb,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAA;IAEf,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAEjC,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAA;CACvB;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAA;IAEpB,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAA;IAEb,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAA;IAEnB,mCAAmC;IACnC,SAAS,EAAE,iBAAiB,CAAA;IAE5B,kCAAkC;IAClC,OAAO,EAAE,iBAAiB,CAAA;IAE1B,mEAAmE;IACnE,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAE3C,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAA;IAEf,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB,0CAA0C;IAC1C,gBAAgB,CAAC,EAAE;QACjB,UAAU,EAAE,OAAO,CAAA;QACnB,wBAAwB,EAAE,MAAM,CAAA;QAChC,cAAc,EAAE,OAAO,CAAA;KACxB,CAAA;IAED,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAA;CAClB;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sBAAsB;IACtB,KAAK,EAAE,MAAM,CAAA;IAEb,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAA;IAEnB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAE1B,qCAAqC;IACrC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAEzB,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAA;IAErB;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,CAAA;IAE1B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAEhC,+DAA+D;IAC/D,aAAa,EAAE,MAAM,CAAA;IAErB,kDAAkD;IAClD,eAAe,EAAE,MAAM,CAAA;IAEvB,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAA;IAEpB,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAA;IAEhB;;;;OAIG;IACH,UAAU,CAAC,EAAE;QACX,cAAc,EAAE,MAAM,CAAA;QACtB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC7F,WAAW,EAAE,MAAM,CAAA;KACpB,GAAG,IAAI,CAAA;CACT;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAA;IAEnB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAA;IAEnB,gCAAgC;IAChC,UAAU,EAAE,iBAAiB,GAAG,iBAAiB,GAAG,cAAc,CAAA;IAElE,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAA;IAEhB,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAA;IAEhB,yBAAyB;IACzB,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,WAAW,GAAG,QAAQ,CAAA;IAEzD,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAA;IAElB,+BAA+B;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAA;IAEnB,gCAAgC;IAChC,UAAU,EAAE,iBAAiB,GAAG,iBAAiB,GAAG,cAAc,CAAA;IAElE,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAA;IAEhB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAA;IAEhB,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAA;IAEb,uBAAuB;IACvB,WAAW,EAAE,MAAM,CAAA;IAEnB,0CAA0C;IAC1C,cAAc,EAAE,MAAM,CAAA;IAEtB,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEtC,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAA;IAEpB,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAA;CACpB;AAID;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qBAAqB;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd,gCAAgC;IAChC,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB,yBAAyB;IACzB,QAAQ,CAAC,EAAE,SAAS,CAAA;IAEpB,+BAA+B;IAC/B,cAAc,CAAC,EAAE,cAAc,CAAA;CAChC;AAID;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAA;IAChB,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAA;IACb,mCAAmC;IACnC,SAAS,EAAE,iBAAiB,CAAA;IAC5B,8BAA8B;IAC9B,OAAO,EAAE,iBAAiB,CAAA;IAC1B,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,EAAE,EAAE,iBAAiB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAW/G,CAAA;AAEV;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CACvC,iBAAiB,EACjB,MAAM,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAS1C,CAAA;AAID,8CAA8C;AAC9C,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,cAAc,GAAG,WAAW,CAAA;AAErE,2CAA2C;AAC3C,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,WAAW,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAID,0DAA0D;AAC1D,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,kDAAkD;AAClD,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,gBAAgB,EAAE,MAAM,CAAA;IACxB,KAAK,EAAE,MAAM,CAAA;CACd;AAID,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,oBAAoB,EAAE,oBAAoB,CAAA;IAC1C,wBAAwB,EAAE,OAAO,CAAA;IACjC,aAAa,EAAE,MAAM,CAAA;CACtB;AAID;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,aAAa,GACrB,WAAW,GACX,cAAc,GACd,YAAY,CAAA;AAEhB,6CAA6C;AAC7C,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,aAAa,CAAA;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,yCAAyC;AACzC,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,EAAE,EAAE,kBAAkB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAOlH,CAAA;AAEV,8BAA8B;AAC9B,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,kBAAkB,CAAA;IAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IAChC,gBAAgB,EAAE,oBAAoB,GAAG,IAAI,CAAA;IAC7C,YAAY,EAAE,aAAa,EAAE,CAAA;CAC9B;AAID,0DAA0D;AAC1D,MAAM,MAAM,sBAAsB,GAC9B,sBAAsB,GACtB,mBAAmB,GACnB,gBAAgB,GAChB,WAAW,CAAA;AAEf,2CAA2C;AAC3C,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,sBAAsB,CAAA;CACvC;AAID,sCAAsC;AACtC,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,gBAAgB,GAAG,WAAW,CAAA;AAExE,sDAAsD;AACtD,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC,UAAU,EAAE,eAAe,CAAA;CAC5B;AAID,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,aAAa,EAAE,MAAM,EAAE,CAAA;CACxB;AAID,iDAAiD;AACjD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,cAAc,EAAE,iBAAiB,GAAG,MAAM,CAAA;IAC1C,QAAQ,EAAE,SAAS,GAAG,MAAM,CAAA;IAC5B,cAAc,EAAE,cAAc,GAAG,MAAM,CAAA;IACvC,sFAAsF;IACtF,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,yCAAyC;AACzC,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,UAAU,EAAE,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;CACd;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB;;;;;;;;;;OAUG;IACH,kBAAkB,EAAE,OAAO,CAAA;IAC3B;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAA;IAC3B,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EACF,gBAAgB,GAChB,UAAU,GACV,UAAU,GACV,UAAU;IACZ,qEAAqE;OACnE,UAAU,GACV,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,aAAa,EAAE,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;CACd"}

package/dist/sop.js

@@ -77,20 +77,21 @@ exports.ENFORCEMENT_BY_STATE = {
  * The valid lifecycle transitions for a stored plan.
  *
  * REJECTED is reachable only from PENDING_APPROVAL — a plan denied before
- * execution ever starts. COMPLETED (via a closure action) is reachable
- * from every non-terminal state, since a plan can be closed with or
- * without ever having been formally approved, and with or without a
- * deviation ever having flipped it to EXECUTING.
+ * execution ever starts. EXECUTING is reachable only from APPROVED, when the
+ * gates observe the first tool call after approval; a plan whose session runs
+ * before approval stays PENDING_APPROVAL, so a reviewer can still decide it.
+ * COMPLETED (via a closure action) is reachable from every non-terminal
+ * state, since a plan can be closed with or without ever having been
+ * formally approved or observed running.
  *
  * @see HLD §3.4.1 — Stored plan compliance trail
  */
 exports.VALID_PLAN_TRANSITIONS = [
     { from: 'PENDING_APPROVAL', to: 'APPROVED', description: 'Human approves the plan' },
     { from: 'PENDING_APPROVAL', to: 'REJECTED', description: 'Human rejects the plan before execution' },
-    { from: 'PENDING_APPROVAL', to: 'EXECUTING', description: 'A deviation is recorded before formal approval' },
     { from: 'PENDING_APPROVAL', to: 'COMPLETED', description: 'Plan closed directly, no approval step required' },
-    { from: 'APPROVED', to: 'EXECUTING', description: 'First deviation recorded after approval' },
-    { from: 'APPROVED', to: 'COMPLETED', description: 'Plan closed after approval, no deviation ever recorded' },
+    { from: 'APPROVED', to: 'EXECUTING', description: 'The gates observe the first tool call after approval' },
+    { from: 'APPROVED', to: 'COMPLETED', description: 'Plan closed after approval, before any tool call was observed' },
     { from: 'EXECUTING', to: 'COMPLETED', description: 'Execution finishes and the plan is closed' },
 ];
 //# sourceMappingURL=sop.js.map

package/dist/sop.js.map

@@ -1 +1 @@
-{"version":3,"file":"sop.js","sourceRoot":"","sources":["../src/sop.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAibH;;;;GAIG;AACU,QAAA,qBAAqB,GAA2F;IAC3H,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,EAAE;IACzE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,8BAA8B,EAAE;IACxF,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,2BAA2B,EAAE;IACjF,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,uBAAuB,EAAE;IAC/E,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,gCAAgC,EAAE;IACtF,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,sBAAsB,EAAE;IAChF,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,+BAA+B,EAAE;IAClF,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,mBAAmB,EAAE;IACxE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,kCAAkC,EAAE;IACzF,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,yCAAyC,EAAE;CAC3F,CAAA;AAEV;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACU,QAAA,oBAAoB,GAG7B;IACF,KAAK,EAAE,MAAM;IACb,cAAc,EAAE,MAAM;IACtB,SAAS,EAAE,MAAM;IACjB,YAAY,EAAE,QAAQ;IACtB,OAAO,EAAE,QAAQ;IACjB,SAAS,EAAE,QAAQ;IACnB,WAAW,EAAE,MAAM;CACpB,CAAA;AAwED;;;;;;;;;;GAUG;AACU,QAAA,sBAAsB,GAA6F;IAC9H,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAyB,EAAE;IACpF,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,yCAAyC,EAAE;IACpG,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,gDAAgD,EAAE;IAC5G,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,iDAAiD,EAAE;IAC7G,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,yCAAyC,EAAE;IAC7F,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,wDAAwD,EAAE;IAC5G,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,2CAA2C,EAAE;CACxF,CAAA"}
+{"version":3,"file":"sop.js","sourceRoot":"","sources":["../src/sop.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAibH;;;;GAIG;AACU,QAAA,qBAAqB,GAA2F;IAC3H,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,EAAE;IACzE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,8BAA8B,EAAE;IACxF,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,2BAA2B,EAAE;IACjF,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,uBAAuB,EAAE;IAC/E,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,gCAAgC,EAAE;IACtF,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,sBAAsB,EAAE;IAChF,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,+BAA+B,EAAE;IAClF,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,mBAAmB,EAAE;IACxE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,kCAAkC,EAAE;IACzF,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,yCAAyC,EAAE;CAC3F,CAAA;AAEV;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACU,QAAA,oBAAoB,GAG7B;IACF,KAAK,EAAE,MAAM;IACb,cAAc,EAAE,MAAM;IACtB,SAAS,EAAE,MAAM;IACjB,YAAY,EAAE,QAAQ;IACtB,OAAO,EAAE,QAAQ;IACjB,SAAS,EAAE,QAAQ;IACnB,WAAW,EAAE,MAAM;CACpB,CAAA;AAiFD;;;;;;;;;;;;GAYG;AACU,QAAA,sBAAsB,GAA6F;IAC9H,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAyB,EAAE;IACpF,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,yCAAyC,EAAE;IACpG,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,iDAAiD,EAAE;IAC7G,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,sDAAsD,EAAE;IAC1G,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,+DAA+D,EAAE;IACnH,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,2CAA2C,EAAE;CACxF,CAAA"}

package/dist/ssoGroupClearance.d.ts

@@ -0,0 +1,103 @@
+/**
+ * SSO-group tool clearance — the one evaluator.
+ *
+ * A workspace's `sso_group_policy` names high-risk tools, the IdP groups that
+ * clear them, and tools that only an on-behalf-of token may call. These places
+ * decide a tool call against it: the control plane's hook gate
+ * (`resolveSsoGroupPrivilege`), the MCP proxy, the Rust proxy's response gate,
+ * and — through the policy snapshot the sync daemon compiles with this
+ * function — every harness gate. `@intutic/gate`, `intutic-clawde` and the Rust
+ * proxy (`packages/proxy/src/sso_groups.rs`) cannot depend on this package, so
+ * they carry ports; `fixtures/sso-group-clearance-vectors.json` holds all of
+ * them to the same answers.
+ *
+ * The algorithm, in order:
+ *   1. no policy                       → GRANTED
+ *   2. tool on `requireOboFor`         → REQUIRES_OBO (a gate has no OBO token,
+ *                                        so every gate refuses it)
+ *   3. tool not on `highRiskTools`     → GRANTED
+ *   4. member's groups unknown         → DENIED (fail closed; never "granted")
+ *   5. member holds a `requiredGroups` → GRANTED
+ *   6. otherwise                       → DENIED
+ *
+ * Names and groups match exactly — no case folding, no patterns — because
+ * that is what the server has always done and a gate that matched more loosely
+ * would refuse calls the server allows.
+ *
+ * @module
+ */
+import { z } from 'zod';
+import type { SsoGroupClearance, SsoGroupPolicy } from './attenuation.js';
+export interface SsoGroupDecision {
+    clearance: SsoGroupClearance;
+    /** `sso_group.<require_obo|high_risk>.<tool>` when the call is refused, else null. */
+    ruleId: string | null;
+    /** Why the call is refused; empty when it is granted. */
+    reason: string;
+}
+/**
+ * The shape of `sso_group_policy` — the one definition. The settings PUT
+ * validates a write against it (and refuses anything else with a 400 naming
+ * the field), and {@link parseSsoGroupPolicy} reads a stored value through it.
+ * Each list is optional on write and defaults to empty.
+ */
+export declare const SsoGroupPolicySchema: z.ZodObject<{
+    highRiskTools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    requiredGroups: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    requireOboFor: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+}, "strict", z.ZodTypeAny, {
+    highRiskTools: string[];
+    requiredGroups: string[];
+    requireOboFor: string[];
+}, {
+    highRiskTools?: string[] | undefined;
+    requiredGroups?: string[] | undefined;
+    requireOboFor?: string[] | undefined;
+}>;
+/**
+ * Reads a stored `sso_group_policy`. A value the settings route wrote passes
+ * {@link SsoGroupPolicySchema} as it is. One that reached the row some other
+ * way is still read rather than dropped: null only when there is no policy
+ * object at all; a wrong-typed list reads as empty and non-string entries are
+ * dropped, so a malformed `requiredGroups` leaves every high-risk tool denied
+ * rather than the whole policy silently gone.
+ */
+export declare function parseSsoGroupPolicy(value: unknown): SsoGroupPolicy | null;
+/** A rule id that survives `ruleIdFromReason` (`[A-Za-z0-9_.:-]`). */
+export declare function ssoGroupRuleId(kind: 'require_obo' | 'high_risk', toolName: string): string;
+/**
+ * Decides one tool call. `toolNames` is every name the call goes by — the MCP
+ * proxy sees `create_issue` where a harness hook sees
+ * `mcp__github__create_issue` — and a policy entry naming any of them applies.
+ * `memberGroups` null means the caller does not know the member's groups.
+ */
+export declare function evaluateSsoGroupClearance(policy: SsoGroupPolicy | null, toolNames: string | readonly string[], memberGroups: readonly string[] | null): SsoGroupDecision;
+/**
+ * What a policy snapshot carries about SSO groups: the workspace's policy and
+ * the member the snapshot was issued to, with their groups as the control
+ * plane resolved them at `issuedAt`. `member` is null when the control plane
+ * named no member for the key, and every gate then treats the groups as
+ * unknown.
+ */
+export interface SsoGroupRecord {
+    policy: SsoGroupPolicy;
+    member: {
+        memberId: string;
+        ssoGroups: string[];
+    } | null;
+    issuedAt: string;
+}
+/**
+ * First column of the record's line in `policy-snapshot.rules`.
+ *
+ * The record is a data line, not a `#` header, on purpose: every gate's digest
+ * covers exactly the non-`#` lines, so the member's groups are inside the
+ * integrity check every deployed gate already performs, and an edited group
+ * list fails it. Two columns, so every rule parser (which needs six) skips it.
+ */
+export declare const SSO_GROUP_RECORD_TAG = "@sso_groups";
+/** The record as one `.rules` line: the tag, a tab, base64 of its JSON. */
+export declare function encodeSsoGroupRecord(record: SsoGroupRecord): string;
+/** Reads a record line back; null for any other line or a damaged one. */
+export declare function decodeSsoGroupRecord(line: string): SsoGroupRecord | null;
+//# sourceMappingURL=ssoGroupClearance.d.ts.map

package/dist/ssoGroupClearance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssoGroupClearance.d.ts","sourceRoot":"","sources":["../src/ssoGroupClearance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEzE,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,iBAAiB,CAAA;IAC5B,sFAAsF;IACtF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAA;CACf;AAUD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;EAMtB,CAAA;AAEX;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAUzE;AAED,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,GAAG,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,cAAc,GAAG,IAAI,EAC7B,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACrC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GACrC,gBAAgB,CA2BlB;AAID;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,cAAc,CAAA;IACtB,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAA;IACxD,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,gBAAgB,CAAA;AAYjD,2EAA2E;AAC3E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAEnE;AAED,0EAA0E;AAC1E,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAgBxE"}