@intutic/shared-types 2.1.0 → 2.3.0

package/dist/sourceProviders.d.ts

@@ -5,7 +5,7 @@
  * restated by hand in three places — the connector service, the sync cron and
  * the dashboard hook — and the dashboard's copy is what the operator sees in
  * the provider picker, so a provider added server-side was invisible until
- * someone remembered the third copy. `LLD #71` widens the list (Google Drive,
+ * someone remembered the third copy. Policy guardrails widened the list (Google Drive,
  * upload) and moves it here so every reader imports it.
  *
  * `MEMORY_PROVIDERS` is deliberately NOT here: memory providers share the
@@ -28,13 +28,6 @@ export type SourceProvider = (typeof SOURCE_PROVIDERS)[number];
  */
 export declare const DOCUMENT_PROVIDERS: readonly ["notion", "confluence", "github", "gdrive", "upload"];
 export type DocumentProvider = (typeof DOCUMENT_PROVIDERS)[number];
-/**
- * Source providers only a workspace OWNER or ADMIN may connect, reschedule,
- * sync or remove. A Google service-account key reads every document it has
- * been shared, so the member-level connector route must not create one — the
- * same reasoning that keeps VirusTotal off the generic provider enum.
- */
-export declare const PRIVILEGED_SOURCE_PROVIDERS: ReadonlySet<string>;
 /** Type guard for a string arriving off the wire or from a config row. */
 export declare function isSourceProvider(value: unknown): value is SourceProvider;
 export declare function isDocumentProvider(value: unknown): value is DocumentProvider;

package/dist/sourceProviders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sourceProviders.d.ts","sourceRoot":"","sources":["../src/sourceProviders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,qGAAqG;AACrG,eAAO,MAAM,gBAAgB,uDAAwD,CAAA;AAErF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE9D;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,iEAA2C,CAAA;AAE1E,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAA;AAElE;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAAuB,CAAA;AAEnF,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAExE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E"}
+{"version":3,"file":"sourceProviders.d.ts","sourceRoot":"","sources":["../src/sourceProviders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,qGAAqG;AACrG,eAAO,MAAM,gBAAgB,uDAAwD,CAAA;AAErF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE9D;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,iEAA2C,CAAA;AAE1E,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAA;AAElE,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAExE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E"}

package/dist/sourceProviders.js

@@ -6,7 +6,7 @@
  * restated by hand in three places — the connector service, the sync cron and
  * the dashboard hook — and the dashboard's copy is what the operator sees in
  * the provider picker, so a provider added server-side was invisible until
- * someone remembered the third copy. `LLD #71` widens the list (Google Drive,
+ * someone remembered the third copy. Policy guardrails widened the list (Google Drive,
  * upload) and moves it here so every reader imports it.
  *
  * `MEMORY_PROVIDERS` is deliberately NOT here: memory providers share the
@@ -17,7 +17,7 @@
  * @module
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PRIVILEGED_SOURCE_PROVIDERS = exports.DOCUMENT_PROVIDERS = exports.SOURCE_PROVIDERS = void 0;
+exports.DOCUMENT_PROVIDERS = exports.SOURCE_PROVIDERS = void 0;
 exports.isSourceProvider = isSourceProvider;
 exports.isDocumentProvider = isDocumentProvider;
 /** Providers that pull documents on a schedule (and, where the provider allows, write SOPs back). */
@@ -31,13 +31,6 @@ exports.SOURCE_PROVIDERS = ['notion', 'confluence', 'github', 'gdrive'];
  * offer "upload" as something to connect.
  */
 exports.DOCUMENT_PROVIDERS = [...exports.SOURCE_PROVIDERS, 'upload'];
-/**
- * Source providers only a workspace OWNER or ADMIN may connect, reschedule,
- * sync or remove. A Google service-account key reads every document it has
- * been shared, so the member-level connector route must not create one — the
- * same reasoning that keeps VirusTotal off the generic provider enum.
- */
-exports.PRIVILEGED_SOURCE_PROVIDERS = new Set(['gdrive']);
 /** Type guard for a string arriving off the wire or from a config row. */
 function isSourceProvider(value) {
     return typeof value === 'string' && exports.SOURCE_PROVIDERS.includes(value);

package/dist/sourceProviders.js.map

@@ -1 +1 @@
-{"version":3,"file":"sourceProviders.js","sourceRoot":"","sources":["../src/sourceProviders.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;AA4BH,4CAEC;AAED,gDAEC;AAhCD,qGAAqG;AACxF,QAAA,gBAAgB,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAA;AAIrF;;;;;;;GAOG;AACU,QAAA,kBAAkB,GAAG,CAAC,GAAG,wBAAgB,EAAE,QAAQ,CAAU,CAAA;AAI1E;;;;;GAKG;AACU,QAAA,2BAA2B,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;AAEnF,0EAA0E;AAC1E,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,wBAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC7F,CAAC;AAED,SAAgB,kBAAkB,CAAC,KAAc;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,0BAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC/F,CAAC"}
+{"version":3,"file":"sourceProviders.js","sourceRoot":"","sources":["../src/sourceProviders.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;AAoBH,4CAEC;AAED,gDAEC;AAxBD,qGAAqG;AACxF,QAAA,gBAAgB,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAA;AAIrF;;;;;;;GAOG;AACU,QAAA,kBAAkB,GAAG,CAAC,GAAG,wBAAgB,EAAE,QAAQ,CAAU,CAAA;AAI1E,0EAA0E;AAC1E,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,wBAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC7F,CAAC;AAED,SAAgB,kBAAkB,CAAC,KAAc;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,0BAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC/F,CAAC"}

package/dist/ssoGroupClearance.d.ts

@@ -0,0 +1,119 @@
+/**
+ * SSO-group tool clearance — the one evaluator.
+ *
+ * A workspace's `sso_group_policy` names high-risk tools, the IdP groups that
+ * clear them, and tools that only an on-behalf-of token may call. These places
+ * decide a tool call against it: the control plane's hook gate
+ * (`resolveSsoGroupPrivilege`), the MCP proxy, the Rust proxy's response gate,
+ * and — through the policy snapshot the sync daemon compiles with this
+ * function — every harness gate. `@intutic/gate`, `intutic-clawde` and the Rust
+ * proxy (`packages/proxy/src/sso_groups.rs`) cannot depend on this package, so
+ * they carry ports; `fixtures/sso-group-clearance-vectors.json` holds all of
+ * them to the same answers.
+ *
+ * The algorithm, in order:
+ *   1. no policy                       → GRANTED
+ *   2. tool on `requireOboFor`         → REQUIRES_OBO (a gate has no OBO token,
+ *                                        so every gate refuses it)
+ *   3. tool not on `highRiskTools`     → GRANTED
+ *   4. member's groups unknown         → DENIED (fail closed; never "granted")
+ *   5. member holds a `requiredGroups` → GRANTED
+ *   6. otherwise                       → DENIED
+ *
+ * Names and groups match exactly — no case folding, no patterns — because
+ * that is what the server has always done and a gate that matched more loosely
+ * would refuse calls the server allows. The one widening is MCP's two names
+ * for one tool ({@link ssoGroupToolMatches}): an entry naming the tool as its
+ * server declares it (`run_query`) also matches the name a harness hook sees
+ * (`mcp__postgres__run_query`), at every gate.
+ *
+ * @module
+ */
+import { z } from 'zod';
+import type { SsoGroupClearance, SsoGroupPolicy } from './attenuation.js';
+export interface SsoGroupDecision {
+    clearance: SsoGroupClearance;
+    /** `sso_group.<require_obo|high_risk>.<tool>` when the call is refused, else null. */
+    ruleId: string | null;
+    /** Why the call is refused; empty when it is granted. */
+    reason: string;
+}
+/**
+ * The shape of `sso_group_policy` — the one definition. The settings PUT
+ * validates a write against it (and refuses anything else with a 400 naming
+ * the field), and {@link parseSsoGroupPolicy} reads a stored value through it.
+ * Each list is optional on write and defaults to empty.
+ */
+export declare const SsoGroupPolicySchema: z.ZodObject<{
+    highRiskTools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    requiredGroups: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    requireOboFor: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+}, "strict", z.ZodTypeAny, {
+    highRiskTools: string[];
+    requiredGroups: string[];
+    requireOboFor: string[];
+}, {
+    highRiskTools?: string[] | undefined;
+    requiredGroups?: string[] | undefined;
+    requireOboFor?: string[] | undefined;
+}>;
+/**
+ * Reads a stored `sso_group_policy`. A value the settings route wrote passes
+ * {@link SsoGroupPolicySchema} as it is. One that reached the row some other
+ * way is still read rather than dropped: null only when there is no policy
+ * object at all; a wrong-typed list reads as empty and non-string entries are
+ * dropped, so a malformed `requiredGroups` leaves every high-risk tool denied
+ * rather than the whole policy silently gone.
+ */
+export declare function parseSsoGroupPolicy(value: unknown): SsoGroupPolicy | null;
+/** A rule id that survives `ruleIdFromReason` (`[A-Za-z0-9_.:-]`). */
+export declare function ssoGroupRuleId(kind: 'require_obo' | 'high_risk', toolName: string): string;
+/**
+ * Whether a call that goes by `name` is the tool a policy entry names.
+ *
+ * Exactly, or — for an entry that is an MCP tool's own name, not starting
+ * with `mcp__` — as the name a harness hook gives that tool on any server:
+ * `mcp__<server>__<entry>`, the server part non-empty. The MCP proxy sees
+ * `run_query` where Claude Code's hook sees `mcp__postgres__run_query`, so
+ * without this an entry written one way held at one gate and not the other.
+ * An entry that already names the harness form (`mcp__postgres__run_query`)
+ * matches only that server's tool.
+ */
+export declare function ssoGroupToolMatches(entry: string, name: string): boolean;
+/**
+ * Decides one tool call. `toolNames` is every name the call goes by — the MCP
+ * proxy sees `create_issue` where a harness hook sees
+ * `mcp__github__create_issue` — and a policy entry naming any of them applies
+ * ({@link ssoGroupToolMatches}). The rule id and reason name the entry.
+ * `memberGroups` null means the caller does not know the member's groups.
+ */
+export declare function evaluateSsoGroupClearance(policy: SsoGroupPolicy | null, toolNames: string | readonly string[], memberGroups: readonly string[] | null): SsoGroupDecision;
+/**
+ * What a policy snapshot carries about SSO groups: the workspace's policy and
+ * the member the snapshot was issued to, with their groups as the control
+ * plane resolved them at `issuedAt`. `member` is null when the control plane
+ * named no member for the key, and every gate then treats the groups as
+ * unknown.
+ */
+export interface SsoGroupRecord {
+    policy: SsoGroupPolicy;
+    member: {
+        memberId: string;
+        ssoGroups: string[];
+    } | null;
+    issuedAt: string;
+}
+/**
+ * First column of the record's line in `policy-snapshot.rules`.
+ *
+ * The record is a data line, not a `#` header, on purpose: every gate's digest
+ * covers exactly the non-`#` lines, so the member's groups are inside the
+ * integrity check every deployed gate already performs, and an edited group
+ * list fails it. Two columns, so every rule parser (which needs six) skips it.
+ */
+export declare const SSO_GROUP_RECORD_TAG = "@sso_groups";
+/** The record as one `.rules` line: the tag, a tab, base64 of its JSON. */
+export declare function encodeSsoGroupRecord(record: SsoGroupRecord): string;
+/** Reads a record line back; null for any other line or a damaged one. */
+export declare function decodeSsoGroupRecord(line: string): SsoGroupRecord | null;
+//# sourceMappingURL=ssoGroupClearance.d.ts.map

package/dist/ssoGroupClearance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssoGroupClearance.d.ts","sourceRoot":"","sources":["../src/ssoGroupClearance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEzE,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,iBAAiB,CAAA;IAC5B,sFAAsF;IACtF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAA;CACf;AAUD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;EAMtB,CAAA;AAEX;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAUzE;AAED,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,GAAG,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAKxE;AAgBD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,cAAc,GAAG,IAAI,EAC7B,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACrC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GACrC,gBAAgB,CA2BlB;AAID;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,cAAc,CAAA;IACtB,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAA;IACxD,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,gBAAgB,CAAA;AAYjD,2EAA2E;AAC3E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAEnE;AAED,0EAA0E;AAC1E,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAgBxE"}

package/dist/ssoGroupClearance.js

@@ -0,0 +1,196 @@
+"use strict";
+/**
+ * SSO-group tool clearance — the one evaluator.
+ *
+ * A workspace's `sso_group_policy` names high-risk tools, the IdP groups that
+ * clear them, and tools that only an on-behalf-of token may call. These places
+ * decide a tool call against it: the control plane's hook gate
+ * (`resolveSsoGroupPrivilege`), the MCP proxy, the Rust proxy's response gate,
+ * and — through the policy snapshot the sync daemon compiles with this
+ * function — every harness gate. `@intutic/gate`, `intutic-clawde` and the Rust
+ * proxy (`packages/proxy/src/sso_groups.rs`) cannot depend on this package, so
+ * they carry ports; `fixtures/sso-group-clearance-vectors.json` holds all of
+ * them to the same answers.
+ *
+ * The algorithm, in order:
+ *   1. no policy                       → GRANTED
+ *   2. tool on `requireOboFor`         → REQUIRES_OBO (a gate has no OBO token,
+ *                                        so every gate refuses it)
+ *   3. tool not on `highRiskTools`     → GRANTED
+ *   4. member's groups unknown         → DENIED (fail closed; never "granted")
+ *   5. member holds a `requiredGroups` → GRANTED
+ *   6. otherwise                       → DENIED
+ *
+ * Names and groups match exactly — no case folding, no patterns — because
+ * that is what the server has always done and a gate that matched more loosely
+ * would refuse calls the server allows. The one widening is MCP's two names
+ * for one tool ({@link ssoGroupToolMatches}): an entry naming the tool as its
+ * server declares it (`run_query`) also matches the name a harness hook sees
+ * (`mcp__postgres__run_query`), at every gate.
+ *
+ * @module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SSO_GROUP_RECORD_TAG = exports.SsoGroupPolicySchema = void 0;
+exports.parseSsoGroupPolicy = parseSsoGroupPolicy;
+exports.ssoGroupRuleId = ssoGroupRuleId;
+exports.ssoGroupToolMatches = ssoGroupToolMatches;
+exports.evaluateSsoGroupClearance = evaluateSsoGroupClearance;
+exports.encodeSsoGroupRecord = encodeSsoGroupRecord;
+exports.decodeSsoGroupRecord = decodeSsoGroupRecord;
+const zod_1 = require("zod");
+function stringList(value) {
+    return Array.isArray(value) ? value.filter((v) => typeof v === 'string') : [];
+}
+/** One tool or group name: matched exactly, so no trimming happens anywhere. */
+const SsoGroupNameSchema = zod_1.z.string().min(1).max(256);
+const SsoGroupNameListSchema = zod_1.z.array(SsoGroupNameSchema).max(500).default([]);
+/**
+ * The shape of `sso_group_policy` — the one definition. The settings PUT
+ * validates a write against it (and refuses anything else with a 400 naming
+ * the field), and {@link parseSsoGroupPolicy} reads a stored value through it.
+ * Each list is optional on write and defaults to empty.
+ */
+exports.SsoGroupPolicySchema = zod_1.z
+    .object({
+    highRiskTools: SsoGroupNameListSchema,
+    requiredGroups: SsoGroupNameListSchema,
+    requireOboFor: SsoGroupNameListSchema,
+})
+    .strict();
+/**
+ * Reads a stored `sso_group_policy`. A value the settings route wrote passes
+ * {@link SsoGroupPolicySchema} as it is. One that reached the row some other
+ * way is still read rather than dropped: null only when there is no policy
+ * object at all; a wrong-typed list reads as empty and non-string entries are
+ * dropped, so a malformed `requiredGroups` leaves every high-risk tool denied
+ * rather than the whole policy silently gone.
+ */
+function parseSsoGroupPolicy(value) {
+    const valid = exports.SsoGroupPolicySchema.safeParse(value);
+    if (valid.success)
+        return valid.data;
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return null;
+    const p = value;
+    const policy = {};
+    for (const key of Object.keys(exports.SsoGroupPolicySchema.shape)) {
+        policy[key] = stringList(p[key]);
+    }
+    return policy;
+}
+/** A rule id that survives `ruleIdFromReason` (`[A-Za-z0-9_.:-]`). */
+function ssoGroupRuleId(kind, toolName) {
+    return `sso_group.${kind}.${toolName.replace(/[^A-Za-z0-9_.:-]/g, '_')}`;
+}
+/**
+ * Whether a call that goes by `name` is the tool a policy entry names.
+ *
+ * Exactly, or — for an entry that is an MCP tool's own name, not starting
+ * with `mcp__` — as the name a harness hook gives that tool on any server:
+ * `mcp__<server>__<entry>`, the server part non-empty. The MCP proxy sees
+ * `run_query` where Claude Code's hook sees `mcp__postgres__run_query`, so
+ * without this an entry written one way held at one gate and not the other.
+ * An entry that already names the harness form (`mcp__postgres__run_query`)
+ * matches only that server's tool.
+ */
+function ssoGroupToolMatches(entry, name) {
+    if (name === entry)
+        return true;
+    if (entry.startsWith('mcp__') || !name.startsWith('mcp__'))
+        return false;
+    const suffix = `__${entry}`;
+    return name.length > 'mcp__'.length + suffix.length && name.endsWith(suffix);
+}
+/**
+ * The first entry of `list` a call matches: an exact match on any of its
+ * names first, then an MCP tool's own name matching a harness name.
+ */
+function matchingEntry(list, names) {
+    const exact = names.find((n) => list.includes(n));
+    if (exact !== undefined)
+        return exact;
+    for (const n of names) {
+        const entry = list.find((e) => ssoGroupToolMatches(e, n));
+        if (entry !== undefined)
+            return entry;
+    }
+    return undefined;
+}
+/**
+ * Decides one tool call. `toolNames` is every name the call goes by — the MCP
+ * proxy sees `create_issue` where a harness hook sees
+ * `mcp__github__create_issue` — and a policy entry naming any of them applies
+ * ({@link ssoGroupToolMatches}). The rule id and reason name the entry.
+ * `memberGroups` null means the caller does not know the member's groups.
+ */
+function evaluateSsoGroupClearance(policy, toolNames, memberGroups) {
+    if (!policy)
+        return { clearance: 'GRANTED', ruleId: null, reason: '' };
+    const names = typeof toolNames === 'string' ? [toolNames] : toolNames;
+    const obo = matchingEntry(policy.requireOboFor, names);
+    if (obo !== undefined) {
+        return {
+            clearance: 'REQUIRES_OBO',
+            ruleId: ssoGroupRuleId('require_obo', obo),
+            reason: `SSO group policy: ${obo} is on-behalf-of only, and a tool-call gate has no OBO token to present`,
+        };
+    }
+    const risky = matchingEntry(policy.highRiskTools, names);
+    if (risky === undefined)
+        return { clearance: 'GRANTED', ruleId: null, reason: '' };
+    if (memberGroups && policy.requiredGroups.some((g) => memberGroups.includes(g))) {
+        return { clearance: 'GRANTED', ruleId: null, reason: '' };
+    }
+    const groups = policy.requiredGroups.length > 0 ? policy.requiredGroups.join(', ') : '(none configured)';
+    return {
+        clearance: 'DENIED',
+        ruleId: ssoGroupRuleId('high_risk', risky),
+        reason: memberGroups
+            ? `SSO group policy: ${risky} requires one of the SSO groups ${groups}, and this member holds none of them`
+            : `SSO group policy: ${risky} requires one of the SSO groups ${groups}, and this gate does not know the member's groups`,
+    };
+}
+/**
+ * First column of the record's line in `policy-snapshot.rules`.
+ *
+ * The record is a data line, not a `#` header, on purpose: every gate's digest
+ * covers exactly the non-`#` lines, so the member's groups are inside the
+ * integrity check every deployed gate already performs, and an edited group
+ * list fails it. Two columns, so every rule parser (which needs six) skips it.
+ */
+exports.SSO_GROUP_RECORD_TAG = '@sso_groups';
+function toBase64(text) {
+    let binary = '';
+    for (const byte of new TextEncoder().encode(text))
+        binary += String.fromCharCode(byte);
+    return btoa(binary);
+}
+function fromBase64(b64) {
+    return new TextDecoder('utf-8', { fatal: true }).decode(Uint8Array.from(atob(b64), (c) => c.charCodeAt(0)));
+}
+/** The record as one `.rules` line: the tag, a tab, base64 of its JSON. */
+function encodeSsoGroupRecord(record) {
+    return `${exports.SSO_GROUP_RECORD_TAG}\t${toBase64(JSON.stringify(record))}`;
+}
+/** Reads a record line back; null for any other line or a damaged one. */
+function decodeSsoGroupRecord(line) {
+    const [tag, b64, ...rest] = line.split('\t');
+    if (tag !== exports.SSO_GROUP_RECORD_TAG || !b64 || rest.length > 0)
+        return null;
+    try {
+        const raw = JSON.parse(fromBase64(b64));
+        const policy = parseSsoGroupPolicy(raw['policy']);
+        if (!policy || typeof raw['issuedAt'] !== 'string')
+            return null;
+        const m = raw['member'];
+        const member = m && typeof m === 'object' && typeof m['memberId'] === 'string'
+            ? { memberId: m['memberId'], ssoGroups: stringList(m['ssoGroups']) }
+            : null;
+        return { policy, member, issuedAt: raw['issuedAt'] };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=ssoGroupClearance.js.map

package/dist/ssoGroupClearance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssoGroupClearance.js","sourceRoot":"","sources":["../src/ssoGroupClearance.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;;;AA4CH,kDAUC;AAGD,wCAEC;AAaD,kDAKC;AAuBD,8DA+BC;AAsCD,oDAEC;AAGD,oDAgBC;AA5LD,6BAAuB;AAYvB,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC5F,CAAC;AAED,gFAAgF;AAChF,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AACrD,MAAM,sBAAsB,GAAG,OAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AAE/E;;;;;GAKG;AACU,QAAA,oBAAoB,GAAG,OAAC;KAClC,MAAM,CAAC;IACN,aAAa,EAAE,sBAAsB;IACrC,cAAc,EAAE,sBAAsB;IACtC,aAAa,EAAE,sBAAsB;CACtC,CAAC;KACD,MAAM,EAAE,CAAA;AAEX;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,KAAc;IAChD,MAAM,KAAK,GAAG,4BAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACnD,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC,IAAI,CAAA;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACpF,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,MAAM,MAAM,GAAG,EAAoB,CAAA;IACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,4BAAoB,CAAC,KAAK,CAAgC,EAAE,CAAC;QACzF,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,sEAAsE;AACtE,SAAgB,cAAc,CAAC,IAAiC,EAAE,QAAgB;IAChF,OAAO,aAAa,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,EAAE,CAAA;AAC1E,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,mBAAmB,CAAC,KAAa,EAAE,IAAY;IAC7D,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAC/B,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IACxE,MAAM,MAAM,GAAG,KAAK,KAAK,EAAE,CAAA;IAC3B,OAAO,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAC9E,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,IAAuB,EAAE,KAAwB;IACtE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IACjD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACrC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACzD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;IACvC,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,yBAAyB,CACvC,MAA6B,EAC7B,SAAqC,EACrC,YAAsC;IAEtC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACtE,MAAM,KAAK,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAErE,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;IACtD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO;YACL,SAAS,EAAE,cAAc;YACzB,MAAM,EAAE,cAAc,CAAC,aAAa,EAAE,GAAG,CAAC;YAC1C,MAAM,EAAE,qBAAqB,GAAG,yEAAyE;SAC1G,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;IACxD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAClF,IAAI,YAAY,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAC3D,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAA;IACxG,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC;QAC1C,MAAM,EAAE,YAAY;YAClB,CAAC,CAAC,qBAAqB,KAAK,mCAAmC,MAAM,sCAAsC;YAC3G,CAAC,CAAC,qBAAqB,KAAK,mCAAmC,MAAM,mDAAmD;KAC3H,CAAA;AACH,CAAC;AAiBD;;;;;;;GAOG;AACU,QAAA,oBAAoB,GAAG,aAAa,CAAA;AAEjD,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IACtF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAA;AACrB,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC7G,CAAC;AAED,2EAA2E;AAC3E,SAAgB,oBAAoB,CAAC,MAAsB;IACzD,OAAO,GAAG,4BAAoB,KAAK,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAA;AACvE,CAAC;AAED,0EAA0E;AAC1E,SAAgB,oBAAoB,CAAC,IAAY;IAC/C,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC5C,IAAI,GAAG,KAAK,4BAAoB,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACxE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAA4B,CAAA;QAClE,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC/D,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAmC,CAAA;QACzD,MAAM,MAAM,GACV,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ;YAC7D,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE;YACpE,CAAC,CAAC,IAAI,CAAA;QACV,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/sync.d.ts

@@ -1,7 +1,6 @@
 /**
  * Sync Daemon & CLI Types — Shared across control plane + CLI + daemon.
  *
- * LLD #8 — Sync Daemon / CLI
  * HLD §3.14 — Real-Time State Mirroring
  *
  * @module
@@ -144,6 +143,13 @@ export interface IntuticConfig {
      * restart without waiting for the first fetch.
      */
     settings?: WorkspaceSettings;
+    /**
+     * Harnesses `intutic disconnect --harness` took out. They are also removed
+     * from `harnesses`; this list is what keeps connect's MCP wrapping and
+     * tamper restore, which cover every installed harness, away from them.
+     * `intutic init` clears it.
+     */
+    disconnectedHarnesses?: HarnessType[];
 }
 /** Local integrity store at .intutic/integrity.json (per-workspace). */
 export interface IntegrityStore {
@@ -154,14 +160,23 @@ export interface IntegrityStore {
     /** Canonical hashes of synced files. */
     files: Record<string, string>;
 }
-/** A single harness config file captured by the daemon. */
+/**
+ * A single harness config file captured by the daemon.
+ *
+ * `content` is present only when the workspace's `configBodyUpload` is on;
+ * without it the capture is metadata only. The hash is of the text after
+ * secret redaction, the text that is (or would be) uploaded, so the chain
+ * does not move when the setting is turned on or off.
+ */
 export interface CapturedConfigFile {
     /** Relative file path (e.g., `.cursorrules`, `CLAUDE.md`). */
     path: string;
-    /** Full file content. */
-    content: string;
-    /** SHA-256 hash of content. */
+    /** File content with credential-shaped strings redacted, when uploaded. */
+    content?: string;
+    /** SHA-256 hex of the redacted content. */
     contentHash: string;
+    /** Size of the file on disk, in bytes. */
+    sizeBytes: number;
 }
 /** Payload sent by daemon to capture harness config snapshots (multi-file). */
 export interface BatchConfigCapturePayload {
@@ -172,7 +187,13 @@ export interface BatchConfigCapturePayload {
     /** Captured config files. */
     files: CapturedConfigFile[];
 }
-/** Structured diff between two config snapshots. */
+/**
+ * Structured diff between a config snapshot and its predecessor.
+ *
+ * `contentUploaded` is false when either snapshot was captured without its
+ * content (`configBodyUpload` off): the history knows the file changed, not
+ * how, so the counts are zero and both contents null.
+ */
 export interface ConfigDiff {
     /** Lines added. */
     addedLines: number;
@@ -180,10 +201,12 @@ export interface ConfigDiff {
     removedLines: number;
     /** Summary of changes. */
     summary: string;
-    /** Previous content (null if first snapshot). */
+    /** Previous content (null for the first snapshot, or when not uploaded). */
     previousContent: string | null;
-    /** Current content. */
-    currentContent: string;
+    /** Current content (null when not uploaded). */
+    currentContent: string | null;
+    /** Whether both snapshots carry content, so the diff is a real one. */
+    contentUploaded: boolean;
 }
 /** Zod schema for SOP hash report (daemon → control plane). */
 export declare const SopHashReportSchema: z.ZodObject<{
@@ -436,32 +459,37 @@ export declare const BatchConfigCapturePayloadSchema: z.ZodObject<{
     }>;
     files: z.ZodArray<z.ZodObject<{
         path: z.ZodString;
-        content: z.ZodString;
+        content: z.ZodOptional<z.ZodString>;
         contentHash: z.ZodString;
+        sizeBytes: z.ZodNumber;
     }, "strip", z.ZodTypeAny, {
         path: string;
-        content: string;
         contentHash: string;
+        sizeBytes: number;
+        content?: string | undefined;
     }, {
         path: string;
-        content: string;
         contentHash: string;
+        sizeBytes: number;
+        content?: string | undefined;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
     workspaceId: string;
     harnessType: "cursor" | "claude-code" | "antigravity" | "n8n" | "codex" | "windsurf" | "aider" | "openhands" | "openclaw" | "hermes" | "pi" | "cline" | "roo-code" | "continue" | "claude-desktop" | "goose" | "open-webui" | "github-copilot" | "langgraph" | "muse-code" | "grok" | "opencode" | "dsh" | "xirp" | "agentic-orchestrator" | "langchain" | "crewai" | "autogen" | "ag2" | "google-adk" | "openai-agents" | "pydantic-ai" | "smolagents" | "strands" | "agent-framework" | "mastra" | "vercel-ai-sdk" | "eve" | "trueforge" | "ai-sdk-harness" | "ai-sdk-workflow" | "agentcore-runtime" | "trueforge-server";
     files: {
         path: string;
-        content: string;
         contentHash: string;
+        sizeBytes: number;
+        content?: string | undefined;
     }[];
 }, {
     workspaceId: string;
     harnessType: "cursor" | "claude-code" | "antigravity" | "n8n" | "codex" | "windsurf" | "aider" | "openhands" | "openclaw" | "hermes" | "pi" | "cline" | "roo-code" | "continue" | "claude-desktop" | "goose" | "open-webui" | "github-copilot" | "langgraph" | "muse-code" | "grok" | "opencode" | "dsh" | "xirp" | "agentic-orchestrator" | "langchain" | "crewai" | "autogen" | "ag2" | "google-adk" | "openai-agents" | "pydantic-ai" | "smolagents" | "strands" | "agent-framework" | "mastra" | "vercel-ai-sdk" | "eve" | "trueforge" | "ai-sdk-harness" | "ai-sdk-workflow" | "agentcore-runtime" | "trueforge-server";
     files: {
         path: string;
-        content: string;
         contentHash: string;
+        sizeBytes: number;
+        content?: string | undefined;
     }[];
 }>;
 //# sourceMappingURL=sync.d.ts.map

package/dist/sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../src/sync.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAG/D,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAK7C,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,gCAAgC;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAA;IACf,gDAAgD;IAChD,WAAW,EAAE,MAAM,CAAA;IACnB,0DAA0D;IAC1D,cAAc,EAAE,WAAW,EAAE,CAAA;IAC7B,6FAA6F;IAC7F,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,6DAA6D;AAC7D,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,aAAa,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,IAAI,EAAE,YAAY,EAAE,CAAA;IACpB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,QAAQ,EAAE,iBAAiB,CAAA;IAC3B,sDAAsD;IACtD,YAAY,CAAC,EAAE,GAAG,EAAE,CAAA;CACrB;AAMD,8CAA8C;AAC9C,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAA;IAChB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAA;IACjB,gDAAgD;IAChD,aAAa,EAAE,MAAM,CAAA;IACrB,6CAA6C;IAC7C,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC5B,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,qCAAqC;IACrC,WAAW,EAAE,WAAW,CAAA;IACxB,+CAA+C;IAC/C,KAAK,EAAE,WAAW,EAAE,CAAA;IACpB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;CACnB;AAKD,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,oBAAoB;IACpB,IAAI,EAAE,WAAW,CAAA;IACjB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAA;IAClB,6CAA6C;IAC7C,QAAQ,EAAE,OAAO,CAAA;IACjB,uEAAuE;IACvE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,oCAAoC;IACpC,aAAa,EAAE,MAAM,CAAA;IACrB,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAA;IACtB,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAA;IAClB,2CAA2C;IAC3C,SAAS,EAAE,eAAe,EAAE,CAAA;IAC5B,kEAAkE;IAClE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,8CAA8C;IAC9C,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,CAAA;QAC1C,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,CAAA;QAC3C,QAAQ,EAAE,SAAS,GAAG,WAAW,CAAA;KAClC,CAAA;CACF;AAKD,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IACjC,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAA;IACd,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,yBAAyB;IACzB,eAAe,EAAE,MAAM,CAAA;IACvB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,gDAAgD;IAChD,aAAa,EAAE,MAAM,CAAA;IACrB,0BAA0B;IAC1B,SAAS,EAAE,WAAW,EAAE,CAAA;IACxB,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAA;IACrB,wDAAwD;IACxD,OAAO,EAAE,OAAO,CAAA;IAChB,6CAA6C;IAC7C,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qDAAqD;IACrD,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAA;CAC7B;AAED,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,mCAAmC;IACnC,aAAa,EAAE,MAAM,CAAA;IACrB,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC9B;AAKD,2DAA2D;AAC3D,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAA;IACZ,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,+EAA+E;AAC/E,MAAM,WAAW,yBAAyB;IACxC,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,0CAA0C;IAC1C,WAAW,EAAE,WAAW,CAAA;IACxB,6BAA6B;IAC7B,KAAK,EAAE,kBAAkB,EAAE,CAAA;CAC5B;AAED,oDAAoD;AACpD,MAAM,WAAW,UAAU;IACzB,mBAAmB;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,qBAAqB;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,iDAAiD;IACjD,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,uBAAuB;IACvB,cAAc,EAAE,MAAM,CAAA;CACvB;AAID,+DAA+D;AAC/D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAU9B,CAAA;AAEF,gDAAgD;AAChD,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiB7B,CAAA;AAEF,4EAA4E;AAC5E,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ1C,CAAA"}
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../src/sync.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAG/D,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAK7C,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,gCAAgC;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAA;IACf,gDAAgD;IAChD,WAAW,EAAE,MAAM,CAAA;IACnB,0DAA0D;IAC1D,cAAc,EAAE,WAAW,EAAE,CAAA;IAC7B,6FAA6F;IAC7F,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,6DAA6D;AAC7D,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,aAAa,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,IAAI,EAAE,YAAY,EAAE,CAAA;IACpB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,QAAQ,EAAE,iBAAiB,CAAA;IAC3B,sDAAsD;IACtD,YAAY,CAAC,EAAE,GAAG,EAAE,CAAA;CACrB;AAMD,8CAA8C;AAC9C,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAA;IAChB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAA;IACjB,gDAAgD;IAChD,aAAa,EAAE,MAAM,CAAA;IACrB,6CAA6C;IAC7C,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC5B,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,qCAAqC;IACrC,WAAW,EAAE,WAAW,CAAA;IACxB,+CAA+C;IAC/C,KAAK,EAAE,WAAW,EAAE,CAAA;IACpB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;CACnB;AAKD,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,oBAAoB;IACpB,IAAI,EAAE,WAAW,CAAA;IACjB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAA;IAClB,6CAA6C;IAC7C,QAAQ,EAAE,OAAO,CAAA;IACjB,uEAAuE;IACvE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,oCAAoC;IACpC,aAAa,EAAE,MAAM,CAAA;IACrB,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAA;IACtB,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAA;IAClB,2CAA2C;IAC3C,SAAS,EAAE,eAAe,EAAE,CAAA;IAC5B,kEAAkE;IAClE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,8CAA8C;IAC9C,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,CAAA;QAC1C,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,CAAA;QAC3C,QAAQ,EAAE,SAAS,GAAG,WAAW,CAAA;KAClC,CAAA;CACF;AAKD,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IACjC,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAA;IACd,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,yBAAyB;IACzB,eAAe,EAAE,MAAM,CAAA;IACvB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,gDAAgD;IAChD,aAAa,EAAE,MAAM,CAAA;IACrB,0BAA0B;IAC1B,SAAS,EAAE,WAAW,EAAE,CAAA;IACxB,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAA;IACrB,wDAAwD;IACxD,OAAO,EAAE,OAAO,CAAA;IAChB,6CAA6C;IAC7C,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qDAAqD;IACrD,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAA;IAC5B;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,WAAW,EAAE,CAAA;CACtC;AAED,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,mCAAmC;IACnC,aAAa,EAAE,MAAM,CAAA;IACrB,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC9B;AAKD;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAA;IACZ,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,WAAW,EAAE,MAAM,CAAA;IACnB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,+EAA+E;AAC/E,MAAM,WAAW,yBAAyB;IACxC,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,0CAA0C;IAC1C,WAAW,EAAE,WAAW,CAAA;IACxB,6BAA6B;IAC7B,KAAK,EAAE,kBAAkB,EAAE,CAAA;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,mBAAmB;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,qBAAqB;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,4EAA4E;IAC5E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,gDAAgD;IAChD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,uEAAuE;IACvE,eAAe,EAAE,OAAO,CAAA;CACzB;AAID,+DAA+D;AAC/D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAU9B,CAAA;AAEF,gDAAgD;AAChD,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiB7B,CAAA;AAEF,4EAA4E;AAC5E,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAS1C,CAAA"}

package/dist/sync.js

@@ -2,7 +2,6 @@
 /**
  * Sync Daemon & CLI Types — Shared across control plane + CLI + daemon.
  *
- * LLD #8 — Sync Daemon / CLI
  * HLD §3.14 — Real-Time State Mirroring
  *
  * @module
@@ -49,8 +48,9 @@ exports.BatchConfigCapturePayloadSchema = zod_1.z.object({
     harnessType: zod_1.z.nativeEnum(enums_js_1.HarnessType),
     files: zod_1.z.array(zod_1.z.object({
         path: zod_1.z.string().min(1),
-        content: zod_1.z.string(),
-        contentHash: zod_1.z.string().length(64),
+        content: zod_1.z.string().optional(),
+        contentHash: zod_1.z.string().regex(/^[0-9a-f]{64}$/),
+        sizeBytes: zod_1.z.number().int().nonnegative(),
     })),
 });
 //# sourceMappingURL=sync.js.map

package/dist/sync.js.map

@@ -1 +1 @@
-{"version":3,"file":"sync.js","sourceRoot":"","sources":["../src/sync.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,6BAAuB;AACvB,yCAAwC;AAiNxC,wEAAwE;AAExE,+DAA+D;AAClD,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,OAAC,CAAC,UAAU,CAAC,sBAAW,CAAC;IACtC,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC;QACtB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAG,cAAc;QACjD,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;KACrB,CAAC,CAAC;IACH,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAA;AAEF,gDAAgD;AACnC,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IACzC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,OAAC,CAAC,UAAU,CAAC,sBAAW,CAAC;QAC/B,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE;QACtB,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE;QACrB,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KAC9C,CAAC,CAAC;IACH,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,UAAU,EAAE,OAAC,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QACnD,QAAQ,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;KAC3C,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAA;AAEF,4EAA4E;AAC/D,QAAA,+BAA+B,GAAG,OAAC,CAAC,MAAM,CAAC;IACtD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,OAAC,CAAC,UAAU,CAAC,sBAAW,CAAC;IACtC,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC;QACtB,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE;QACnB,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;KACnC,CAAC,CAAC;CACJ,CAAC,CAAA"}
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../src/sync.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH,6BAAuB;AACvB,yCAAwC;AAyOxC,wEAAwE;AAExE,+DAA+D;AAClD,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,OAAC,CAAC,UAAU,CAAC,sBAAW,CAAC;IACtC,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC;QACtB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAG,cAAc;QACjD,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;KACrB,CAAC,CAAC;IACH,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAA;AAEF,gDAAgD;AACnC,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IACzC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,OAAC,CAAC,UAAU,CAAC,sBAAW,CAAC;QAC/B,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE;QACtB,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE;QACrB,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KAC9C,CAAC,CAAC;IACH,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,UAAU,EAAE,OAAC,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QACnD,QAAQ,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;KAC3C,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAA;AAEF,4EAA4E;AAC/D,QAAA,+BAA+B,GAAG,OAAC,CAAC,MAAM,CAAC;IACtD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,OAAC,CAAC,UAAU,CAAC,sBAAW,CAAC;IACtC,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC;QACtB,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAC/C,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;KAC1C,CAAC,CAAC;CACJ,CAAC,CAAA"}

package/dist/taskManagement.d.ts

@@ -1,8 +1,6 @@
 /**
  * Task Management Adapter — Generic interface for external task/issue trackers.
  *
- * TD-022 item 3.9: TaskManagementAdapter interface
- *
  * Provides a unified abstraction over external task management tools
  * (Jira, Linear, GitHub Issues, etc.) so the control plane can
  * create/update tasks based on governance events.

package/dist/taskManagement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"taskManagement.d.ts","sourceRoot":"","sources":["../src/taskManagement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,2CAA2C;AAC3C,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAA;AAE/E,+CAA+C;AAC/C,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEjE,iDAAiD;AACjD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,QAAQ,CAAA;AAEvE,gEAAgE;AAChE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,YAAY,CAAA;IACtB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAA;IACf,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAA;IACjB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED,uCAAuC;AACvC,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAA;IACnB,2BAA2B;IAC3B,QAAQ,EAAE,YAAY,CAAA;IACtB,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iDAAiD;IACjD,WAAW,CAAC,EAAE;QACZ,uDAAuD;QACvD,SAAS,EAAE,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,YAAY,CAAA;QAC/D,kCAAkC;QAClC,OAAO,EAAE,MAAM,CAAA;QACf,uCAAuC;QACvC,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;CACF;AAED,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,OAAO,EAAE,OAAO,CAAA;IAChB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IAChC,kCAAkC;IAClC,cAAc,EAAE,MAAM,CAAA;IACtB,6BAA6B;IAC7B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,mCAAmC;IACnC,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAED,iCAAiC;AACjC,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,UAAU,CAAA;IAClB,QAAQ,EAAE,YAAY,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAE/B;;;OAGG;IACH,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAElC;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAEjE;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAEjE;;;;OAIG;IACH,OAAO,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAE7D;;;;;OAKG;IACH,WAAW,CACT,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,UAAU,CAAC;QAAC,QAAQ,CAAC,EAAE,YAAY,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC5E,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;CAC3B"}
+{"version":3,"file":"taskManagement.d.ts","sourceRoot":"","sources":["../src/taskManagement.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,2CAA2C;AAC3C,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAA;AAE/E,+CAA+C;AAC/C,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEjE,iDAAiD;AACjD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,QAAQ,CAAA;AAEvE,gEAAgE;AAChE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,YAAY,CAAA;IACtB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAA;IACf,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAA;IACjB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED,uCAAuC;AACvC,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAA;IACnB,2BAA2B;IAC3B,QAAQ,EAAE,YAAY,CAAA;IACtB,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iDAAiD;IACjD,WAAW,CAAC,EAAE;QACZ,uDAAuD;QACvD,SAAS,EAAE,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,YAAY,CAAA;QAC/D,kCAAkC;QAClC,OAAO,EAAE,MAAM,CAAA;QACf,uCAAuC;QACvC,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;CACF;AAED,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,OAAO,EAAE,OAAO,CAAA;IAChB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IAChC,kCAAkC;IAClC,cAAc,EAAE,MAAM,CAAA;IACtB,6BAA6B;IAC7B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,mCAAmC;IACnC,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAED,iCAAiC;AACjC,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,UAAU,CAAA;IAClB,QAAQ,EAAE,YAAY,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAE/B;;;OAGG;IACH,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAElC;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAEjE;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAEjE;;;;OAIG;IACH,OAAO,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAE7D;;;;;OAKG;IACH,WAAW,CACT,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,UAAU,CAAC;QAAC,QAAQ,CAAC,EAAE,YAAY,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC5E,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;CAC3B"}

package/dist/taskManagement.js

@@ -2,8 +2,6 @@
 /**
  * Task Management Adapter — Generic interface for external task/issue trackers.
  *
- * TD-022 item 3.9: TaskManagementAdapter interface
- *
  * Provides a unified abstraction over external task management tools
  * (Jira, Linear, GitHub Issues, etc.) so the control plane can
  * create/update tasks based on governance events.

package/dist/taskManagement.js.map

@@ -1 +1 @@
-{"version":3,"file":"taskManagement.js","sourceRoot":"","sources":["../src/taskManagement.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG"}
+{"version":3,"file":"taskManagement.js","sourceRoot":"","sources":["../src/taskManagement.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG"}