@intutic/shared-types 2.2.0 → 2.4.0

package/dist/spendBudgets.d.ts

@@ -0,0 +1,122 @@
+/**
+ * Spend budgets and key rate limits — how much LLM spend a workspace, one
+ * virtual key or one member may run up per day or per month, and how many
+ * requests and tokens a virtual key may send per minute.
+ *
+ * A budget is `hard` or `soft`. The LLM proxy refuses a request that a hard
+ * budget's remainder does not cover (`BUDGET_EXCEEDED`, 429, before the
+ * request leaves); a soft budget never refuses. Both raise the workspace's
+ * budget alerts — once at the alert threshold and once at the limit, per
+ * period — as `finops.budget.threshold` / `finops.budget.exceeded`.
+ *
+ * Periods are fixed UTC windows, like MCP call budgets (`mcpBudgets.ts`): a
+ * day starts at 00:00 UTC, a month on the 1st at 00:00 UTC. The window id is
+ * part of every per-key and per-member spend counter's Valkey key, so a new
+ * day or month starts from zero and an old counter expires on its own.
+ *
+ * Spend is what the control plane records per completed call
+ * (`finopsService.incrementSpend`), so a request's own cost lands after it
+ * finishes: the proxy checks a hard budget against the spend recorded so far
+ * plus the request's estimated cost, with the same 20% margin the workspace
+ * cap has always used.
+ *
+ * @module
+ */
+import { z } from 'zod';
+/** A budget's period: a UTC calendar day or a UTC calendar month. */
+export type SpendBudgetPeriod = 'day' | 'month';
+/** `hard` refuses requests the remainder does not cover; `soft` only alerts. */
+export type SpendBudgetEnforcement = 'hard' | 'soft';
+/**
+ * Whose spend a budget limits:
+ * - `workspace` every call in the workspace (Settings › Billing › Budget Limits);
+ * - `key`       the calls one virtual key makes;
+ * - `member`    the calls made with the virtual keys one member owns.
+ */
+export type SpendBudgetScope = 'workspace' | 'key' | 'member';
+export interface SpendBudget {
+    period: SpendBudgetPeriod;
+    limitUsd: number;
+    enforcement: SpendBudgetEnforcement;
+}
+export declare const SPEND_BUDGET_PERIODS: readonly SpendBudgetPeriod[];
+export declare const SPEND_BUDGET_SCOPES: readonly SpendBudgetScope[];
+export declare const MAX_SPEND_BUDGET_USD = 1000000;
+/**
+ * The member budget that applies to every member without one of their own,
+ * period by period. A member's own day budget replaces the default day
+ * budget; the default month budget still applies to them unless they have a
+ * month budget too.
+ */
+export declare const MEMBER_BUDGET_DEFAULT = "default";
+export declare const SpendBudgetSchema: z.ZodObject<{
+    period: z.ZodEnum<["day", "month"]>;
+    limitUsd: z.ZodNumber;
+    enforcement: z.ZodDefault<z.ZodEnum<["hard", "soft"]>>;
+}, "strict", z.ZodTypeAny, {
+    period: "day" | "month";
+    limitUsd: number;
+    enforcement: "hard" | "soft";
+}, {
+    period: "day" | "month";
+    limitUsd: number;
+    enforcement?: "hard" | "soft" | undefined;
+}>;
+/** One budget per period at most: a key or member has a day budget, a month budget, both or neither. */
+export declare const SpendBudgetListSchema: z.ZodEffects<z.ZodArray<z.ZodObject<{
+    period: z.ZodEnum<["day", "month"]>;
+    limitUsd: z.ZodNumber;
+    enforcement: z.ZodDefault<z.ZodEnum<["hard", "soft"]>>;
+}, "strict", z.ZodTypeAny, {
+    period: "day" | "month";
+    limitUsd: number;
+    enforcement: "hard" | "soft";
+}, {
+    period: "day" | "month";
+    limitUsd: number;
+    enforcement?: "hard" | "soft" | undefined;
+}>, "many">, {
+    period: "day" | "month";
+    limitUsd: number;
+    enforcement: "hard" | "soft";
+}[], {
+    period: "day" | "month";
+    limitUsd: number;
+    enforcement?: "hard" | "soft" | undefined;
+}[]>;
+/** Requests and tokens one virtual key may send per minute; `null` (or absent) means no limit. */
+export interface KeyRateLimit {
+    rpm: number | null;
+    tpm: number | null;
+}
+export declare const MAX_KEY_RPM = 100000;
+export declare const MAX_KEY_TPM = 100000000;
+export declare const KeyRateLimitSchema: z.ZodObject<{
+    rpm: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    tpm: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+}, "strict", z.ZodTypeAny, {
+    rpm?: number | null | undefined;
+    tpm?: number | null | undefined;
+}, {
+    rpm?: number | null | undefined;
+    tpm?: number | null | undefined;
+}>;
+/**
+ * One hard budget as the proxy reads it from a virtual key's cached auth
+ * entry (`hardBudgets`) and from `GET /api/v1/auth/key-context`. Soft budgets
+ * are not sent: the proxy never refuses on one.
+ */
+export interface HardBudgetWire {
+    scope: SpendBudgetScope;
+    period: SpendBudgetPeriod;
+    limitUsd: number;
+}
+/** The UTC window a moment falls in: its id (part of the counter key), when it began and when it resets. */
+export declare function spendBudgetWindow(period: SpendBudgetPeriod, nowMs: number): {
+    id: string;
+    startMs: number;
+    resetAtMs: number;
+};
+/** A budget in words, for alerts, refusals and the dashboard. */
+export declare function describeSpendBudget(scope: SpendBudgetScope, budget: SpendBudget, subjectLabel?: string): string;
+//# sourceMappingURL=spendBudgets.d.ts.map

package/dist/spendBudgets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spendBudgets.d.ts","sourceRoot":"","sources":["../src/spendBudgets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,qEAAqE;AACrE,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,OAAO,CAAA;AAE/C,gFAAgF;AAChF,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,MAAM,CAAA;AAEpD;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,KAAK,GAAG,QAAQ,CAAA;AAE7D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,iBAAiB,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,sBAAsB,CAAA;CACpC;AAED,eAAO,MAAM,oBAAoB,EAAE,SAAS,iBAAiB,EAAqB,CAAA;AAClF,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EAAmC,CAAA;AAC9F,eAAO,MAAM,oBAAoB,UAAY,CAAA;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,YAAY,CAAA;AAE9C,eAAO,MAAM,iBAAiB;;;;;;;;;;;;EAMnB,CAAA;AAEX,wGAAwG;AACxG,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;IAS9B,CAAA;AAEJ,kGAAkG;AAClG,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AAED,eAAO,MAAM,WAAW,SAAU,CAAA;AAClC,eAAO,MAAM,WAAW,YAAc,CAAA;AAEtC,eAAO,MAAM,kBAAkB;;;;;;;;;EAKpB,CAAA;AAEX;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,gBAAgB,CAAA;IACvB,MAAM,EAAE,iBAAiB,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,4GAA4G;AAC5G,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,MAAM,GACZ;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAUpD;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAW/G"}

package/dist/spendBudgets.js

@@ -0,0 +1,92 @@
+"use strict";
+/**
+ * Spend budgets and key rate limits — how much LLM spend a workspace, one
+ * virtual key or one member may run up per day or per month, and how many
+ * requests and tokens a virtual key may send per minute.
+ *
+ * A budget is `hard` or `soft`. The LLM proxy refuses a request that a hard
+ * budget's remainder does not cover (`BUDGET_EXCEEDED`, 429, before the
+ * request leaves); a soft budget never refuses. Both raise the workspace's
+ * budget alerts — once at the alert threshold and once at the limit, per
+ * period — as `finops.budget.threshold` / `finops.budget.exceeded`.
+ *
+ * Periods are fixed UTC windows, like MCP call budgets (`mcpBudgets.ts`): a
+ * day starts at 00:00 UTC, a month on the 1st at 00:00 UTC. The window id is
+ * part of every per-key and per-member spend counter's Valkey key, so a new
+ * day or month starts from zero and an old counter expires on its own.
+ *
+ * Spend is what the control plane records per completed call
+ * (`finopsService.incrementSpend`), so a request's own cost lands after it
+ * finishes: the proxy checks a hard budget against the spend recorded so far
+ * plus the request's estimated cost, with the same 20% margin the workspace
+ * cap has always used.
+ *
+ * @module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeyRateLimitSchema = exports.MAX_KEY_TPM = exports.MAX_KEY_RPM = exports.SpendBudgetListSchema = exports.SpendBudgetSchema = exports.MEMBER_BUDGET_DEFAULT = exports.MAX_SPEND_BUDGET_USD = exports.SPEND_BUDGET_SCOPES = exports.SPEND_BUDGET_PERIODS = void 0;
+exports.spendBudgetWindow = spendBudgetWindow;
+exports.describeSpendBudget = describeSpendBudget;
+const zod_1 = require("zod");
+exports.SPEND_BUDGET_PERIODS = ['day', 'month'];
+exports.SPEND_BUDGET_SCOPES = ['workspace', 'key', 'member'];
+exports.MAX_SPEND_BUDGET_USD = 1_000_000;
+/**
+ * The member budget that applies to every member without one of their own,
+ * period by period. A member's own day budget replaces the default day
+ * budget; the default month budget still applies to them unless they have a
+ * month budget too.
+ */
+exports.MEMBER_BUDGET_DEFAULT = 'default';
+exports.SpendBudgetSchema = zod_1.z
+    .object({
+    period: zod_1.z.enum(['day', 'month']),
+    limitUsd: zod_1.z.number().positive().max(exports.MAX_SPEND_BUDGET_USD),
+    enforcement: zod_1.z.enum(['hard', 'soft']).default('hard'),
+})
+    .strict();
+/** One budget per period at most: a key or member has a day budget, a month budget, both or neither. */
+exports.SpendBudgetListSchema = zod_1.z
+    .array(exports.SpendBudgetSchema)
+    .max(2)
+    .superRefine((list, ctx) => {
+    const seen = new Set();
+    list.forEach((b, i) => {
+        if (seen.has(b.period))
+            ctx.addIssue({ code: 'custom', path: [i, 'period'], message: `two ${b.period} budgets` });
+        seen.add(b.period);
+    });
+});
+exports.MAX_KEY_RPM = 100_000;
+exports.MAX_KEY_TPM = 100_000_000;
+exports.KeyRateLimitSchema = zod_1.z
+    .object({
+    rpm: zod_1.z.number().int().min(1).max(exports.MAX_KEY_RPM).nullable().optional(),
+    tpm: zod_1.z.number().int().min(1).max(exports.MAX_KEY_TPM).nullable().optional(),
+})
+    .strict();
+/** The UTC window a moment falls in: its id (part of the counter key), when it began and when it resets. */
+function spendBudgetWindow(period, nowMs) {
+    const d = new Date(nowMs);
+    const y = d.getUTCFullYear();
+    const m = d.getUTCMonth();
+    if (period === 'day') {
+        const startMs = Date.UTC(y, m, d.getUTCDate());
+        return { id: new Date(startMs).toISOString().slice(0, 10), startMs, resetAtMs: startMs + 86_400_000 };
+    }
+    const startMs = Date.UTC(y, m, 1);
+    return { id: new Date(startMs).toISOString().slice(0, 7), startMs, resetAtMs: Date.UTC(y, m + 1, 1) };
+}
+/** A budget in words, for alerts, refusals and the dashboard. */
+function describeSpendBudget(scope, budget, subjectLabel) {
+    const whose = scope === 'workspace'
+        ? 'Workspace'
+        : scope === 'key'
+            ? `Key ${subjectLabel ?? ''}`.trim()
+            : subjectLabel === exports.MEMBER_BUDGET_DEFAULT || subjectLabel === undefined
+                ? 'Member'
+                : `Member ${subjectLabel}`;
+    const per = budget.period === 'day' ? 'day' : 'month';
+    return `${whose} ${budget.enforcement} budget: $${budget.limitUsd.toFixed(2)} per ${per}`;
+}
+//# sourceMappingURL=spendBudgets.js.map

package/dist/spendBudgets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spendBudgets.js","sourceRoot":"","sources":["../src/spendBudgets.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;;AAoFH,8CAaC;AAGD,kDAWC;AA7GD,6BAAuB;AAsBV,QAAA,oBAAoB,GAAiC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;AACrE,QAAA,mBAAmB,GAAgC,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;AACjF,QAAA,oBAAoB,GAAG,SAAS,CAAA;AAE7C;;;;;GAKG;AACU,QAAA,qBAAqB,GAAG,SAAS,CAAA;AAEjC,QAAA,iBAAiB,GAAG,OAAC;KAC/B,MAAM,CAAC;IACN,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,4BAAoB,CAAC;IACzD,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACtD,CAAC;KACD,MAAM,EAAE,CAAA;AAEX,wGAAwG;AAC3F,QAAA,qBAAqB,GAAG,OAAC;KACnC,KAAK,CAAC,yBAAiB,CAAC;KACxB,GAAG,CAAC,CAAC,CAAC;KACN,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,UAAU,EAAE,CAAC,CAAA;QACjH,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAQS,QAAA,WAAW,GAAG,OAAO,CAAA;AACrB,QAAA,WAAW,GAAG,WAAW,CAAA;AAEzB,QAAA,kBAAkB,GAAG,OAAC;KAChC,MAAM,CAAC;IACN,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnE,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACpE,CAAC;KACD,MAAM,EAAE,CAAA;AAaX,4GAA4G;AAC5G,SAAgB,iBAAiB,CAC/B,MAAyB,EACzB,KAAa;IAEb,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAA;IACzB,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,CAAA;IAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;IACzB,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAA;QAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,UAAU,EAAE,CAAA;IACvG,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IACjC,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAA;AACvG,CAAC;AAED,iEAAiE;AACjE,SAAgB,mBAAmB,CAAC,KAAuB,EAAE,MAAmB,EAAE,YAAqB;IACrG,MAAM,KAAK,GACT,KAAK,KAAK,WAAW;QACnB,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,KAAK,KAAK,KAAK;YACf,CAAC,CAAC,OAAO,YAAY,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;YACpC,CAAC,CAAC,YAAY,KAAK,6BAAqB,IAAI,YAAY,KAAK,SAAS;gBACpE,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,UAAU,YAAY,EAAE,CAAA;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAA;IACrD,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,WAAW,aAAa,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAA;AAC3F,CAAC"}

package/dist/ssoGroupClearance.d.ts

@@ -22,7 +22,10 @@
  *
  * Names and groups match exactly — no case folding, no patterns — because
  * that is what the server has always done and a gate that matched more loosely
- * would refuse calls the server allows.
+ * would refuse calls the server allows. The one widening is MCP's two names
+ * for one tool ({@link ssoGroupToolMatches}): an entry naming the tool as its
+ * server declares it (`run_query`) also matches the name a harness hook sees
+ * (`mcp__postgres__run_query`), at every gate.
  *
  * @module
  */
@@ -65,10 +68,23 @@ export declare const SsoGroupPolicySchema: z.ZodObject<{
 export declare function parseSsoGroupPolicy(value: unknown): SsoGroupPolicy | null;
 /** A rule id that survives `ruleIdFromReason` (`[A-Za-z0-9_.:-]`). */
 export declare function ssoGroupRuleId(kind: 'require_obo' | 'high_risk', toolName: string): string;
+/**
+ * Whether a call that goes by `name` is the tool a policy entry names.
+ *
+ * Exactly, or — for an entry that is an MCP tool's own name, not starting
+ * with `mcp__` — as the name a harness hook gives that tool on any server:
+ * `mcp__<server>__<entry>`, the server part non-empty. The MCP proxy sees
+ * `run_query` where Claude Code's hook sees `mcp__postgres__run_query`, so
+ * without this an entry written one way held at one gate and not the other.
+ * An entry that already names the harness form (`mcp__postgres__run_query`)
+ * matches only that server's tool.
+ */
+export declare function ssoGroupToolMatches(entry: string, name: string): boolean;
 /**
  * Decides one tool call. `toolNames` is every name the call goes by — the MCP
  * proxy sees `create_issue` where a harness hook sees
- * `mcp__github__create_issue` — and a policy entry naming any of them applies.
+ * `mcp__github__create_issue` — and a policy entry naming any of them applies
+ * ({@link ssoGroupToolMatches}). The rule id and reason name the entry.
  * `memberGroups` null means the caller does not know the member's groups.
  */
 export declare function evaluateSsoGroupClearance(policy: SsoGroupPolicy | null, toolNames: string | readonly string[], memberGroups: readonly string[] | null): SsoGroupDecision;

package/dist/ssoGroupClearance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssoGroupClearance.d.ts","sourceRoot":"","sources":["../src/ssoGroupClearance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEzE,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,iBAAiB,CAAA;IAC5B,sFAAsF;IACtF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAA;CACf;AAUD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;EAMtB,CAAA;AAEX;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAUzE;AAED,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,GAAG,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,cAAc,GAAG,IAAI,EAC7B,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACrC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GACrC,gBAAgB,CA2BlB;AAID;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,cAAc,CAAA;IACtB,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAA;IACxD,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,gBAAgB,CAAA;AAYjD,2EAA2E;AAC3E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAEnE;AAED,0EAA0E;AAC1E,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAgBxE"}
+{"version":3,"file":"ssoGroupClearance.d.ts","sourceRoot":"","sources":["../src/ssoGroupClearance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEzE,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,iBAAiB,CAAA;IAC5B,sFAAsF;IACtF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAA;CACf;AAUD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;EAMtB,CAAA;AAEX;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAUzE;AAED,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,GAAG,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAKxE;AAgBD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,cAAc,GAAG,IAAI,EAC7B,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACrC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GACrC,gBAAgB,CA2BlB;AAID;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,cAAc,CAAA;IACtB,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAA;IACxD,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,gBAAgB,CAAA;AAYjD,2EAA2E;AAC3E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAEnE;AAED,0EAA0E;AAC1E,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAgBxE"}

package/dist/ssoGroupClearance.js

@@ -23,7 +23,10 @@
  *
  * Names and groups match exactly — no case folding, no patterns — because
  * that is what the server has always done and a gate that matched more loosely
- * would refuse calls the server allows.
+ * would refuse calls the server allows. The one widening is MCP's two names
+ * for one tool ({@link ssoGroupToolMatches}): an entry naming the tool as its
+ * server declares it (`run_query`) also matches the name a harness hook sees
+ * (`mcp__postgres__run_query`), at every gate.
  *
  * @module
  */
@@ -31,6 +34,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SSO_GROUP_RECORD_TAG = exports.SsoGroupPolicySchema = void 0;
 exports.parseSsoGroupPolicy = parseSsoGroupPolicy;
 exports.ssoGroupRuleId = ssoGroupRuleId;
+exports.ssoGroupToolMatches = ssoGroupToolMatches;
 exports.evaluateSsoGroupClearance = evaluateSsoGroupClearance;
 exports.encodeSsoGroupRecord = encodeSsoGroupRecord;
 exports.decodeSsoGroupRecord = decodeSsoGroupRecord;
@@ -79,17 +83,52 @@ function parseSsoGroupPolicy(value) {
 function ssoGroupRuleId(kind, toolName) {
     return `sso_group.${kind}.${toolName.replace(/[^A-Za-z0-9_.:-]/g, '_')}`;
 }
+/**
+ * Whether a call that goes by `name` is the tool a policy entry names.
+ *
+ * Exactly, or — for an entry that is an MCP tool's own name, not starting
+ * with `mcp__` — as the name a harness hook gives that tool on any server:
+ * `mcp__<server>__<entry>`, the server part non-empty. The MCP proxy sees
+ * `run_query` where Claude Code's hook sees `mcp__postgres__run_query`, so
+ * without this an entry written one way held at one gate and not the other.
+ * An entry that already names the harness form (`mcp__postgres__run_query`)
+ * matches only that server's tool.
+ */
+function ssoGroupToolMatches(entry, name) {
+    if (name === entry)
+        return true;
+    if (entry.startsWith('mcp__') || !name.startsWith('mcp__'))
+        return false;
+    const suffix = `__${entry}`;
+    return name.length > 'mcp__'.length + suffix.length && name.endsWith(suffix);
+}
+/**
+ * The first entry of `list` a call matches: an exact match on any of its
+ * names first, then an MCP tool's own name matching a harness name.
+ */
+function matchingEntry(list, names) {
+    const exact = names.find((n) => list.includes(n));
+    if (exact !== undefined)
+        return exact;
+    for (const n of names) {
+        const entry = list.find((e) => ssoGroupToolMatches(e, n));
+        if (entry !== undefined)
+            return entry;
+    }
+    return undefined;
+}
 /**
  * Decides one tool call. `toolNames` is every name the call goes by — the MCP
  * proxy sees `create_issue` where a harness hook sees
- * `mcp__github__create_issue` — and a policy entry naming any of them applies.
+ * `mcp__github__create_issue` — and a policy entry naming any of them applies
+ * ({@link ssoGroupToolMatches}). The rule id and reason name the entry.
  * `memberGroups` null means the caller does not know the member's groups.
  */
 function evaluateSsoGroupClearance(policy, toolNames, memberGroups) {
     if (!policy)
         return { clearance: 'GRANTED', ruleId: null, reason: '' };
     const names = typeof toolNames === 'string' ? [toolNames] : toolNames;
-    const obo = names.find((n) => policy.requireOboFor.includes(n));
+    const obo = matchingEntry(policy.requireOboFor, names);
     if (obo !== undefined) {
         return {
             clearance: 'REQUIRES_OBO',
@@ -97,7 +136,7 @@ function evaluateSsoGroupClearance(policy, toolNames, memberGroups) {
             reason: `SSO group policy: ${obo} is on-behalf-of only, and a tool-call gate has no OBO token to present`,
         };
     }
-    const risky = names.find((n) => policy.highRiskTools.includes(n));
+    const risky = matchingEntry(policy.highRiskTools, names);
     if (risky === undefined)
         return { clearance: 'GRANTED', ruleId: null, reason: '' };
     if (memberGroups && policy.requiredGroups.some((g) => memberGroups.includes(g))) {

package/dist/ssoGroupClearance.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssoGroupClearance.js","sourceRoot":"","sources":["../src/ssoGroupClearance.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;;AA4CH,kDAUC;AAGD,wCAEC;AAQD,8DA+BC;AAsCD,oDAEC;AAGD,oDAgBC;AA3JD,6BAAuB;AAYvB,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC5F,CAAC;AAED,gFAAgF;AAChF,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AACrD,MAAM,sBAAsB,GAAG,OAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AAE/E;;;;;GAKG;AACU,QAAA,oBAAoB,GAAG,OAAC;KAClC,MAAM,CAAC;IACN,aAAa,EAAE,sBAAsB;IACrC,cAAc,EAAE,sBAAsB;IACtC,aAAa,EAAE,sBAAsB;CACtC,CAAC;KACD,MAAM,EAAE,CAAA;AAEX;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,KAAc;IAChD,MAAM,KAAK,GAAG,4BAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACnD,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC,IAAI,CAAA;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACpF,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,MAAM,MAAM,GAAG,EAAoB,CAAA;IACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,4BAAoB,CAAC,KAAK,CAAgC,EAAE,CAAC;QACzF,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,sEAAsE;AACtE,SAAgB,cAAc,CAAC,IAAiC,EAAE,QAAgB;IAChF,OAAO,aAAa,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,EAAE,CAAA;AAC1E,CAAC;AAED;;;;;GAKG;AACH,SAAgB,yBAAyB,CACvC,MAA6B,EAC7B,SAAqC,EACrC,YAAsC;IAEtC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACtE,MAAM,KAAK,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAErE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO;YACL,SAAS,EAAE,cAAc;YACzB,MAAM,EAAE,cAAc,CAAC,aAAa,EAAE,GAAG,CAAC;YAC1C,MAAM,EAAE,qBAAqB,GAAG,yEAAyE;SAC1G,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IACjE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAClF,IAAI,YAAY,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAC3D,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAA;IACxG,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC;QAC1C,MAAM,EAAE,YAAY;YAClB,CAAC,CAAC,qBAAqB,KAAK,mCAAmC,MAAM,sCAAsC;YAC3G,CAAC,CAAC,qBAAqB,KAAK,mCAAmC,MAAM,mDAAmD;KAC3H,CAAA;AACH,CAAC;AAiBD;;;;;;;GAOG;AACU,QAAA,oBAAoB,GAAG,aAAa,CAAA;AAEjD,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IACtF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAA;AACrB,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC7G,CAAC;AAED,2EAA2E;AAC3E,SAAgB,oBAAoB,CAAC,MAAsB;IACzD,OAAO,GAAG,4BAAoB,KAAK,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAA;AACvE,CAAC;AAED,0EAA0E;AAC1E,SAAgB,oBAAoB,CAAC,IAAY;IAC/C,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC5C,IAAI,GAAG,KAAK,4BAAoB,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACxE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAA4B,CAAA;QAClE,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC/D,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAmC,CAAA;QACzD,MAAM,MAAM,GACV,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ;YAC7D,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE;YACpE,CAAC,CAAC,IAAI,CAAA;QACV,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}
+{"version":3,"file":"ssoGroupClearance.js","sourceRoot":"","sources":["../src/ssoGroupClearance.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;;;AA4CH,kDAUC;AAGD,wCAEC;AAaD,kDAKC;AAuBD,8DA+BC;AAsCD,oDAEC;AAGD,oDAgBC;AA5LD,6BAAuB;AAYvB,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC5F,CAAC;AAED,gFAAgF;AAChF,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AACrD,MAAM,sBAAsB,GAAG,OAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AAE/E;;;;;GAKG;AACU,QAAA,oBAAoB,GAAG,OAAC;KAClC,MAAM,CAAC;IACN,aAAa,EAAE,sBAAsB;IACrC,cAAc,EAAE,sBAAsB;IACtC,aAAa,EAAE,sBAAsB;CACtC,CAAC;KACD,MAAM,EAAE,CAAA;AAEX;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,KAAc;IAChD,MAAM,KAAK,GAAG,4BAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACnD,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC,IAAI,CAAA;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACpF,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,MAAM,MAAM,GAAG,EAAoB,CAAA;IACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,4BAAoB,CAAC,KAAK,CAAgC,EAAE,CAAC;QACzF,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,sEAAsE;AACtE,SAAgB,cAAc,CAAC,IAAiC,EAAE,QAAgB;IAChF,OAAO,aAAa,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,EAAE,CAAA;AAC1E,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,mBAAmB,CAAC,KAAa,EAAE,IAAY;IAC7D,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAC/B,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IACxE,MAAM,MAAM,GAAG,KAAK,KAAK,EAAE,CAAA;IAC3B,OAAO,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAC9E,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,IAAuB,EAAE,KAAwB;IACtE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IACjD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACrC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACzD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;IACvC,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,yBAAyB,CACvC,MAA6B,EAC7B,SAAqC,EACrC,YAAsC;IAEtC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACtE,MAAM,KAAK,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAErE,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;IACtD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO;YACL,SAAS,EAAE,cAAc;YACzB,MAAM,EAAE,cAAc,CAAC,aAAa,EAAE,GAAG,CAAC;YAC1C,MAAM,EAAE,qBAAqB,GAAG,yEAAyE;SAC1G,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;IACxD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAClF,IAAI,YAAY,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAC3D,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAA;IACxG,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC;QAC1C,MAAM,EAAE,YAAY;YAClB,CAAC,CAAC,qBAAqB,KAAK,mCAAmC,MAAM,sCAAsC;YAC3G,CAAC,CAAC,qBAAqB,KAAK,mCAAmC,MAAM,mDAAmD;KAC3H,CAAA;AACH,CAAC;AAiBD;;;;;;;GAOG;AACU,QAAA,oBAAoB,GAAG,aAAa,CAAA;AAEjD,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IACtF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAA;AACrB,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC7G,CAAC;AAED,2EAA2E;AAC3E,SAAgB,oBAAoB,CAAC,MAAsB;IACzD,OAAO,GAAG,4BAAoB,KAAK,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAA;AACvE,CAAC;AAED,0EAA0E;AAC1E,SAAgB,oBAAoB,CAAC,IAAY;IAC/C,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC5C,IAAI,GAAG,KAAK,4BAAoB,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACxE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAA4B,CAAA;QAClE,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC/D,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAmC,CAAA;QACzD,MAAM,MAAM,GACV,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ;YAC7D,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE;YACpE,CAAC,CAAC,IAAI,CAAA;QACV,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/sync.d.ts

@@ -1,7 +1,6 @@
 /**
  * Sync Daemon & CLI Types — Shared across control plane + CLI + daemon.
  *
- * LLD #8 — Sync Daemon / CLI
  * HLD §3.14 — Real-Time State Mirroring
  *
  * @module

package/dist/sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../src/sync.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAG/D,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAK7C,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,gCAAgC;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAA;IACf,gDAAgD;IAChD,WAAW,EAAE,MAAM,CAAA;IACnB,0DAA0D;IAC1D,cAAc,EAAE,WAAW,EAAE,CAAA;IAC7B,6FAA6F;IAC7F,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,6DAA6D;AAC7D,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,aAAa,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,IAAI,EAAE,YAAY,EAAE,CAAA;IACpB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,QAAQ,EAAE,iBAAiB,CAAA;IAC3B,sDAAsD;IACtD,YAAY,CAAC,EAAE,GAAG,EAAE,CAAA;CACrB;AAMD,8CAA8C;AAC9C,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAA;IAChB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAA;IACjB,gDAAgD;IAChD,aAAa,EAAE,MAAM,CAAA;IACrB,6CAA6C;IAC7C,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC5B,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,qCAAqC;IACrC,WAAW,EAAE,WAAW,CAAA;IACxB,+CAA+C;IAC/C,KAAK,EAAE,WAAW,EAAE,CAAA;IACpB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;CACnB;AAKD,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,oBAAoB;IACpB,IAAI,EAAE,WAAW,CAAA;IACjB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAA;IAClB,6CAA6C;IAC7C,QAAQ,EAAE,OAAO,CAAA;IACjB,uEAAuE;IACvE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,oCAAoC;IACpC,aAAa,EAAE,MAAM,CAAA;IACrB,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAA;IACtB,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAA;IAClB,2CAA2C;IAC3C,SAAS,EAAE,eAAe,EAAE,CAAA;IAC5B,kEAAkE;IAClE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,8CAA8C;IAC9C,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,CAAA;QAC1C,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,CAAA;QAC3C,QAAQ,EAAE,SAAS,GAAG,WAAW,CAAA;KAClC,CAAA;CACF;AAKD,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IACjC,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAA;IACd,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,yBAAyB;IACzB,eAAe,EAAE,MAAM,CAAA;IACvB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,gDAAgD;IAChD,aAAa,EAAE,MAAM,CAAA;IACrB,0BAA0B;IAC1B,SAAS,EAAE,WAAW,EAAE,CAAA;IACxB,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAA;IACrB,wDAAwD;IACxD,OAAO,EAAE,OAAO,CAAA;IAChB,6CAA6C;IAC7C,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qDAAqD;IACrD,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAA;IAC5B;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,WAAW,EAAE,CAAA;CACtC;AAED,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,mCAAmC;IACnC,aAAa,EAAE,MAAM,CAAA;IACrB,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC9B;AAKD;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAA;IACZ,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,WAAW,EAAE,MAAM,CAAA;IACnB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,+EAA+E;AAC/E,MAAM,WAAW,yBAAyB;IACxC,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,0CAA0C;IAC1C,WAAW,EAAE,WAAW,CAAA;IACxB,6BAA6B;IAC7B,KAAK,EAAE,kBAAkB,EAAE,CAAA;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,mBAAmB;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,qBAAqB;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,4EAA4E;IAC5E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,gDAAgD;IAChD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,uEAAuE;IACvE,eAAe,EAAE,OAAO,CAAA;CACzB;AAID,+DAA+D;AAC/D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAU9B,CAAA;AAEF,gDAAgD;AAChD,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiB7B,CAAA;AAEF,4EAA4E;AAC5E,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAS1C,CAAA"}
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../src/sync.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAG/D,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAK7C,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,gCAAgC;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAA;IACf,gDAAgD;IAChD,WAAW,EAAE,MAAM,CAAA;IACnB,0DAA0D;IAC1D,cAAc,EAAE,WAAW,EAAE,CAAA;IAC7B,6FAA6F;IAC7F,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,6DAA6D;AAC7D,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,aAAa,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,IAAI,EAAE,YAAY,EAAE,CAAA;IACpB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,QAAQ,EAAE,iBAAiB,CAAA;IAC3B,sDAAsD;IACtD,YAAY,CAAC,EAAE,GAAG,EAAE,CAAA;CACrB;AAMD,8CAA8C;AAC9C,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAA;IAChB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAA;IACjB,gDAAgD;IAChD,aAAa,EAAE,MAAM,CAAA;IACrB,6CAA6C;IAC7C,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC5B,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,qCAAqC;IACrC,WAAW,EAAE,WAAW,CAAA;IACxB,+CAA+C;IAC/C,KAAK,EAAE,WAAW,EAAE,CAAA;IACpB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;CACnB;AAKD,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,oBAAoB;IACpB,IAAI,EAAE,WAAW,CAAA;IACjB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAA;IAClB,6CAA6C;IAC7C,QAAQ,EAAE,OAAO,CAAA;IACjB,uEAAuE;IACvE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,oCAAoC;IACpC,aAAa,EAAE,MAAM,CAAA;IACrB,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAA;IACtB,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAA;IAClB,2CAA2C;IAC3C,SAAS,EAAE,eAAe,EAAE,CAAA;IAC5B,kEAAkE;IAClE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,8CAA8C;IAC9C,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,CAAA;QAC1C,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,CAAA;QAC3C,QAAQ,EAAE,SAAS,GAAG,WAAW,CAAA;KAClC,CAAA;CACF;AAKD,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IACjC,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAA;IACd,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,yBAAyB;IACzB,eAAe,EAAE,MAAM,CAAA;IACvB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,gDAAgD;IAChD,aAAa,EAAE,MAAM,CAAA;IACrB,0BAA0B;IAC1B,SAAS,EAAE,WAAW,EAAE,CAAA;IACxB,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAA;IACrB,wDAAwD;IACxD,OAAO,EAAE,OAAO,CAAA;IAChB,6CAA6C;IAC7C,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qDAAqD;IACrD,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAA;IAC5B;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,WAAW,EAAE,CAAA;CACtC;AAED,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,mCAAmC;IACnC,aAAa,EAAE,MAAM,CAAA;IACrB,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC9B;AAKD;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAA;IACZ,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,WAAW,EAAE,MAAM,CAAA;IACnB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,+EAA+E;AAC/E,MAAM,WAAW,yBAAyB;IACxC,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,0CAA0C;IAC1C,WAAW,EAAE,WAAW,CAAA;IACxB,6BAA6B;IAC7B,KAAK,EAAE,kBAAkB,EAAE,CAAA;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,mBAAmB;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,qBAAqB;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,4EAA4E;IAC5E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,gDAAgD;IAChD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,uEAAuE;IACvE,eAAe,EAAE,OAAO,CAAA;CACzB;AAID,+DAA+D;AAC/D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAU9B,CAAA;AAEF,gDAAgD;AAChD,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiB7B,CAAA;AAEF,4EAA4E;AAC5E,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAS1C,CAAA"}

package/dist/sync.js

@@ -2,7 +2,6 @@
 /**
  * Sync Daemon & CLI Types — Shared across control plane + CLI + daemon.
  *
- * LLD #8 — Sync Daemon / CLI
  * HLD §3.14 — Real-Time State Mirroring
  *
  * @module

package/dist/sync.js.map

@@ -1 +1 @@
-{"version":3,"file":"sync.js","sourceRoot":"","sources":["../src/sync.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,6BAAuB;AACvB,yCAAwC;AAyOxC,wEAAwE;AAExE,+DAA+D;AAClD,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,OAAC,CAAC,UAAU,CAAC,sBAAW,CAAC;IACtC,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC;QACtB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAG,cAAc;QACjD,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;KACrB,CAAC,CAAC;IACH,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAA;AAEF,gDAAgD;AACnC,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IACzC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,OAAC,CAAC,UAAU,CAAC,sBAAW,CAAC;QAC/B,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE;QACtB,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE;QACrB,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KAC9C,CAAC,CAAC;IACH,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,UAAU,EAAE,OAAC,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QACnD,QAAQ,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;KAC3C,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAA;AAEF,4EAA4E;AAC/D,QAAA,+BAA+B,GAAG,OAAC,CAAC,MAAM,CAAC;IACtD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,OAAC,CAAC,UAAU,CAAC,sBAAW,CAAC;IACtC,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC;QACtB,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAC/C,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;KAC1C,CAAC,CAAC;CACJ,CAAC,CAAA"}
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../src/sync.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH,6BAAuB;AACvB,yCAAwC;AAyOxC,wEAAwE;AAExE,+DAA+D;AAClD,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,OAAC,CAAC,UAAU,CAAC,sBAAW,CAAC;IACtC,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC;QACtB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAG,cAAc;QACjD,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;KACrB,CAAC,CAAC;IACH,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAA;AAEF,gDAAgD;AACnC,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IACzC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,OAAC,CAAC,UAAU,CAAC,sBAAW,CAAC;QAC/B,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE;QACtB,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE;QACrB,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KAC9C,CAAC,CAAC;IACH,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,UAAU,EAAE,OAAC,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QACnD,QAAQ,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;KAC3C,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAA;AAEF,4EAA4E;AAC/D,QAAA,+BAA+B,GAAG,OAAC,CAAC,MAAM,CAAC;IACtD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,OAAC,CAAC,UAAU,CAAC,sBAAW,CAAC;IACtC,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC;QACtB,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAC/C,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;KAC1C,CAAC,CAAC;CACJ,CAAC,CAAA"}

package/dist/taskManagement.d.ts

@@ -1,8 +1,6 @@
 /**
  * Task Management Adapter — Generic interface for external task/issue trackers.
  *
- * TD-022 item 3.9: TaskManagementAdapter interface
- *
  * Provides a unified abstraction over external task management tools
  * (Jira, Linear, GitHub Issues, etc.) so the control plane can
  * create/update tasks based on governance events.

package/dist/taskManagement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"taskManagement.d.ts","sourceRoot":"","sources":["../src/taskManagement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,2CAA2C;AAC3C,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAA;AAE/E,+CAA+C;AAC/C,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEjE,iDAAiD;AACjD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,QAAQ,CAAA;AAEvE,gEAAgE;AAChE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,YAAY,CAAA;IACtB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAA;IACf,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAA;IACjB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED,uCAAuC;AACvC,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAA;IACnB,2BAA2B;IAC3B,QAAQ,EAAE,YAAY,CAAA;IACtB,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iDAAiD;IACjD,WAAW,CAAC,EAAE;QACZ,uDAAuD;QACvD,SAAS,EAAE,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,YAAY,CAAA;QAC/D,kCAAkC;QAClC,OAAO,EAAE,MAAM,CAAA;QACf,uCAAuC;QACvC,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;CACF;AAED,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,OAAO,EAAE,OAAO,CAAA;IAChB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IAChC,kCAAkC;IAClC,cAAc,EAAE,MAAM,CAAA;IACtB,6BAA6B;IAC7B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,mCAAmC;IACnC,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAED,iCAAiC;AACjC,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,UAAU,CAAA;IAClB,QAAQ,EAAE,YAAY,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAE/B;;;OAGG;IACH,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAElC;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAEjE;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAEjE;;;;OAIG;IACH,OAAO,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAE7D;;;;;OAKG;IACH,WAAW,CACT,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,UAAU,CAAC;QAAC,QAAQ,CAAC,EAAE,YAAY,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC5E,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;CAC3B"}
+{"version":3,"file":"taskManagement.d.ts","sourceRoot":"","sources":["../src/taskManagement.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,2CAA2C;AAC3C,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAA;AAE/E,+CAA+C;AAC/C,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEjE,iDAAiD;AACjD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,QAAQ,CAAA;AAEvE,gEAAgE;AAChE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,YAAY,CAAA;IACtB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAA;IACf,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAA;IACjB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED,uCAAuC;AACvC,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAA;IACnB,2BAA2B;IAC3B,QAAQ,EAAE,YAAY,CAAA;IACtB,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iDAAiD;IACjD,WAAW,CAAC,EAAE;QACZ,uDAAuD;QACvD,SAAS,EAAE,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,YAAY,CAAA;QAC/D,kCAAkC;QAClC,OAAO,EAAE,MAAM,CAAA;QACf,uCAAuC;QACvC,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;CACF;AAED,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,OAAO,EAAE,OAAO,CAAA;IAChB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IAChC,kCAAkC;IAClC,cAAc,EAAE,MAAM,CAAA;IACtB,6BAA6B;IAC7B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,mCAAmC;IACnC,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAED,iCAAiC;AACjC,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,UAAU,CAAA;IAClB,QAAQ,EAAE,YAAY,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAE/B;;;OAGG;IACH,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAElC;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAEjE;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAEjE;;;;OAIG;IACH,OAAO,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAE7D;;;;;OAKG;IACH,WAAW,CACT,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,UAAU,CAAC;QAAC,QAAQ,CAAC,EAAE,YAAY,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC5E,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;CAC3B"}

package/dist/taskManagement.js

@@ -2,8 +2,6 @@
 /**
  * Task Management Adapter — Generic interface for external task/issue trackers.
  *
- * TD-022 item 3.9: TaskManagementAdapter interface
- *
  * Provides a unified abstraction over external task management tools
  * (Jira, Linear, GitHub Issues, etc.) so the control plane can
  * create/update tasks based on governance events.

package/dist/taskManagement.js.map

@@ -1 +1 @@
-{"version":3,"file":"taskManagement.js","sourceRoot":"","sources":["../src/taskManagement.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG"}
+{"version":3,"file":"taskManagement.js","sourceRoot":"","sources":["../src/taskManagement.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG"}

package/dist/toolPoison.d.ts

@@ -0,0 +1,33 @@
+/**
+ * toolPoison.ts — Tool-description poisoning patterns.
+ *
+ * Direct TypeScript port of `packages/proxy/src/tool_poison.rs`'s `scan`
+ * function and its seven named patterns. This is a SEPARATE pattern set from
+ * the MCP proxy's `injection.ts`, on purpose: `tool_poison.rs`'s own module
+ * doc records that it tried reusing `injection::scan` for this and measured
+ * that its five patterns match ZERO of the tool-poisoning payloads — they are
+ * tuned for conversational jailbreak phrasing ("ignore previous
+ * instructions"), while a poisoned tool description reads like documentation,
+ * not a jailbreak.
+ *
+ * Two consumers, which is why it lives here: the MCP proxy's
+ * `tool_poisoning` detector (`packages/mcp-proxy/src/anomaly/detectors.ts`)
+ * and the tool-change risk score (`mcpToolRisk.ts`), which the control plane
+ * computes when a server's tool set changes.
+ *
+ * The Rust source gates each pattern behind a cheap substring pre-check
+ * (`GATES`) before running the regex. That optimization is not ported — it is
+ * a performance detail proven equivalent to the plain regex loop (the Rust
+ * module's own `gating_never_changes_a_verdict` test), and the volume of tool
+ * descriptions scanned here is orders of magnitude below the Rust proxy's
+ * request path. The pattern SOURCE TEXT below is unchanged from the Rust
+ * `PATTERNS` array.
+ *
+ @module
+ */
+/**
+ * Pattern names matching this tool description, deduplicated, empty when it
+ * looks like ordinary prose (the overwhelmingly common case).
+ */
+export declare function scanToolDescription(description: string): string[];
+//# sourceMappingURL=toolPoison.d.ts.map

package/dist/toolPoison.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolPoison.d.ts","sourceRoot":"","sources":["../src/toolPoison.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAkDH;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAOjE"}

package/dist/toolPoison.js

@@ -0,0 +1,85 @@
+"use strict";
+/**
+ * toolPoison.ts — Tool-description poisoning patterns.
+ *
+ * Direct TypeScript port of `packages/proxy/src/tool_poison.rs`'s `scan`
+ * function and its seven named patterns. This is a SEPARATE pattern set from
+ * the MCP proxy's `injection.ts`, on purpose: `tool_poison.rs`'s own module
+ * doc records that it tried reusing `injection::scan` for this and measured
+ * that its five patterns match ZERO of the tool-poisoning payloads — they are
+ * tuned for conversational jailbreak phrasing ("ignore previous
+ * instructions"), while a poisoned tool description reads like documentation,
+ * not a jailbreak.
+ *
+ * Two consumers, which is why it lives here: the MCP proxy's
+ * `tool_poisoning` detector (`packages/mcp-proxy/src/anomaly/detectors.ts`)
+ * and the tool-change risk score (`mcpToolRisk.ts`), which the control plane
+ * computes when a server's tool set changes.
+ *
+ * The Rust source gates each pattern behind a cheap substring pre-check
+ * (`GATES`) before running the regex. That optimization is not ported — it is
+ * a performance detail proven equivalent to the plain regex loop (the Rust
+ * module's own `gating_never_changes_a_verdict` test), and the volume of tool
+ * descriptions scanned here is orders of magnitude below the Rust proxy's
+ * request path. The pattern SOURCE TEXT below is unchanged from the Rust
+ * `PATTERNS` array.
+ *
+ @module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scanToolDescription = scanToolDescription;
+/**
+ * Ported verbatim from `tool_poison.rs`'s `PATTERNS` const. All bounded
+ * repetitions here are small fixed-width gaps (`{0,40}`, `{0,60}`, `{0,80}`)
+ * over a handful of alternations — the same "no wide bounded repetition, no
+ * RegexSet performance regression" shape the MCP proxy's `injection.ts` documents, not the
+ * `dlp.rs` shape that regressed.
+ */
+const PATTERNS = [
+    {
+        name: 'hidden-instruction-block',
+        regex: /<\s*(important|secret|system|hidden|instructions?)\s*>/i,
+    },
+    {
+        name: 'conceal-from-user',
+        regex: /\bdo\s+not\s+(mention|tell|inform|reveal|disclose|show)\b[^.!?]{0,40}\buser\b|\bwithout\s+(informing|telling|notifying|alerting)\s+the\s+user\b/i,
+    },
+    {
+        name: 'sidechannel-exfil',
+        regex: /\b(pass|send|include|append|forward|provide)\b[^.!?]{0,60}\b(content|value|text)s?\s+of\b[^.!?]{0,40}(~\/|\.env|\.ssh|id_rsa|credential|secret|token|api[_ ]?key)/i,
+    },
+    {
+        name: 'read-sensitive-path',
+        // Rust's own comment: no `\b` before the alternation, because a word
+        // boundary cannot exist before a literal `.` — `\b\.env` matches
+        // nothing. Preserved exactly, including that absence.
+        regex: /\b(read|open|cat|load|access)\b[^.!?]{0,30}(~\/\.\w+|\.ssh\/|id_rsa|\.env\b|\.aws\/|mcp\.json|\/etc\/passwd)/i,
+    },
+    {
+        name: 'cross-tool-shadowing',
+        regex: /\buse\s+this\s+tool\s+instead\s+of\b|\bdo\s+not\s+use\s+the\s+\w+\s+tool\b|\bthis\s+tool\s+supersedes\b/i,
+    },
+    {
+        name: 'agent-directed-precondition',
+        regex: /\bbefore\s+(using|calling|invoking)\s+(this|the)\s+tool\b[^.!?]{0,80}\b(you\s+must|first\s+read|first\s+call)\b/i,
+    },
+    {
+        name: 'tool-scoped-instruction-override',
+        regex: /\b(ignore|disregard|override)\b[^.!?]{0,40}\b(other\s+tools?|previous\s+tools?|system\s+prompt)\b/i,
+    },
+];
+/**
+ * Pattern names matching this tool description, deduplicated, empty when it
+ * looks like ordinary prose (the overwhelmingly common case).
+ */
+function scanToolDescription(description) {
+    if (!description)
+        return [];
+    const found = [];
+    for (const { name, regex } of PATTERNS) {
+        if (regex.test(description))
+            found.push(name);
+    }
+    return found;
+}
+//# sourceMappingURL=toolPoison.js.map

package/dist/toolPoison.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolPoison.js","sourceRoot":"","sources":["../src/toolPoison.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;AAsDH,kDAOC;AAtDD;;;;;;GAMG;AACH,MAAM,QAAQ,GAAiC;IAC7C;QACE,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE,yDAAyD;KACjE;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EACH,kJAAkJ;KACrJ;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EACH,oKAAoK;KACvK;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,qEAAqE;QACrE,iEAAiE;QACjE,sDAAsD;QACtD,KAAK,EAAE,+GAA+G;KACvH;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,0GAA0G;KAClH;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,KAAK,EAAE,kHAAkH;KAC1H;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,KAAK,EAAE,oGAAoG;KAC5G;CACF,CAAA;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,WAAmB;IACrD,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAA;IAC3B,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}