@intutic/sync-daemon 2.1.0 → 2.3.0

package/dist/lib/phrasesPy.js

@@ -0,0 +1,351 @@
+/**
+ * The phrase matcher in Python, for the gates that run Python: the bash gates
+ * (their extractor already requires python3) and the Open WebUI filter.
+ *
+ * Byte-identical to `packages/intutic-clawde/intutic_clawde/gate/phrases.py`,
+ * which a test compares; edit that file and copy it here. It is the
+ * transliteration of `@intutic/shared-types`'s phrases.ts, and both run the
+ * shared vectors.
+ */
+export const PHRASES_PY_SOURCE = String.raw `"""Phrase matching for shell commands and SQL in linear time.
+
+A transliteration of packages/shared-types/src/phrases.ts; read that module's
+docstring for what counts as a separator and why no regex searches the input.
+The rules are the same; the walk is organised for CPython, which is slow per
+step: runs of ordinary characters, spaces and backslashes are consumed by
+anchored character-class matches (one pass each, nothing to backtrack into),
+and a phrase is checked only at the words that can start it.
+
+Every classifier runs the shared vectors in
+packages/proxy/src/plugins/anomaly/action_vectors.json, and the hook gates
+emit this file verbatim (services/sync-daemon/src/lib/phrasesPy.ts holds a
+byte-identical copy, which a test compares). It must stay self-contained: the
+standard library only, no module state beyond the constants below, and no
+backtick or dollar-brace, which the TypeScript copy cannot hold.
+"""
+
+import re
+from bisect import bisect_left
+
+_SPACE_CHARS = (
+    " \t\n\r\v\f\u00a0\u1680\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007"
+    "\u2008\u2009\u200a\u2028\u2029\u202f\u205f\u3000\ufeff"
+)
+_SPACES = frozenset(_SPACE_CHARS)
+_WORD = frozenset("abcdefghijklmnopqrstuvwxyz0123456789_")
+# One anchored match per piece of the text. Every alternative starts with a
+# character no other alternative can start with, so exactly one can match at
+# a position and it matches one run of its class: nothing to backtrack into.
+_PIECE = re.compile(
+    "(?P<plain>[^" + _SPACE_CHARS + "\\\\/;&|-]+)"
+    "|(?P<space>[" + _SPACE_CHARS + "]+)"
+    "|(?P<dash>-+)"
+    "|(?P<backslash>\\\\+)"
+    "|(?P<other>[/;&|])"
+)
+# A run of words that need no decision, each followed by one plain space:
+# ordinary characters, after at most a leading run of dashes. Consumed in one
+# match and split in C — most of a long command is this.
+_BULK = re.compile("(?:(?:[^" + _SPACE_CHARS + "\\\\/;&|-]+|-+[^" + _SPACE_CHARS + "\\\\/;&|-]*) )+")
+_BULK_NO_COMMENT = re.compile("(?:(?:[^" + _SPACE_CHARS + "\\\\;&|-]+|-+[^" + _SPACE_CHARS + "\\\\;&|-]*) )+")
+# A run of line continuations or escaped spaces between words: one break.
+_CONTINUATIONS = re.compile("(?:\\\\[" + _SPACE_CHARS + "])+")
+# The same once no "*/" is left in the text: no "/*" can open a comment, so a
+# slash is an ordinary character.
+_PIECE_NO_COMMENT = re.compile(
+    "(?P<plain>[^" + _SPACE_CHARS + "\\\\;&|-]+)"
+    "|(?P<space>[" + _SPACE_CHARS + "]+)"
+    "|(?P<dash>-+)"
+    "|(?P<backslash>\\\\+)"
+    "|(?P<other>[;&|])"
+)
+
+
+class PhraseText:
+    """A text cut into words, ready for any number of has_phrase calls."""
+
+    __slots__ = ("raw", "joined", "toks", "sep", "nl", "eol", "dash", "bar", "tail", "memo")
+
+    def __init__(self):
+        self.raw = ""
+        self.joined = ""
+        self.toks = []
+        self.sep = []
+        self.nl = []
+        self.eol = []
+        self.dash = []
+        self.bar = []
+        self.tail = False
+        self.memo = {}
+
+
+def phrase_text(value):
+    """Cut value into words in one pass (see phraseText in phrases.ts)."""
+    s = ("" if value is None else str(value)).lower()
+    n = len(s)
+    t = PhraseText()
+    t.raw = s
+    toks, sep, nl, eol, dash, bar = t.toks, t.sep, t.nl, t.eol, t.dash, t.bar
+    start = -1
+    tok_bar = False
+    pend_sep = pend_nl = pend_eol = False
+    close = -2 if "*/" in s else -1  # the next "*/" at or after the last search; -1 once none is left
+    piece = _PIECE if close != -1 else _PIECE_NO_COMMENT
+    bulk = _BULK if close != -1 else _BULK_NO_COMMENT
+    i = 0
+    while i < n:
+        if start < 0:
+            m = bulk.match(s, i)
+            if m is not None:
+                words = m.group().split(" ")
+                words.pop()
+                rest = len(words) - 1
+                toks.extend(words)
+                sep.append(pend_sep)
+                sep.extend([True] * rest)
+                nl.append(pend_nl)
+                nl.extend([False] * rest)
+                eol.append(pend_eol)
+                eol.extend([False] * rest)
+                dash.extend([w.startswith("--") for w in words])
+                bar.extend([False] * (rest + 1))
+                pend_sep = True
+                pend_nl = pend_eol = False
+                i = m.end()
+                continue
+            m = _CONTINUATIONS.match(s, i)
+            if m is not None:
+                pend_sep = True
+                i = m.end()
+                continue
+        m = piece.match(s, i)
+        kind = m.lastgroup
+        j = m.end()
+        if kind == "plain":
+            if start < 0:
+                start = i
+            i = j
+            continue
+        word_break = False
+        newline = eol_here = False
+        nxt = j
+        if kind == "space":
+            newline = eol_here = "\n" in m.group()
+            word_break = True
+        elif kind == "dash":
+            # A "--" inside a word starts a new one, glued to it: it can open a
+            # comment or an option run but cannot stand for a plain gap.
+            if j - i > 1 and start >= 0:
+                toks.append(s[start:i])
+                sep.append(pend_sep)
+                nl.append(pend_nl)
+                eol.append(pend_eol)
+                dash.append(s.startswith("--", start))
+                bar.append(tok_bar)
+                start = -1
+                tok_bar = False
+                pend_sep = pend_nl = pend_eol = False
+            if start < 0:
+                start = i
+            i = j
+            continue
+        elif kind == "backslash":
+            # Every backslash but the last is followed by a backslash: a
+            # literal character. The last one decides.
+            last = j - 1
+            d = s[j] if j < n else ""
+            if d in ("n", "t", "r") or (d != "" and d in _SPACES):
+                if last > i and start < 0:
+                    start = i
+                word_break = True
+                eol_here = d == "n"
+                nxt = j + 1
+                if last > i:
+                    # the literal backslashes end the word before the escape
+                    toks.append(s[start:last])
+                    sep.append(pend_sep)
+                    nl.append(pend_nl)
+                    eol.append(pend_eol)
+                    dash.append(s.startswith("--", start))
+                    bar.append(tok_bar)
+                    start = -1
+                    tok_bar = False
+                    pend_sep = pend_nl = pend_eol = False
+            else:
+                if start < 0:
+                    start = i
+                i = j
+                continue
+        else:
+            c = s[i]
+            if c == "/" and j < n and s[j] == "*" and close != -1:
+                if close < i + 2:
+                    close = s.find("*/", i + 2)
+                    if close == -1:
+                        piece = _PIECE_NO_COMMENT
+                        bulk = _BULK_NO_COMMENT
+                if close != -1:
+                    word_break = True
+                    nxt = close + 2
+            if not word_break:
+                if start < 0:
+                    start = i
+                if c != "/":
+                    tok_bar = True
+                i = j
+                continue
+        if start >= 0:
+            toks.append(s[start:i])
+            sep.append(pend_sep)
+            nl.append(pend_nl)
+            eol.append(pend_eol)
+            dash.append(s.startswith("--", start))
+            bar.append(tok_bar)
+            start = -1
+            tok_bar = False
+            pend_sep = pend_nl = pend_eol = False
+        pend_sep = True
+        if newline:
+            pend_nl = True
+        if eol_here:
+            pend_eol = True
+        i = nxt
+    if start >= 0:
+        toks.append(s[start:n])
+        sep.append(pend_sep)
+        nl.append(pend_nl)
+        eol.append(pend_eol)
+        dash.append(s.startswith("--", start))
+        bar.append(tok_bar)
+        pend_sep = False
+    t.tail = pend_sep
+    t.joined = " ".join(toks)
+    return t
+
+
+def _next_index(t):
+    """Per word x: the first word at or after x containing ;&|, with a real
+    newline before it, and with any newline before it. Built once per text."""
+    ix = t.memo.get("#next")
+    if ix is None:
+        T = len(t.toks)
+        nb = [T] * (T + 1)
+        nn = [T] * (T + 1)
+        ne = [T] * (T + 1)
+        b = n_ = e = T
+        bar, nl, eol = t.bar, t.nl, t.eol
+        for x in range(T - 1, -1, -1):
+            if bar[x]:
+                b = x
+            if nl[x]:
+                n_ = x
+            if eol[x]:
+                e = x
+            nb[x] = b
+            nn[x] = n_
+            ne[x] = e
+        ix = (nb, nn, ne)
+        t.memo["#next"] = ix
+    return ix
+
+
+def has_phrase(t, needle, bounded=False):
+    """Whether t contains needle (see hasPhrase in phrases.ts)."""
+    words = needle.lower().split(" ")
+    if len(words) == 1:
+        return words[0] in t.raw
+    trailing_gap = words[-1] == ""
+    if trailing_gap:
+        words.pop()
+    for w in words:
+        if w == "" or w not in t.joined:
+            return False
+    toks, sep, dash, tail = t.toks, t.sep, t.dash, t.tail
+    T = len(toks)
+    k = len(words)
+
+    def positions(i):
+        """The words that word i of the phrase can be, by its position."""
+        w = words[i]
+        first = i == 0
+        last = i == k - 1 and not trailing_gap
+        key = ("f" if first else "") + ("l" if last else "") + ("b" if bounded else "") + ":" + w
+        hit = t.memo.get(key)
+        if hit is not None:
+            return hit
+        lw = len(w)
+        if first:
+            out = [q for q, tok in enumerate(toks) if tok.endswith(w)]
+        elif last:
+            out = [q for q, tok in enumerate(toks) if tok.startswith(w)]
+        else:
+            out = [q for q, tok in enumerate(toks) if tok == w]
+        if bounded:
+            kept = []
+            for q in out:
+                tok = toks[q]
+                if first and len(tok) > lw and tok[len(tok) - lw - 1] in _WORD:
+                    continue
+                if last and len(tok) > lw and (tok[lw] in _WORD or tok[lw] == "."):
+                    continue
+                kept.append(q)
+            out = kept
+        t.memo[key] = out
+        return out
+
+    # The words at which the rest of the phrase matches, ascending.
+    ok = positions(k - 1)
+    if trailing_gap:
+        kept = []
+        for q in ok:
+            r = q + 1
+            if r < T:
+                if sep[r] or (dash[r] and not t.bar[r] and (r + 1 < T or tail)):
+                    kept.append(q)
+            elif tail:
+                kept.append(q)
+        ok = kept
+    if k == 1:
+        return bool(ok)
+    nb, nn, ne = _next_index(t)
+    for i in range(k - 2, -1, -1):
+        ok_sep = [q for q in ok if sep[q]]
+        ok_set = set(ok_sep)
+        memo = {}
+
+        def option(r):
+            # An option run reaches any word before a ;&| word or a real newline.
+            j = bisect_left(ok_sep, r + 1)
+            return j < len(ok_sep) and ok_sep[j] <= min(nb[r], nn[r + 1], T - 1)
+
+        def reach(r):
+            # The gap that starts at word r leads into the rest of the phrase:
+            # directly, after an option run, or after -- comments, each of
+            # which runs to the next newline.
+            path = []
+            cur = r
+            while True:
+                if cur >= T:
+                    val = False
+                    break
+                if cur in memo:
+                    val = memo[cur]
+                    break
+                if cur in ok_set or (dash[cur] and option(cur)):
+                    val = memo[cur] = True
+                    break
+                if not dash[cur]:
+                    val = memo[cur] = False
+                    break
+                path.append(cur)
+                cur = ne[cur + 1]
+            for x in path:
+                memo[x] = val
+            return val
+
+        ok = [p for p in positions(i) if reach(p + 1)]
+        if not ok:
+            return False
+    return bool(ok)
+`;
+//# sourceMappingURL=phrasesPy.js.map

package/dist/lib/phrasesPy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"phrasesPy.js","sourceRoot":"","sources":["../../src/lib/phrasesPy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoV1C,CAAA"}

package/dist/lib/policySnapshot.d.ts

@@ -4,7 +4,7 @@
  *
  * # Why
  *
- * TD-307: `POST /api/v1/hook-gate` was called by two of thirteen gates, so DLP,
+ * `POST /api/v1/hook-gate` was called by two of thirteen gates, so DLP,
  * `BLOCK:` SOPs, SSO policy and promoted findings reached two of thirteen. The
  * obvious repair — route the other eleven through the gate — is the wrong one:
  * those eleven enforce locally and **fail closed**, the two network callers were
@@ -54,12 +54,28 @@
  *
  * @module
  */
+import { type McpRegistryRecord, type SsoGroupPolicy } from '@intutic/shared-types';
 import { type GuardPattern } from '../harness/protectedPaths.js';
 /** Directory every gate looks in. Inside `.intutic/hooks`, which is already
  *  protected — see the module note. */
 export declare const DEFAULT_SNAPSHOT_DIR: string;
 export declare const SNAPSHOT_JSON = "policy-snapshot.json";
 export declare const SNAPSHOT_RULES = "policy-snapshot.rules";
+/**
+ * The subdirectory of the snapshot directory holding the last snapshot the
+ * daemon wrote and so verified: both artifacts, byte for byte, read-only.
+ * Inside `.intutic/hooks`, which every gate refuses to touch. The settings
+ * guard compares the live snapshot with it and restores it when they differ
+ * ({@link restoreVerifiedSnapshot}), the way a policy agent keeps its last
+ * verified bundle active when a new one fails verification.
+ */
+export declare const VERIFIED_SNAPSHOT_DIR = "verified";
+/**
+ * Whether a `.rules` text verifies: it carries a `#digest` line, and the
+ * digest of its data lines matches it — the check every gate makes. A
+ * missing digest fails, since the writer always writes one.
+ */
+export declare function snapshotRulesVerify(text: string): boolean;
 /**
  * Whether the destructive tier ships as `block` or as `warn`.
  *
@@ -93,10 +109,9 @@ export declare const DESTRUCTIVE_TIER_SEVERITY: 'block' | 'warn';
  * is not that kind of rule: it does not run `scanSkillContent` or judge
  * anything about what a skill file says, only WHERE a write's target path
  * points — `.agents/skills/**` or `.claude/skills/**`, a deterministic,
- * zero-ambiguity match. TD-358 (`docs/TECH_DEBT.md`) says this about exactly
- * that distinction: "Path-matching is the one exception, and it is not
+ * zero-ambiguity match. Path-matching is the one exception, and it is not
  * actually an exception to the measurement requirement — it never needed
- * one." There is no false-positive rate to earn a promotion by measuring,
+ * one. There is no false-positive rate to earn a promotion by measuring,
  * because there is nothing probabilistic here to measure in the first place.
  *
  * The second half of the argument is what `warn` actually buys on this
@@ -131,7 +146,7 @@ export declare const SKILL_SURFACE_TIER_SEVERITY: 'block' | 'warn';
  * ships as `block` or as `warn`.
  *
  * `block`, licensed by a measurement rather than by argument, unlike
- * `SKILL_SURFACE_TIER_SEVERITY` above. TD-358 held content enforcement at warn
+ * `SKILL_SURFACE_TIER_SEVERITY` above. Content enforcement was held at warn
  * until `scanSkillContent`'s false-positive rate on real benign skills had been
  * measured. It now has: 350 vendored SKILL.md files
  * (`packages/shared-types/src/__tests__/corpus/skills/`), and the nine patterns
@@ -159,7 +174,7 @@ export interface ResolvedPolicy {
         action: string;
         reason: string;
         /**
-         * LLD #71: `'guardrail'` on rules the control plane projects from a cited
+         * `'guardrail'` on rules the control plane projects from a cited
          * policy guardrail. The only origin for which `action: 'warn'` is shipped
          * (at severity `warn`, report-only); every other warn rule is still
          * dropped, the HIGH/CRITICAL catch-all included.
@@ -174,9 +189,9 @@ export interface ResolvedPolicy {
      * this same field name off `workspaces.settings`, so this is not a new
      * name invented for the snapshot). Absent/empty means unrestricted — the
      * MCP proxy already reads it that way (`packages/mcp-proxy/src/policy.ts`),
-     * and the gate-side `#mcpservers` header this field feeds
+     * and the gate-side `@mcp_allowlist` record this field feeds
      * (`writePolicySnapshot` below) preserves the same convention: an empty
-     * list omits the header entirely rather than shipping a deny-everything one.
+     * list writes no record rather than a deny-everything one.
      */
     mcpAllowedServers: string[];
     /**
@@ -187,6 +202,29 @@ export interface ResolvedPolicy {
      * here degrades in.
      */
     sqlDropStrictBlock: boolean;
+    /**
+     * The workspace's `sso_group_policy`, as `GET /api/v1/policy/resolve`
+     * serves it (`ssoGroupPolicy`). Absent or null: the workspace has none, and
+     * the snapshot is byte-identical to one written before group rules existed.
+     */
+    ssoGroupPolicy?: SsoGroupPolicy | null;
+    /**
+     * The member the daemon's API key resolves to, with their SSO groups as the
+     * control plane read them for this response (`principal`). Null when the
+     * control plane named no member, which every gate reads as "groups unknown".
+     */
+    principal?: {
+        memberId: string;
+        ssoGroups: string[];
+    } | null;
+    /**
+     * The workspace's MCP server registry decisions (`mcpRegistry`): blocked,
+     * held and approved servers, disabled tools and `mcpDefaultPolicy`. Written
+     * as an `@mcp_registry` record so the hook gates apply them to every
+     * `mcp__<server>__<tool>` call, not only the calls an MCP proxy fronts.
+     * Absent or null: an older control plane, and no record is written.
+     */
+    mcpRegistry?: McpRegistryRecord | null;
 }
 export interface PolicySnapshotOptions {
     controlPlaneUrl: string;
@@ -198,7 +236,7 @@ export interface PolicySnapshotOptions {
      * `review_before:` tokens from the workspace's local SOPs and settings
      * (`parseSopConstraints(...).reviewBefore`). Each becomes a `hold` rule,
      * `sop.local.review_before.<token>`, so every gate holds on them — not only
-     * the Claude Code hook that used to bake them in (TD-474 item 4).
+     * the Claude Code hook that used to bake them in.
      */
     localHoldTokens?: readonly string[];
 }
@@ -228,6 +266,20 @@ export declare function writePolicySnapshot(policy: ResolvedPolicy, snapshotDir?
     digest: string;
     ruleCount: number;
 }>;
+/**
+ * Puts the last verified snapshot back when the live one differs from it.
+ *
+ * `'intact'`: the live snapshot is the verified one, or there is nothing to
+ * compare (no snapshot written yet, or a live one from before the verified
+ * copy existed that still verifies). `'restored'`: either live artifact was
+ * edited, replaced or deleted, and both are the verified copy again.
+ * `'unverifiable'`: the live `.rules` fails its digest and there is no
+ * verified copy to restore, so the caller fetches a fresh snapshot. Any
+ * difference counts, a valid-looking one included: the daemon is the only
+ * writer of these files, so an older snapshot copied back in is tampering
+ * too. Never throws.
+ */
+export declare function restoreVerifiedSnapshot(snapshotDir?: string): Promise<'intact' | 'restored' | 'unverifiable'>;
 /**
  * Fetch and write in one call. Safe to run on every sync cycle.
  *
@@ -235,6 +287,8 @@ export declare function writePolicySnapshot(policy: ResolvedPolicy, snapshotDir?
  * failed fetch leaves the previous snapshot in place, which is the correct
  * degradation — stale rules stay enforced. If they expired into permissiveness,
  * "kill the daemon and wait" would be a supported way to disarm governance.
+ * The one thing a failed fetch does change: when the control plane refuses
+ * the key itself, the member's SSO groups are forgotten (`forgetSnapshotMember`).
  */
 export declare function refreshPolicySnapshot(opts: PolicySnapshotOptions): Promise<{
     digest: string;

package/dist/lib/policySnapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policySnapshot.d.ts","sourceRoot":"","sources":["../../src/lib/policySnapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAQH,OAAO,EAKL,KAAK,YAAY,EAClB,MAAM,8BAA8B,CAAA;AAIrC;uCACuC;AACvC,eAAO,MAAM,oBAAoB,QAA+C,CAAA;AAChF,eAAO,MAAM,aAAa,yBAAyB,CAAA;AACnD,eAAO,MAAM,cAAc,0BAA0B,CAAA;AAErD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,yBAAyB,EAAE,OAAO,GAAG,MAAe,CAAA;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,eAAO,MAAM,2BAA2B,EAAE,OAAO,GAAG,MAAgB,CAAA;AAEpE;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,2BAA2B,EAAE,OAAO,GAAG,MAAgB,CAAA;AAEpE;;;;mEAImE;AACnE,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,KAAK,CAAC;QACd,EAAE,EAAE,MAAM,CAAA;QACV,WAAW,EAAE,MAAM,CAAA;QACnB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,MAAM,EAAE,MAAM,CAAA;QACd,MAAM,EAAE,MAAM,CAAA;QACd;;;;;WAKG;QACH,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAC,CAAA;IACF,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;;;;;;;;OAUG;IACH,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B;;;;;;OAMG;IACH,kBAAkB,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAgDD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmD/E;AA4FD;oFACoF;AACpF,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA4ChC;AAyDD;mEACmE;AACnE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,EAAE,eAAe,GAAE,SAAS,MAAM,EAAO,GAAG,YAAY,EAAE,CAiElH;AA+BD;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,cAAc,EACtB,WAAW,GAAE,MAA6B,EAC1C,eAAe,GAAE,SAAS,MAAM,EAAO,GACtC,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAmHhD;AAaD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CASvD"}
+{"version":3,"file":"policySnapshot.d.ts","sourceRoot":"","sources":["../../src/lib/policySnapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAOH,OAAO,EAQL,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,EAKL,KAAK,YAAY,EAClB,MAAM,8BAA8B,CAAA;AAIrC;uCACuC;AACvC,eAAO,MAAM,oBAAoB,QAA+C,CAAA;AAChF,eAAO,MAAM,aAAa,yBAAyB,CAAA;AACnD,eAAO,MAAM,cAAc,0BAA0B,CAAA;AAErD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,aAAa,CAAA;AAE/C;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMzD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,yBAAyB,EAAE,OAAO,GAAG,MAAe,CAAA;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,eAAO,MAAM,2BAA2B,EAAE,OAAO,GAAG,MAAgB,CAAA;AAEpE;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,2BAA2B,EAAE,OAAO,GAAG,MAAgB,CAAA;AAEpE;;;;mEAImE;AACnE,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,KAAK,CAAC;QACd,EAAE,EAAE,MAAM,CAAA;QACV,WAAW,EAAE,MAAM,CAAA;QACnB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,MAAM,EAAE,MAAM,CAAA;QACd,MAAM,EAAE,MAAM,CAAA;QACd;;;;;WAKG;QACH,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAC,CAAA;IACF,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;;;;;;;;OAUG;IACH,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B;;;;;;OAMG;IACH,kBAAkB,EAAE,OAAO,CAAA;IAC3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI,CAAA;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAA;IAC5D;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAgDD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmD/E;AAuGD;oFACoF;AACpF,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAGhC;AA8GD;mEACmE;AACnE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,EAAE,eAAe,GAAE,SAAS,MAAM,EAAO,GAAG,YAAY,EAAE,CAoElH;AAqGD;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,cAAc,EACtB,WAAW,GAAE,MAA6B,EAC1C,eAAe,GAAE,SAAS,MAAM,EAAO,GACtC,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAsIhD;AAaD;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,GAAE,MAA6B,GACzC,OAAO,CAAC,QAAQ,GAAG,UAAU,GAAG,cAAc,CAAC,CAsBjD;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAcvD"}