@intutic/sync-daemon 2.4.0 → 2.5.0

package/dist/lib/atomicWrite.js

@@ -0,0 +1,104 @@
+/**
+ * atomicWrite.ts — the one way the daemon replaces a whole file that a
+ * harness or a gate reads.
+ *
+ * A gate script, a hook registration, a harness settings file and the policy
+ * snapshot are all read by other processes at moments the daemon does not
+ * choose. A plain `writeFile` truncates first and fills after, so a reader in
+ * between sees an empty or half-written file: a truncated gate script crashes,
+ * and for the exit-code harnesses (Claude Code and most others) a crash with
+ * any code other than 2 lets the tool call through, ungoverned. So every such
+ * write goes to a temp file beside the target and is renamed over it: a
+ * reader opens either the old file or the new one, never a mix.
+ *
+ * `__tests__/lib/atomicWriteGuard.test.ts` fails when a harness writer calls
+ * `writeFile` itself instead of this.
+ *
+ * @module
+ */
+import { randomBytes } from 'node:crypto';
+import * as fs from 'node:fs/promises';
+/** Per-process counter, so two writes from one process never share a temp name. */
+let sequence = 0;
+/**
+ * Replaces `file` with `content` atomically: a unique temp file in the same
+ * directory (a rename is only atomic within one filesystem), written, given
+ * its final mode, flushed to disk, then renamed over the target. On any
+ * failure the temp file is removed and the error rethrown; the target is then
+ * untouched. The parent directory must exist.
+ */
+export async function writeFileAtomic(file, content, options = {}) {
+    const target = options.followSymlink ? await linkTarget(file) : file;
+    const mode = options.mode ?? (await currentMode(target));
+    // pid + counter is unique among live writers; the random part keeps a temp
+    // left behind by a crashed process whose pid came round again from
+    // colliding. `wx` refuses an existing path, a planted symlink included.
+    const tmp = `${target}.${process.pid}-${++sequence}-${randomBytes(4).toString('hex')}.intutic-tmp`;
+    let handle;
+    try {
+        handle = await fs.open(tmp, 'wx', mode ?? 0o666);
+        await handle.writeFile(content);
+        // `open`'s mode passes through the umask; this does not.
+        if (mode !== undefined)
+            await handle.chmod(mode);
+        await handle.sync();
+        await handle.close();
+        handle = undefined;
+        await renameOver(tmp, target, content, mode);
+    }
+    catch (err) {
+        await handle?.close().catch(() => undefined);
+        await fs.rm(tmp, { force: true }).catch(() => undefined);
+        throw err;
+    }
+}
+async function linkTarget(file) {
+    try {
+        return await fs.realpath(file);
+    }
+    catch {
+        // Nothing there yet (or a dangling link): write the path itself.
+        return file;
+    }
+}
+async function currentMode(file) {
+    try {
+        return (await fs.stat(file)).mode & 0o7777;
+    }
+    catch {
+        return undefined;
+    }
+}
+const WINDOWS_RENAME_CODES = new Set(['EPERM', 'EACCES', 'EBUSY']);
+const WINDOWS_RENAME_ATTEMPTS = 5;
+/**
+ * POSIX rename replaces the target whatever its mode and whoever has it open.
+ * Windows refuses while the target is read-only (the 0444 snapshot) or open
+ * without delete sharing (an editor, a virus scanner), usually only for a
+ * moment. So there: clear read-only, retry with a short backoff, and as a last
+ * resort write the target in place, which is what every one of these writes
+ * did before and is better than leaving the old gate or settings in force.
+ */
+async function renameOver(tmp, target, content, mode) {
+    for (let attempt = 1;; attempt++) {
+        try {
+            await fs.rename(tmp, target);
+            return;
+        }
+        catch (err) {
+            const code = err.code ?? '';
+            if (process.platform !== 'win32' || !WINDOWS_RENAME_CODES.has(code))
+                throw err;
+            if (attempt === 1)
+                await fs.chmod(target, 0o666).catch(() => undefined);
+            if (attempt >= WINDOWS_RENAME_ATTEMPTS)
+                break;
+            await new Promise((resolve) => setTimeout(resolve, 25 * 2 ** attempt));
+        }
+    }
+    await fs.writeFile(target, content);
+    if (mode !== undefined)
+        await fs.chmod(target, mode);
+    await fs.rm(tmp, { force: true });
+}
+//# sourceMappingURL=atomicWrite.js.map

package/dist/lib/atomicWrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomicWrite.js","sourceRoot":"","sources":["../../src/lib/atomicWrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAqBtC,mFAAmF;AACnF,IAAI,QAAQ,GAAG,CAAC,CAAA;AAEhB;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,OAA4B,EAC5B,UAA8B,EAAE;IAEhC,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACpE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC,CAAA;IACxD,2EAA2E;IAC3E,mEAAmE;IACnE,wEAAwE;IACxE,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,IAAI,EAAE,QAAQ,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAA;IAClG,IAAI,MAAiC,CAAA;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI,KAAK,CAAC,CAAA;QAChD,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAC/B,yDAAyD;QACzD,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAChD,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QACnB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;QACpB,MAAM,GAAG,SAAS,CAAA;QAClB,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC5C,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACxD,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,MAAM,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;AAClE,MAAM,uBAAuB,GAAG,CAAC,CAAA;AAEjC;;;;;;;GAOG;AACH,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,MAAc,EAAE,OAA4B,EAAE,IAAwB;IAC3G,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAC5B,OAAM;QACR,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,IAAI,EAAE,CAAA;YACtD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,GAAG,CAAA;YAC9E,IAAI,OAAO,KAAK,CAAC;gBAAE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACvE,IAAI,OAAO,IAAI,uBAAuB;gBAAE,MAAK;YAC7C,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IACD,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACpD,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACnC,CAAC"}

package/dist/lib/chaosPy.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The chaos-run fault injection in Python, for the bash gates (their
+ * extractor already requires python3).
+ *
+ * Byte-identical to `packages/intutic-clawde/intutic_clawde/gate/chaos.py`,
+ * which a test compares; edit that file and copy it here. It is the
+ * transliteration of `@intutic/shared-types`'s chaosGate.ts, and both run the
+ * shared vectors.
+ */
+export declare const CHAOS_PY_SOURCE: string;
+//# sourceMappingURL=chaosPy.d.ts.map

package/dist/lib/chaosPy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chaosPy.d.ts","sourceRoot":"","sources":["../../src/lib/chaosPy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,QAqT3B,CAAA"}

package/dist/lib/chaosPy.js

@@ -0,0 +1,320 @@
+/**
+ * The chaos-run fault injection in Python, for the bash gates (their
+ * extractor already requires python3).
+ *
+ * Byte-identical to `packages/intutic-clawde/intutic_clawde/gate/chaos.py`,
+ * which a test compares; edit that file and copy it here. It is the
+ * transliteration of `@intutic/shared-types`'s chaosGate.ts, and both run the
+ * shared vectors.
+ */
+export const CHAOS_PY_SOURCE = String.raw `"""Fault injection in the hook gates, for chaos runs (intutic chaos run).
+
+A transliteration of packages/shared-types/src/chaosGate.ts; read that
+module's docstring for the counter files and why every count lives on disk.
+In short: a gate is a new process per tool call, so the plan is decoded on
+each call, plan_loaded is reported by whichever gate first creates
+EVENTS.gate-plan-loaded, and each fault's seen and hit counts are numbered
+empty files in EVENTS.gate-counters/, each number claimed with an exclusive
+create (O_CREAT | O_EXCL), which exactly one process wins. A permission fault
+never sleeps: it holds the call as an approval hold does, in a
+FAULT.held.KEY.G file whose modification time is when, and the identical
+retry is held again until delay_s has passed, then allowed (delay) or denied
+(hold_then_deny) by the one retry that creates FAULT.released.KEY.G.
+
+The bash gates emit this file verbatim (services/sync-daemon/src/lib/chaosPy.ts
+holds a byte-identical copy, which a test compares), intutic_clawde.gate's
+Gate.guard runs it in process, and every copy runs
+packages/shared-types/fixtures/chaos-gate-vectors.json. It must stay
+self-contained: the standard library only, no module state beyond the
+constants below, and no backtick or dollar-brace, which the TypeScript copy
+cannot hold.
+"""
+
+import base64
+import binascii
+import datetime
+import json
+import os
+import re
+import sys
+import time
+
+_CHAOS_FAULT_IDS = (
+    "llm.rate_limit", "llm.upstream_5xx", "llm.context_trim", "llm.model_degrade", "tool.error", "tool.stale_data",
+    "mcp.toolset_change", "permission.deny_or_delay", "inject.tool_result", "egress.dns_fail", "egress.credential_401",
+)
+_CHAOS_B64URL = re.compile(r"^[A-Za-z0-9_-]+={0,2}$")
+_CHAOS_RUN_ID = re.compile(r"^[A-Za-z0-9_-]{6,64}$")
+_CHAOS_CANARY = re.compile(r"^E-INTUTIC-[0-9A-F]{4,16}$")
+
+
+def _chaos_int(v, low, high):
+    # JSON numbers as JavaScript reads them: 2.0 is the integer 2. A bool is not a number.
+    if isinstance(v, bool) or not isinstance(v, (int, float)):
+        return None
+    if isinstance(v, float):
+        if not v.is_integer():
+            return None
+        v = int(v)
+    return v if low <= v <= high else None
+
+
+def chaos_decode(raw):
+    """(plan, None), or (None, why it is not one)."""
+    def invalid(why):
+        return None, "INTUTIC_CHAOS_PLAN is not a valid plan: " + why
+    try:
+        if not isinstance(raw, str) or not _CHAOS_B64URL.match(raw):
+            raise ValueError("alphabet")
+        b64 = raw.rstrip("=")
+        data = json.loads(base64.urlsafe_b64decode(b64 + "=" * ((4 - len(b64) % 4) % 4)).decode("utf-8"))
+    except (ValueError, binascii.Error, UnicodeDecodeError):
+        return None, "INTUTIC_CHAOS_PLAN is not base64url-encoded JSON"
+    if not isinstance(data, dict):
+        return invalid("not a JSON object")
+    v = data.get("v")
+    if isinstance(v, bool) or v != 1:
+        return invalid("version " + json.dumps(v) + ", and a gate reads only version 1")
+    run_id = data.get("runId")
+    if not isinstance(run_id, str) or not _CHAOS_RUN_ID.match(run_id):
+        return invalid("runId")
+    canary = data.get("canary")
+    if not isinstance(canary, str) or not _CHAOS_CANARY.match(canary):
+        return invalid("canary")
+    raw_faults = data.get("faults")
+    if not isinstance(raw_faults, list) or len(raw_faults) > 50:
+        return invalid("faults")
+    faults = []
+    for i, f in enumerate(raw_faults):
+        at = "faults[" + str(i) + "]"
+        if not isinstance(f, dict) or not isinstance(f.get("id"), str) or f["id"] not in _CHAOS_FAULT_IDS:
+            return invalid(at + ".id")
+        if f["id"] not in ("tool.error", "permission.deny_or_delay"):
+            continue
+        match = None
+        if "match" in f:
+            if not isinstance(f["match"], dict):
+                return invalid(at + ".match")
+            for k, mv in f["match"].items():
+                if k not in ("tool", "host", "model") or not isinstance(mv, str) or not mv:
+                    return invalid(at + ".match." + k)
+            match = f["match"]
+        after_calls = 0
+        if "after_calls" in f:
+            after_calls = _chaos_int(f["after_calls"], 0, 10000)
+            if after_calls is None:
+                return invalid(at + ".after_calls")
+        times = None
+        if "times" in f:
+            times = _chaos_int(f["times"], 1, 10000)
+            if times is None:
+                return invalid(at + ".times")
+        fault = {
+            "index": i, "id": f["id"], "match": match, "after_calls": after_calls, "times": times,
+            "message": "tool failed", "mode": "deny", "delay_s": 0,
+        }
+        if f["id"] == "tool.error" and "message" in f:
+            # Lengths in UTF-16 code units, as JavaScript counts them.
+            m = f["message"]
+            if not isinstance(m, str) or not 1 <= len(m.encode("utf-16-le", "surrogatepass")) // 2 <= 2000:
+                return invalid(at + ".message")
+            fault["message"] = m
+        if f["id"] == "permission.deny_or_delay":
+            if "mode" in f:
+                if f["mode"] not in ("deny", "delay", "hold_then_deny"):
+                    return invalid(at + ".mode")
+                fault["mode"] = f["mode"]
+            if "delay_s" in f:
+                delay_s = _chaos_int(f["delay_s"], 0, 600)
+                if delay_s is None:
+                    return invalid(at + ".delay_s")
+                fault["delay_s"] = delay_s
+        faults.append(fault)
+    return {"runId": run_id, "canary": canary, "faults": faults}, None
+
+
+def chaos_matches(match, tool):
+    """Whether a fault's match covers a gate call, which has a tool and nothing else."""
+    if not match:
+        return True
+    if "host" in match or "model" in match:
+        return False
+    p = match.get("tool")
+    if p is None:
+        return True
+    return tool.endswith(p[1:]) if p.startswith("*") else tool == p
+
+
+def chaos_event(plan, type_, fields, now):
+    """One events-file line: ts, runId, component, type, then the fields that are set."""
+    event = {"ts": now, "runId": plan["runId"], "component": "gate", "type": type_}
+    for k, v in fields:
+        if v is not None:
+            event[k] = v
+    return json.dumps(event, separators=(",", ":"), ensure_ascii=False) + "\n"
+
+
+def chaos_append(events_path, lines):
+    """Appends whole lines in one write. An I/O error is reported, never raised."""
+    try:
+        fd = os.open(events_path, os.O_WRONLY | os.O_APPEND | os.O_CREAT, 0o644)
+        try:
+            os.write(fd, lines.encode("utf-8"))
+        finally:
+            os.close(fd)
+    except OSError as e:
+        sys.stderr.write("[Intutic Governance] chaos: could not append to " + events_path + ": " + str(e) + "\n")
+
+
+def chaos_claim(directory, prefix, limit):
+    """Claims the next numbered file DIRECTORY/PREFIXn with an exclusive create.
+
+    Returns n, 0 when every number up to limit is taken, or -1 on an I/O
+    error, after saying so.
+    """
+    try:
+        # Beside the events file, never creating its directory: the runner did.
+        try:
+            os.mkdir(directory)
+        except FileExistsError:
+            pass
+        n = sum(1 for name in os.listdir(directory) if name.startswith(prefix)) + 1
+        while limit is None or n <= limit:
+            try:
+                os.close(os.open(os.path.join(directory, prefix + str(n)), os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o644))
+                return n
+            except FileExistsError:
+                n += 1
+        return 0
+    except OSError as e:
+        sys.stderr.write("[Intutic Governance] chaos: could not count calls in " + directory + ": " + str(e) + "\n")
+        return -1
+
+
+def chaos_open_hold(directory, fault, key):
+    """The open hold of one fault on one call: (g, created), the number of
+    the newest FAULT.held.KEY.G file with no released twin and its
+    modification time in milliseconds; None when there is none or it cannot
+    be read."""
+    try:
+        held = str(fault) + ".held." + key + "."
+        names = os.listdir(directory)
+        g = 0
+        for name in names:
+            if name.startswith(held) and name[len(held):].isdigit():
+                g = max(g, int(name[len(held):]))
+        if g == 0 or (str(fault) + ".released." + key + "." + str(g)) in names:
+            return None
+        # In whole milliseconds, as now is: a hold is never younger than the call that reads it.
+        return g, os.stat(os.path.join(directory, held + str(g))).st_mtime_ns // 1000000
+    except OSError:
+        # No counters yet, or none readable: no hold to continue.
+        return None
+
+
+def chaos_release(directory, fault, key, g):
+    """Ends hold g with an exclusive create: True for the one caller that does."""
+    try:
+        os.close(os.open(os.path.join(directory, str(fault) + ".released." + key + "." + str(g)),
+                         os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o644))
+        return True
+    except OSError:
+        # Another gate released it first, or it cannot be written.
+        return False
+
+
+def _chaos_ms(now):
+    # The ISO-8601 time a call is decided at, in milliseconds; the clock if unreadable.
+    try:
+        return round(datetime.datetime.fromisoformat(now.replace("Z", "+00:00")).timestamp() * 1000)
+    except (AttributeError, TypeError, ValueError):
+        return int(time.time() * 1000)
+
+
+def chaos_now():
+    """The time as the JavaScript gates write it: 2026-10-10T12:00:00.000Z."""
+    return datetime.datetime.now(datetime.timezone.utc).isoformat(timespec="milliseconds").replace("+00:00", "Z")
+
+
+def chaos_call(plan, events_path, call, now):
+    """Reports one call and returns the fault the gate must apply, or None.
+
+    call: tool, decision (allow, deny, ask or hold, before any fault), ruleId,
+    destructive, policyHit, and key: the call's digest in hex (its tool and
+    input, as the gate keys an approval hold), which a held call's retry
+    shares. The fault: faultId, kind (deny or hold) and reason, as
+    chaosGateCall returns it. now is the ISO-8601 time, and the clock a hold
+    is timed by.
+    """
+    lines = ""
+    first = True
+    try:
+        os.close(os.open(events_path + ".gate-plan-loaded", os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o644))
+    except FileExistsError:
+        first = False
+    except OSError:
+        pass
+    if first:
+        lines += chaos_event(plan, "plan_loaded", [("faults", len(plan["faults"]))], now)
+    lines += chaos_event(plan, "gate_decision", [
+        ("tool", call["tool"]),
+        ("decision", call["decision"]),
+        ("ruleId", call.get("ruleId") or None),
+        ("destructive", bool(call.get("destructive"))),
+        ("policyHit", bool(call.get("policyHit"))),
+    ], now)
+    fault = None
+    if call["decision"] == "allow":
+        directory = events_path + ".gate-counters"
+        key = re.sub(r"[^0-9A-Za-z]", "", str(call.get("key") or ""))[:128] or "call"
+        now_ms = _chaos_ms(now)
+        tag = " [" + plan["canary"] + "]"
+        held = "Permission held for approval; retrying this exact call passes once it is approved" + tag
+        # The retry of a held call: still held until the delay has passed,
+        # then let through or denied by the one retry that releases it.
+        retry = False
+        for f in plan["faults"]:
+            if f["id"] != "permission.deny_or_delay" or f["mode"] == "deny" or not chaos_matches(f["match"], call["tool"]):
+                continue
+            open_hold = chaos_open_hold(directory, f["index"], key)
+            if open_hold is None:
+                continue
+            retry = True
+            if f["delay_s"] > 0 and now_ms - open_hold[1] < f["delay_s"] * 1000:
+                fault = {"faultId": f["id"], "kind": "hold", "reason": held}
+            elif chaos_release(directory, f["index"], key, open_hold[0]):
+                if f["mode"] == "hold_then_deny":
+                    fault = {"faultId": f["id"], "kind": "deny",
+                             "reason": "Permission held for approval, then denied by approver" + tag}
+            else:
+                # Another gate released it first: this call is a new one.
+                retry = False
+                continue
+            break
+        for f in plan["faults"] if not retry else ():
+            if not chaos_matches(f["match"], call["tool"]):
+                continue
+            # An MCP tool's error is the MCP proxy's to inject; a gate injects the built-in side.
+            if f["id"] == "tool.error" and call["tool"].startswith("mcp__"):
+                continue
+            seen = chaos_claim(directory, str(f["index"]) + ".seen.", None)
+            if fault is not None or seen < 1 or seen <= f["after_calls"]:
+                continue
+            if f["times"] is not None and chaos_claim(directory, str(f["index"]) + ".hit.", f["times"]) < 1:
+                continue
+            if f["id"] == "tool.error":
+                fault = {"faultId": f["id"], "kind": "deny", "reason": f["message"] + tag}
+            elif f["mode"] == "deny":
+                fault = {"faultId": f["id"], "kind": "deny", "reason": "Permission denied by approver" + tag}
+            else:
+                # Held from now: the hold's file is what its retries find.
+                if chaos_claim(directory, str(f["index"]) + ".held." + key + ".", None) < 1:
+                    continue
+                fault = {"faultId": f["id"], "kind": "hold", "reason": held}
+            lines += chaos_event(plan, "fault_injected", [("faultId", f["id"]), ("call", seen), ("target", call["tool"])], now)
+        if fault is None or fault["kind"] == "hold":
+            lines += chaos_event(plan, "tool_call", [("tool", call["tool"]), ("ok", fault is None)], now)
+    chaos_append(events_path, lines)
+    return fault
+`;
+//# sourceMappingURL=chaosPy.js.map

package/dist/lib/chaosPy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chaosPy.js","sourceRoot":"","sources":["../../src/lib/chaosPy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqTxC,CAAA"}

package/dist/lib/decisionsDigest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decisionsDigest.d.ts","sourceRoot":"","sources":["../../src/lib/decisionsDigest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAKH,OAAO,EAAE,WAAW,EAAkC,MAAM,uBAAuB,CAAA;AAUnF,sCAAsC;AACtC,eAAO,MAAM,2BAA2B,QAAwC,CAAA;AAEhF,0FAA0F;AAC1F,eAAO,MAAM,qBAAqB,sDAAsD,CAAA;AAExF,2IAA2I;AAC3I,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,oBAAoB,EAAE,CAAA;CAChC;AAED,MAAM,WAAW,sBAAsB;IACrC,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,uGAAuG;IACvG,SAAS,EAAE,WAAW,EAAE,CAAA;CACzB;AAyBD;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,CAAC,sBAAsB,EAAE,iBAAiB,GAAG,QAAQ,GAAG,aAAa,CAAC,GAC/E,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CA0BzC;AAkBD,0EAA0E;AAC1E,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,MAAM,CAO/E;AAED,yFAAyF;AACzF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,oBAAoB,EAAE,EAAE,KAAK,SAAK,GAAG,MAAM,CAO9F;AAgBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BjI;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB/E;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAe5C"}
+{"version":3,"file":"decisionsDigest.d.ts","sourceRoot":"","sources":["../../src/lib/decisionsDigest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAKH,OAAO,EAAE,WAAW,EAAkC,MAAM,uBAAuB,CAAA;AAWnF,sCAAsC;AACtC,eAAO,MAAM,2BAA2B,QAAwC,CAAA;AAEhF,0FAA0F;AAC1F,eAAO,MAAM,qBAAqB,sDAAsD,CAAA;AAExF,2IAA2I;AAC3I,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,oBAAoB,EAAE,CAAA;CAChC;AAED,MAAM,WAAW,sBAAsB;IACrC,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,uGAAuG;IACvG,SAAS,EAAE,WAAW,EAAE,CAAA;CACzB;AAyBD;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,CAAC,sBAAsB,EAAE,iBAAiB,GAAG,QAAQ,GAAG,aAAa,CAAC,GAC/E,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CA0BzC;AAkBD,0EAA0E;AAC1E,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,MAAM,CAO/E;AAED,yFAAyF;AACzF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,oBAAoB,EAAE,EAAE,KAAK,SAAK,GAAG,MAAM,CAO9F;AAgBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BjI;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB/E;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAe5C"}

package/dist/lib/decisionsDigest.js

@@ -65,6 +65,7 @@ import { claudeCodeReadsAgentsMd } from '../harness/claudeAgentsMd.js';
 import { openclawAgentWorkspace } from '../harness/openclawHooks.js';
 import { ensureAiderReadEntry } from '../harness/aiderConfigMerger.js';
 import { forgetOriginal, readOriginal, writeOwnedFile } from '../disconnect/originals.js';
+import { writeFileAtomic } from './atomicWrite.js';
 const log = createLogger('sync-decisions-digest');
 /** Relative to the workspace root. */
 export const DECISIONS_LOG_RELATIVE_PATH = path.join('.intutic', 'DECISIONS.md');
@@ -224,11 +225,7 @@ export async function retireClaudeMdDigest(workspaceRoot) {
             log.info({ action: 'decisions_claude_md_removed', path: file }, 'Removed the CLAUDE.md an earlier version created for the decisions log');
             return;
         }
-        const mode = (await fs.stat(file)).mode & 0o7777;
-        const tmp = `${file}.intutic-tmp`;
-        await fs.writeFile(tmp, next, 'utf-8');
-        await fs.chmod(tmp, mode);
-        await fs.rename(tmp, file);
+        await writeFileAtomic(file, next);
         log.info({ action: 'decisions_claude_md_section_removed', path: file }, 'Took the decisions-log section out of CLAUDE.md');
     }
     await retireRulesFile(file, workspaceRoot);

package/dist/lib/decisionsDigest.js.map

@@ -1 +1 @@
-{"version":3,"file":"decisionsDigest.js","sourceRoot":"","sources":["../../src/lib/decisionsDigest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AACtH,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAA;AACtE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAEzF,MAAM,GAAG,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAEjD,sCAAsC;AACtC,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAA;AAEhF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,qBAAqB,GAAG,mDAAmD,CAAA;AAwBxF;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,CAAS;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAA;IAClB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS;QAAE,GAAG,EAAE,CAAA;IAC/D,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO,CACL,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAC9B,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAgF;IAEhF,MAAM,GAAG,GACP,GAAG,mBAAmB,CAAC,IAAI,CAAC,eAAe,CAAC,oCAAoC;QAChF,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAA;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,WAAW,EAAE;YACvF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,+BAA+B,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAC/D,kCAAkC,CACnC,CAAA;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAA;QAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC1D,MAAM,GAAG,GAAG,IAA+B,CAAA;QAC3C,MAAM,WAAW,GAAG,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAA;QAC5F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QACnF,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAA;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAA;QAC1F,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,SAAS,YAAY,CAAC,OAA+B;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,OAAO,CAAA;IAC/C,OAAO;QACL,mDAAmD;QACnD,gDAAgD;QAChD,wBAAwB,MAAM,EAAE;QAChC,GAAG;QACH,sEAAsE;QACtE,yEAAyE;QACzE,yCAAyC;QACzC,EAAE;QACF,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,uBAAuB,CAAC,OAA+B;IACrE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IACpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,MAAM,2CAA2C,CAAA;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;IACnE,OAAO,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;AACzC,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,0BAA0B,CAAC,OAA+B,EAAE,KAAK,GAAG,EAAE;IACpF,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACvC,MAAM,KAAK,GACT,OAAO,CAAC,MAAM,GAAG,CAAC;QAChB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QACvD,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAA;IACjD,OAAO,CAAC,8BAA8B,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAClE,CAAC;AAED,uFAAuF;AACvF,SAAS,mBAAmB,CAAC,IAAY,EAAE,WAAmB;IAC5D,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,WAAW,WAAW,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9D,OAAO,GAAG,IAAI,GAAG,qBAAqB,uDAAuD,IAAI,IAAI,CAAA;AACvG,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,aAAqB,EAAE,SAAiC,EAAE,IAAY;IAChH,MAAM,kBAAkB,GACtB,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC;QAC3C,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC;QACrD,CAAC,MAAM,uBAAuB,CAAC,aAAa,CAAC,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;QACzC,IAAI,CAAC,MAAM;YAAE,SAAQ;QACrB,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM;YAClD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,sBAAsB,EAAE,EAAE,WAAW,CAAC;YACxD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QAC3C,IAAI,OAAO,KAAK,WAAW,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC;YAC9D,MAAM,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;YAC1C,SAAQ;QACV,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC/B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACjB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,iBAAiB,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAA;YACrE,SAAQ;QACV,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,gCAAgC,CAAC,IAAI,EAAE,CAAC,CAAA;QACvG,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,OAAO;YAAE,MAAM,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;QAC1F,4CAA4C;QAC5C,IAAI,OAAO,KAAK,WAAW,CAAC,KAAK;YAAE,MAAM,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,EAAE,IAAI,CAAC,CAAA;IAClH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,aAAqB;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IAClD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAM;IACzB,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;IACxD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;QACtD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpD,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAClC,MAAM,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;YACzC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,6BAA6B,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,wEAAwE,CAAC,CAAA;YACzI,OAAM;QACR,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,MAAM,CAAA;QAChD,MAAM,GAAG,GAAG,GAAG,IAAI,cAAc,CAAA;QACjC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QACtC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACzB,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC1B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qCAAqC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,iDAAiD,CAAC,CAAA;IAC5H,CAAC;IACD,MAAM,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAA4B;IAE5B,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAA;IAC/C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAEhC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,2BAA2B,CAAC,CAAA;QAC3E,MAAM,WAAW,CAAC,QAAQ,EAAE,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;QAEpE,MAAM,qBAAqB,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,0BAA0B,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;QAE/G,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAA;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,GAAG,EAAE,EAAE,qCAAqC,CAAC,CAAA;QACjG,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}
+{"version":3,"file":"decisionsDigest.js","sourceRoot":"","sources":["../../src/lib/decisionsDigest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AACtH,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAA;AACtE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAElD,MAAM,GAAG,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAEjD,sCAAsC;AACtC,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAA;AAEhF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,qBAAqB,GAAG,mDAAmD,CAAA;AAwBxF;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,CAAS;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAA;IAClB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS;QAAE,GAAG,EAAE,CAAA;IAC/D,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO,CACL,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAC9B,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAgF;IAEhF,MAAM,GAAG,GACP,GAAG,mBAAmB,CAAC,IAAI,CAAC,eAAe,CAAC,oCAAoC;QAChF,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAA;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,WAAW,EAAE;YACvF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,+BAA+B,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAC/D,kCAAkC,CACnC,CAAA;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAA;QAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC1D,MAAM,GAAG,GAAG,IAA+B,CAAA;QAC3C,MAAM,WAAW,GAAG,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAA;QAC5F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QACnF,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAA;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAA;QAC1F,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,SAAS,YAAY,CAAC,OAA+B;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,OAAO,CAAA;IAC/C,OAAO;QACL,mDAAmD;QACnD,gDAAgD;QAChD,wBAAwB,MAAM,EAAE;QAChC,GAAG;QACH,sEAAsE;QACtE,yEAAyE;QACzE,yCAAyC;QACzC,EAAE;QACF,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,uBAAuB,CAAC,OAA+B;IACrE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IACpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,MAAM,2CAA2C,CAAA;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;IACnE,OAAO,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;AACzC,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,0BAA0B,CAAC,OAA+B,EAAE,KAAK,GAAG,EAAE;IACpF,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACvC,MAAM,KAAK,GACT,OAAO,CAAC,MAAM,GAAG,CAAC;QAChB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QACvD,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAA;IACjD,OAAO,CAAC,8BAA8B,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAClE,CAAC;AAED,uFAAuF;AACvF,SAAS,mBAAmB,CAAC,IAAY,EAAE,WAAmB;IAC5D,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,WAAW,WAAW,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9D,OAAO,GAAG,IAAI,GAAG,qBAAqB,uDAAuD,IAAI,IAAI,CAAA;AACvG,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,aAAqB,EAAE,SAAiC,EAAE,IAAY;IAChH,MAAM,kBAAkB,GACtB,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC;QAC3C,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC;QACrD,CAAC,MAAM,uBAAuB,CAAC,aAAa,CAAC,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;QACzC,IAAI,CAAC,MAAM;YAAE,SAAQ;QACrB,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM;YAClD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,sBAAsB,EAAE,EAAE,WAAW,CAAC;YACxD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QAC3C,IAAI,OAAO,KAAK,WAAW,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC;YAC9D,MAAM,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;YAC1C,SAAQ;QACV,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC/B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACjB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,iBAAiB,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAA;YACrE,SAAQ;QACV,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,gCAAgC,CAAC,IAAI,EAAE,CAAC,CAAA;QACvG,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,OAAO;YAAE,MAAM,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;QAC1F,4CAA4C;QAC5C,IAAI,OAAO,KAAK,WAAW,CAAC,KAAK;YAAE,MAAM,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,EAAE,IAAI,CAAC,CAAA;IAClH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,aAAqB;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IAClD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAM;IACzB,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;IACxD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;QACtD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpD,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAClC,MAAM,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;YACzC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,6BAA6B,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,wEAAwE,CAAC,CAAA;YACzI,OAAM;QACR,CAAC;QACD,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACjC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qCAAqC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,iDAAiD,CAAC,CAAA;IAC5H,CAAC;IACD,MAAM,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAA4B;IAE5B,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAA;IAC/C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAEhC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,2BAA2B,CAAC,CAAA;QAC3E,MAAM,WAAW,CAAC,QAAQ,EAAE,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;QAEpE,MAAM,qBAAqB,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,0BAA0B,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;QAE/G,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAA;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,GAAG,EAAE,EAAE,qCAAqC,CAAC,CAAA;QACjG,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/lib/egressPolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"egressPolicy.d.ts","sourceRoot":"","sources":["../../src/lib/egressPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAUH,eAAO,MAAM,wBAAwB,QAA+C,CAAA;AACpF,eAAO,MAAM,kBAAkB,uBAAuB,CAAA;AAEtD,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,CAAA;AAEtD,wFAAwF;AACxF,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IACvB,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,sCAAsC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAaD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAElF;AAED;;0DAE0D;AAC1D,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CA0BvC;AAED;;yCAEyC;AACzC,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,qBAAqB,EAC7B,WAAW,EAAE,MAAM,EACnB,QAAQ,GAAE,MAAiC,GAC1C,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;CAAE,CAAC,CAuBtD;AAED;;sBAEsB;AACtB,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAAC,CAS7D"}
+{"version":3,"file":"egressPolicy.d.ts","sourceRoot":"","sources":["../../src/lib/egressPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAWH,eAAO,MAAM,wBAAwB,QAA+C,CAAA;AACpF,eAAO,MAAM,kBAAkB,uBAAuB,CAAA;AAEtD,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,CAAA;AAEtD,wFAAwF;AACxF,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IACvB,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,sCAAsC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAaD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAElF;AAED;;0DAE0D;AAC1D,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CA0BvC;AAED;;yCAEyC;AACzC,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,qBAAqB,EAC7B,WAAW,EAAE,MAAM,EACnB,QAAQ,GAAE,MAAiC,GAC1C,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;CAAE,CAAC,CAoBtD;AAED;;sBAEsB;AACtB,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAAC,CAS7D"}

package/dist/lib/egressPolicy.js

@@ -30,6 +30,7 @@ import * as path from 'node:path';
 import * as os from 'node:os';
 import { createHash } from 'node:crypto';
 import { createLogger } from '@intutic/logger';
+import { writeFileAtomic } from './atomicWrite.js';
 const log = createLogger('sync-egress-policy');
 export const DEFAULT_EGRESS_CACHE_DIR = path.join(os.homedir(), '.intutic', 'hooks');
 export const EGRESS_POLICY_FILE = 'egress-policy.json';
@@ -101,10 +102,7 @@ export async function writeEgressPolicy(policy, workspaceId, cacheDir = DEFAULT_
     const text = JSON.stringify(doc, null, 2) + '\n';
     await fs.mkdir(cacheDir, { recursive: true });
     const target = path.join(cacheDir, EGRESS_POLICY_FILE);
-    const tmp = target + '.tmp';
-    await fs.writeFile(tmp, text, { encoding: 'utf-8' });
-    await fs.chmod(tmp, 0o444);
-    await fs.rename(tmp, target);
+    await writeFileAtomic(target, text, { mode: 0o444 });
     log.debug({ action: 'egress_policy_written', digest, mode: policy.mode, count: policy.allow.length, dir: cacheDir }, 'Egress policy cache refreshed');
     return { digest, mode: policy.mode };
 }

package/dist/lib/egressPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"egressPolicy.js","sourceRoot":"","sources":["../../src/lib/egressPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,GAAG,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAA;AAE9C,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AAmBtD;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,CAAS;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAA;IAClB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS;QAAE,GAAG,EAAE,CAAA;IAC/D,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAuB,EAAE,KAAe;IACxE,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC1C,CAAC;AAED;;0DAE0D;AAC1D,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAyB;IAEzB,MAAM,GAAG,GACP,GAAG,mBAAmB,CAAC,IAAI,CAAC,eAAe,CAAC,iCAAiC;QAC7E,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAA;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,WAAW,EAAE;YACvF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAA;YAChG,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAA;QAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC1D,MAAM,GAAG,GAAG,IAA+B,CAAA;QAC3C,MAAM,IAAI,GACR,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;QAC1F,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;YACpC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAC7E,CAAC,CAAC,EAAE,CAAA;QACN,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,EAAE,2BAA2B,CAAC,CAAA;QAC7E,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;yCAEyC;AACzC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAA6B,EAC7B,WAAmB,EACnB,WAAmB,wBAAwB;IAE3C,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;SACpD,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACf,MAAM,GAAG,GAAG;QACV,SAAS,EAAE,WAAW;QACtB,MAAM;QACN,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAA;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAA;IAEhD,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAA;IACtD,MAAM,GAAG,GAAG,MAAM,GAAG,MAAM,CAAA;IAC3B,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;IACpD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC1B,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAE5B,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,+BAA+B,CAAC,CAAA;IACrJ,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;AACtC,CAAC;AAED;;sBAEsB;AACtB,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,CAAA;IACrD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAChC,IAAI,CAAC;QACH,OAAO,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,IAAI,wBAAwB,CAAC,CAAA;IACrG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,GAAG,EAAE,EAAE,qCAAqC,CAAC,CAAA;QAC9F,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}
+{"version":3,"file":"egressPolicy.js","sourceRoot":"","sources":["../../src/lib/egressPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAElD,MAAM,GAAG,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAA;AAE9C,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AAmBtD;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,CAAS;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAA;IAClB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS;QAAE,GAAG,EAAE,CAAA;IAC/D,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAuB,EAAE,KAAe;IACxE,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC1C,CAAC;AAED;;0DAE0D;AAC1D,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAyB;IAEzB,MAAM,GAAG,GACP,GAAG,mBAAmB,CAAC,IAAI,CAAC,eAAe,CAAC,iCAAiC;QAC7E,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAA;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,WAAW,EAAE;YACvF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAA;YAChG,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAA;QAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC1D,MAAM,GAAG,GAAG,IAA+B,CAAA;QAC3C,MAAM,IAAI,GACR,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;QAC1F,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;YACpC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAC7E,CAAC,CAAC,EAAE,CAAA;QACN,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,EAAE,2BAA2B,CAAC,CAAA;QAC7E,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;yCAEyC;AACzC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAA6B,EAC7B,WAAmB,EACnB,WAAmB,wBAAwB;IAE3C,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;SACpD,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACf,MAAM,GAAG,GAAG;QACV,SAAS,EAAE,WAAW;QACtB,MAAM;QACN,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAA;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAA;IAEhD,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAA;IACtD,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAEpD,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,+BAA+B,CAAC,CAAA;IACrJ,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;AACtC,CAAC;AAED;;sBAEsB;AACtB,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,CAAA;IACrD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAChC,IAAI,CAAC;QACH,OAAO,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,IAAI,wBAAwB,CAAC,CAAA;IACrG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,GAAG,EAAE,EAAE,qCAAqC,CAAC,CAAA;QAC9F,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/lib/policySnapshot.d.ts

@@ -79,7 +79,7 @@ export declare function snapshotRulesVerify(text: string): boolean;
 /**
  * Whether the destructive tier ships as `block` or as `warn`.
  *
- * `warn`. These seven patterns qualify for `block` on the merits — every one is
+ * `warn`. These eight patterns qualify for `block` on the merits — every one is
  * unrecoverable without a reinstall or a backup — but they have never run
  * against real developer traffic, and they would land on thirteen harnesses at
  * once. A false positive here does not merely annoy: the fastest workaround
@@ -103,7 +103,7 @@ export declare const DESTRUCTIVE_TIER_SEVERITY: 'block' | 'warn';
  *
  * `block` — deliberately not following `DESTRUCTIVE_TIER_SEVERITY`'s warn-first
  * ramp, because the thing that ramp is buying time for does not exist on this
- * surface. `DESTRUCTIVE_COMMAND_PATTERNS` rides at `warn` because those seven
+ * surface. `DESTRUCTIVE_COMMAND_PATTERNS` rides at `warn` because those eight
  * families are unmeasured against real developer traffic and a false positive
  * has a real cost (see that constant's own comment). `SKILL_SURFACE_PATTERNS`
  * is not that kind of rule: it does not run `scanSkillContent` or judge

package/dist/lib/policySnapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policySnapshot.d.ts","sourceRoot":"","sources":["../../src/lib/policySnapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAOH,OAAO,EAQL,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,EAKL,KAAK,YAAY,EAClB,MAAM,8BAA8B,CAAA;AAIrC;uCACuC;AACvC,eAAO,MAAM,oBAAoB,QAA+C,CAAA;AAChF,eAAO,MAAM,aAAa,yBAAyB,CAAA;AACnD,eAAO,MAAM,cAAc,0BAA0B,CAAA;AAErD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,aAAa,CAAA;AAE/C;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMzD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,yBAAyB,EAAE,OAAO,GAAG,MAAe,CAAA;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,eAAO,MAAM,2BAA2B,EAAE,OAAO,GAAG,MAAgB,CAAA;AAEpE;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,2BAA2B,EAAE,OAAO,GAAG,MAAgB,CAAA;AAEpE;;;;mEAImE;AACnE,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,KAAK,CAAC;QACd,EAAE,EAAE,MAAM,CAAA;QACV,WAAW,EAAE,MAAM,CAAA;QACnB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,MAAM,EAAE,MAAM,CAAA;QACd,MAAM,EAAE,MAAM,CAAA;QACd;;;;;WAKG;QACH,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAC,CAAA;IACF,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;;;;;;;;OAUG;IACH,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B;;;;;;OAMG;IACH,kBAAkB,EAAE,OAAO,CAAA;IAC3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI,CAAA;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAA;IAC5D;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAgDD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmD/E;AAuGD;oFACoF;AACpF,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAGhC;AA8GD;mEACmE;AACnE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,EAAE,eAAe,GAAE,SAAS,MAAM,EAAO,GAAG,YAAY,EAAE,CAoElH;AAqGD;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,cAAc,EACtB,WAAW,GAAE,MAA6B,EAC1C,eAAe,GAAE,SAAS,MAAM,EAAO,GACtC,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAsIhD;AAaD;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,GAAE,MAA6B,GACzC,OAAO,CAAC,QAAQ,GAAG,UAAU,GAAG,cAAc,CAAC,CAsBjD;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAcvD"}
+{"version":3,"file":"policySnapshot.d.ts","sourceRoot":"","sources":["../../src/lib/policySnapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAOH,OAAO,EAUL,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAA;AAG9B,OAAO,EAKL,KAAK,YAAY,EAClB,MAAM,8BAA8B,CAAA;AAIrC;uCACuC;AACvC,eAAO,MAAM,oBAAoB,QAA+C,CAAA;AAChF,eAAO,MAAM,aAAa,yBAAyB,CAAA;AACnD,eAAO,MAAM,cAAc,0BAA0B,CAAA;AAErD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,aAAa,CAAA;AAE/C;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMzD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,yBAAyB,EAAE,OAAO,GAAG,MAAe,CAAA;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,eAAO,MAAM,2BAA2B,EAAE,OAAO,GAAG,MAAgB,CAAA;AAEpE;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,2BAA2B,EAAE,OAAO,GAAG,MAAgB,CAAA;AAEpE;;;;mEAImE;AACnE,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,KAAK,CAAC;QACd,EAAE,EAAE,MAAM,CAAA;QACV,WAAW,EAAE,MAAM,CAAA;QACnB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,MAAM,EAAE,MAAM,CAAA;QACd,MAAM,EAAE,MAAM,CAAA;QACd;;;;;WAKG;QACH,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAC,CAAA;IACF,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;;;;;;;;OAUG;IACH,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B;;;;;;OAMG;IACH,kBAAkB,EAAE,OAAO,CAAA;IAC3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI,CAAA;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAA;IAC5D;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAgDD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmD/E;AAuGD;oFACoF;AACpF,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAGhC;AA8GD;mEACmE;AACnE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,EAAE,eAAe,GAAE,SAAS,MAAM,EAAO,GAAG,YAAY,EAAE,CAoElH;AAqGD;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,cAAc,EACtB,WAAW,GAAE,MAA6B,EAC1C,eAAe,GAAE,SAAS,MAAM,EAAO,GACtC,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAEhD;AA0KD;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,GAAE,MAA6B,GACzC,OAAO,CAAC,QAAQ,GAAG,UAAU,GAAG,cAAc,CAAC,CAEjD;AA0BD;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAcvD"}