@praxis.guard/auditor-cli 0.0.61 → 0.0.63

package/dist/mcp/evaluate-guard-proposal.js

@@ -0,0 +1,57 @@
+import { evaluatePolicyWithDaemon } from "../daemon/client.js";
+import { daemonModeEnabled } from "../daemon/paths.js";
+import { evaluateMcpProposal, evaluateShellProposal } from "../shell/evaluate.js";
+export function evaluateGuardProposal(input, policy) {
+    const shellCommand = input.proposal.kind === "shell"
+        ? input.proposal.raw_command ?? input.proposal.argv.join(" ")
+        : null;
+    const shellResult = input.proposal.kind === "shell" && shellCommand
+        ? evaluateShellProposal(policy, shellCommand)
+        : null;
+    const mcpResult = input.proposal.kind === "mcp"
+        ? evaluateMcpProposal(policy, input.proposal.argv)
+        : null;
+    return {
+        skipped: shellResult?.skipped ?? mcpResult?.skipped ?? true,
+        evaluation: shellResult?.evaluation ?? mcpResult.evaluation,
+        analysis: shellResult?.analysis,
+        shellCommand,
+    };
+}
+export async function applyDaemonEvaluation(argv, evaluation) {
+    if (!daemonModeEnabled()) {
+        return { skipped: true, evaluation };
+    }
+    try {
+        const daemonEvaluation = await evaluatePolicyWithDaemon(argv);
+        return {
+            skipped: daemonEvaluation.skipped,
+            evaluation: {
+                ...evaluation,
+                tier: daemonEvaluation.tier,
+                classification: daemonEvaluation.classification,
+                flags: daemonEvaluation.flags,
+                reasons: daemonEvaluation.skipped
+                    ? [{ code: "skipped", message: "No policy entry matched in the native daemon." }]
+                    : [
+                        {
+                            code: "policy_match",
+                            message: "Matched policy entry in the native daemon.",
+                            details: {
+                                tool: daemonEvaluation.classification.tool,
+                                command_path: daemonEvaluation.classification.command_path,
+                                verb: daemonEvaluation.classification.verb,
+                                tier: daemonEvaluation.tier,
+                            },
+                        },
+                    ],
+            },
+        };
+    }
+    catch (error) {
+        if (process.env.PRAXIS_GUARD_SPAWN_FALLBACK !== "1")
+            throw error;
+        return { skipped: true, evaluation };
+    }
+}
+//# sourceMappingURL=evaluate-guard-proposal.js.map

package/dist/mcp/evaluate-guard-proposal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-proposal.js","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-proposal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAalF,MAAM,UAAU,qBAAqB,CACnC,KAAiB,EACjB,MAAkB;IAElB,MAAM,YAAY,GAChB,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO;QAC7B,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7D,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,WAAW,GACf,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,YAAY;QAC7C,CAAC,CAAC,qBAAqB,CAAC,MAAM,EAAE,YAAY,CAAC;QAC7C,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,SAAS,GACb,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK;QAC3B,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAClD,CAAC,CAAC,IAAI,CAAC;IAEX,OAAO;QACL,OAAO,EAAE,WAAW,EAAE,OAAO,IAAI,SAAS,EAAE,OAAO,IAAI,IAAI;QAC3D,UAAU,EAAE,WAAW,EAAE,UAAU,IAAI,SAAU,CAAC,UAAU;QAC5D,QAAQ,EAAE,WAAW,EAAE,QAAQ;QAC/B,YAAY;KACb,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAc,EACd,UAA2B;IAE3B,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAC9D,OAAO;YACL,OAAO,EAAE,gBAAgB,CAAC,OAAO;YACjC,UAAU,EAAE;gBACV,GAAG,UAAU;gBACb,IAAI,EAAE,gBAAgB,CAAC,IAAY;gBACnC,cAAc,EAAE,gBAAgB,CAAC,cAAc;gBAC/C,KAAK,EAAE,gBAAgB,CAAC,KAAK;gBAC7B,OAAO,EAAE,gBAAgB,CAAC,OAAO;oBAC/B,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;oBACjF,CAAC,CAAC;wBACE;4BACE,IAAI,EAAE,cAAc;4BACpB,OAAO,EAAE,4CAA4C;4BACrD,OAAO,EAAE;gCACP,IAAI,EAAE,gBAAgB,CAAC,cAAc,CAAC,IAAI;gCAC1C,YAAY,EAAE,gBAAgB,CAAC,cAAc,CAAC,YAAY;gCAC1D,IAAI,EAAE,gBAAgB,CAAC,cAAc,CAAC,IAAI;gCAC1C,IAAI,EAAE,gBAAgB,CAAC,IAAI;6BAC5B;yBACF;qBACF;aACN;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,GAAG;YAAE,MAAM,KAAK,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACvC,CAAC;AACH,CAAC"}

package/dist/mcp/evaluate-guard-run.d.ts

@@ -0,0 +1,23 @@
+import type { Tier } from "../policy/index.js";
+import type { GuardEvaluation } from "../shell/guard-eval.js";
+import type { ApprovalBlock } from "./guard-approval-block.js";
+import type { GuardInput } from "./guard-schemas.js";
+import { applyGuardMode, type GuardDecision } from "./guard-mode.js";
+import { type PolicyState } from "./evaluate-guard-tier.js";
+import { type GuardProposalEvaluation } from "./evaluate-guard-proposal.js";
+export type GuardEvaluationResult = {
+    startedAt: number;
+    eventId: string;
+    proposal: GuardProposalEvaluation;
+    skipped: boolean;
+    evaluation: GuardEvaluation;
+    tier: Tier;
+    reasons: GuardEvaluation["reasons"];
+    decision: GuardDecision;
+    shadow: ReturnType<typeof applyGuardMode>["shadow"];
+    approvalBlock: ApprovalBlock;
+    approvalRequestId: string | null;
+};
+export declare function runGuardEvaluation(input: GuardInput, policyState: PolicyState): Promise<GuardEvaluationResult>;
+export declare function buildGuardResponse(input: GuardInput, result: GuardEvaluationResult): Record<string, unknown>;
+//# sourceMappingURL=evaluate-guard-run.d.ts.map

package/dist/mcp/evaluate-guard-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-run.d.ts","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-run.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,8BAA8B,CAAC;AAgBtC,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,uBAAuB,CAAC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,eAAe,CAAC;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;IACpC,QAAQ,EAAE,aAAa,CAAC;IACxB,MAAM,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,QAAQ,CAAC,CAAC;IACpD,aAAa,EAAE,aAAa,CAAC;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC;AAEF,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,qBAAqB,CAAC,CA2ChC;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,qBAAqB,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiBzB"}

package/dist/mcp/evaluate-guard-run.js

@@ -0,0 +1,75 @@
+import { v4 as uuidv4 } from "uuid";
+import { rememberResolvedWorkspaceRoot, resolveGuardStorageRootFromHints, } from "../bridge/guard-storage-root.js";
+import { daemonModeEnabled } from "../daemon/paths.js";
+import { riskScore } from "./evaluate-guard-tier.js";
+import { applyDaemonEvaluation, evaluateGuardProposal, } from "./evaluate-guard-proposal.js";
+import { resolveGuardEnforcement, } from "./evaluate-guard-approval.js";
+import { loadGuardPolicyState } from "./evaluate-guard-policy.js";
+function rememberGuardWorkspace(input) {
+    const storageRoot = resolveGuardStorageRootFromHints({
+        cwd: input.proposal.cwd,
+        workspaceRoot: input.context?.workspace_root,
+        workspaceRoots: input.context?.workspace_roots,
+    });
+    rememberResolvedWorkspaceRoot(storageRoot);
+    return storageRoot;
+}
+export async function runGuardEvaluation(input, policyState) {
+    const startedAt = performance.now();
+    const eventId = uuidv4();
+    await loadGuardPolicyState(policyState);
+    const storageRoot = rememberGuardWorkspace(input);
+    const proposal = evaluateGuardProposal(input, policyState.policy);
+    let skipped = proposal.skipped;
+    let evaluation = proposal.evaluation;
+    if (daemonModeEnabled()) {
+        const daemon = await applyDaemonEvaluation(evaluation.argv, evaluation);
+        skipped = daemon.skipped;
+        evaluation = daemon.evaluation;
+    }
+    const tier = evaluation.tier;
+    const reasons = [...evaluation.reasons];
+    const enforcement = await resolveGuardEnforcement({
+        guardInput: input,
+        skipped,
+        tier,
+        reasons,
+        argv: evaluation.argv,
+        storageRoot,
+        eventId,
+        policyRevision: policyState.policyRevision,
+        analysis: proposal.analysis,
+    });
+    return {
+        startedAt,
+        eventId,
+        proposal,
+        skipped,
+        evaluation,
+        tier,
+        reasons,
+        decision: enforcement.decision,
+        shadow: enforcement.shadow,
+        approvalBlock: enforcement.approvalBlock,
+        approvalRequestId: enforcement.approvalRequestId,
+    };
+}
+export function buildGuardResponse(input, result) {
+    return {
+        mode: input.mode,
+        decision: result.decision,
+        skipped: result.skipped,
+        tier: result.tier,
+        risk_score: riskScore(result.skipped, result.tier),
+        reasons: result.reasons,
+        shadow: result.shadow,
+        approval: result.approvalBlock,
+        audit: {
+            event_id: result.eventId,
+            timestamp: new Date().toISOString(),
+            latency_ms: performance.now() - result.startedAt,
+        },
+        execution: { attempted: false, result: null },
+    };
+}
+//# sourceMappingURL=evaluate-guard-run.js.map

package/dist/mcp/evaluate-guard-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-run.js","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EACL,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAMvD,OAAO,EAAE,SAAS,EAAoB,MAAM,0BAA0B,CAAC;AACvE,OAAO,EACL,qBAAqB,EACrB,qBAAqB,GAEtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uBAAuB,GACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,SAAS,sBAAsB,CAAC,KAAiB;IAC/C,MAAM,WAAW,GAAG,gCAAgC,CAAC;QACnD,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG;QACvB,aAAa,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc;QAC5C,cAAc,EAAE,KAAK,CAAC,OAAO,EAAE,eAAe;KAC/C,CAAC,CAAC;IACH,6BAA6B,CAAC,WAAW,CAAC,CAAC;IAC3C,OAAO,WAAW,CAAC;AACrB,CAAC;AAgBD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAiB,EACjB,WAAwB;IAExB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC;IACzB,MAAM,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAExC,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAElD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC/B,IAAI,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;IACrC,IAAI,iBAAiB,EAAE,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACxE,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACzB,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC7B,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC;QAChD,UAAU,EAAE,KAAK;QACjB,OAAO;QACP,IAAI;QACJ,OAAO;QACP,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,WAAW;QACX,OAAO;QACP,cAAc,EAAE,WAAW,CAAC,cAAc;QAC1C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC,CAAC;IAEH,OAAO;QACL,SAAS;QACT,OAAO;QACP,QAAQ;QACR,OAAO;QACP,UAAU;QACV,IAAI;QACJ,OAAO;QACP,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,aAAa,EAAE,WAAW,CAAC,aAAa;QACxC,iBAAiB,EAAE,WAAW,CAAC,iBAAiB;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAiB,EACjB,MAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC;QAClD,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,aAAa;QAC9B,KAAK,EAAE;YACL,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS;SACjD;QACD,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;KAC9C,CAAC;AACJ,CAAC"}

package/dist/mcp/evaluate-guard-telemetry.d.ts

@@ -0,0 +1,22 @@
+import type { Tier } from "../policy/index.js";
+import type { GuardDecision } from "./guard-mode.js";
+import type { GuardInput } from "./guard-schemas.js";
+import type { PolicyState } from "./evaluate-guard-tier.js";
+export declare function emitGuardEvaluationTelemetry(input: {
+    guardInput: GuardInput;
+    policyState: PolicyState;
+    startedAt: number;
+    eventId: string;
+    skipped: boolean;
+    tier: Tier;
+    decision: GuardDecision;
+    argv: string[];
+    shellCommand: string | null;
+    reasons: {
+        message?: string;
+        code?: string;
+    }[];
+    approvalRequestId: string | null;
+    invocationCount: number | null;
+}): void;
+//# sourceMappingURL=evaluate-guard-telemetry.d.ts.map

package/dist/mcp/evaluate-guard-telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-telemetry.d.ts","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-telemetry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAc5D,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,UAAU,EAAE,UAAU,CAAC;IACvB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/C,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,GAAG,IAAI,CAyBP"}

package/dist/mcp/evaluate-guard-telemetry.js

@@ -0,0 +1,38 @@
+import { sendGuardEvent } from "../telemetry/guard-events.js";
+import { getInstallId } from "../cli/install-id.js";
+import { resolveGuardAuditStatus } from "./guard-audit-status.js";
+function firstPolicyReason(reasons) {
+    return (reasons.find((r) => typeof r?.message === "string")?.message ??
+        reasons.find((r) => typeof r?.code === "string")?.code ??
+        null);
+}
+function guardSkipReason(kind) {
+    return kind === "shell" ? "no_governed_invocation" : "mcp_policy_unmatched";
+}
+export function emitGuardEvaluationTelemetry(input) {
+    const status = resolveGuardAuditStatus({ skipped: input.skipped, decision: input.decision });
+    void sendGuardEvent({
+        ts: new Date().toISOString(),
+        status,
+        skipped: input.skipped,
+        ...(input.skipped ? { skip_reason: guardSkipReason(input.guardInput.proposal.kind) } : {}),
+        tool: "auditor-mcp",
+        command_path: input.argv[0] ?? null,
+        verb: input.argv[1] ?? null,
+        resource: input.argv.length > 2 ? input.argv.slice(2).join(" ") : null,
+        reason: firstPolicyReason(input.reasons),
+        cmd: input.shellCommand ?? input.argv.join(" "),
+        tier: input.tier,
+        decision: input.decision,
+        latency_ms: performance.now() - input.startedAt,
+        event_id: input.eventId,
+        installId: getInstallId(),
+        kind: input.guardInput.proposal.kind,
+        ...(input.policyState.policyRevision !== null
+            ? { policy_revision: input.policyState.policyRevision }
+            : {}),
+        ...(input.approvalRequestId ? { approval_request_id: input.approvalRequestId } : {}),
+        meta: { invocation_count: input.invocationCount },
+    });
+}
+//# sourceMappingURL=evaluate-guard-telemetry.js.map

package/dist/mcp/evaluate-guard-telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-telemetry.js","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-telemetry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAKlE,SAAS,iBAAiB,CAAC,OAA8C;IACvE,OAAO,CACL,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ,CAAC,EAAE,OAAO;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC,EAAE,IAAI;QACtD,IAAI,CACL,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAoC;IAC3D,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,sBAAsB,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAa5C;IACC,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7F,KAAK,cAAc,CAAC;QAClB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QACnC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QAC3B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;QACtE,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC;QACxC,GAAG,EAAE,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS;QAC/C,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,SAAS,EAAE,YAAY,EAAE;QACzB,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI;QACpC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,cAAc,KAAK,IAAI;YAC3C,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,WAAW,CAAC,cAAc,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,IAAI,EAAE,EAAE,gBAAgB,EAAE,KAAK,CAAC,eAAe,EAAE;KAClD,CAAC,CAAC;AACL,CAAC"}

package/dist/mcp/evaluate-guard-tier.d.ts

@@ -0,0 +1,18 @@
+import { loadPoliciesV1, type Tier } from "../policy/index.js";
+import { type ApprovalBlock } from "./guard-approval-block.js";
+import { type GuardDecision } from "./guard-mode.js";
+import type { GuardInput } from "./guard-schemas.js";
+export type PolicyState = {
+    policy: Awaited<ReturnType<typeof loadPoliciesV1>>;
+    policyRevision: number | null;
+};
+export declare function riskScore(skipped: boolean, tier: Tier): number;
+export declare function resolveTierDecision(input: {
+    mode: GuardInput["mode"];
+    skipped: boolean;
+    tier: Tier;
+}): {
+    enforceDecision: GuardDecision;
+    approvalBlock: ApprovalBlock;
+};
+//# sourceMappingURL=evaluate-guard-tier.d.ts.map

package/dist/mcp/evaluate-guard-tier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-tier.d.ts","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-tier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,KAAK,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC;IACnD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,CAAC;AAEF,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,MAAM,CAK9D;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;CACZ,GAAG;IAAE,eAAe,EAAE,aAAa,CAAC;IAAC,aAAa,EAAE,aAAa,CAAA;CAAE,CAgCnE"}

package/dist/mcp/evaluate-guard-tier.js

@@ -0,0 +1,42 @@
+import { defaultApprovalBlock } from "./guard-approval-block.js";
+import { tierToPolicyDecision } from "./guard-mode.js";
+export function riskScore(skipped, tier) {
+    if (skipped)
+        return 0;
+    if (tier === "READ")
+        return 0;
+    if (tier === "MUTATE")
+        return 60;
+    return 95;
+}
+export function resolveTierDecision(input) {
+    const { mode, skipped, tier } = input;
+    let enforceDecision = tierToPolicyDecision(tier, skipped);
+    const approvalBlock = defaultApprovalBlock();
+    if (skipped) {
+        return { enforceDecision: "allow", approvalBlock };
+    }
+    if (tier === "DESTRUCTIVE") {
+        return {
+            enforceDecision: "block",
+            approvalBlock: {
+                ...approvalBlock,
+                instructions: "DESTRUCTIVE actions cannot be approved via guard. Escalate outside the agent loop.",
+            },
+        };
+    }
+    if (tier === "READ") {
+        return { enforceDecision: "allow", approvalBlock };
+    }
+    if (mode === "shadow") {
+        return {
+            enforceDecision: "require_approval",
+            approvalBlock: {
+                ...approvalBlock,
+                instructions: "Shadow mode: no approval request created. Re-call with mode enforce to coordinate human approval.",
+            },
+        };
+    }
+    return { enforceDecision, approvalBlock };
+}
+//# sourceMappingURL=evaluate-guard-tier.js.map

package/dist/mcp/evaluate-guard-tier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-tier.js","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-tier.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAsB,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAsB,MAAM,iBAAiB,CAAC;AAQ3E,MAAM,UAAU,SAAS,CAAC,OAAgB,EAAE,IAAU;IACpD,IAAI,OAAO;QAAE,OAAO,CAAC,CAAC;IACtB,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAInC;IACC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACtC,IAAI,eAAe,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,oBAAoB,EAAE,CAAC;IAE7C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,OAAO;YACL,eAAe,EAAE,OAAO;YACxB,aAAa,EAAE;gBACb,GAAG,aAAa;gBAChB,YAAY,EACV,oFAAoF;aACvF;SACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,eAAe,EAAE,kBAAkB;YACnC,aAAa,EAAE;gBACb,GAAG,aAAa;gBAChB,YAAY,EACV,mGAAmG;aACtG;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC;AAC5C,CAAC"}

package/dist/mcp/evaluate-guard.d.ts

@@ -1,9 +1,6 @@
-import { loadPoliciesV1 } from "../policy/index.js";
 import type { GuardInput } from "./guard-schemas.js";
-export type PolicyState = {
-    policy: Awaited<ReturnType<typeof loadPoliciesV1>>;
-    policyRevision: number | null;
-};
+import type { PolicyState } from "./evaluate-guard-tier.js";
+export type { PolicyState } from "./evaluate-guard-tier.js";
 export declare function evaluateGuard(input: GuardInput, policyState: PolicyState): Promise<{
     response: Record<string, unknown>;
     startedAt: number;

package/dist/mcp/evaluate-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate-guard.d.ts","sourceRoot":"","sources":["../../src/mcp/evaluate-guard.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAqC,MAAM,oBAAoB,CAAC;AAkBvF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC;IACnD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,CAAC;AA+CF,wBAAsB,aAAa,CACjC,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAwKnE"}
+{"version":3,"file":"evaluate-guard.d.ts","sourceRoot":"","sources":["../../src/mcp/evaluate-guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAI5D,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,wBAAsB,aAAa,CACjC,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBnE"}

package/dist/mcp/evaluate-guard.js

@@ -1,201 +1,24 @@
-import { v4 as uuidv4 } from "uuid";
-import { loadPoliciesV1, readPoliciesV1Revision } from "../policy/index.js";
-import { rememberResolvedWorkspaceRoot, resolveGuardStorageRootFromHints, } from "../bridge/guard-storage-root.js";
-import { evaluateMcpProposal, evaluateShellProposal } from "../shell/evaluate.js";
-import { sendGuardEvent } from "../telemetry/guard-events.js";
-import { getInstallId } from "../cli/install-id.js";
-import { evaluatePolicyWithDaemon } from "../daemon/client.js";
-import { daemonModeEnabled } from "../daemon/paths.js";
-import { resolveGuardAuditStatus } from "./guard-audit-status.js";
-import { applyGuardMode, tierToPolicyDecision } from "./guard-mode.js";
 import { resetHeartbeatIdle } from "./guard-heartbeat.js";
-import { defaultApprovalBlock, resolveEnforceMutateApproval, } from "./guard-approval-block.js";
-function riskScore(skipped, tier) {
-    if (skipped)
-        return 0;
-    if (tier === "READ")
-        return 0;
-    if (tier === "MUTATE")
-        return 60;
-    return 95;
-}
-function resolveTierDecision(input) {
-    const { mode, skipped, tier } = input;
-    let enforceDecision = tierToPolicyDecision(tier, skipped);
-    const approvalBlock = defaultApprovalBlock();
-    if (skipped) {
-        return { enforceDecision: "allow", approvalBlock };
-    }
-    if (tier === "DESTRUCTIVE") {
-        return {
-            enforceDecision: "block",
-            approvalBlock: {
-                ...approvalBlock,
-                instructions: "DESTRUCTIVE actions cannot be approved via guard. Escalate outside the agent loop.",
-            },
-        };
-    }
-    if (tier === "READ") {
-        return { enforceDecision: "allow", approvalBlock };
-    }
-    if (mode === "shadow") {
-        return {
-            enforceDecision: "require_approval",
-            approvalBlock: {
-                ...approvalBlock,
-                instructions: "Shadow mode: no approval request created. Re-call with mode enforce to coordinate human approval.",
-            },
-        };
-    }
-    return { enforceDecision, approvalBlock };
-}
+import { emitGuardEvaluationTelemetry } from "./evaluate-guard-telemetry.js";
+import { buildGuardResponse, runGuardEvaluation } from "./evaluate-guard-run.js";
 export async function evaluateGuard(input, policyState) {
-    const startedAt = performance.now();
-    const event_id = uuidv4();
     resetHeartbeatIdle();
-    policyState.policy = await loadPoliciesV1();
-    policyState.policyRevision = await readPoliciesV1Revision();
-    const storageRoot = resolveGuardStorageRootFromHints({
-        cwd: input.proposal.cwd,
-        workspaceRoot: input.context?.workspace_root,
-        workspaceRoots: input.context?.workspace_roots,
-    });
-    rememberResolvedWorkspaceRoot(storageRoot);
-    const shellCommand = input.proposal.kind === "shell"
-        ? input.proposal.raw_command ?? input.proposal.argv.join(" ")
-        : null;
-    const shellResult = input.proposal.kind === "shell" && shellCommand
-        ? evaluateShellProposal(policyState.policy, shellCommand)
-        : null;
-    const mcpResult = input.proposal.kind === "mcp"
-        ? evaluateMcpProposal(policyState.policy, input.proposal.argv)
-        : null;
-    let skipped = shellResult?.skipped ?? mcpResult?.skipped ?? true;
-    let evaluation = shellResult?.evaluation ?? mcpResult.evaluation;
-    const analysis = shellResult?.analysis;
-    const argv = evaluation.argv;
-    if (daemonModeEnabled()) {
-        try {
-            const daemonEvaluation = await evaluatePolicyWithDaemon(argv);
-            skipped = daemonEvaluation.skipped;
-            evaluation = {
-                ...evaluation,
-                tier: daemonEvaluation.tier,
-                classification: daemonEvaluation.classification,
-                flags: daemonEvaluation.flags,
-                reasons: daemonEvaluation.skipped
-                    ? [{ code: "skipped", message: "No policy entry matched in the native daemon." }]
-                    : [
-                        {
-                            code: "policy_match",
-                            message: "Matched policy entry in the native daemon.",
-                            details: {
-                                tool: daemonEvaluation.classification.tool,
-                                command_path: daemonEvaluation.classification.command_path,
-                                verb: daemonEvaluation.classification.verb,
-                                tier: daemonEvaluation.tier,
-                            },
-                        },
-                    ],
-            };
-        }
-        catch (error) {
-            if (process.env.PRAXIS_GUARD_SPAWN_FALLBACK !== "1")
-                throw error;
-        }
-    }
-    const tier = evaluation.tier;
-    const reasons = [...evaluation.reasons];
-    const policyReasons = [...evaluation.reasons];
-    let { enforceDecision, approvalBlock } = resolveTierDecision({
-        mode: input.mode,
-        skipped,
-        tier,
-    });
-    let approvalRequestId = null;
-    const hookApprovalRequestId = input.context?.approval?.request_id?.trim() || null;
-    const hookWaitMs = input.context?.wait_ms ?? 0;
-    const redeemHookApproval = !skipped &&
-        tier !== "DESTRUCTIVE" &&
-        input.mode === "enforce" &&
-        hookApprovalRequestId !== null &&
-        hookWaitMs > 0;
-    if (redeemHookApproval ||
-        (!skipped && tier !== "DESTRUCTIVE" && tier !== "READ" && input.mode === "enforce")) {
-        const mutate = await resolveEnforceMutateApproval({
-            guardInput: input,
-            argv,
-            storageRoot,
-            eventId: event_id,
-            policyRevision: policyState.policyRevision,
-            reasons,
-            approval_fingerprint: analysis?.approval_fingerprint_payload ?? null,
-        });
-        enforceDecision = mutate.enforceDecision;
-        approvalBlock = mutate.approvalBlock;
-        approvalRequestId = mutate.approvalRequestId;
-    }
-    const { decision, shadow } = applyGuardMode({
-        mode: input.mode,
-        skipped,
-        tier,
-        policyReasons,
-        enforceDecision,
-    });
-    const response = {
-        mode: input.mode,
-        decision,
-        skipped,
-        tier,
-        risk_score: riskScore(skipped, tier),
-        reasons,
-        shadow,
-        approval: approvalBlock,
-        audit: {
-            event_id,
-            timestamp: new Date().toISOString(),
-            latency_ms: performance.now() - startedAt,
-        },
-        execution: {
-            attempted: false,
-            result: null,
-        },
-    };
-    const firstReason = reasons.find((r) => typeof r?.message === "string")?.message ??
-        reasons.find((r) => typeof r?.code === "string")?.code ??
-        null;
-    const actionVerb = argv[1] ?? null;
-    const actionResource = argv.length > 2 ? argv.slice(2).join(" ") : null;
-    const status = resolveGuardAuditStatus({ skipped, decision });
-    void sendGuardEvent({
-        ts: new Date().toISOString(),
-        status,
-        skipped,
-        ...(skipped
-            ? {
-                skip_reason: input.proposal.kind === "shell" ? "no_governed_invocation" : "mcp_policy_unmatched",
-            }
-            : {}),
-        tool: "auditor-mcp",
-        command_path: argv[0] ?? null,
-        verb: actionVerb,
-        resource: actionResource,
-        reason: firstReason,
-        cmd: shellCommand ?? argv.join(" "),
-        tier,
-        decision,
-        latency_ms: performance.now() - startedAt,
-        event_id,
-        installId: getInstallId(),
-        kind: input.proposal.kind,
-        ...(policyState.policyRevision !== null
-            ? { policy_revision: policyState.policyRevision }
-            : {}),
-        ...(approvalRequestId ? { approval_request_id: approvalRequestId } : {}),
-        meta: {
-            invocation_count: analysis?.invocations.length ?? null,
-        },
+    const result = await runGuardEvaluation(input, policyState);
+    const response = buildGuardResponse(input, result);
+    emitGuardEvaluationTelemetry({
+        guardInput: input,
+        policyState,
+        startedAt: result.startedAt,
+        eventId: result.eventId,
+        skipped: result.skipped,
+        tier: result.tier,
+        decision: result.decision,
+        argv: result.evaluation.argv,
+        shellCommand: result.proposal.shellCommand,
+        reasons: result.reasons,
+        approvalRequestId: result.approvalRequestId,
+        invocationCount: result.proposal.analysis?.invocations.length ?? null,
     });
-    return { response, startedAt };
+    return { response, startedAt: result.startedAt };
 }
 //# sourceMappingURL=evaluate-guard.js.map

package/dist/mcp/evaluate-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate-guard.js","sourceRoot":"","sources":["../../src/mcp/evaluate-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAa,MAAM,oBAAoB,CAAC;AACvF,OAAO,EACL,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAsB,MAAM,iBAAiB,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EACL,oBAAoB,EACpB,4BAA4B,GAE7B,MAAM,2BAA2B,CAAC;AAQnC,SAAS,SAAS,CAAC,OAAgB,EAAE,IAAU;IAC7C,IAAI,OAAO;QAAE,OAAO,CAAC,CAAC;IACtB,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAI5B;IACC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACtC,IAAI,eAAe,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,oBAAoB,EAAE,CAAC;IAE7C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,OAAO;YACL,eAAe,EAAE,OAAO;YACxB,aAAa,EAAE;gBACb,GAAG,aAAa;gBAChB,YAAY,EACV,oFAAoF;aACvF;SACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,eAAe,EAAE,kBAAkB;YACnC,aAAa,EAAE;gBACb,GAAG,aAAa;gBAChB,YAAY,EACV,mGAAmG;aACtG;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAiB,EACjB,WAAwB;IAExB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC;IAC1B,kBAAkB,EAAE,CAAC;IAErB,WAAW,CAAC,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;IAC5C,WAAW,CAAC,cAAc,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAE5D,MAAM,WAAW,GAAG,gCAAgC,CAAC;QACnD,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG;QACvB,aAAa,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc;QAC5C,cAAc,EAAE,KAAK,CAAC,OAAO,EAAE,eAAe;KAC/C,CAAC,CAAC;IACH,6BAA6B,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,YAAY,GAChB,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO;QAC7B,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7D,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,WAAW,GACf,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,YAAY;QAC7C,CAAC,CAAC,qBAAqB,CAAC,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC;QACzD,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,SAAS,GACb,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK;QAC3B,CAAC,CAAC,mBAAmB,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC9D,CAAC,CAAC,IAAI,CAAC;IAEX,IAAI,OAAO,GAAG,WAAW,EAAE,OAAO,IAAI,SAAS,EAAE,OAAO,IAAI,IAAI,CAAC;IACjE,IAAI,UAAU,GAAG,WAAW,EAAE,UAAU,IAAI,SAAU,CAAC,UAAU,CAAC;IAClE,MAAM,QAAQ,GAAG,WAAW,EAAE,QAAQ,CAAC;IACvC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAE7B,IAAI,iBAAiB,EAAE,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC9D,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC;YACnC,UAAU,GAAG;gBACX,GAAG,UAAU;gBACb,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,cAAc,EAAE,gBAAgB,CAAC,cAAc;gBAC/C,KAAK,EAAE,gBAAgB,CAAC,KAAK;gBAC7B,OAAO,EAAE,gBAAgB,CAAC,OAAO;oBAC/B,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;oBACjF,CAAC,CAAC;wBACE;4BACE,IAAI,EAAE,cAAc;4BACpB,OAAO,EAAE,4CAA4C;4BACrD,OAAO,EAAE;gCACP,IAAI,EAAE,gBAAgB,CAAC,cAAc,CAAC,IAAI;gCAC1C,YAAY,EAAE,gBAAgB,CAAC,cAAc,CAAC,YAAY;gCAC1D,IAAI,EAAE,gBAAgB,CAAC,cAAc,CAAC,IAAI;gCAC1C,IAAI,EAAE,gBAAgB,CAAC,IAAI;6BAC5B;yBACF;qBACF;aACN,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,GAAG;gBAAE,MAAM,KAAK,CAAC;QACnE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAS,UAAU,CAAC,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAE9C,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,mBAAmB,CAAC;QAC3D,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO;QACP,IAAI;KACL,CAAC,CAAC;IACH,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAE5C,MAAM,qBAAqB,GAAG,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAClF,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,CAAC,CAAC;IAC/C,MAAM,kBAAkB,GACtB,CAAC,OAAO;QACR,IAAI,KAAK,aAAa;QACtB,KAAK,CAAC,IAAI,KAAK,SAAS;QACxB,qBAAqB,KAAK,IAAI;QAC9B,UAAU,GAAG,CAAC,CAAC;IAEjB,IACE,kBAAkB;QAClB,CAAC,CAAC,OAAO,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,EACnF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;YAChD,UAAU,EAAE,KAAK;YACjB,IAAI;YACJ,WAAW;YACX,OAAO,EAAE,QAAQ;YACjB,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,OAAO;YACP,oBAAoB,EAAE,QAAQ,EAAE,4BAA4B,IAAI,IAAI;SACrE,CAAC,CAAC;QACH,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QACzC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QACrC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC/C,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC;QAC1C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO;QACP,IAAI;QACJ,aAAa;QACb,eAAe;KAChB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG;QACf,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ;QACR,OAAO;QACP,IAAI;QACJ,UAAU,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC;QACpC,OAAO;QACP,MAAM;QACN,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE;YACL,QAAQ;YACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;SAC1C;QACD,SAAS,EAAE;YACT,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,IAAI;SACb;KACF,CAAC;IAEF,MAAM,WAAW,GACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ,CAAC,EAAE,OAAO;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC,EAAE,IAAI;QACtD,IAAI,CAAC;IACP,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACnC,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAE9D,KAAK,cAAc,CAAC;QAClB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,MAAM;QACN,OAAO;QACP,GAAG,CAAC,OAAO;YACT,CAAC,CAAC;gBACE,WAAW,EACT,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,sBAAsB;aACtF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QAC7B,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,WAAW;QACnB,GAAG,EAAE,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI;QACJ,QAAQ;QACR,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;QACzC,QAAQ;QACR,SAAS,EAAE,YAAY,EAAE;QACzB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;QACzB,GAAG,CAAC,WAAW,CAAC,cAAc,KAAK,IAAI;YACrC,CAAC,CAAC,EAAE,eAAe,EAAE,WAAW,CAAC,cAAc,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,IAAI,EAAE;YACJ,gBAAgB,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,IAAI,IAAI;SACvD;KACF,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC"}
+{"version":3,"file":"evaluate-guard.js","sourceRoot":"","sources":["../../src/mcp/evaluate-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAIjF,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAiB,EACjB,WAAwB;IAExB,kBAAkB,EAAE,CAAC;IACrB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnD,4BAA4B,CAAC;QAC3B,UAAU,EAAE,KAAK;QACjB,WAAW;QACX,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI;QAC5B,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY;QAC1C,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,IAAI,IAAI;KACtE,CAAC,CAAC;IACH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;AACnD,CAAC"}

package/dist/mcp/gateway-call-handler.d.ts

@@ -0,0 +1,9 @@
+import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
+import type { GatewayConnection } from "./gateway-connection.js";
+export declare function handleGatewayCallTool(input: {
+    exposed: string;
+    args: Record<string, unknown>;
+    ids: string[];
+    byId: Map<string, GatewayConnection>;
+}): Promise<CallToolResult>;
+//# sourceMappingURL=gateway-call-handler.d.ts.map

package/dist/mcp/gateway-call-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-call-handler.d.ts","sourceRoot":"","sources":["../../src/mcp/gateway-call-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAKzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAmCjE,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CACtC,GAAG,OAAO,CAAC,cAAc,CAAC,CAyC1B"}