@provos/ironcurtain 0.7.2 → 0.9.0

package/dist/trusted-process/index.js

@@ -10,7 +10,10 @@ import { prepareToolArgs } from './path-utils.js';
 import { extractPolicyRoots, toMcpRoots, directoryForPath } from './policy-roots.js';
 import * as logger from '../logger.js';
 import { extractMcpErrorMessage } from './mcp-error-utils.js';
+import { extractTextFromContent, buildAuditEntry } from './mcp-proxy-server.js';
 import { updateServerContext, formatServerContext } from './server-context.js';
+import { buildTrustedServerSet } from '../memory/memory-annotations.js';
+import { createApprovalWhitelist, extractWhitelistCandidates, } from './approval-whitelist.js';
 /**
  * Detects Docker-style `-e VAR_NAME` args (no `=`) where the env var is unset.
  */
@@ -35,6 +38,7 @@ export class TrustedProcess {
     auditLog;
     escalation;
     onEscalation;
+    whitelist;
     autoApproveModel = null;
     lastUserMessage = null;
     serverContextMap = new Map();
@@ -47,7 +51,8 @@ export class TrustedProcess {
         });
         checkConstitutionFreshness(compiledPolicy, config.constitutionPath);
         const serverDomainAllowlists = extractServerDomainAllowlists(config.mcpServers);
-        this.policyEngine = new PolicyEngine(compiledPolicy, toolAnnotations, config.protectedPaths, config.allowedDirectory, serverDomainAllowlists, dynamicLists);
+        const trustedServers = buildTrustedServerSet(config.mcpServers);
+        this.policyEngine = new PolicyEngine(compiledPolicy, toolAnnotations, config.protectedPaths, config.allowedDirectory, serverDomainAllowlists, dynamicLists, trustedServers);
         const policyRoots = extractPolicyRoots(compiledPolicy, config.allowedDirectory);
         this.mcpRoots = toMcpRoots(policyRoots);
         this.mcpManager = new MCPClientManager();
@@ -56,6 +61,7 @@ export class TrustedProcess {
         });
         this.escalation = new EscalationHandler();
         this.onEscalation = options?.onEscalation;
+        this.whitelist = createApprovalWhitelist();
     }
     /**
      * Sets the most recent user message for auto-approval context.
@@ -114,9 +120,16 @@ export class TrustedProcess {
      */
     async handleToolCall(request) {
         const startTime = Date.now();
-        // Annotation-driven normalization: split into transport vs policy args
+        // Annotation-driven normalization: split into transport vs policy args.
+        // Trusted servers skip annotation lookup and prepareToolArgs — use raw args directly.
         const annotation = this.policyEngine.getAnnotation(request.serverName, request.toolName, request.arguments);
-        if (!annotation) {
+        let argsForTransport;
+        let argsForPolicy;
+        if (!annotation && this.policyEngine.isTrustedServer(request.serverName)) {
+            argsForTransport = request.arguments;
+            argsForPolicy = request.arguments;
+        }
+        else if (!annotation) {
             const reason = `Missing annotation for tool: ${request.serverName}__${request.toolName}. Re-run 'ironcurtain annotate-tools' to update.`;
             return {
                 requestId: request.requestId,
@@ -126,7 +139,9 @@ export class TrustedProcess {
                 durationMs: Date.now() - startTime,
             };
         }
-        const { argsForTransport, argsForPolicy } = prepareToolArgs(request.arguments, annotation, this.config.allowedDirectory);
+        else {
+            ({ argsForTransport, argsForPolicy } = prepareToolArgs(request.arguments, annotation, this.config.allowedDirectory));
+        }
         const policyRequest = { ...request, arguments: argsForPolicy };
         const transportRequest = { ...request, arguments: argsForTransport };
         // Step 1: Evaluate request against the policy rule chain
@@ -138,44 +153,72 @@ export class TrustedProcess {
         };
         let escalationResult;
         let autoApproved = false;
+        let whitelistApproved = false;
+        let whitelistPatternId;
         let resultContent;
         let resultStatus;
         let resultError;
         try {
-            // Step 2: Handle escalation -- try auto-approve first, then human
+            // Step 2: Handle escalation -- whitelist check, auto-approve, then human
             if (evaluation.decision === 'escalate') {
-                // Try auto-approve before prompting the human
-                if (this.autoApproveModel && this.lastUserMessage) {
-                    const autoResult = await autoApprove({
-                        userMessage: this.lastUserMessage,
-                        toolName: `${request.serverName}/${request.toolName}`,
-                        escalationReason: evaluation.reason,
-                    }, this.autoApproveModel);
-                    if (autoResult.decision === 'approve') {
-                        autoApproved = true;
-                        escalationResult = 'approved';
-                        policyDecision.status = 'allow';
-                        policyDecision.reason = `Auto-approved: ${autoResult.reasoning}`;
-                    }
+                // Annotation is guaranteed non-null here: trusted servers always allow (never escalate),
+                // and missing-annotation returns early above. Narrow the type for TypeScript.
+                const resolvedAnnotation = annotation;
+                const whitelistMatch = this.whitelist.match(request.serverName, request.toolName, argsForPolicy, resolvedAnnotation);
+                if (whitelistMatch.matched) {
+                    whitelistApproved = true;
+                    whitelistPatternId = whitelistMatch.patternId;
+                    escalationResult = 'approved';
+                    policyDecision.status = 'allow';
+                    policyDecision.reason = `Whitelist-approved: ${whitelistMatch.pattern.description}`;
                 }
-                // Fall through to human escalation if not auto-approved
-                if (!autoApproved) {
-                    const escalationContext = formatServerContext(this.serverContextMap, transportRequest.serverName);
-                    escalationResult = this.onEscalation
-                        ? await this.onEscalation(transportRequest, evaluation.reason, escalationContext)
-                        : await this.escalation.prompt(transportRequest, evaluation.reason, escalationContext);
-                    if (escalationResult === 'approved') {
-                        policyDecision.status = 'allow';
-                        policyDecision.reason = 'Approved by human during escalation';
+                if (!whitelistApproved) {
+                    // Try auto-approve before prompting the human
+                    if (this.autoApproveModel && this.lastUserMessage) {
+                        const autoResult = await autoApprove({
+                            userMessage: this.lastUserMessage,
+                            toolName: `${request.serverName}/${request.toolName}`,
+                            escalationReason: evaluation.reason,
+                        }, this.autoApproveModel);
+                        if (autoResult.decision === 'approve') {
+                            autoApproved = true;
+                            escalationResult = 'approved';
+                            policyDecision.status = 'allow';
+                            policyDecision.reason = `Auto-approved: ${autoResult.reasoning}`;
+                        }
                     }
-                    else {
-                        policyDecision.status = 'deny';
-                        policyDecision.reason = 'Denied by human during escalation';
+                    // Fall through to human escalation if not auto-approved
+                    if (!autoApproved) {
+                        // Extract whitelist candidates for display
+                        const escalationId = `inprocess-${Date.now()}`;
+                        const candidates = extractWhitelistCandidates(request.serverName, request.toolName, argsForPolicy, resolvedAnnotation, evaluation.escalatedRoles, escalationId, evaluation.reason);
+                        const candidatePatterns = candidates.patterns;
+                        const candidateIpcs = candidates.ipcs.length > 0 ? candidates.ipcs : undefined;
+                        const escalationContext = formatServerContext(this.serverContextMap, transportRequest.serverName);
+                        const escalationResponse = this.onEscalation
+                            ? await this.onEscalation(transportRequest, evaluation.reason, escalationContext, candidateIpcs)
+                            : { decision: await this.escalation.prompt(transportRequest, evaluation.reason, escalationContext) };
+                        escalationResult = escalationResponse.decision;
+                        if (escalationResponse.decision === 'approved') {
+                            policyDecision.status = 'allow';
+                            policyDecision.reason = 'Approved by human during escalation';
+                            // Handle whitelist selection
+                            if (escalationResponse.whitelistSelection !== undefined &&
+                                escalationResponse.whitelistSelection >= 0 &&
+                                escalationResponse.whitelistSelection < candidatePatterns.length) {
+                                const selectedPattern = candidatePatterns[escalationResponse.whitelistSelection];
+                                this.whitelist.add(selectedPattern);
+                            }
+                        }
+                        else {
+                            policyDecision.status = 'deny';
+                            policyDecision.reason = 'Denied by human during escalation';
+                        }
                     }
                 }
                 // Expand roots to include target directories so the filesystem
                 // server accepts the forwarded call (for both auto and human approval).
-                if (escalationResult === 'approved') {
+                if (escalationResult === 'approved' && annotation) {
                     const pathValues = extractAnnotatedPaths(transportRequest.arguments, annotation, getPathRoles());
                     for (const p of pathValues) {
                         const dir = directoryForPath(p);
@@ -192,13 +235,7 @@ export class TrustedProcess {
                 resultContent = mcpResult;
                 if (mcpResult.isError) {
                     resultStatus = 'error';
-                    const content = mcpResult.content;
-                    if (Array.isArray(content)) {
-                        resultError = content
-                            .filter((c) => c.type === 'text' && typeof c.text === 'string')
-                            .map((c) => c.text)
-                            .join('\n');
-                    }
+                    resultError = extractTextFromContent(mcpResult.content);
                 }
                 else {
                     resultStatus = 'success';
@@ -217,23 +254,16 @@ export class TrustedProcess {
         }
         const durationMs = Date.now() - startTime;
         // Step 4: Append-only audit log (records argsForTransport -- what was sent to MCP server)
-        const auditEntry = {
-            timestamp: new Date().toISOString(),
-            requestId: transportRequest.requestId,
-            serverName: transportRequest.serverName,
-            toolName: transportRequest.toolName,
-            arguments: transportRequest.arguments,
-            policyDecision,
+        this.auditLog.log(buildAuditEntry(transportRequest, transportRequest.arguments, policyDecision, {
+            status: resultStatus,
+            content: resultStatus === 'success' ? resultContent : undefined,
+            error: resultError,
+        }, durationMs, {
             escalationResult,
-            result: {
-                status: resultStatus,
-                content: resultStatus === 'success' ? resultContent : undefined,
-                error: resultError,
-            },
-            durationMs,
             autoApproved: autoApproved || undefined,
-        };
-        this.auditLog.log(auditEntry);
+            whitelistApproved: whitelistApproved || undefined,
+            whitelistPatternId,
+        }));
         // Step 5: Return result to caller
         return {
             requestId: transportRequest.requestId,

package/dist/trusted-process/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trusted-process/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAgB,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAyB,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAEtG;;GAEG;AACH,SAAS,iBAAiB,CAAC,IAAc;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;YACD,CAAC,EAAE,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAYD,MAAM,OAAO,cAAc;IAYf;IAXF,YAAY,CAAe;IAC3B,UAAU,CAAmB;IAC7B,QAAQ,CAAY;IACpB,QAAQ,CAAW;IACnB,UAAU,CAAoB;IAC9B,YAAY,CAAsB;IAClC,gBAAgB,GAA2B,IAAI,CAAC;IAChD,eAAe,GAAkB,IAAI,CAAC;IACtC,gBAAgB,GAAqB,IAAI,GAAG,EAAE,CAAC;IAEvD,YACU,MAAyB,EACjC,OAA+B;QADvB,WAAM,GAAN,MAAM,CAAmB;QAGjC,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,mBAAmB,CAAC;YAC5E,SAAS,EAAE,MAAM,CAAC,YAAY;YAC9B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,YAAY;YACpE,WAAW,EAAE,sBAAsB,EAAE;SACtC,CAAC,CAAC;QACH,0BAA0B,CAAC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEpE,MAAM,sBAAsB,GAAG,6BAA6B,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChF,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAClC,cAAc,EACd,eAAe,EACf,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,gBAAgB,EACvB,sBAAsB,EACtB,YAAY,CACb,CAAC;QAEF,MAAM,WAAW,GAAG,kBAAkB,CAAC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QAExC,IAAI,CAAC,UAAU,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE;YAChD,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,OAAO;SACjD,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,iBAAiB,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,OAAe;QAChC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1E,+EAA+E;YAC/E,MAAM,WAAW,GAAG,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,wBAAwB,IAAI,sCAAsC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACxG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,6BAA6B,IAAI,KAAK,CAAC,CAAC;YACpD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,oCAAoC,IAAI,MAAM,GAAG,aAAa,CAAC,CAAC;gBAC5E,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,4BAA4B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QAC1G,CAAC;QAED,uCAAuC;QACvC,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC;QAC7D,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,GAAG,MAAM,mBAAmB,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACvG,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;gBAC5D,0CAA0C;gBAC1C,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,OAAwB;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,uEAAuE;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5G,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,gCAAgC,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,QAAQ,kDAAkD,CAAC;YACzI,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;gBACjC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE;gBACtE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,eAAe,CACzD,OAAO,CAAC,SAAS,EACjB,UAAU,EACV,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAC7B,CAAC;QACF,MAAM,aAAa,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QAC/D,MAAM,gBAAgB,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;QAErE,yDAAyD;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC7D,MAAM,cAAc,GAAmB;YACrC,MAAM,EAAE,UAAU,CAAC,QAAQ;YAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC;QAEF,IAAI,gBAAmD,CAAC;QACxD,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,aAAsB,CAAC;QAC3B,IAAI,YAA4C,CAAC;QACjD,IAAI,WAA+B,CAAC;QAEpC,IAAI,CAAC;YACH,kEAAkE;YAClE,IAAI,UAAU,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACvC,8CAA8C;gBAC9C,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;oBAClD,MAAM,UAAU,GAAG,MAAM,WAAW,CAClC;wBACE,WAAW,EAAE,IAAI,CAAC,eAAe;wBACjC,QAAQ,EAAE,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,EAAE;wBACrD,gBAAgB,EAAE,UAAU,CAAC,MAAM;qBACpC,EACD,IAAI,CAAC,gBAAgB,CACtB,CAAC;oBAEF,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;wBACtC,YAAY,GAAG,IAAI,CAAC;wBACpB,gBAAgB,GAAG,UAAU,CAAC;wBAC9B,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC;wBAChC,cAAc,CAAC,MAAM,GAAG,kBAAkB,UAAU,CAAC,SAAS,EAAE,CAAC;oBACnE,CAAC;gBACH,CAAC;gBAED,wDAAwD;gBACxD,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;oBAClG,gBAAgB,GAAG,IAAI,CAAC,YAAY;wBAClC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,UAAU,CAAC,MAAM,EAAE,iBAAiB,CAAC;wBACjF,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;oBAEzF,IAAI,gBAAgB,KAAK,UAAU,EAAE,CAAC;wBACpC,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC;wBAChC,cAAc,CAAC,MAAM,GAAG,qCAAqC,CAAC;oBAChE,CAAC;yBAAM,CAAC;wBACN,cAAc,CAAC,MAAM,GAAG,MAAM,CAAC;wBAC/B,cAAc,CAAC,MAAM,GAAG,mCAAmC,CAAC;oBAC9D,CAAC;gBACH,CAAC;gBAED,+DAA+D;gBAC/D,wEAAwE;gBACxE,IAAI,gBAAgB,KAAK,UAAU,EAAE,CAAC;oBACpC,MAAM,UAAU,GAAG,qBAAqB,CAAC,gBAAgB,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;oBACjG,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;wBAC3B,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;wBAChC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE;4BACzD,GAAG,EAAE,UAAU,GAAG,EAAE;4BACpB,IAAI,EAAE,qBAAqB;yBAC5B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAED,+DAA+D;YAC/D,IAAI,cAAc,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBACtC,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAC/C,gBAAgB,CAAC,UAAU,EAC3B,gBAAgB,CAAC,QAAQ,EACzB,gBAAgB,CAAC,SAAS,CAC3B,CAA6C,CAAC;gBAC/C,aAAa,GAAG,SAAS,CAAC;gBAE1B,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;oBACtB,YAAY,GAAG,OAAO,CAAC;oBACvB,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;oBAClC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC3B,WAAW,GAAG,OAAO;6BAClB,MAAM,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;6BACvF,GAAG,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC;6BACrD,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,YAAY,GAAG,SAAS,CAAC;oBACzB,mBAAmB,CACjB,IAAI,CAAC,gBAAgB,EACrB,gBAAgB,CAAC,UAAU,EAC3B,gBAAgB,CAAC,QAAQ,EACzB,gBAAgB,CAAC,SAAS,CAC3B,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,aAAa,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC;gBAChE,YAAY,GAAG,QAAQ,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,GAAG,OAAO,CAAC;YACvB,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;YAC1C,aAAa,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,0FAA0F;QAC1F,MAAM,UAAU,GAAe;YAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,UAAU,EAAE,gBAAgB,CAAC,UAAU;YACvC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;YACnC,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,cAAc;YACd,gBAAgB;YAChB,MAAM,EAAE;gBACN,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;gBAC/D,KAAK,EAAE,WAAW;aACnB;YACD,UAAU;YACV,YAAY,EAAE,YAAY,IAAI,SAAS;SACxC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE9B,kCAAkC;QAClC,OAAO;YACL,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,aAAa;YACtB,cAAc;YACd,UAAU;SACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;CACF"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trusted-process/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAgB,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAyB,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,GAG3B,MAAM,yBAAyB,CAAC;AAEjC;;GAEG;AACH,SAAS,iBAAiB,CAAC,IAAc;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;YACD,CAAC,EAAE,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAqBD,MAAM,OAAO,cAAc;IAaf;IAZF,YAAY,CAAe;IAC3B,UAAU,CAAmB;IAC7B,QAAQ,CAAY;IACpB,QAAQ,CAAW;IACnB,UAAU,CAAoB;IAC9B,YAAY,CAAsB;IACzB,SAAS,CAAoB;IACtC,gBAAgB,GAA2B,IAAI,CAAC;IAChD,eAAe,GAAkB,IAAI,CAAC;IACtC,gBAAgB,GAAqB,IAAI,GAAG,EAAE,CAAC;IAEvD,YACU,MAAyB,EACjC,OAA+B;QADvB,WAAM,GAAN,MAAM,CAAmB;QAGjC,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,mBAAmB,CAAC;YAC5E,SAAS,EAAE,MAAM,CAAC,YAAY;YAC9B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,YAAY;YACpE,WAAW,EAAE,sBAAsB,EAAE;SACtC,CAAC,CAAC;QACH,0BAA0B,CAAC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEpE,MAAM,sBAAsB,GAAG,6BAA6B,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChF,MAAM,cAAc,GAAG,qBAAqB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChE,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAClC,cAAc,EACd,eAAe,EACf,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,gBAAgB,EACvB,sBAAsB,EACtB,YAAY,EACZ,cAAc,CACf,CAAC;QAEF,MAAM,WAAW,GAAG,kBAAkB,CAAC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QAExC,IAAI,CAAC,UAAU,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE;YAChD,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,OAAO;SACjD,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,iBAAiB,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,uBAAuB,EAAE,CAAC;IAC7C,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,OAAe;QAChC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1E,+EAA+E;YAC/E,MAAM,WAAW,GAAG,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,wBAAwB,IAAI,sCAAsC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACxG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,6BAA6B,IAAI,KAAK,CAAC,CAAC;YACpD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,oCAAoC,IAAI,MAAM,GAAG,aAAa,CAAC,CAAC;gBAC5E,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,4BAA4B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QAC1G,CAAC;QAED,uCAAuC;QACvC,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC;QAC7D,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,GAAG,MAAM,mBAAmB,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACvG,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;gBAC5D,0CAA0C;gBAC1C,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,OAAwB;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,wEAAwE;QACxE,sFAAsF;QACtF,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5G,IAAI,gBAAyC,CAAC;QAC9C,IAAI,aAAsC,CAAC;QAE3C,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACzE,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC;YACrC,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,CAAC;aAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,gCAAgC,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,QAAQ,kDAAkD,CAAC;YACzI,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;gBACjC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE;gBACtE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,CAAC,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,eAAe,CACpD,OAAO,CAAC,SAAS,EACjB,UAAU,EACV,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAC7B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,aAAa,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QAC/D,MAAM,gBAAgB,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;QAErE,yDAAyD;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC7D,MAAM,cAAc,GAAmB;YACrC,MAAM,EAAE,UAAU,CAAC,QAAQ;YAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC;QAEF,IAAI,gBAAmD,CAAC;QACxD,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,kBAAsC,CAAC;QAC3C,IAAI,aAAsB,CAAC;QAC3B,IAAI,YAA4C,CAAC;QACjD,IAAI,WAA+B,CAAC;QAEpC,IAAI,CAAC;YACH,yEAAyE;YACzE,IAAI,UAAU,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACvC,yFAAyF;gBACzF,8EAA8E;gBAC9E,MAAM,kBAAkB,GAAG,UAA4B,CAAC;gBACxD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CACzC,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,QAAQ,EAChB,aAAa,EACb,kBAAkB,CACnB,CAAC;gBACF,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;oBAC3B,iBAAiB,GAAG,IAAI,CAAC;oBACzB,kBAAkB,GAAG,cAAc,CAAC,SAAS,CAAC;oBAC9C,gBAAgB,GAAG,UAAU,CAAC;oBAC9B,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC;oBAChC,cAAc,CAAC,MAAM,GAAG,uBAAuB,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBACtF,CAAC;gBAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBACvB,8CAA8C;oBAC9C,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;wBAClD,MAAM,UAAU,GAAG,MAAM,WAAW,CAClC;4BACE,WAAW,EAAE,IAAI,CAAC,eAAe;4BACjC,QAAQ,EAAE,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,EAAE;4BACrD,gBAAgB,EAAE,UAAU,CAAC,MAAM;yBACpC,EACD,IAAI,CAAC,gBAAgB,CACtB,CAAC;wBAEF,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;4BACtC,YAAY,GAAG,IAAI,CAAC;4BACpB,gBAAgB,GAAG,UAAU,CAAC;4BAC9B,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC;4BAChC,cAAc,CAAC,MAAM,GAAG,kBAAkB,UAAU,CAAC,SAAS,EAAE,CAAC;wBACnE,CAAC;oBACH,CAAC;oBAED,wDAAwD;oBACxD,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,2CAA2C;wBAC3C,MAAM,YAAY,GAAG,aAAa,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;wBAC/C,MAAM,UAAU,GAAG,0BAA0B,CAC3C,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,QAAQ,EAChB,aAAa,EACb,kBAAkB,EAClB,UAAU,CAAC,cAAc,EACzB,YAAY,EACZ,UAAU,CAAC,MAAM,CAClB,CAAC;wBACF,MAAM,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC;wBAC9C,MAAM,aAAa,GACjB,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;wBAE3D,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;wBAClG,MAAM,kBAAkB,GAAqB,IAAI,CAAC,YAAY;4BAC5D,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,UAAU,CAAC,MAAM,EAAE,iBAAiB,EAAE,aAAa,CAAC;4BAChG,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;wBAEvG,gBAAgB,GAAG,kBAAkB,CAAC,QAAQ,CAAC;wBAE/C,IAAI,kBAAkB,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;4BAC/C,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC;4BAChC,cAAc,CAAC,MAAM,GAAG,qCAAqC,CAAC;4BAE9D,6BAA6B;4BAC7B,IACE,kBAAkB,CAAC,kBAAkB,KAAK,SAAS;gCACnD,kBAAkB,CAAC,kBAAkB,IAAI,CAAC;gCAC1C,kBAAkB,CAAC,kBAAkB,GAAG,iBAAiB,CAAC,MAAM,EAChE,CAAC;gCACD,MAAM,eAAe,GAAG,iBAAiB,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;gCACjF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;4BACtC,CAAC;wBACH,CAAC;6BAAM,CAAC;4BACN,cAAc,CAAC,MAAM,GAAG,MAAM,CAAC;4BAC/B,cAAc,CAAC,MAAM,GAAG,mCAAmC,CAAC;wBAC9D,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,+DAA+D;gBAC/D,wEAAwE;gBACxE,IAAI,gBAAgB,KAAK,UAAU,IAAI,UAAU,EAAE,CAAC;oBAClD,MAAM,UAAU,GAAG,qBAAqB,CAAC,gBAAgB,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;oBACjG,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;wBAC3B,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;wBAChC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE;4BACzD,GAAG,EAAE,UAAU,GAAG,EAAE;4BACpB,IAAI,EAAE,qBAAqB;yBAC5B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAED,+DAA+D;YAC/D,IAAI,cAAc,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBACtC,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAC/C,gBAAgB,CAAC,UAAU,EAC3B,gBAAgB,CAAC,QAAQ,EACzB,gBAAgB,CAAC,SAAS,CAC3B,CAA6C,CAAC;gBAC/C,aAAa,GAAG,SAAS,CAAC;gBAE1B,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;oBACtB,YAAY,GAAG,OAAO,CAAC;oBACvB,WAAW,GAAG,sBAAsB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC1D,CAAC;qBAAM,CAAC;oBACN,YAAY,GAAG,SAAS,CAAC;oBACzB,mBAAmB,CACjB,IAAI,CAAC,gBAAgB,EACrB,gBAAgB,CAAC,UAAU,EAC3B,gBAAgB,CAAC,QAAQ,EACzB,gBAAgB,CAAC,SAAS,CAC3B,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,aAAa,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC;gBAChE,YAAY,GAAG,QAAQ,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,GAAG,OAAO,CAAC;YACvB,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;YAC1C,aAAa,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,0FAA0F;QAC1F,IAAI,CAAC,QAAQ,CAAC,GAAG,CACf,eAAe,CACb,gBAAgB,EAChB,gBAAgB,CAAC,SAAS,EAC1B,cAAc,EACd;YACE,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YAC/D,KAAK,EAAE,WAAW;SACnB,EACD,UAAU,EACV;YACE,gBAAgB;YAChB,YAAY,EAAE,YAAY,IAAI,SAAS;YACvC,iBAAiB,EAAE,iBAAiB,IAAI,SAAS;YACjD,kBAAkB;SACnB,CACF,CACF,CAAC;QAEF,kCAAkC;QAClC,OAAO;YACL,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,aAAa;YACtB,cAAc;YACd,UAAU;SACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;CACF"}

package/dist/trusted-process/mcp-proxy-server.d.ts

@@ -38,6 +38,8 @@ import { type UserContext } from './auto-approver.js';
 import { type ServerContextMap } from './server-context.js';
 import type { LanguageModelV3 } from '@ai-sdk/provider';
 import type { MCPServerConfig, SandboxAvailabilityPolicy } from '../config/types.js';
+import { type ApprovalWhitelist } from './approval-whitelist.js';
+import { type ControlApiClient } from '../docker/proxy-tools.js';
 export interface ProxiedTool {
     serverName: string;
     name: string;
@@ -49,6 +51,15 @@ export interface ClientState {
     roots: McpRoot[];
     rootsRefreshed?: () => void;
 }
+/**
+ * Delay before retrying a tool call that returned "access denied" immediately
+ * after roots expansion. The filesystem server needs time to async-validate
+ * (fs.realpath, fs.stat) the new roots after receiving the rootsListChanged
+ * notification. Exported for test access.
+ */
+export declare const ROOTS_RACE_RETRY_DELAY_MS = 200;
+/** Extracts concatenated text from MCP content blocks. */
+export declare function extractTextFromContent(content: unknown): string | undefined;
 /**
  * Returns true when a user context is safe to act on for auto-approval.
  *
@@ -104,6 +115,10 @@ export interface CallToolDeps {
     escalationDir: string | undefined;
     autoApproveModel: LanguageModelV3 | null;
     serverContextMap: ServerContextMap;
+    /** Ephemeral approval whitelist for this session. */
+    whitelist: ApprovalWhitelist;
+    /** Control API client for virtual proxy tools. Only set in virtual-only mode. */
+    controlApiClient?: ControlApiClient | null;
 }
 /**
  * Reads and validates proxy environment variables.
@@ -126,6 +141,12 @@ export declare function resolveServerSandboxConfigs(serversConfig: Record<string
     settingsDir: string;
     serverCwdPaths: Map<string, string>;
 };
+/**
+ * Validates that all argument keys exist in the tool's inputSchema.
+ * Returns null if valid, or an error message listing unknown and valid keys.
+ * Skips validation when the schema has no properties or allows additional properties.
+ */
+export declare function validateToolArguments(args: Record<string, unknown>, inputSchema: Record<string, unknown>): string | null;
 /** Builds a lookup map from tool name to ProxiedTool for routing. */
 export declare function buildToolMap(allTools: ProxiedTool[]): Map<string, ProxiedTool>;
 /**
@@ -136,6 +157,8 @@ export declare function buildAuditEntry(request: ToolCallRequest, argsForTranspo
     escalationResult?: 'approved' | 'denied';
     sandboxed?: boolean;
     autoApproved?: boolean;
+    whitelistApproved?: boolean;
+    whitelistPatternId?: string;
 }): AuditEntry;
 /**
  * Handles a single tool call request: policy evaluation, escalation,