@provos/ironcurtain 0.8.0 → 0.9.0

package/dist/trusted-process/gworkspace-credentials.js

@@ -0,0 +1,45 @@
+/**
+ * Google Workspace credential file management.
+ *
+ * Writes credential files in the format expected by
+ * @alanse/mcp-server-google-workspace's auth.ts.
+ *
+ * SECURITY: The refresh_token field is intentionally omitted.
+ * This prevents the MCP server from independently refreshing tokens,
+ * which would cause refresh token rotation races in multi-session
+ * environments. IronCurtain's OAuthTokenProvider is the sole token
+ * authority.
+ *
+ * The file is written atomically (write to .tmp, rename) to prevent
+ * the MCP server from reading a partial file during a refresh cycle.
+ */
+import { mkdirSync, renameSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+/** The filename the MCP server expects in its GWORKSPACE_CREDS_DIR. */
+export const GWORKSPACE_CREDENTIAL_FILENAME = '.gworkspace-credentials.json';
+/**
+ * Writes a Google Workspace credential file for the MCP server.
+ *
+ * Creates the directory if it does not exist. Writes atomically via
+ * a temporary file + rename to prevent the MCP server from reading
+ * a partial file. File permissions are set to 0o600 (owner-only).
+ *
+ * @param credsDir - Directory to write the credential file into
+ * @param accessToken - OAuth2 access token (short-lived)
+ * @param expiresAt - Token expiry timestamp in milliseconds since epoch
+ * @param scopes - OAuth2 scopes granted to this token
+ */
+export function writeGWorkspaceCredentialFile(credsDir, accessToken, expiresAt, scopes) {
+    mkdirSync(credsDir, { recursive: true });
+    const credential = {
+        access_token: accessToken,
+        expiry_date: expiresAt,
+        token_type: 'Bearer',
+        scope: scopes.join(' '),
+    };
+    const filePath = join(credsDir, GWORKSPACE_CREDENTIAL_FILENAME);
+    const tmpPath = filePath + '.tmp';
+    writeFileSync(tmpPath, JSON.stringify(credential, null, 2), { mode: 0o600 });
+    renameSync(tmpPath, filePath);
+}
+//# sourceMappingURL=gworkspace-credentials.js.map

package/dist/trusted-process/gworkspace-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gworkspace-credentials.js","sourceRoot":"","sources":["../../src/trusted-process/gworkspace-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,uEAAuE;AACvE,MAAM,CAAC,MAAM,8BAA8B,GAAG,8BAA8B,CAAC;AAe7E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAAgB,EAChB,WAAmB,EACnB,SAAiB,EACjB,MAAyB;IAEzB,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzC,MAAM,UAAU,GAA6B;QAC3C,YAAY,EAAE,WAAW;QACzB,WAAW,EAAE,SAAS;QACtB,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KACxB,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,8BAA8B,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;IAElC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAChC,CAAC"}

package/dist/trusted-process/index.d.ts

@@ -1,6 +1,15 @@
 import type { IronCurtainConfig } from '../config/types.js';
 import type { ToolCallRequest, ToolCallResult } from '../types/mcp.js';
-export type EscalationPromptFn = (request: ToolCallRequest, reason: string, context?: Readonly<Record<string, string>>) => Promise<'approved' | 'denied'>;
+import { type WhitelistCandidateIpc } from './approval-whitelist.js';
+/** Result from an escalation callback, optionally including whitelist selection. */
+export interface EscalationResult {
+    readonly decision: 'approved' | 'denied';
+    /** Index into whitelistCandidates to whitelist. Absent = no whitelisting. */
+    readonly whitelistSelection?: number;
+}
+export type EscalationPromptFn = (request: ToolCallRequest, reason: string, context?: Readonly<Record<string, string>>, 
+/** Whitelist candidates for display to the user. */
+whitelistCandidates?: readonly WhitelistCandidateIpc[]) => Promise<EscalationResult>;
 export interface TrustedProcessOptions {
     onEscalation?: EscalationPromptFn;
 }
@@ -12,6 +21,7 @@ export declare class TrustedProcess {
     private auditLog;
     private escalation;
     private onEscalation?;
+    private readonly whitelist;
     private autoApproveModel;
     private lastUserMessage;
     private serverContextMap;

package/dist/trusted-process/index.js

@@ -13,6 +13,7 @@ import { extractMcpErrorMessage } from './mcp-error-utils.js';
 import { extractTextFromContent, buildAuditEntry } from './mcp-proxy-server.js';
 import { updateServerContext, formatServerContext } from './server-context.js';
 import { buildTrustedServerSet } from '../memory/memory-annotations.js';
+import { createApprovalWhitelist, extractWhitelistCandidates, } from './approval-whitelist.js';
 /**
  * Detects Docker-style `-e VAR_NAME` args (no `=`) where the env var is unset.
  */
@@ -37,6 +38,7 @@ export class TrustedProcess {
     auditLog;
     escalation;
     onEscalation;
+    whitelist;
     autoApproveModel = null;
     lastUserMessage = null;
     serverContextMap = new Map();
@@ -59,6 +61,7 @@ export class TrustedProcess {
         });
         this.escalation = new EscalationHandler();
         this.onEscalation = options?.onEscalation;
+        this.whitelist = createApprovalWhitelist();
     }
     /**
      * Sets the most recent user message for auto-approval context.
@@ -150,39 +153,67 @@ export class TrustedProcess {
         };
         let escalationResult;
         let autoApproved = false;
+        let whitelistApproved = false;
+        let whitelistPatternId;
         let resultContent;
         let resultStatus;
         let resultError;
         try {
-            // Step 2: Handle escalation -- try auto-approve first, then human
+            // Step 2: Handle escalation -- whitelist check, auto-approve, then human
             if (evaluation.decision === 'escalate') {
-                // Try auto-approve before prompting the human
-                if (this.autoApproveModel && this.lastUserMessage) {
-                    const autoResult = await autoApprove({
-                        userMessage: this.lastUserMessage,
-                        toolName: `${request.serverName}/${request.toolName}`,
-                        escalationReason: evaluation.reason,
-                    }, this.autoApproveModel);
-                    if (autoResult.decision === 'approve') {
-                        autoApproved = true;
-                        escalationResult = 'approved';
-                        policyDecision.status = 'allow';
-                        policyDecision.reason = `Auto-approved: ${autoResult.reasoning}`;
-                    }
+                // Annotation is guaranteed non-null here: trusted servers always allow (never escalate),
+                // and missing-annotation returns early above. Narrow the type for TypeScript.
+                const resolvedAnnotation = annotation;
+                const whitelistMatch = this.whitelist.match(request.serverName, request.toolName, argsForPolicy, resolvedAnnotation);
+                if (whitelistMatch.matched) {
+                    whitelistApproved = true;
+                    whitelistPatternId = whitelistMatch.patternId;
+                    escalationResult = 'approved';
+                    policyDecision.status = 'allow';
+                    policyDecision.reason = `Whitelist-approved: ${whitelistMatch.pattern.description}`;
                 }
-                // Fall through to human escalation if not auto-approved
-                if (!autoApproved) {
-                    const escalationContext = formatServerContext(this.serverContextMap, transportRequest.serverName);
-                    escalationResult = this.onEscalation
-                        ? await this.onEscalation(transportRequest, evaluation.reason, escalationContext)
-                        : await this.escalation.prompt(transportRequest, evaluation.reason, escalationContext);
-                    if (escalationResult === 'approved') {
-                        policyDecision.status = 'allow';
-                        policyDecision.reason = 'Approved by human during escalation';
+                if (!whitelistApproved) {
+                    // Try auto-approve before prompting the human
+                    if (this.autoApproveModel && this.lastUserMessage) {
+                        const autoResult = await autoApprove({
+                            userMessage: this.lastUserMessage,
+                            toolName: `${request.serverName}/${request.toolName}`,
+                            escalationReason: evaluation.reason,
+                        }, this.autoApproveModel);
+                        if (autoResult.decision === 'approve') {
+                            autoApproved = true;
+                            escalationResult = 'approved';
+                            policyDecision.status = 'allow';
+                            policyDecision.reason = `Auto-approved: ${autoResult.reasoning}`;
+                        }
                     }
-                    else {
-                        policyDecision.status = 'deny';
-                        policyDecision.reason = 'Denied by human during escalation';
+                    // Fall through to human escalation if not auto-approved
+                    if (!autoApproved) {
+                        // Extract whitelist candidates for display
+                        const escalationId = `inprocess-${Date.now()}`;
+                        const candidates = extractWhitelistCandidates(request.serverName, request.toolName, argsForPolicy, resolvedAnnotation, evaluation.escalatedRoles, escalationId, evaluation.reason);
+                        const candidatePatterns = candidates.patterns;
+                        const candidateIpcs = candidates.ipcs.length > 0 ? candidates.ipcs : undefined;
+                        const escalationContext = formatServerContext(this.serverContextMap, transportRequest.serverName);
+                        const escalationResponse = this.onEscalation
+                            ? await this.onEscalation(transportRequest, evaluation.reason, escalationContext, candidateIpcs)
+                            : { decision: await this.escalation.prompt(transportRequest, evaluation.reason, escalationContext) };
+                        escalationResult = escalationResponse.decision;
+                        if (escalationResponse.decision === 'approved') {
+                            policyDecision.status = 'allow';
+                            policyDecision.reason = 'Approved by human during escalation';
+                            // Handle whitelist selection
+                            if (escalationResponse.whitelistSelection !== undefined &&
+                                escalationResponse.whitelistSelection >= 0 &&
+                                escalationResponse.whitelistSelection < candidatePatterns.length) {
+                                const selectedPattern = candidatePatterns[escalationResponse.whitelistSelection];
+                                this.whitelist.add(selectedPattern);
+                            }
+                        }
+                        else {
+                            policyDecision.status = 'deny';
+                            policyDecision.reason = 'Denied by human during escalation';
+                        }
                     }
                 }
                 // Expand roots to include target directories so the filesystem
@@ -227,7 +258,12 @@ export class TrustedProcess {
             status: resultStatus,
             content: resultStatus === 'success' ? resultContent : undefined,
             error: resultError,
-        }, durationMs, { escalationResult, autoApproved: autoApproved || undefined }));
+        }, durationMs, {
+            escalationResult,
+            autoApproved: autoApproved || undefined,
+            whitelistApproved: whitelistApproved || undefined,
+            whitelistPatternId,
+        }));
         // Step 5: Return result to caller
         return {
             requestId: transportRequest.requestId,

package/dist/trusted-process/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trusted-process/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAgB,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAyB,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAExE;;GAEG;AACH,SAAS,iBAAiB,CAAC,IAAc;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;YACD,CAAC,EAAE,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAYD,MAAM,OAAO,cAAc;IAYf;IAXF,YAAY,CAAe;IAC3B,UAAU,CAAmB;IAC7B,QAAQ,CAAY;IACpB,QAAQ,CAAW;IACnB,UAAU,CAAoB;IAC9B,YAAY,CAAsB;IAClC,gBAAgB,GAA2B,IAAI,CAAC;IAChD,eAAe,GAAkB,IAAI,CAAC;IACtC,gBAAgB,GAAqB,IAAI,GAAG,EAAE,CAAC;IAEvD,YACU,MAAyB,EACjC,OAA+B;QADvB,WAAM,GAAN,MAAM,CAAmB;QAGjC,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,mBAAmB,CAAC;YAC5E,SAAS,EAAE,MAAM,CAAC,YAAY;YAC9B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,YAAY;YACpE,WAAW,EAAE,sBAAsB,EAAE;SACtC,CAAC,CAAC;QACH,0BAA0B,CAAC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEpE,MAAM,sBAAsB,GAAG,6BAA6B,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChF,MAAM,cAAc,GAAG,qBAAqB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChE,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAClC,cAAc,EACd,eAAe,EACf,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,gBAAgB,EACvB,sBAAsB,EACtB,YAAY,EACZ,cAAc,CACf,CAAC;QAEF,MAAM,WAAW,GAAG,kBAAkB,CAAC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QAExC,IAAI,CAAC,UAAU,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE;YAChD,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,OAAO;SACjD,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,iBAAiB,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,OAAe;QAChC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1E,+EAA+E;YAC/E,MAAM,WAAW,GAAG,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,wBAAwB,IAAI,sCAAsC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACxG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,6BAA6B,IAAI,KAAK,CAAC,CAAC;YACpD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,oCAAoC,IAAI,MAAM,GAAG,aAAa,CAAC,CAAC;gBAC5E,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,4BAA4B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QAC1G,CAAC;QAED,uCAAuC;QACvC,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC;QAC7D,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,GAAG,MAAM,mBAAmB,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACvG,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;gBAC5D,0CAA0C;gBAC1C,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,OAAwB;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,wEAAwE;QACxE,sFAAsF;QACtF,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5G,IAAI,gBAAyC,CAAC;QAC9C,IAAI,aAAsC,CAAC;QAE3C,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACzE,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC;YACrC,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,CAAC;aAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,gCAAgC,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,QAAQ,kDAAkD,CAAC;YACzI,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;gBACjC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE;gBACtE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,CAAC,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,eAAe,CACpD,OAAO,CAAC,SAAS,EACjB,UAAU,EACV,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAC7B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,aAAa,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QAC/D,MAAM,gBAAgB,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;QAErE,yDAAyD;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC7D,MAAM,cAAc,GAAmB;YACrC,MAAM,EAAE,UAAU,CAAC,QAAQ;YAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC;QAEF,IAAI,gBAAmD,CAAC;QACxD,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,aAAsB,CAAC;QAC3B,IAAI,YAA4C,CAAC;QACjD,IAAI,WAA+B,CAAC;QAEpC,IAAI,CAAC;YACH,kEAAkE;YAClE,IAAI,UAAU,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACvC,8CAA8C;gBAC9C,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;oBAClD,MAAM,UAAU,GAAG,MAAM,WAAW,CAClC;wBACE,WAAW,EAAE,IAAI,CAAC,eAAe;wBACjC,QAAQ,EAAE,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,EAAE;wBACrD,gBAAgB,EAAE,UAAU,CAAC,MAAM;qBACpC,EACD,IAAI,CAAC,gBAAgB,CACtB,CAAC;oBAEF,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;wBACtC,YAAY,GAAG,IAAI,CAAC;wBACpB,gBAAgB,GAAG,UAAU,CAAC;wBAC9B,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC;wBAChC,cAAc,CAAC,MAAM,GAAG,kBAAkB,UAAU,CAAC,SAAS,EAAE,CAAC;oBACnE,CAAC;gBACH,CAAC;gBAED,wDAAwD;gBACxD,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;oBAClG,gBAAgB,GAAG,IAAI,CAAC,YAAY;wBAClC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,UAAU,CAAC,MAAM,EAAE,iBAAiB,CAAC;wBACjF,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;oBAEzF,IAAI,gBAAgB,KAAK,UAAU,EAAE,CAAC;wBACpC,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC;wBAChC,cAAc,CAAC,MAAM,GAAG,qCAAqC,CAAC;oBAChE,CAAC;yBAAM,CAAC;wBACN,cAAc,CAAC,MAAM,GAAG,MAAM,CAAC;wBAC/B,cAAc,CAAC,MAAM,GAAG,mCAAmC,CAAC;oBAC9D,CAAC;gBACH,CAAC;gBAED,+DAA+D;gBAC/D,wEAAwE;gBACxE,IAAI,gBAAgB,KAAK,UAAU,IAAI,UAAU,EAAE,CAAC;oBAClD,MAAM,UAAU,GAAG,qBAAqB,CAAC,gBAAgB,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;oBACjG,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;wBAC3B,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;wBAChC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE;4BACzD,GAAG,EAAE,UAAU,GAAG,EAAE;4BACpB,IAAI,EAAE,qBAAqB;yBAC5B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAED,+DAA+D;YAC/D,IAAI,cAAc,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBACtC,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAC/C,gBAAgB,CAAC,UAAU,EAC3B,gBAAgB,CAAC,QAAQ,EACzB,gBAAgB,CAAC,SAAS,CAC3B,CAA6C,CAAC;gBAC/C,aAAa,GAAG,SAAS,CAAC;gBAE1B,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;oBACtB,YAAY,GAAG,OAAO,CAAC;oBACvB,WAAW,GAAG,sBAAsB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC1D,CAAC;qBAAM,CAAC;oBACN,YAAY,GAAG,SAAS,CAAC;oBACzB,mBAAmB,CACjB,IAAI,CAAC,gBAAgB,EACrB,gBAAgB,CAAC,UAAU,EAC3B,gBAAgB,CAAC,QAAQ,EACzB,gBAAgB,CAAC,SAAS,CAC3B,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,aAAa,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC;gBAChE,YAAY,GAAG,QAAQ,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,GAAG,OAAO,CAAC;YACvB,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;YAC1C,aAAa,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,0FAA0F;QAC1F,IAAI,CAAC,QAAQ,CAAC,GAAG,CACf,eAAe,CACb,gBAAgB,EAChB,gBAAgB,CAAC,SAAS,EAC1B,cAAc,EACd;YACE,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YAC/D,KAAK,EAAE,WAAW;SACnB,EACD,UAAU,EACV,EAAE,gBAAgB,EAAE,YAAY,EAAE,YAAY,IAAI,SAAS,EAAE,CAC9D,CACF,CAAC;QAEF,kCAAkC;QAClC,OAAO;YACL,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,aAAa;YACtB,cAAc;YACd,UAAU;SACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;CACF"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trusted-process/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAgB,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAyB,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,GAG3B,MAAM,yBAAyB,CAAC;AAEjC;;GAEG;AACH,SAAS,iBAAiB,CAAC,IAAc;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;YACD,CAAC,EAAE,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAqBD,MAAM,OAAO,cAAc;IAaf;IAZF,YAAY,CAAe;IAC3B,UAAU,CAAmB;IAC7B,QAAQ,CAAY;IACpB,QAAQ,CAAW;IACnB,UAAU,CAAoB;IAC9B,YAAY,CAAsB;IACzB,SAAS,CAAoB;IACtC,gBAAgB,GAA2B,IAAI,CAAC;IAChD,eAAe,GAAkB,IAAI,CAAC;IACtC,gBAAgB,GAAqB,IAAI,GAAG,EAAE,CAAC;IAEvD,YACU,MAAyB,EACjC,OAA+B;QADvB,WAAM,GAAN,MAAM,CAAmB;QAGjC,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,mBAAmB,CAAC;YAC5E,SAAS,EAAE,MAAM,CAAC,YAAY;YAC9B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,YAAY;YACpE,WAAW,EAAE,sBAAsB,EAAE;SACtC,CAAC,CAAC;QACH,0BAA0B,CAAC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEpE,MAAM,sBAAsB,GAAG,6BAA6B,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChF,MAAM,cAAc,GAAG,qBAAqB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChE,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAClC,cAAc,EACd,eAAe,EACf,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,gBAAgB,EACvB,sBAAsB,EACtB,YAAY,EACZ,cAAc,CACf,CAAC;QAEF,MAAM,WAAW,GAAG,kBAAkB,CAAC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QAExC,IAAI,CAAC,UAAU,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE;YAChD,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,OAAO;SACjD,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,iBAAiB,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,uBAAuB,EAAE,CAAC;IAC7C,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,OAAe;QAChC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1E,+EAA+E;YAC/E,MAAM,WAAW,GAAG,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,wBAAwB,IAAI,sCAAsC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACxG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,6BAA6B,IAAI,KAAK,CAAC,CAAC;YACpD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,oCAAoC,IAAI,MAAM,GAAG,aAAa,CAAC,CAAC;gBAC5E,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,4BAA4B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QAC1G,CAAC;QAED,uCAAuC;QACvC,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC;QAC7D,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,GAAG,MAAM,mBAAmB,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACvG,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;gBAC5D,0CAA0C;gBAC1C,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,OAAwB;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,wEAAwE;QACxE,sFAAsF;QACtF,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5G,IAAI,gBAAyC,CAAC;QAC9C,IAAI,aAAsC,CAAC;QAE3C,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACzE,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC;YACrC,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,CAAC;aAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,gCAAgC,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,QAAQ,kDAAkD,CAAC;YACzI,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;gBACjC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE;gBACtE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,CAAC,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,eAAe,CACpD,OAAO,CAAC,SAAS,EACjB,UAAU,EACV,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAC7B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,aAAa,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QAC/D,MAAM,gBAAgB,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;QAErE,yDAAyD;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC7D,MAAM,cAAc,GAAmB;YACrC,MAAM,EAAE,UAAU,CAAC,QAAQ;YAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC;QAEF,IAAI,gBAAmD,CAAC;QACxD,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,kBAAsC,CAAC;QAC3C,IAAI,aAAsB,CAAC;QAC3B,IAAI,YAA4C,CAAC;QACjD,IAAI,WAA+B,CAAC;QAEpC,IAAI,CAAC;YACH,yEAAyE;YACzE,IAAI,UAAU,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACvC,yFAAyF;gBACzF,8EAA8E;gBAC9E,MAAM,kBAAkB,GAAG,UAA4B,CAAC;gBACxD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CACzC,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,QAAQ,EAChB,aAAa,EACb,kBAAkB,CACnB,CAAC;gBACF,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;oBAC3B,iBAAiB,GAAG,IAAI,CAAC;oBACzB,kBAAkB,GAAG,cAAc,CAAC,SAAS,CAAC;oBAC9C,gBAAgB,GAAG,UAAU,CAAC;oBAC9B,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC;oBAChC,cAAc,CAAC,MAAM,GAAG,uBAAuB,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBACtF,CAAC;gBAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBACvB,8CAA8C;oBAC9C,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;wBAClD,MAAM,UAAU,GAAG,MAAM,WAAW,CAClC;4BACE,WAAW,EAAE,IAAI,CAAC,eAAe;4BACjC,QAAQ,EAAE,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,EAAE;4BACrD,gBAAgB,EAAE,UAAU,CAAC,MAAM;yBACpC,EACD,IAAI,CAAC,gBAAgB,CACtB,CAAC;wBAEF,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;4BACtC,YAAY,GAAG,IAAI,CAAC;4BACpB,gBAAgB,GAAG,UAAU,CAAC;4BAC9B,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC;4BAChC,cAAc,CAAC,MAAM,GAAG,kBAAkB,UAAU,CAAC,SAAS,EAAE,CAAC;wBACnE,CAAC;oBACH,CAAC;oBAED,wDAAwD;oBACxD,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,2CAA2C;wBAC3C,MAAM,YAAY,GAAG,aAAa,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;wBAC/C,MAAM,UAAU,GAAG,0BAA0B,CAC3C,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,QAAQ,EAChB,aAAa,EACb,kBAAkB,EAClB,UAAU,CAAC,cAAc,EACzB,YAAY,EACZ,UAAU,CAAC,MAAM,CAClB,CAAC;wBACF,MAAM,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC;wBAC9C,MAAM,aAAa,GACjB,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;wBAE3D,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;wBAClG,MAAM,kBAAkB,GAAqB,IAAI,CAAC,YAAY;4BAC5D,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,UAAU,CAAC,MAAM,EAAE,iBAAiB,EAAE,aAAa,CAAC;4BAChG,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;wBAEvG,gBAAgB,GAAG,kBAAkB,CAAC,QAAQ,CAAC;wBAE/C,IAAI,kBAAkB,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;4BAC/C,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC;4BAChC,cAAc,CAAC,MAAM,GAAG,qCAAqC,CAAC;4BAE9D,6BAA6B;4BAC7B,IACE,kBAAkB,CAAC,kBAAkB,KAAK,SAAS;gCACnD,kBAAkB,CAAC,kBAAkB,IAAI,CAAC;gCAC1C,kBAAkB,CAAC,kBAAkB,GAAG,iBAAiB,CAAC,MAAM,EAChE,CAAC;gCACD,MAAM,eAAe,GAAG,iBAAiB,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;gCACjF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;4BACtC,CAAC;wBACH,CAAC;6BAAM,CAAC;4BACN,cAAc,CAAC,MAAM,GAAG,MAAM,CAAC;4BAC/B,cAAc,CAAC,MAAM,GAAG,mCAAmC,CAAC;wBAC9D,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,+DAA+D;gBAC/D,wEAAwE;gBACxE,IAAI,gBAAgB,KAAK,UAAU,IAAI,UAAU,EAAE,CAAC;oBAClD,MAAM,UAAU,GAAG,qBAAqB,CAAC,gBAAgB,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;oBACjG,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;wBAC3B,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;wBAChC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE;4BACzD,GAAG,EAAE,UAAU,GAAG,EAAE;4BACpB,IAAI,EAAE,qBAAqB;yBAC5B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAED,+DAA+D;YAC/D,IAAI,cAAc,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBACtC,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAC/C,gBAAgB,CAAC,UAAU,EAC3B,gBAAgB,CAAC,QAAQ,EACzB,gBAAgB,CAAC,SAAS,CAC3B,CAA6C,CAAC;gBAC/C,aAAa,GAAG,SAAS,CAAC;gBAE1B,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;oBACtB,YAAY,GAAG,OAAO,CAAC;oBACvB,WAAW,GAAG,sBAAsB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC1D,CAAC;qBAAM,CAAC;oBACN,YAAY,GAAG,SAAS,CAAC;oBACzB,mBAAmB,CACjB,IAAI,CAAC,gBAAgB,EACrB,gBAAgB,CAAC,UAAU,EAC3B,gBAAgB,CAAC,QAAQ,EACzB,gBAAgB,CAAC,SAAS,CAC3B,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,aAAa,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC;gBAChE,YAAY,GAAG,QAAQ,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,GAAG,OAAO,CAAC;YACvB,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;YAC1C,aAAa,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,0FAA0F;QAC1F,IAAI,CAAC,QAAQ,CAAC,GAAG,CACf,eAAe,CACb,gBAAgB,EAChB,gBAAgB,CAAC,SAAS,EAC1B,cAAc,EACd;YACE,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YAC/D,KAAK,EAAE,WAAW;SACnB,EACD,UAAU,EACV;YACE,gBAAgB;YAChB,YAAY,EAAE,YAAY,IAAI,SAAS;YACvC,iBAAiB,EAAE,iBAAiB,IAAI,SAAS;YACjD,kBAAkB;SACnB,CACF,CACF,CAAC;QAEF,kCAAkC;QAClC,OAAO;YACL,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,aAAa;YACtB,cAAc;YACd,UAAU;SACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;CACF"}

package/dist/trusted-process/mcp-proxy-server.d.ts

@@ -38,6 +38,8 @@ import { type UserContext } from './auto-approver.js';
 import { type ServerContextMap } from './server-context.js';
 import type { LanguageModelV3 } from '@ai-sdk/provider';
 import type { MCPServerConfig, SandboxAvailabilityPolicy } from '../config/types.js';
+import { type ApprovalWhitelist } from './approval-whitelist.js';
+import { type ControlApiClient } from '../docker/proxy-tools.js';
 export interface ProxiedTool {
     serverName: string;
     name: string;
@@ -113,6 +115,10 @@ export interface CallToolDeps {
     escalationDir: string | undefined;
     autoApproveModel: LanguageModelV3 | null;
     serverContextMap: ServerContextMap;
+    /** Ephemeral approval whitelist for this session. */
+    whitelist: ApprovalWhitelist;
+    /** Control API client for virtual proxy tools. Only set in virtual-only mode. */
+    controlApiClient?: ControlApiClient | null;
 }
 /**
  * Reads and validates proxy environment variables.
@@ -135,6 +141,12 @@ export declare function resolveServerSandboxConfigs(serversConfig: Record<string
     settingsDir: string;
     serverCwdPaths: Map<string, string>;
 };
+/**
+ * Validates that all argument keys exist in the tool's inputSchema.
+ * Returns null if valid, or an error message listing unknown and valid keys.
+ * Skips validation when the schema has no properties or allows additional properties.
+ */
+export declare function validateToolArguments(args: Record<string, unknown>, inputSchema: Record<string, unknown>): string | null;
 /** Builds a lookup map from tool name to ProxiedTool for routing. */
 export declare function buildToolMap(allTools: ProxiedTool[]): Map<string, ProxiedTool>;
 /**
@@ -145,6 +157,8 @@ export declare function buildAuditEntry(request: ToolCallRequest, argsForTranspo
     escalationResult?: 'approved' | 'denied';
     sandboxed?: boolean;
     autoApproved?: boolean;
+    whitelistApproved?: boolean;
+    whitelistPatternId?: string;
 }): AuditEntry;
 /**
  * Handles a single tool call request: policy evaluation, escalation,