@shield-agent/kya 0.32.9 → 0.33.2

package/dist/gate/config-gen.js

@@ -24,8 +24,36 @@
  * noise (and upstream build strings) stays out of gate.log.
  */
 import { mcpServerAdminPatterns, mcpServerDefaultTier, } from "../mcp-servers.js";
-/** Destructive-name family denied on every target, registry or not. */
-export const DESTRUCTIVE_PATTERN = "(?:^|_)(?:drop|truncate|purge|transfer)(?:_|$)";
+const DESTRUCTIVE_VERBS = ["drop", "truncate", "purge", "transfer"];
+/**
+ * Destructive-name family denied on every target, registry or not. The verb must be a whole
+ * word of the name: snake_case, kebab-case, dotted and camelCase/PascalCase all split into
+ * words (`drop_table`, `drop-table`, `dropTable`, `DropTable`, `DROP_TABLE`). The gateway
+ * engine has no lookaround and no `(?i)`, so each verb is spelled lower, Capitalized and
+ * UPPER. A verb inside a longer word (`dropdown`, `purgeable`, `transferable`) is not a word.
+ */
+export const DESTRUCTIVE_PATTERN = `(?:${DESTRUCTIVE_VERBS.flatMap((v) => {
+    const cap = v[0].toUpperCase() + v.slice(1);
+    return [
+        `(?:^|[^A-Za-z])${v}(?:[^a-z]|$)`,
+        `(?:^|[^A-Za-z]|[a-z])${cap}(?:[^a-z]|$)`,
+        `(?:^|[^A-Za-z])${v.toUpperCase()}(?:[^A-Za-z]|$)`,
+    ];
+}).join("|")})`;
+/**
+ * Whole names that carry a destructive verb as a word but are not destructive: the UI
+ * gesture `drag_and_drop` (with at most one prefix word: `appium_drag_and_drop`,
+ * `appiumDragAndDrop`) and the ML term `transfer_learn(ing)` (no prefix). Exact match
+ * only, so a second verb or any other suffix (`drag_and_drop_table`) stays denied. Lifts
+ * the destructive family only, never a server's ADMIN rules.
+ */
+export const DESTRUCTIVE_SAFE_PATTERN = "^(?:(?:[A-Za-z0-9]+[_-]|[a-z0-9]+)?(?:[Dd]rag[_-]?[Aa]nd[_-]?[Dd]rop|DRAG[_-]?AND[_-]?DROP)|[Tt]ransfer[_-]?[Ll]earn(?:ing)?|TRANSFER[_-]?LEARN(?:ING)?)$";
+/**
+ * The prefix word of a drag-and-drop name must not be a destructive verb itself
+ * (`drop_drag_and_drop`, `dropDragAndDrop`): the safe exception does not apply then.
+ */
+export const DESTRUCTIVE_PREFIX_PATTERN = `^(?:${DESTRUCTIVE_VERBS.flatMap((v) => [v, v[0].toUpperCase() + v.slice(1), v.toUpperCase()]).join("|")})(?:[^a-z].*)?(?:[Dd]rag|DRAG)`;
+const safeException = (name) => `(${name}.matches(${celString(DESTRUCTIVE_SAFE_PATTERN)}) && !${name}.matches(${celString(DESTRUCTIVE_PREFIX_PATTERN)}))`;
 /** Loopback-only L4 rule for the (wildcard-bound) MCP listener. */
 export const LOOPBACK_RULE = 'cidr("127.0.0.0/8").containsIP(source.address) || source.address == "::1"';
 /** Deny patterns for one server: destructive family + its ADMIN registry rules. */
@@ -45,16 +73,37 @@ export function unmatchedAllowed(serverId) {
 function celString(s) {
     return `'${s.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
 }
+/**
+ * Whether the generated gateway policy denies this tool name on this server (same rule as
+ * the CEL below, for the report and tests). A bad pattern never denies.
+ */
+export function gatewayDenies(serverId, toolName) {
+    try {
+        const [, ...admin] = denyPatternsFor(serverId);
+        if (admin.length > 0 && new RegExp(admin.join("|")).test(toolName))
+            return true;
+        if (!new RegExp(DESTRUCTIVE_PATTERN).test(toolName))
+            return false;
+        return !new RegExp(DESTRUCTIVE_SAFE_PATTERN).test(toolName) || new RegExp(DESTRUCTIVE_PREFIX_PATTERN).test(toolName);
+    }
+    catch {
+        return false;
+    }
+}
 /** The OR-allow CEL rule for one server target. */
 export function celAllowRule(server) {
     const target = `mcp.tool.target == ${celString(server.id)}`;
-    const deny = denyPatternsFor(server.id).join("|");
     if (!unmatchedAllowed(server.id)) {
         // ADMIN defaultTier: only explicitly non-denied, non-admin tools may run -
         // allow nothing unmatched (no registered server has this today).
         return `${target} && false`;
     }
-    return `${target} && !mcp.tool.name.matches(${celString(deny)})`;
+    const [, ...admin] = denyPatternsFor(server.id);
+    const name = "mcp.tool.name";
+    const destructive = `(!${name}.matches(${celString(DESTRUCTIVE_PATTERN)}) || ${safeException(name)})`;
+    return admin.length > 0
+        ? `${target} && ${destructive} && !${name}.matches(${celString(admin.join("|"))})`
+        : `${target} && ${destructive}`;
 }
 function q(s) {
     return JSON.stringify(s);

package/dist/gate/config-gen.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-gen.js","sourceRoot":"","sources":["../../src/gate/config-gen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAG3B,uEAAuE;AACvE,MAAM,CAAC,MAAM,mBAAmB,GAAG,gDAAgD,CAAC;AAEpF,mEAAmE;AACnE,MAAM,CAAC,MAAM,aAAa,GACxB,2EAA2E,CAAC;AAE9E,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,KAAK,GAAG,sBAAsB,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACrD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,oBAAoB,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AAC9D,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,YAAY,CAAC,MAAqB;IAChD,MAAM,MAAM,GAAG,sBAAsB,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QACjC,2EAA2E;QAC3E,iEAAiE;QACjE,OAAO,GAAG,MAAM,WAAW,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,MAAM,8BAA8B,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;AACnE,CAAC;AAED,SAAS,CAAC,CAAC,CAAS;IAClB,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,KAAe,EAAE,GAAW;IAC1C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAAC,MAAqB;IACvC,MAAM,KAAK,GAAa,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,GAAI,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,GAAI,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,GAAI,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7D,4DAA4D;YAC5D,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACzB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpD,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAsB;IACxD,MAAM,KAAK,GAAa;QACtB,yEAAyE;QACzE,SAAS;QACT,oBAAoB;QACpB,wBAAwB;QACxB,oBAAoB;QACpB,YAAY;QACZ,mBAAmB;QACnB,YAAY;QACZ,qBAAqB,CAAC,CAAC,oBAAoB,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE;QAC/D,0BAA0B;QAC1B,0BAA0B;QAC1B,mBAAmB;QACnB,yBAAyB;QACzB,YAAY;QACZ,kBAAkB,CAAC,CAAC,aAAa,CAAC,EAAE;QACpC,QAAQ;QACR,aAAa,MAAM,CAAC,IAAI,EAAE;QAC1B,gBAAgB;QAChB,iBAAiB;QACjB,uBAAuB;QACvB,sBAAsB;QACtB,kCAAkC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;KAC1D,CAAC;IACF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC5C,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACjC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,4EAA4E;IAC5E,8DAA8D;IAC9D,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAClD,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}
+{"version":3,"file":"config-gen.js","sourceRoot":"","sources":["../../src/gate/config-gen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAG3B,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAE7E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;IACvE,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7C,OAAO;QACL,kBAAkB,CAAC,cAAc;QACjC,wBAAwB,GAAG,cAAc;QACzC,kBAAkB,CAAC,CAAC,WAAW,EAAE,iBAAiB;KACnD,CAAC;AACJ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAEhB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,2JAA2J,CAAC;AAE9J;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gCAAgC,CAAC;AAEpL,MAAM,aAAa,GAAG,CAAC,IAAY,EAAU,EAAE,CAC7C,IAAI,IAAI,YAAY,SAAS,CAAC,wBAAwB,CAAC,SAAS,IAAI,YAAY,SAAS,CAAC,0BAA0B,CAAC,IAAI,CAAC;AAE5H,mEAAmE;AACnE,MAAM,CAAC,MAAM,aAAa,GACxB,2EAA2E,CAAC;AAE9E,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,KAAK,GAAG,sBAAsB,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACrD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,oBAAoB,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,QAAgB;IAC9D,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAChF,IAAI,CAAC,IAAI,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,OAAO,CAAC,IAAI,MAAM,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,MAAM,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,YAAY,CAAC,MAAqB;IAChD,MAAM,MAAM,GAAG,sBAAsB,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5D,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QACjC,2EAA2E;QAC3E,iEAAiE;QACjE,OAAO,GAAG,MAAM,WAAW,CAAC;IAC9B,CAAC;IACD,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,eAAe,CAAC;IAC7B,MAAM,WAAW,GAAG,KAAK,IAAI,YAAY,SAAS,CAAC,mBAAmB,CAAC,QAAQ,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;IACtG,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC;QACrB,CAAC,CAAC,GAAG,MAAM,OAAO,WAAW,QAAQ,IAAI,YAAY,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG;QAClF,CAAC,CAAC,GAAG,MAAM,OAAO,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,CAAC,CAAC,CAAS;IAClB,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,KAAe,EAAE,GAAW;IAC1C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAAC,MAAqB;IACvC,MAAM,KAAK,GAAa,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,GAAI,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,GAAI,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,GAAI,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7D,4DAA4D;YAC5D,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACzB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpD,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAsB;IACxD,MAAM,KAAK,GAAa;QACtB,yEAAyE;QACzE,SAAS;QACT,oBAAoB;QACpB,wBAAwB;QACxB,oBAAoB;QACpB,YAAY;QACZ,mBAAmB;QACnB,YAAY;QACZ,qBAAqB,CAAC,CAAC,oBAAoB,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE;QAC/D,0BAA0B;QAC1B,0BAA0B;QAC1B,mBAAmB;QACnB,yBAAyB;QACzB,YAAY;QACZ,kBAAkB,CAAC,CAAC,aAAa,CAAC,EAAE;QACpC,QAAQ;QACR,aAAa,MAAM,CAAC,IAAI,EAAE;QAC1B,gBAAgB;QAChB,iBAAiB;QACjB,uBAAuB;QACvB,sBAAsB;QACtB,kCAAkC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;KAC1D,CAAC;IACF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC5C,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACjC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,4EAA4E;IAC5E,8DAA8D;IAC9D,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAClD,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/gate/otlp-receiver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"otlp-receiver.d.ts","sourceRoot":"","sources":["../../src/gate/otlp-receiver.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAc1B,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAOD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,cAAc,GAAG,UAAU,GAAG,SAAS,CA+B/F;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IAClC,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,wDAAwD;IACxD,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC;CACpF;AAoBD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CA+FxF"}
+{"version":3,"file":"otlp-receiver.d.ts","sourceRoot":"","sources":["../../src/gate/otlp-receiver.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAG3D,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAc1B,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAOD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,cAAc,GAAG,UAAU,GAAG,SAAS,CA+B/F;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IAClC,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,wDAAwD;IACxD,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC;CACpF;AAoBD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CAgGxF"}

package/dist/gate/otlp-receiver.js

@@ -16,6 +16,7 @@
  */
 import { createServer } from "node:http";
 import { appendTrail } from "../trail.js";
+import { deviceId } from "../device-id.js";
 import { assertNoSecrets } from "../dash/render.js";
 import { decodeTraceJson, decodeTraceProtobuf, } from "./otlp-decode.js";
 const STATUS_ERROR = 2;
@@ -152,8 +153,9 @@ export async function startOtlpReceiver(opts) {
                 }
                 try {
                     const event = spanToTrailEvent(span, ctx);
+                    const id = deviceId(env);
                     if (event)
-                        append(opts.cwd, event, env);
+                        append(opts.cwd, id ? { ...event, deviceId: id } : event, env);
                 }
                 catch {
                     // Secret-scanner trip or append failure: drop the event, keep serving.

package/dist/gate/otlp-receiver.js.map

@@ -1 +1 @@
-{"version":3,"file":"otlp-receiver.js","sourceRoot":"","sources":["../../src/gate/otlp-receiver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAmB,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,eAAe,EACf,mBAAmB,GAEpB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB,uFAAuF;AACvF,MAAM,WAAW,GAAG,MAAM,CAAC;AAE3B,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,mDAAmD;AACnD,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAS1C,SAAS,IAAI,CAAC,IAAiB,EAAE,GAAW;IAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAiB,EAAE,GAAmB;IACrE,IAAI,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,KAAK,YAAY;QAAE,OAAO,SAAS,CAAC;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,SAAS,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC;IAExE,IAAI,OAAO,GAAG,OAAO,CAAC;IACtB,IAAI,UAAU,GAAG,OAAO,CAAC;IACzB,IAAI,IAAI,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QACrC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,CAAC;YACjD,OAAO,GAAG,MAAM,CAAC;YACjB,UAAU,GAAG,aAAa,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,qDAAqD;YACrD,UAAU,GAAG,YAAY,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,MAAM,KAAK,IAAI,EAAE,CAAC;IACpC,2EAA2E;IAC3E,eAAe,CAAC,GAAG,MAAM,KAAK,SAAS,EAAE,CAAC,CAAC;IAC3C,OAAO;QACL,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,SAAS;QACT,MAAM;QACN,OAAO;QACP,UAAU;QACV,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,SAAS,MAAM,IAAI,IAAI,EAAE;KACnC,CAAC;AACJ,CAAC;AAkBD,SAAS,QAAQ,CAAC,GAAwC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YAC3B,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC;YACjB,IAAI,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBAC3B,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;gBACvC,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAyB;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;IAC1C,MAAM,GAAG,GAAmB,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IACzF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,qFAAqF;IACrF,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEjD,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,YAAY,EAAE,CAAC;gBACtD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YACD,IAAI,KAAoB,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBACtE,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAClC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;oBACpD,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;gBAC/E,OAAO;YACT,CAAC;YACD,qEAAqE;YACrE,6DAA6D;YAC7D,uEAAuE;YACvE,kEAAkE;YAClE,0CAA0C;YAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,cAAc,EAAE,CAAC;gBACtC,IAAI,GAAG,IAAI,GAAG;oBAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,CAAc,EAAU,EAAE,CACzC,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7H,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,KAAK;iBACF,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,KAAK,YAAY;gBAChD,OAAO,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CACrD;iBACA,GAAG,CAAC,OAAO,CAAC,CAChB,CAAC;YACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,KAAK,YAAY,CAAC;gBACnE,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC;gBACzE,IAAI,MAAM,IAAI,UAAU,EAAE,CAAC;oBACzB,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,WAAW,CAAC,CAAC;gBACvD,CAAC;gBACD,IACE,MAAM;oBACN,CAAC,UAAU;oBACX,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;wBAC5B,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,EACjD,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBAChB,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;wBAAE,SAAS;oBAC3C,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC7B,IAAI,WAAW,CAAC,IAAI,GAAG,OAAO;wBAAE,WAAW,CAAC,KAAK,EAAE,CAAC;gBACtD,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBAC1C,IAAI,KAAK;wBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC1C,CAAC;gBAAC,MAAM,CAAC;oBACP,uEAAuE;gBACzE,CAAC;YACH,CAAC;YACD,yDAAyD;YACzD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,wBAAwB,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxF,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACd,IAAI,CAAC;gBACH,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;IACpD,OAAO;QACL,IAAI;QACJ,GAAG,EAAE,oBAAoB,IAAI,EAAE;QAC/B,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACtB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAChC,CAAC,CAAC;KACL,CAAC;AACJ,CAAC"}
+{"version":3,"file":"otlp-receiver.js","sourceRoot":"","sources":["../../src/gate/otlp-receiver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAmB,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,eAAe,EACf,mBAAmB,GAEpB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB,uFAAuF;AACvF,MAAM,WAAW,GAAG,MAAM,CAAC;AAE3B,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,mDAAmD;AACnD,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAS1C,SAAS,IAAI,CAAC,IAAiB,EAAE,GAAW;IAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAiB,EAAE,GAAmB;IACrE,IAAI,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,KAAK,YAAY;QAAE,OAAO,SAAS,CAAC;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,SAAS,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC;IAExE,IAAI,OAAO,GAAG,OAAO,CAAC;IACtB,IAAI,UAAU,GAAG,OAAO,CAAC;IACzB,IAAI,IAAI,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QACrC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,CAAC;YACjD,OAAO,GAAG,MAAM,CAAC;YACjB,UAAU,GAAG,aAAa,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,qDAAqD;YACrD,UAAU,GAAG,YAAY,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,MAAM,KAAK,IAAI,EAAE,CAAC;IACpC,2EAA2E;IAC3E,eAAe,CAAC,GAAG,MAAM,KAAK,SAAS,EAAE,CAAC,CAAC;IAC3C,OAAO;QACL,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,SAAS;QACT,MAAM;QACN,OAAO;QACP,UAAU;QACV,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,SAAS,MAAM,IAAI,IAAI,EAAE;KACnC,CAAC;AACJ,CAAC;AAkBD,SAAS,QAAQ,CAAC,GAAwC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YAC3B,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC;YACjB,IAAI,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBAC3B,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;gBACvC,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAyB;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;IAC1C,MAAM,GAAG,GAAmB,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IACzF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,qFAAqF;IACrF,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEjD,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,YAAY,EAAE,CAAC;gBACtD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YACD,IAAI,KAAoB,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBACtE,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAClC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;oBACpD,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;gBAC/E,OAAO;YACT,CAAC;YACD,qEAAqE;YACrE,6DAA6D;YAC7D,uEAAuE;YACvE,kEAAkE;YAClE,0CAA0C;YAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,cAAc,EAAE,CAAC;gBACtC,IAAI,GAAG,IAAI,GAAG;oBAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,CAAc,EAAU,EAAE,CACzC,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7H,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,KAAK;iBACF,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,KAAK,YAAY;gBAChD,OAAO,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CACrD;iBACA,GAAG,CAAC,OAAO,CAAC,CAChB,CAAC;YACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,KAAK,YAAY,CAAC;gBACnE,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC;gBACzE,IAAI,MAAM,IAAI,UAAU,EAAE,CAAC;oBACzB,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,WAAW,CAAC,CAAC;gBACvD,CAAC;gBACD,IACE,MAAM;oBACN,CAAC,UAAU;oBACX,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;wBAC5B,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,EACjD,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBAChB,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;wBAAE,SAAS;oBAC3C,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC7B,IAAI,WAAW,CAAC,IAAI,GAAG,OAAO;wBAAE,WAAW,CAAC,KAAK,EAAE,CAAC;gBACtD,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBAC1C,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;oBACzB,IAAI,KAAK;wBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC5E,CAAC;gBAAC,MAAM,CAAC;oBACP,uEAAuE;gBACzE,CAAC;YACH,CAAC;YACD,yDAAyD;YACzD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,wBAAwB,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxF,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACd,IAAI,CAAC;gBACH,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;IACpD,OAAO;QACL,IAAI;QACJ,GAAG,EAAE,oBAAoB,IAAI,EAAE;QAC/B,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACtB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAChC,CAAC,CAAC;KACL,CAAC;AACJ,CAAC"}

package/dist/guard-pack.d.ts

@@ -0,0 +1,58 @@
+export type GuardCode = "NEVER_SHELL" | "NEVER_SECRET_READ" | "NEVER_SECRET_WRITE" | "NEVER_EXFIL";
+export interface GuardHit {
+    readonly rule: string;
+    readonly code: GuardCode;
+    /** Absolute, normalized path the rule fired on, when it has one (matched by `guardAllow` `path`). */
+    readonly target?: string;
+}
+export interface GuardContext {
+    readonly cwd: string;
+    readonly home: string | undefined;
+    /** Defaults to cwd. */
+    readonly projectRoot?: string;
+    /** Variables for `rm -rf "$X/"`. Defaults to process.env. */
+    readonly env?: NodeJS.ProcessEnv;
+}
+export interface GuardAllow {
+    readonly rule: string;
+    readonly path?: string;
+    readonly command?: string;
+}
+export interface GuardConfig {
+    readonly shellNeverList: boolean;
+    readonly secretsGuard: boolean;
+    readonly exfilGuard: boolean;
+    readonly guardAllow: readonly GuardAllow[];
+}
+export declare const GUARD_DEFAULTS: GuardConfig;
+/** Rule ids of the shell family, in match order. Listed in docs/guard-pack.md. */
+export declare const GUARD_SHELL_RULES: readonly ["rm-root-home", "terraform-destroy", "sql-drop", "git-force-push", "git-delete-default-branch", "git-hard-reset-clean", "docker-volumes", "k8s-delete-ns", "cloud-delete", "railway-volume-delete"];
+/** Home for the guard: an absolute `HOME` from the given env, else the OS home. */
+export declare function guardContextFrom(cwd: string, env?: NodeJS.ProcessEnv): GuardContext;
+/**
+ * Read the guard keys from `<home>/.kya/config.json`. A missing file is the defaults. A malformed
+ * file or key falls back to the default for that key and reports `problem` (the hook writes one
+ * trail line). Never throws.
+ */
+export declare function readGuardConfig(home: string | undefined): {
+    readonly config: GuardConfig;
+    readonly problem?: string;
+};
+/**
+ * First guard-pack hit for this tool call that `guardAllow` does not skip, or undefined (allow).
+ * Shell tools: the command. Tools that read: the path. Tools that write: the written text.
+ * Never throws.
+ */
+export declare function guardPackMatch(toolId: string, toolInput: unknown, ctx: GuardContext, cfg?: GuardConfig): GuardHit | undefined;
+/**
+ * Rule id of the first shell-family rule that matches a command, or null. Shell rules only
+ * (no secrets, no allowlist), so a caller can ask the one question the spec names.
+ */
+export declare function matchesShellNeverList(command: string, ctx: {
+    cwd: string;
+    home: string;
+    projectRoot: string;
+}): string | null;
+/** Actionable text for a deny, from the rule id alone (no command text, no matched secret). */
+export declare function guardHint(rule: string): string;
+//# sourceMappingURL=guard-pack.d.ts.map

package/dist/guard-pack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-pack.d.ts","sourceRoot":"","sources":["../src/guard-pack.ts"],"names":[],"mappings":"AAsBA,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,mBAAmB,GAAG,oBAAoB,GAAG,aAAa,CAAC;AAEnG,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,qGAAqG;IACrG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,uBAAuB;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,SAAS,UAAU,EAAE,CAAC;CAC5C;AAED,eAAO,MAAM,cAAc,EAAE,WAA4F,CAAC;AAE1H,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,+MAGpB,CAAC;AAMX,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,CAUhG;AAID;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAmCrH;AAwhBD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,OAAO,EAClB,GAAG,EAAE,YAAY,EACjB,GAAG,GAAE,WAA4B,GAChC,QAAQ,GAAG,SAAS,CA0CtB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAM7H;AAgBD,+FAA+F;AAC/F,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO9C"}