@agent-relay/policy 0.1.0

package/dist/agent-policy.d.ts

@@ -0,0 +1,225 @@
+/**
+ * Agent Policy Service
+ *
+ * Manages agent permissions and rules with multi-level fallback:
+ * 1. Repo-level policy (.claude/agents/*.md)
+ * 2. Workspace-level policy (from cloud API)
+ * 3. Built-in safe defaults
+ *
+ * Provides spawn authorization, tool permission checks, and audit logging.
+ */
+/**
+ * PRPM-style policy file format (YAML or JSON)
+ *
+ * Policy files are loaded from (in order of precedence):
+ * 1. User-level: ~/.config/agent-relay/policies/*.yaml (NOT in source control)
+ * 2. Cloud: Workspace config from dashboard (stored in database)
+ *
+ * PRPM packages install to the user-level location to avoid polluting repos.
+ * Install via: prpm install @org/strict-agent-rules --global
+ *
+ * Example policy file (~/.config/agent-relay/policies/strict-rules.yaml):
+ * ```yaml
+ * name: strict-spawn-rules
+ * version: 1.0.0
+ * description: Restrict agent spawning to leads only
+ *
+ * agents:
+ *   - name: Lead
+ *     canSpawn: ["*"]
+ *     canMessage: ["*"]
+ *   - name: Worker*
+ *     canSpawn: []
+ *     canMessage: ["Lead", "Coordinator"]
+ *
+ * settings:
+ *   requireExplicitAgents: false
+ *   auditEnabled: true
+ * ```
+ */
+/**
+ * Agent policy definition
+ */
+export interface AgentPolicy {
+    /** Agent name pattern (supports wildcards: "Lead", "Worker*", "*") */
+    name: string;
+    /** Allowed tools (empty = all allowed, ["none"] = no tools) */
+    allowedTools?: string[];
+    /** Agents this agent can spawn (empty = can spawn any) */
+    canSpawn?: string[];
+    /** Agents this agent can message (empty = can message any) */
+    canMessage?: string[];
+    /** Maximum concurrent spawns allowed */
+    maxSpawns?: number;
+    /** Rate limit: messages per minute */
+    rateLimit?: number;
+    /** Whether this agent can be spawned by others */
+    canBeSpawned?: boolean;
+    /** Custom metadata */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Workspace-level policy configuration
+ */
+export interface WorkspacePolicy {
+    /** Default policy for agents without explicit config */
+    defaultPolicy: AgentPolicy;
+    /** Named agent policies */
+    agents: AgentPolicy[];
+    /** Global settings */
+    settings: {
+        /** Require explicit agent definitions (reject unknown agents) */
+        requireExplicitAgents: boolean;
+        /** Enable audit logging */
+        auditEnabled: boolean;
+        /** Maximum total agents */
+        maxTotalAgents: number;
+    };
+}
+/**
+ * Policy decision with reasoning
+ */
+export interface PolicyDecision {
+    allowed: boolean;
+    reason: string;
+    policySource: 'repo' | 'local' | 'workspace' | 'default';
+    matchedPolicy?: AgentPolicy;
+}
+/**
+ * Audit log entry
+ */
+export interface AuditEntry {
+    timestamp: number;
+    action: 'spawn' | 'message' | 'tool' | 'release';
+    actor: string;
+    target?: string;
+    decision: PolicyDecision;
+    context?: Record<string, unknown>;
+}
+/**
+ * Cloud policy fetcher interface
+ * Implement this to fetch workspace policies from cloud API
+ */
+export interface CloudPolicyFetcher {
+    getWorkspacePolicy(workspaceId: string): Promise<WorkspacePolicy | null>;
+}
+export declare class AgentPolicyService {
+    private projectRoot;
+    private workspaceId?;
+    private cloudFetcher?;
+    private cachedWorkspacePolicy?;
+    private cachedLocalPolicy?;
+    private policyCacheExpiry;
+    private localPolicyCacheExpiry;
+    private auditLog;
+    private strictMode;
+    /** Cache TTL in milliseconds (5 minutes) */
+    private static readonly CACHE_TTL_MS;
+    /** Local policy cache TTL (1 minute - files can change) */
+    private static readonly LOCAL_CACHE_TTL_MS;
+    /** Maximum audit log entries to keep in memory */
+    private static readonly MAX_AUDIT_ENTRIES;
+    constructor(options: {
+        projectRoot: string;
+        workspaceId?: string;
+        cloudFetcher?: CloudPolicyFetcher;
+        strictMode?: boolean;
+    });
+    /**
+     * Get the user-level policies directory
+     * Uses ~/.config/agent-relay/policies/ (not in source control)
+     */
+    private getUserPoliciesDir;
+    /**
+     * Load policies from user-level directory (PRPM-installable)
+     * Files are YAML/JSON with agent policy definitions
+     * Location: ~/.config/agent-relay/policies/*.yaml
+     */
+    private loadLocalPolicies;
+    /**
+     * Simple YAML parser for policy files
+     * Handles basic key: value and arrays
+     */
+    private parseSimpleYaml;
+    /**
+     * Parse a YAML value string
+     */
+    private parseValue;
+    /**
+     * Check if an agent can spawn another agent
+     */
+    canSpawn(spawnerName: string, targetName: string, targetCli: string): Promise<PolicyDecision>;
+    /**
+     * Check if an agent can send a message to another agent
+     */
+    canMessage(senderName: string, recipientName: string): Promise<PolicyDecision>;
+    /**
+     * Check if an agent can use a specific tool
+     */
+    canUseTool(agentName: string, toolName: string): Promise<PolicyDecision>;
+    /**
+     * Get the effective policy for an agent
+     * Fallback chain: repo config → user PRPM policies → cloud workspace → defaults
+     */
+    getAgentPolicy(agentName: string): Promise<{
+        matchedPolicy: AgentPolicy;
+        policySource: 'repo' | 'local' | 'workspace' | 'default';
+    }>;
+    /**
+     * Get workspace policy from cloud (with caching)
+     */
+    private getWorkspacePolicy;
+    /**
+     * Find matching policy from a list (supports wildcards)
+     */
+    private findMatchingPolicy;
+    /**
+     * Check if a name matches any pattern in the list
+     * Supports: exact match, prefix* match, *suffix match, * (all)
+     */
+    private matchesPattern;
+    /**
+     * Convert AgentConfig to AgentPolicy
+     */
+    private configToPolicy;
+    /**
+     * Record an audit entry
+     */
+    private audit;
+    /**
+     * Get audit log entries
+     */
+    getAuditLog(options?: {
+        limit?: number;
+        action?: AuditEntry['action'];
+        actor?: string;
+        deniedOnly?: boolean;
+    }): AuditEntry[];
+    /**
+     * Clear audit log
+     */
+    clearAuditLog(): void;
+    /**
+     * Invalidate cached workspace policy
+     */
+    invalidateCache(): void;
+    /**
+     * Get a human-readable policy summary for an agent
+     * This can be injected into agent prompts to inform them of their permissions
+     */
+    getPolicySummary(agentName: string): Promise<string>;
+    /**
+     * Get a concise policy instruction for injection into agent prompts
+     */
+    getPolicyInstruction(agentName: string): Promise<string | null>;
+}
+/**
+ * Create a policy service for a project
+ */
+export declare function createPolicyService(options: {
+    projectRoot: string;
+    workspaceId?: string;
+    cloudFetcher?: CloudPolicyFetcher;
+    strictMode?: boolean;
+}): AgentPolicyService;
+//# sourceMappingURL=agent-policy.d.ts.map

package/dist/agent-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-policy.d.ts","sourceRoot":"","sources":["../src/agent-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,sBAAsB;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,aAAa,EAAE,WAAW,CAAC;IAC3B,2BAA2B;IAC3B,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,sBAAsB;IACtB,QAAQ,EAAE;QACR,iEAAiE;QACjE,qBAAqB,EAAE,OAAO,CAAC;QAC/B,2BAA2B;QAC3B,YAAY,EAAE,OAAO,CAAC;QACtB,2BAA2B;QAC3B,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,CAAC;IACzD,aAAa,CAAC,EAAE,WAAW,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,cAAc,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAwBD;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;CAC1E;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,WAAW,CAAC,CAAS;IAC7B,OAAO,CAAC,YAAY,CAAC,CAAqB;IAC1C,OAAO,CAAC,qBAAqB,CAAC,CAAkB;IAChD,OAAO,CAAC,iBAAiB,CAAC,CAAkB;IAC5C,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,sBAAsB,CAAK;IACnC,OAAO,CAAC,QAAQ,CAAoB;IACpC,OAAO,CAAC,UAAU,CAAU;IAE5B,4CAA4C;IAC5C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAiB;IACrD,2DAA2D;IAC3D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAa;IACvD,kDAAkD;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAQ;gBAErC,OAAO,EAAE;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,kBAAkB,CAAC;QAClC,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB;IAOD;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAM1B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IA6EzB;;;OAGG;IACH,OAAO,CAAC,eAAe;IA0EvB;;OAEG;IACH,OAAO,CAAC,UAAU;IAwBlB;;OAEG;IACG,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,cAAc,CAAC;IA2C1B;;OAEG;IACG,UAAU,CACd,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,cAAc,CAAC;IA4B1B;;OAEG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAyC9E;;;OAGG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAC/C,aAAa,EAAE,WAAW,CAAC;QAC3B,YAAY,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,CAAC;KAC1D,CAAC;IAiFF;;OAEG;YACW,kBAAkB;IAwBhC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAe1B;;;OAGG;IACH,OAAO,CAAC,cAAc;IA0BtB;;OAEG;IACH,OAAO,CAAC,cAAc;IAatB;;OAEG;IACH,OAAO,CAAC,KAAK;IA6Bb;;OAEG;IACH,WAAW,CAAC,OAAO,CAAC,EAAE;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GAAG,UAAU,EAAE;IAmBhB;;OAEG;IACH,aAAa,IAAI,IAAI;IAIrB;;OAEG;IACH,eAAe,IAAI,IAAI;IAKvB;;;OAGG;IACG,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAqD1D;;OAEG;IACG,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CA6CtE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,GAAG,kBAAkB,CAErB"}

package/dist/agent-policy.js

@@ -0,0 +1,665 @@
+/**
+ * Agent Policy Service
+ *
+ * Manages agent permissions and rules with multi-level fallback:
+ * 1. Repo-level policy (.claude/agents/*.md)
+ * 2. Workspace-level policy (from cloud API)
+ * 3. Built-in safe defaults
+ *
+ * Provides spawn authorization, tool permission checks, and audit logging.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { findAgentConfig } from '@agent-relay/config/agent-config';
+import os from 'node:os';
+/** Built-in safe defaults when no policy exists */
+const DEFAULT_POLICY = {
+    name: '*',
+    allowedTools: undefined, // All tools allowed by default
+    canSpawn: undefined, // Can spawn any agent
+    canMessage: undefined, // Can message any agent
+    maxSpawns: 10,
+    rateLimit: 60, // 60 messages per minute
+    canBeSpawned: true,
+};
+/** Restrictive defaults for unknown agents in strict mode */
+const STRICT_DEFAULT_POLICY = {
+    name: '*',
+    allowedTools: ['Read', 'Grep', 'Glob'], // Read-only by default
+    canSpawn: [], // Cannot spawn
+    canMessage: ['Lead', 'Coordinator'], // Can only message leads
+    maxSpawns: 0,
+    rateLimit: 10,
+    canBeSpawned: false,
+};
+export class AgentPolicyService {
+    projectRoot;
+    workspaceId;
+    cloudFetcher;
+    cachedWorkspacePolicy;
+    cachedLocalPolicy;
+    policyCacheExpiry = 0;
+    localPolicyCacheExpiry = 0;
+    auditLog = [];
+    strictMode;
+    /** Cache TTL in milliseconds (5 minutes) */
+    static CACHE_TTL_MS = 5 * 60 * 1000;
+    /** Local policy cache TTL (1 minute - files can change) */
+    static LOCAL_CACHE_TTL_MS = 60 * 1000;
+    /** Maximum audit log entries to keep in memory */
+    static MAX_AUDIT_ENTRIES = 1000;
+    constructor(options) {
+        this.projectRoot = options.projectRoot;
+        this.workspaceId = options.workspaceId;
+        this.cloudFetcher = options.cloudFetcher;
+        this.strictMode = options.strictMode ?? false;
+    }
+    /**
+     * Get the user-level policies directory
+     * Uses ~/.config/agent-relay/policies/ (not in source control)
+     */
+    getUserPoliciesDir() {
+        const configDir = process.env.AGENT_RELAY_CONFIG_DIR ??
+            path.join(os.homedir(), '.config', 'agent-relay');
+        return path.join(configDir, 'policies');
+    }
+    /**
+     * Load policies from user-level directory (PRPM-installable)
+     * Files are YAML/JSON with agent policy definitions
+     * Location: ~/.config/agent-relay/policies/*.yaml
+     */
+    loadLocalPolicies() {
+        // Check cache
+        if (this.cachedLocalPolicy && Date.now() < this.localPolicyCacheExpiry) {
+            return this.cachedLocalPolicy;
+        }
+        const policiesDir = this.getUserPoliciesDir();
+        if (!fs.existsSync(policiesDir)) {
+            return null;
+        }
+        try {
+            const files = fs.readdirSync(policiesDir).filter(f => f.endsWith('.yaml') || f.endsWith('.yml') || f.endsWith('.json'));
+            if (files.length === 0) {
+                return null;
+            }
+            // Merge all policy files
+            const mergedAgents = [];
+            let mergedSettings = {
+                requireExplicitAgents: false,
+                auditEnabled: true,
+                maxTotalAgents: 50,
+            };
+            let mergedDefault = { ...DEFAULT_POLICY };
+            for (const file of files) {
+                const filePath = path.join(policiesDir, file);
+                const content = fs.readFileSync(filePath, 'utf-8');
+                let parsed;
+                if (file.endsWith('.json')) {
+                    parsed = JSON.parse(content);
+                }
+                else {
+                    // Simple YAML parsing for policy files
+                    parsed = this.parseSimpleYaml(content);
+                }
+                // Merge agents
+                if (Array.isArray(parsed.agents)) {
+                    for (const agent of parsed.agents) {
+                        if (agent && typeof agent === 'object' && 'name' in agent) {
+                            mergedAgents.push(agent);
+                        }
+                    }
+                }
+                // Merge settings (later files override)
+                if (parsed.settings && typeof parsed.settings === 'object') {
+                    mergedSettings = { ...mergedSettings, ...parsed.settings };
+                }
+                // Merge default policy
+                if (parsed.defaultPolicy && typeof parsed.defaultPolicy === 'object') {
+                    mergedDefault = { ...mergedDefault, ...parsed.defaultPolicy };
+                }
+            }
+            const policy = {
+                defaultPolicy: mergedDefault,
+                agents: mergedAgents,
+                settings: mergedSettings,
+            };
+            this.cachedLocalPolicy = policy;
+            this.localPolicyCacheExpiry = Date.now() + AgentPolicyService.LOCAL_CACHE_TTL_MS;
+            return policy;
+        }
+        catch (err) {
+            console.error('[policy] Failed to load local policies:', err);
+            return null;
+        }
+    }
+    /**
+     * Simple YAML parser for policy files
+     * Handles basic key: value and arrays
+     */
+    parseSimpleYaml(content) {
+        const result = {};
+        const lines = content.split('\n');
+        let _currentKey = '';
+        let currentArray = null;
+        let currentObject = null;
+        let indent = 0;
+        for (const line of lines) {
+            const trimmed = line.trim();
+            // Skip comments and empty lines
+            if (!trimmed || trimmed.startsWith('#'))
+                continue;
+            // Calculate indentation
+            const lineIndent = line.length - line.trimStart().length;
+            // Array item
+            if (trimmed.startsWith('- ')) {
+                const value = trimmed.slice(2).trim();
+                // Object in array (e.g., "- name: Worker")
+                if (value.includes(':')) {
+                    const [key, val] = value.split(':').map(s => s.trim());
+                    currentObject = { [key]: this.parseValue(val) };
+                    if (currentArray) {
+                        currentArray.push(currentObject);
+                    }
+                }
+                else {
+                    // Simple array value
+                    if (currentArray) {
+                        currentArray.push(this.parseValue(value));
+                    }
+                }
+                continue;
+            }
+            // Key: value pair
+            const colonIdx = trimmed.indexOf(':');
+            if (colonIdx > 0) {
+                const key = trimmed.slice(0, colonIdx).trim();
+                const value = trimmed.slice(colonIdx + 1).trim();
+                // If we're inside an object in an array
+                if (currentObject && lineIndent > indent) {
+                    currentObject[key] = this.parseValue(value);
+                    continue;
+                }
+                // Top-level or section key
+                if (value === '' || value === '|' || value === '>') {
+                    // Start of array or nested object
+                    _currentKey = key;
+                    currentArray = [];
+                    currentObject = null;
+                    indent = lineIndent;
+                    result[key] = currentArray;
+                }
+                else {
+                    // Simple key: value
+                    if (lineIndent === 0) {
+                        result[key] = this.parseValue(value);
+                        _currentKey = '';
+                        currentArray = null;
+                        currentObject = null;
+                    }
+                    else if (currentObject) {
+                        currentObject[key] = this.parseValue(value);
+                    }
+                }
+            }
+        }
+        return result;
+    }
+    /**
+     * Parse a YAML value string
+     */
+    parseValue(value) {
+        if (!value || value === '~' || value === 'null')
+            return null;
+        if (value === 'true')
+            return true;
+        if (value === 'false')
+            return false;
+        // Array notation [a, b, c]
+        if (value.startsWith('[') && value.endsWith(']')) {
+            const inner = value.slice(1, -1);
+            if (!inner.trim())
+                return [];
+            return inner.split(',').map(s => {
+                const trimmed = s.trim().replace(/^["']|["']$/g, '');
+                return trimmed;
+            });
+        }
+        // Number
+        if (/^-?\d+(\.\d+)?$/.test(value)) {
+            return parseFloat(value);
+        }
+        // String (remove quotes if present)
+        return value.replace(/^["']|["']$/g, '');
+    }
+    /**
+     * Check if an agent can spawn another agent
+     */
+    async canSpawn(spawnerName, targetName, targetCli) {
+        const spawnerPolicy = await this.getAgentPolicy(spawnerName);
+        const targetPolicy = await this.getAgentPolicy(targetName);
+        // Check if target can be spawned
+        if (targetPolicy.matchedPolicy?.canBeSpawned === false) {
+            const decision = {
+                allowed: false,
+                reason: `Agent "${targetName}" is not allowed to be spawned`,
+                policySource: targetPolicy.policySource,
+                matchedPolicy: targetPolicy.matchedPolicy,
+            };
+            this.audit('spawn', spawnerName, targetName, decision, { cli: targetCli });
+            return decision;
+        }
+        // Check if spawner can spawn
+        const canSpawnList = spawnerPolicy.matchedPolicy?.canSpawn;
+        if (canSpawnList !== undefined && canSpawnList.length > 0) {
+            const canSpawn = this.matchesPattern(targetName, canSpawnList);
+            if (!canSpawn) {
+                const decision = {
+                    allowed: false,
+                    reason: `Agent "${spawnerName}" is not allowed to spawn "${targetName}"`,
+                    policySource: spawnerPolicy.policySource,
+                    matchedPolicy: spawnerPolicy.matchedPolicy,
+                };
+                this.audit('spawn', spawnerName, targetName, decision, { cli: targetCli });
+                return decision;
+            }
+        }
+        // Check max spawns (would need spawn count tracking - placeholder)
+        const decision = {
+            allowed: true,
+            reason: 'Spawn permitted by policy',
+            policySource: spawnerPolicy.policySource,
+            matchedPolicy: spawnerPolicy.matchedPolicy,
+        };
+        this.audit('spawn', spawnerName, targetName, decision, { cli: targetCli });
+        return decision;
+    }
+    /**
+     * Check if an agent can send a message to another agent
+     */
+    async canMessage(senderName, recipientName) {
+        const senderPolicy = await this.getAgentPolicy(senderName);
+        const canMessageList = senderPolicy.matchedPolicy?.canMessage;
+        if (canMessageList !== undefined && canMessageList.length > 0) {
+            const canMessage = this.matchesPattern(recipientName, canMessageList);
+            if (!canMessage) {
+                const decision = {
+                    allowed: false,
+                    reason: `Agent "${senderName}" is not allowed to message "${recipientName}"`,
+                    policySource: senderPolicy.policySource,
+                    matchedPolicy: senderPolicy.matchedPolicy,
+                };
+                this.audit('message', senderName, recipientName, decision);
+                return decision;
+            }
+        }
+        const decision = {
+            allowed: true,
+            reason: 'Message permitted by policy',
+            policySource: senderPolicy.policySource,
+            matchedPolicy: senderPolicy.matchedPolicy,
+        };
+        this.audit('message', senderName, recipientName, decision);
+        return decision;
+    }
+    /**
+     * Check if an agent can use a specific tool
+     */
+    async canUseTool(agentName, toolName) {
+        const policy = await this.getAgentPolicy(agentName);
+        const allowedTools = policy.matchedPolicy?.allowedTools;
+        if (allowedTools !== undefined) {
+            // ["none"] means no tools allowed
+            if (allowedTools.length === 1 && allowedTools[0] === 'none') {
+                const decision = {
+                    allowed: false,
+                    reason: `Agent "${agentName}" is not allowed to use any tools`,
+                    policySource: policy.policySource,
+                    matchedPolicy: policy.matchedPolicy,
+                };
+                this.audit('tool', agentName, toolName, decision);
+                return decision;
+            }
+            // Check if tool is in allowed list
+            const allowed = this.matchesPattern(toolName, allowedTools);
+            if (!allowed) {
+                const decision = {
+                    allowed: false,
+                    reason: `Agent "${agentName}" is not allowed to use tool "${toolName}"`,
+                    policySource: policy.policySource,
+                    matchedPolicy: policy.matchedPolicy,
+                };
+                this.audit('tool', agentName, toolName, decision);
+                return decision;
+            }
+        }
+        const decision = {
+            allowed: true,
+            reason: 'Tool usage permitted by policy',
+            policySource: policy.policySource,
+            matchedPolicy: policy.matchedPolicy,
+        };
+        this.audit('tool', agentName, toolName, decision);
+        return decision;
+    }
+    /**
+     * Get the effective policy for an agent
+     * Fallback chain: repo config → user PRPM policies → cloud workspace → defaults
+     */
+    async getAgentPolicy(agentName) {
+        // 1. Try repo-level config (.claude/agents/*.md)
+        const repoConfig = findAgentConfig(agentName, this.projectRoot);
+        if (repoConfig) {
+            return {
+                matchedPolicy: this.configToPolicy(repoConfig),
+                policySource: 'repo',
+            };
+        }
+        // 2. Try user-level PRPM policies (~/.config/agent-relay/policies/*.yaml)
+        const localPolicy = this.loadLocalPolicies();
+        if (localPolicy) {
+            // Check for strict mode in local policy
+            if (localPolicy.settings?.requireExplicitAgents) {
+                const matchedPolicy = this.findMatchingPolicy(agentName, localPolicy.agents);
+                if (matchedPolicy) {
+                    return { matchedPolicy, policySource: 'local' };
+                }
+                // Unknown agent in strict mode
+                return {
+                    matchedPolicy: { ...STRICT_DEFAULT_POLICY, name: agentName },
+                    policySource: 'local',
+                };
+            }
+            // Find matching policy
+            const matchedPolicy = this.findMatchingPolicy(agentName, localPolicy.agents);
+            if (matchedPolicy) {
+                return { matchedPolicy, policySource: 'local' };
+            }
+            // Use local default
+            if (localPolicy.defaultPolicy) {
+                return {
+                    matchedPolicy: { ...localPolicy.defaultPolicy, name: agentName },
+                    policySource: 'local',
+                };
+            }
+        }
+        // 3. Try workspace-level policy from cloud
+        const workspacePolicy = await this.getWorkspacePolicy();
+        if (workspacePolicy) {
+            // Check for strict mode
+            if (workspacePolicy.settings?.requireExplicitAgents) {
+                // In strict mode, unknown agents get restrictive defaults
+                const matchedPolicy = this.findMatchingPolicy(agentName, workspacePolicy.agents);
+                if (matchedPolicy) {
+                    return { matchedPolicy, policySource: 'workspace' };
+                }
+                // Unknown agent in strict mode
+                return {
+                    matchedPolicy: { ...STRICT_DEFAULT_POLICY, name: agentName },
+                    policySource: 'workspace',
+                };
+            }
+            // Find matching policy
+            const matchedPolicy = this.findMatchingPolicy(agentName, workspacePolicy.agents);
+            if (matchedPolicy) {
+                return { matchedPolicy, policySource: 'workspace' };
+            }
+            // Use workspace default
+            if (workspacePolicy.defaultPolicy) {
+                return {
+                    matchedPolicy: { ...workspacePolicy.defaultPolicy, name: agentName },
+                    policySource: 'workspace',
+                };
+            }
+        }
+        // 4. Fall back to built-in defaults
+        const defaultPolicy = this.strictMode ? STRICT_DEFAULT_POLICY : DEFAULT_POLICY;
+        return {
+            matchedPolicy: { ...defaultPolicy, name: agentName },
+            policySource: 'default',
+        };
+    }
+    /**
+     * Get workspace policy from cloud (with caching)
+     */
+    async getWorkspacePolicy() {
+        if (!this.workspaceId || !this.cloudFetcher) {
+            return null;
+        }
+        // Check cache
+        if (this.cachedWorkspacePolicy && Date.now() < this.policyCacheExpiry) {
+            return this.cachedWorkspacePolicy;
+        }
+        try {
+            const policy = await this.cloudFetcher.getWorkspacePolicy(this.workspaceId);
+            if (policy) {
+                this.cachedWorkspacePolicy = policy;
+                this.policyCacheExpiry = Date.now() + AgentPolicyService.CACHE_TTL_MS;
+            }
+            return policy;
+        }
+        catch (err) {
+            console.error('[policy] Failed to fetch workspace policy:', err);
+            // Return cached policy if available, even if expired
+            return this.cachedWorkspacePolicy ?? null;
+        }
+    }
+    /**
+     * Find matching policy from a list (supports wildcards)
+     */
+    findMatchingPolicy(agentName, policies) {
+        // First try exact match
+        const exactMatch = policies.find(p => p.name.toLowerCase() === agentName.toLowerCase());
+        if (exactMatch)
+            return exactMatch;
+        // Then try pattern match
+        for (const policy of policies) {
+            if (this.matchesPattern(agentName, [policy.name])) {
+                return policy;
+            }
+        }
+        return null;
+    }
+    /**
+     * Check if a name matches any pattern in the list
+     * Supports: exact match, prefix* match, *suffix match, * (all)
+     */
+    matchesPattern(name, patterns) {
+        const lowerName = name.toLowerCase();
+        for (const pattern of patterns) {
+            const lowerPattern = pattern.toLowerCase();
+            // Wildcard all
+            if (lowerPattern === '*')
+                return true;
+            // Exact match
+            if (lowerPattern === lowerName)
+                return true;
+            // Prefix match (e.g., "Worker*" matches "WorkerA")
+            if (lowerPattern.endsWith('*')) {
+                const prefix = lowerPattern.slice(0, -1);
+                if (lowerName.startsWith(prefix))
+                    return true;
+            }
+            // Suffix match (e.g., "*Lead" matches "TeamLead")
+            if (lowerPattern.startsWith('*')) {
+                const suffix = lowerPattern.slice(1);
+                if (lowerName.endsWith(suffix))
+                    return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * Convert AgentConfig to AgentPolicy
+     */
+    configToPolicy(config) {
+        return {
+            name: config.name,
+            allowedTools: config.allowedTools,
+            // Other fields come from defaults since repo config doesn't specify them
+            canSpawn: undefined,
+            canMessage: undefined,
+            maxSpawns: 10,
+            rateLimit: 60,
+            canBeSpawned: true,
+        };
+    }
+    /**
+     * Record an audit entry
+     */
+    audit(action, actor, target, decision, context) {
+        const entry = {
+            timestamp: Date.now(),
+            action,
+            actor,
+            target,
+            decision,
+            context,
+        };
+        this.auditLog.push(entry);
+        // Trim log if too large
+        if (this.auditLog.length > AgentPolicyService.MAX_AUDIT_ENTRIES) {
+            this.auditLog = this.auditLog.slice(-AgentPolicyService.MAX_AUDIT_ENTRIES / 2);
+        }
+        // Log denied actions
+        if (!decision.allowed) {
+            console.warn(`[policy] DENIED: ${action} by ${actor}${target ? ` -> ${target}` : ''}: ${decision.reason}`);
+        }
+    }
+    /**
+     * Get audit log entries
+     */
+    getAuditLog(options) {
+        let entries = [...this.auditLog];
+        if (options?.action) {
+            entries = entries.filter(e => e.action === options.action);
+        }
+        if (options?.actor) {
+            entries = entries.filter(e => e.actor === options.actor);
+        }
+        if (options?.deniedOnly) {
+            entries = entries.filter(e => !e.decision.allowed);
+        }
+        if (options?.limit) {
+            entries = entries.slice(-options.limit);
+        }
+        return entries;
+    }
+    /**
+     * Clear audit log
+     */
+    clearAuditLog() {
+        this.auditLog = [];
+    }
+    /**
+     * Invalidate cached workspace policy
+     */
+    invalidateCache() {
+        this.cachedWorkspacePolicy = undefined;
+        this.policyCacheExpiry = 0;
+    }
+    /**
+     * Get a human-readable policy summary for an agent
+     * This can be injected into agent prompts to inform them of their permissions
+     */
+    async getPolicySummary(agentName) {
+        const { matchedPolicy, policySource } = await this.getAgentPolicy(agentName);
+        const lines = [
+            `# Agent Policy for ${agentName}`,
+            `Source: ${policySource}`,
+            '',
+        ];
+        // Tools
+        if (matchedPolicy.allowedTools) {
+            if (matchedPolicy.allowedTools.length === 1 && matchedPolicy.allowedTools[0] === 'none') {
+                lines.push('**Tools**: No tools allowed');
+            }
+            else {
+                lines.push(`**Allowed Tools**: ${matchedPolicy.allowedTools.join(', ')}`);
+            }
+        }
+        else {
+            lines.push('**Tools**: All tools allowed');
+        }
+        // Spawning
+        if (matchedPolicy.canSpawn) {
+            if (matchedPolicy.canSpawn.length === 0) {
+                lines.push('**Spawning**: Cannot spawn other agents');
+            }
+            else {
+                lines.push(`**Can Spawn**: ${matchedPolicy.canSpawn.join(', ')}`);
+            }
+        }
+        else {
+            lines.push('**Spawning**: Can spawn any agent');
+        }
+        // Messaging
+        if (matchedPolicy.canMessage) {
+            if (matchedPolicy.canMessage.length === 0) {
+                lines.push('**Messaging**: Cannot message other agents');
+            }
+            else {
+                lines.push(`**Can Message**: ${matchedPolicy.canMessage.join(', ')}`);
+            }
+        }
+        else {
+            lines.push('**Messaging**: Can message any agent');
+        }
+        // Limits
+        if (matchedPolicy.maxSpawns !== undefined) {
+            lines.push(`**Max Spawns**: ${matchedPolicy.maxSpawns}`);
+        }
+        if (matchedPolicy.rateLimit !== undefined) {
+            lines.push(`**Rate Limit**: ${matchedPolicy.rateLimit} messages/min`);
+        }
+        return lines.join('\n');
+    }
+    /**
+     * Get a concise policy instruction for injection into agent prompts
+     */
+    async getPolicyInstruction(agentName) {
+        const { matchedPolicy, policySource: _policySource } = await this.getAgentPolicy(agentName);
+        // Only generate instructions if there are restrictions
+        const hasRestrictions = matchedPolicy.allowedTools !== undefined ||
+            matchedPolicy.canSpawn !== undefined ||
+            matchedPolicy.canMessage !== undefined;
+        if (!hasRestrictions) {
+            return null; // No restrictions, no need to inform agent
+        }
+        const restrictions = [];
+        if (matchedPolicy.allowedTools) {
+            if (matchedPolicy.allowedTools.length === 1 && matchedPolicy.allowedTools[0] === 'none') {
+                restrictions.push('You are not allowed to use any tools.');
+            }
+            else {
+                restrictions.push(`You may only use these tools: ${matchedPolicy.allowedTools.join(', ')}.`);
+            }
+        }
+        if (matchedPolicy.canSpawn) {
+            if (matchedPolicy.canSpawn.length === 0) {
+                restrictions.push('You are not allowed to spawn other agents.');
+            }
+            else {
+                restrictions.push(`You may only spawn these agents: ${matchedPolicy.canSpawn.join(', ')}.`);
+            }
+        }
+        if (matchedPolicy.canMessage) {
+            if (matchedPolicy.canMessage.length === 0) {
+                restrictions.push('You are not allowed to message other agents.');
+            }
+            else {
+                restrictions.push(`You may only message these agents: ${matchedPolicy.canMessage.join(', ')}.`);
+            }
+        }
+        if (restrictions.length === 0) {
+            return null;
+        }
+        return `[Policy Restrictions]\n${restrictions.join('\n')}`;
+    }
+}
+/**
+ * Create a policy service for a project
+ */
+export function createPolicyService(options) {
+    return new AgentPolicyService(options);
+}
+//# sourceMappingURL=agent-policy.js.map

package/dist/agent-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-policy.js","sourceRoot":"","sources":["../src/agent-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAoB,MAAM,kCAAkC,CAAC;AAErF,OAAO,EAAE,MAAM,SAAS,CAAC;AA+FzB,mDAAmD;AACnD,MAAM,cAAc,GAAgB;IAClC,IAAI,EAAE,GAAG;IACT,YAAY,EAAE,SAAS,EAAE,+BAA+B;IACxD,QAAQ,EAAE,SAAS,EAAE,sBAAsB;IAC3C,UAAU,EAAE,SAAS,EAAE,wBAAwB;IAC/C,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE,EAAE,yBAAyB;IACxC,YAAY,EAAE,IAAI;CACnB,CAAC;AAEF,6DAA6D;AAC7D,MAAM,qBAAqB,GAAgB;IACzC,IAAI,EAAE,GAAG;IACT,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,uBAAuB;IAC/D,QAAQ,EAAE,EAAE,EAAE,eAAe;IAC7B,UAAU,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,yBAAyB;IAC9D,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,EAAE;IACb,YAAY,EAAE,KAAK;CACpB,CAAC;AAUF,MAAM,OAAO,kBAAkB;IACrB,WAAW,CAAS;IACpB,WAAW,CAAU;IACrB,YAAY,CAAsB;IAClC,qBAAqB,CAAmB;IACxC,iBAAiB,CAAmB;IACpC,iBAAiB,GAAG,CAAC,CAAC;IACtB,sBAAsB,GAAG,CAAC,CAAC;IAC3B,QAAQ,GAAiB,EAAE,CAAC;IAC5B,UAAU,CAAU;IAE5B,4CAA4C;IACpC,MAAM,CAAU,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACrD,2DAA2D;IACnD,MAAM,CAAU,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;IACvD,kDAAkD;IAC1C,MAAM,CAAU,iBAAiB,GAAG,IAAI,CAAC;IAEjD,YAAY,OAKX;QACC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC;IAChD,CAAC;IAED;;;OAGG;IACK,kBAAkB;QACxB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB;YAClD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACK,iBAAiB;QACvB,cAAc;QACd,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACvE,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAChC,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACnD,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CACjE,CAAC;YAEF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,yBAAyB;YACzB,MAAM,YAAY,GAAkB,EAAE,CAAC;YACvC,IAAI,cAAc,GAAgC;gBAChD,qBAAqB,EAAE,KAAK;gBAC5B,YAAY,EAAE,IAAI;gBAClB,cAAc,EAAE,EAAE;aACnB,CAAC;YACF,IAAI,aAAa,GAAgB,EAAE,GAAG,cAAc,EAAE,CAAC;YAEvD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAC9C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAEnD,IAAI,MAA+B,CAAC;gBACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC/B,CAAC;qBAAM,CAAC;oBACN,uCAAuC;oBACvC,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;gBACzC,CAAC;gBAED,eAAe;gBACf,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBACjC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;wBAClC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;4BAC1D,YAAY,CAAC,IAAI,CAAC,KAAoB,CAAC,CAAC;wBAC1C,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,wCAAwC;gBACxC,IAAI,MAAM,CAAC,QAAQ,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBAC3D,cAAc,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,CAAC,QAAmC,EAAE,CAAC;gBACxF,CAAC;gBAED,uBAAuB;gBACvB,IAAI,MAAM,CAAC,aAAa,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;oBACrE,aAAa,GAAG,EAAE,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC,aAA4B,EAAE,CAAC;gBAC/E,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAoB;gBAC9B,aAAa,EAAE,aAAa;gBAC5B,MAAM,EAAE,YAAY;gBACpB,QAAQ,EAAE,cAAc;aACzB,CAAC;YAEF,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC;YAChC,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC,kBAAkB,CAAC;YAEjF,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,eAAe,CAAC,OAAe;QACrC,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,WAAW,GAAG,EAAE,CAAC;QACrB,IAAI,YAAY,GAAqB,IAAI,CAAC;QAC1C,IAAI,aAAa,GAAmC,IAAI,CAAC;QACzD,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAE5B,gCAAgC;YAChC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAElD,wBAAwB;YACxB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC;YAEzD,aAAa;YACb,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAEtC,2CAA2C;gBAC3C,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;oBACvD,aAAa,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAChD,IAAI,YAAY,EAAE,CAAC;wBACjB,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;oBACnC,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,qBAAqB;oBACrB,IAAI,YAAY,EAAE,CAAC;wBACjB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC5C,CAAC;gBACH,CAAC;gBACD,SAAS;YACX,CAAC;YAED,kBAAkB;YAClB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAEjD,wCAAwC;gBACxC,IAAI,aAAa,IAAI,UAAU,GAAG,MAAM,EAAE,CAAC;oBACzC,aAAa,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;oBAC5C,SAAS;gBACX,CAAC;gBAED,2BAA2B;gBAC3B,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;oBACnD,kCAAkC;oBAClC,WAAW,GAAG,GAAG,CAAC;oBAClB,YAAY,GAAG,EAAE,CAAC;oBAClB,aAAa,GAAG,IAAI,CAAC;oBACrB,MAAM,GAAG,UAAU,CAAC;oBACpB,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;gBAC7B,CAAC;qBAAM,CAAC;oBACN,oBAAoB;oBACpB,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;wBACrB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;wBACrC,WAAW,GAAG,EAAE,CAAC;wBACjB,YAAY,GAAG,IAAI,CAAC;wBACpB,aAAa,GAAG,IAAI,CAAC;oBACvB,CAAC;yBAAM,IAAI,aAAa,EAAE,CAAC;wBACzB,aAAa,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;oBAC9C,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,KAAa;QAC9B,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,KAAK,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAClC,IAAI,KAAK,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QAEpC,2BAA2B;QAC3B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;gBAAE,OAAO,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;gBAC9B,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;gBACrD,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC;QAED,SAAS;QACT,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAED,oCAAoC;QACpC,OAAO,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CACZ,WAAmB,EACnB,UAAkB,EAClB,SAAiB;QAEjB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QAC7D,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAE3D,iCAAiC;QACjC,IAAI,YAAY,CAAC,aAAa,EAAE,YAAY,KAAK,KAAK,EAAE,CAAC;YACvD,MAAM,QAAQ,GAAmB;gBAC/B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,UAAU,UAAU,gCAAgC;gBAC5D,YAAY,EAAE,YAAY,CAAC,YAAY;gBACvC,aAAa,EAAE,YAAY,CAAC,aAAa;aAC1C,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;YAC3E,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,6BAA6B;QAC7B,MAAM,YAAY,GAAG,aAAa,CAAC,aAAa,EAAE,QAAQ,CAAC;QAC3D,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,QAAQ,GAAmB;oBAC/B,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,UAAU,WAAW,8BAA8B,UAAU,GAAG;oBACxE,YAAY,EAAE,aAAa,CAAC,YAAY;oBACxC,aAAa,EAAE,aAAa,CAAC,aAAa;iBAC3C,CAAC;gBACF,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC3E,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,MAAM,QAAQ,GAAmB;YAC/B,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,2BAA2B;YACnC,YAAY,EAAE,aAAa,CAAC,YAAY;YACxC,aAAa,EAAE,aAAa,CAAC,aAAa;SAC3C,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,UAAkB,EAClB,aAAqB;QAErB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAE3D,MAAM,cAAc,GAAG,YAAY,CAAC,aAAa,EAAE,UAAU,CAAC;QAC9D,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YACtE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAmB;oBAC/B,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,UAAU,UAAU,gCAAgC,aAAa,GAAG;oBAC5E,YAAY,EAAE,YAAY,CAAC,YAAY;oBACvC,aAAa,EAAE,YAAY,CAAC,aAAa;iBAC1C,CAAC;gBACF,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;gBAC3D,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAmB;YAC/B,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,6BAA6B;YACrC,YAAY,EAAE,YAAY,CAAC,YAAY;YACvC,aAAa,EAAE,YAAY,CAAC,aAAa;SAC1C,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC3D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,QAAgB;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAEpD,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC;QACxD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,kCAAkC;YAClC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;gBAC5D,MAAM,QAAQ,GAAmB;oBAC/B,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,UAAU,SAAS,mCAAmC;oBAC9D,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,aAAa,EAAE,MAAM,CAAC,aAAa;iBACpC,CAAC;gBACF,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAClD,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,mCAAmC;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAmB;oBAC/B,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,UAAU,SAAS,iCAAiC,QAAQ,GAAG;oBACvE,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,aAAa,EAAE,MAAM,CAAC,aAAa;iBACpC,CAAC;gBACF,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAClD,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAmB;YAC/B,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,gCAAgC;YACxC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,aAAa,EAAE,MAAM,CAAC,aAAa;SACpC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,SAAiB;QAIpC,iDAAiD;QACjD,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,UAAU,EAAE,CAAC;YACf,OAAO;gBACL,aAAa,EAAE,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC;gBAC9C,YAAY,EAAE,MAAM;aACrB,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC7C,IAAI,WAAW,EAAE,CAAC;YAChB,wCAAwC;YACxC,IAAI,WAAW,CAAC,QAAQ,EAAE,qBAAqB,EAAE,CAAC;gBAChD,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBAC7E,IAAI,aAAa,EAAE,CAAC;oBAClB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;gBAClD,CAAC;gBACD,+BAA+B;gBAC/B,OAAO;oBACL,aAAa,EAAE,EAAE,GAAG,qBAAqB,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC5D,YAAY,EAAE,OAAO;iBACtB,CAAC;YACJ,CAAC;YAED,uBAAuB;YACvB,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;YAC7E,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;YAClD,CAAC;YAED,oBAAoB;YACpB,IAAI,WAAW,CAAC,aAAa,EAAE,CAAC;gBAC9B,OAAO;oBACL,aAAa,EAAE,EAAE,GAAG,WAAW,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;oBAChE,YAAY,EAAE,OAAO;iBACtB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2CAA2C;QAC3C,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxD,IAAI,eAAe,EAAE,CAAC;YACpB,wBAAwB;YACxB,IAAI,eAAe,CAAC,QAAQ,EAAE,qBAAqB,EAAE,CAAC;gBACpD,0DAA0D;gBAC1D,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;gBACjF,IAAI,aAAa,EAAE,CAAC;oBAClB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;gBACtD,CAAC;gBACD,+BAA+B;gBAC/B,OAAO;oBACL,aAAa,EAAE,EAAE,GAAG,qBAAqB,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC5D,YAAY,EAAE,WAAW;iBAC1B,CAAC;YACJ,CAAC;YAED,uBAAuB;YACvB,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;YACjF,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;YACtD,CAAC;YAED,wBAAwB;YACxB,IAAI,eAAe,CAAC,aAAa,EAAE,CAAC;gBAClC,OAAO;oBACL,aAAa,EAAE,EAAE,GAAG,eAAe,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;oBACpE,YAAY,EAAE,WAAW;iBAC1B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,cAAc,CAAC;QAC/E,OAAO;YACL,aAAa,EAAE,EAAE,GAAG,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;YACpD,YAAY,EAAE,SAAS;SACxB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,cAAc;QACd,IAAI,IAAI,CAAC,qBAAqB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,qBAAqB,CAAC;QACpC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC5E,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,qBAAqB,GAAG,MAAM,CAAC;gBACpC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC,YAAY,CAAC;YACxE,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAC;YACjE,qDAAqD;YACrD,OAAO,IAAI,CAAC,qBAAqB,IAAI,IAAI,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;OAEG;IACK,kBAAkB,CAAC,SAAiB,EAAE,QAAuB;QACnE,wBAAwB;QACxB,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QACxF,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAElC,yBAAyB;QACzB,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAClD,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,cAAc,CAAC,IAAY,EAAE,QAAkB;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACrC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YAE3C,eAAe;YACf,IAAI,YAAY,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YAEtC,cAAc;YACd,IAAI,YAAY,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YAE5C,mDAAmD;YACnD,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACzC,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,OAAO,IAAI,CAAC;YAChD,CAAC;YAED,kDAAkD;YAClD,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACrC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,OAAO,IAAI,CAAC;YAC9C,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,MAAmB;QACxC,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,yEAAyE;YACzE,QAAQ,EAAE,SAAS;YACnB,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;YACb,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CACX,MAA4B,EAC5B,KAAa,EACb,MAA0B,EAC1B,QAAwB,EACxB,OAAiC;QAEjC,MAAM,KAAK,GAAe;YACxB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM;YACN,KAAK;YACL,MAAM;YACN,QAAQ;YACR,OAAO;SACR,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE1B,wBAAwB;QACxB,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,kBAAkB,CAAC,iBAAiB,EAAE,CAAC;YAChE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC;QACjF,CAAC;QAED,qBAAqB;QACrB,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,oBAAoB,MAAM,OAAO,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,OAKX;QACC,IAAI,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEjC,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;YACxB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,aAAa;QACX,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,eAAe;QACb,IAAI,CAAC,qBAAqB,GAAG,SAAS,CAAC;QACvC,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,SAAiB;QACtC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAE7E,MAAM,KAAK,GAAa;YACtB,sBAAsB,SAAS,EAAE;YACjC,WAAW,YAAY,EAAE;YACzB,EAAE;SACH,CAAC;QAEF,QAAQ;QACR,IAAI,aAAa,CAAC,YAAY,EAAE,CAAC;YAC/B,IAAI,aAAa,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;gBACxF,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,sBAAsB,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC7C,CAAC;QAED,WAAW;QACX,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC3B,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxC,KAAK,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YACxD,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,kBAAkB,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QAClD,CAAC;QAED,YAAY;QACZ,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;YAC7B,IAAI,aAAa,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1C,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YAC3D,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,oBAAoB,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QACrD,CAAC;QAED,SAAS;QACT,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,mBAAmB,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,mBAAmB,aAAa,CAAC,SAAS,eAAe,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CAAC,SAAiB;QAC1C,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAE5F,uDAAuD;QACvD,MAAM,eAAe,GACnB,aAAa,CAAC,YAAY,KAAK,SAAS;YACxC,aAAa,CAAC,QAAQ,KAAK,SAAS;YACpC,aAAa,CAAC,UAAU,KAAK,SAAS,CAAC;QAEzC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,CAAC,2CAA2C;QAC1D,CAAC;QAED,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,IAAI,aAAa,CAAC,YAAY,EAAE,CAAC;YAC/B,IAAI,aAAa,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;gBACxF,YAAY,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;YAC7D,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,IAAI,CAAC,iCAAiC,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC;QAED,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC3B,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxC,YAAY,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YAClE,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,IAAI,CAAC,oCAAoC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;QAED,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;YAC7B,IAAI,aAAa,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1C,YAAY,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;YACpE,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,IAAI,CAAC,sCAAsC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,0BAA0B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7D,CAAC;;AAGH;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAKnC;IACC,OAAO,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC"}

package/dist/cloud-policy-fetcher.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Cloud Policy Fetcher
+ *
+ * Fetches workspace agent policies from the cloud API.
+ * Used by workspace containers to get their policy configuration.
+ */
+import type { CloudPolicyFetcher } from './agent-policy.js';
+/**
+ * Create a cloud policy fetcher for workspace containers
+ */
+export declare function createCloudPolicyFetcher(): CloudPolicyFetcher | null;
+//# sourceMappingURL=cloud-policy-fetcher.d.ts.map

package/dist/cloud-policy-fetcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-policy-fetcher.d.ts","sourceRoot":"","sources":["../src/cloud-policy-fetcher.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAgC,MAAM,mBAAmB,CAAC;AAE1F;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,kBAAkB,GAAG,IAAI,CAiEpE"}

package/dist/cloud-policy-fetcher.js

@@ -0,0 +1,64 @@
+/**
+ * Cloud Policy Fetcher
+ *
+ * Fetches workspace agent policies from the cloud API.
+ * Used by workspace containers to get their policy configuration.
+ */
+/**
+ * Create a cloud policy fetcher for workspace containers
+ */
+export function createCloudPolicyFetcher() {
+    const cloudApiUrl = process.env.CLOUD_API_URL;
+    const workspaceId = process.env.WORKSPACE_ID;
+    const workspaceToken = process.env.WORKSPACE_TOKEN;
+    if (!cloudApiUrl || !workspaceId) {
+        return null;
+    }
+    return {
+        async getWorkspacePolicy(requestedWorkspaceId) {
+            // Only allow fetching policy for this workspace
+            if (requestedWorkspaceId !== workspaceId) {
+                console.warn(`[policy-fetcher] Attempted to fetch policy for different workspace: ${requestedWorkspaceId}`);
+                return null;
+            }
+            try {
+                const url = `${cloudApiUrl}/api/policy/${workspaceId}/internal`;
+                const headers = {
+                    'Content-Type': 'application/json',
+                };
+                // Add auth header if we have a workspace token
+                if (workspaceToken) {
+                    headers['Authorization'] = `Bearer ${workspaceToken}`;
+                }
+                const response = await fetch(url, { headers });
+                if (!response.ok) {
+                    console.error(`[policy-fetcher] Failed to fetch policy: ${response.status} ${response.statusText}`);
+                    return null;
+                }
+                const data = await response.json();
+                // Convert API response to WorkspacePolicy
+                const policy = {
+                    defaultPolicy: data.defaultPolicy ?? {
+                        name: '*',
+                        maxSpawns: 10,
+                        rateLimit: 60,
+                        canBeSpawned: true,
+                    },
+                    agents: data.agents ?? [],
+                    settings: data.settings ?? {
+                        requireExplicitAgents: false,
+                        auditEnabled: true,
+                        maxTotalAgents: 50,
+                    },
+                };
+                console.log(`[policy-fetcher] Fetched policy for workspace ${workspaceId}: ${policy.agents.length} agent rules`);
+                return policy;
+            }
+            catch (error) {
+                console.error('[policy-fetcher] Error fetching policy:', error);
+                return null;
+            }
+        },
+    };
+}
+//# sourceMappingURL=cloud-policy-fetcher.js.map

package/dist/cloud-policy-fetcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-policy-fetcher.js","sourceRoot":"","sources":["../src/cloud-policy-fetcher.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;GAEG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC7C,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAEnD,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,KAAK,CAAC,kBAAkB,CAAC,oBAA4B;YACnD,gDAAgD;YAChD,IAAI,oBAAoB,KAAK,WAAW,EAAE,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,uEAAuE,oBAAoB,EAAE,CAAC,CAAC;gBAC5G,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,GAAG,WAAW,eAAe,WAAW,WAAW,CAAC;gBAChE,MAAM,OAAO,GAA2B;oBACtC,cAAc,EAAE,kBAAkB;iBACnC,CAAC;gBAEF,+CAA+C;gBAC/C,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,cAAc,EAAE,CAAC;gBACxD,CAAC;gBAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;gBAE/C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,OAAO,CAAC,KAAK,CAAC,4CAA4C,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;oBACpG,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAI/B,CAAC;gBAEF,0CAA0C;gBAC1C,MAAM,MAAM,GAAoB;oBAC9B,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI;wBACnC,IAAI,EAAE,GAAG;wBACT,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,EAAE;wBACb,YAAY,EAAE,IAAI;qBACnB;oBACD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;oBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI;wBACzB,qBAAqB,EAAE,KAAK;wBAC5B,YAAY,EAAE,IAAI;wBAClB,cAAc,EAAE,EAAE;qBACnB;iBACF,CAAC;gBAEF,OAAO,CAAC,GAAG,CAAC,iDAAiD,WAAW,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,cAAc,CAAC,CAAC;gBACjH,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;gBAChE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @relay/policy
+ *
+ * Agent policy management with multi-level fallback:
+ * - Repo-level policy (.claude/agents/*.md)
+ * - User-level PRPM policies (~/.config/agent-relay/policies/*.yaml)
+ * - Cloud workspace policies
+ * - Built-in safe defaults
+ */
+export { AgentPolicyService, createPolicyService, type AgentPolicy, type WorkspacePolicy, type PolicyDecision, type AuditEntry, type CloudPolicyFetcher, } from './agent-policy.js';
+export { createCloudPolicyFetcher } from './cloud-policy-fetcher.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/index.js

@@ -0,0 +1,12 @@
+/**
+ * @relay/policy
+ *
+ * Agent policy management with multi-level fallback:
+ * - Repo-level policy (.claude/agents/*.md)
+ * - User-level PRPM policies (~/.config/agent-relay/policies/*.yaml)
+ * - Cloud workspace policies
+ * - Built-in safe defaults
+ */
+export { AgentPolicyService, createPolicyService, } from './agent-policy.js';
+export { createCloudPolicyFetcher } from './cloud-policy-fetcher.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GAMpB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC"}

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@agent-relay/policy",
+  "version": "0.1.0",
+  "description": "Agent policy management with multi-level fallback (repo, local PRPM, cloud workspace)",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "clean": "rm -rf dist",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "dependencies": {
+    "@agent-relay/config": "^0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.19.3",
+    "typescript": "^5.9.3",
+    "vitest": "^3.2.4"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}