@anweat/dsh-browser 0.2.0 → 0.2.2

package/lib/approval-policy.d.ts

@@ -11,6 +11,15 @@
  */
 import { type AnyRecipeStep } from './automation.ts';
 import { type AutomationMode } from './freedom.ts';
+/** What `BrowserService.previewPolicyChange` reports for a policy action, so the approval prompt can show the diff. */
+export type PolicyPreview = {
+    ok: true;
+    direction: 'tighten' | 'loosen' | 'none';
+    lines: string[];
+} | {
+    ok: false;
+    message: string;
+};
 export type BrowserPolicyDecision = {
     kind: 'allow';
 } | {
@@ -47,4 +56,14 @@ export declare function recipeStepsDecision(name: string, steps: readonly AnyRec
  * @param draftSteps - for `automation.develop` test of a recipe, the steps the draft would replay.
  * @param asset - for the same two, the asset itself, so the approval prompt names it instead of showing a bare id.
  */
-export declare function browserPolicyDecision(name: string, args: unknown, mode?: AutomationMode, assetKind?: 'recipe' | 'userscript', draftSteps?: readonly AnyRecipeStep[], asset?: AssetRef): BrowserPolicyDecision;
+export declare function browserPolicyDecision(name: string, args: unknown, mode?: AutomationMode, assetKind?: 'recipe' | 'userscript', draftSteps?: readonly AnyRecipeStep[], asset?: AssetRef, policyPreview?: PolicyPreview): BrowserPolicyDecision;
+/**
+ * The decision the Host hook returns for a resolved browser action, in this order:
+ *
+ * 1. An action the automationMode disables stays denied (`browserPolicyDecision` says so).
+ * 2. Arguments `runAction` would refuse for their shape are let through unasked: the executor validates them
+ *    again with the same check and returns `INVALID_ARGS` with the schema, and runs nothing.
+ * 3. Otherwise the approval rules of `browserPolicyDecision` apply. The rules that read the arguments themselves
+ *    (upload paths, evaluate expression, userscript source) therefore only see arguments that passed the schema.
+ */
+export declare function browserCallDecision(...params: Parameters<typeof browserPolicyDecision>): BrowserPolicyDecision;

package/lib/approval-policy.js

@@ -13,6 +13,7 @@ import { READ_ONLY_ACTIONS, recipeNeedsApproval } from "./automation.js";
 import { validateUserscript } from "./scripts.js";
 import { isBrowserActionExposed } from "./freedom.js";
 import { findAction } from "./actions/registry.js";
+import { argsRejectedByExecutor } from "./actions/surface.js";
 const WEB_LOCAL_MUTATIONS = new Set(['web_cache_clear']);
 const clip = (text, max = 120) => text.length > max ? text.slice(0, max) + '…' : text;
 /**
@@ -77,7 +78,7 @@ export function recipeStepsDecision(name, steps, mode) {
  * @param draftSteps - for `automation.develop` test of a recipe, the steps the draft would replay.
  * @param asset - for the same two, the asset itself, so the approval prompt names it instead of showing a bare id.
  */
-export function browserPolicyDecision(name, args, mode = 'standard', assetKind, draftSteps, asset) {
+export function browserPolicyDecision(name, args, mode = 'standard', assetKind, draftSteps, asset, policyPreview) {
     const action = findAction(name);
     if (!action && (name.startsWith('browser_') || /^[a-z]+\.[a-z_]+$/.test(name))) {
         return { kind: 'deny', reason: `Unknown browser action ${name}; browser tools are reached through browser_index / browser_call` };
@@ -112,6 +113,47 @@ export function browserPolicyDecision(name, args, mode = 'standard', assetKind,
                     return { kind: 'allow' };
                 return { kind: 'ask', reason: `${name} ${targetLabel(args)}: Read local files and expose them to the current website upload control: ` + files.slice(0, 5).join(', ') };
             }
+            case 'policy': {
+                // Judged by direction, not by action: tightening and no-ops are free in every mode. A change the preview
+                // could not plan is let through: the executor refuses it with the reason and changes nothing.
+                if (policyPreview && !policyPreview.ok)
+                    return { kind: 'allow' };
+                if (policyPreview && policyPreview.direction !== 'loosen')
+                    return { kind: 'allow' };
+                const diff = policyPreview?.ok ? policyPreview.lines.join('; ') : 'a change that may widen what the browser can do';
+                if (mode === 'read-only')
+                    return { kind: 'deny', reason: `Loosening a restriction is disabled by automationMode=${mode}: ${clip(diff, 300)}` };
+                if (mode === 'unrestricted')
+                    return { kind: 'allow' };
+                return { kind: 'ask', reason: `${name}: Loosen a browser restriction: ${clip(diff, 500)}` };
+            }
+            case 'download': {
+                const url = args?.url;
+                if (typeof url !== 'string' || !url.trim())
+                    return { kind: 'deny', reason: `${name} requires a URL` };
+                if (mode === 'read-only')
+                    return { kind: 'deny', reason: `File download is disabled by automationMode=${mode}` };
+                if (mode === 'unrestricted')
+                    return { kind: 'allow' };
+                const filename = args?.filename;
+                return { kind: 'ask', reason: `${name} ${clip(url, 160)}: Fetch this URL with the session's login state and save it to the local download directory` + (typeof filename === 'string' ? ` as ${clip(filename, 80)}` : '') };
+            }
+            case 'context-options': {
+                // Viewport, locale and time zone only change what the page sees of the window; a proxy changes where the traffic
+                // goes and a user agent changes how the browser presents itself, so only those two are approved.
+                const input = (args ?? {});
+                const changed = [
+                    ...typeof input.proxyServer === 'string' ? [`proxyServer=${clip(input.proxyServer, 80)} (all traffic of the new context goes through this proxy)`] : [],
+                    ...typeof input.userAgent === 'string' ? [`userAgent=${JSON.stringify(clip(input.userAgent, 80))} (the browser presents itself differently)`] : [],
+                ];
+                if (changed.length === 0)
+                    return { kind: 'allow' };
+                if (mode === 'read-only')
+                    return { kind: 'deny', reason: `Changing the network egress or browser fingerprint is disabled by automationMode=${mode}: ${changed.join('; ')}` };
+                if (mode === 'unrestricted')
+                    return { kind: 'allow' };
+                return { kind: 'ask', reason: `${name} ${typeof input.url === 'string' ? clip(input.url, 120) : ''}: Open a new browser context with changed ` + changed.join('; ') };
+            }
             case 'evaluate': {
                 const expression = args?.expression;
                 if (typeof expression !== 'string' || !expression.trim())
@@ -205,4 +247,19 @@ export function browserPolicyDecision(name, args, mode = 'standard', assetKind,
     }
     return { kind: 'allow' };
 }
+/**
+ * The decision the Host hook returns for a resolved browser action, in this order:
+ *
+ * 1. An action the automationMode disables stays denied (`browserPolicyDecision` says so).
+ * 2. Arguments `runAction` would refuse for their shape are let through unasked: the executor validates them
+ *    again with the same check and returns `INVALID_ARGS` with the schema, and runs nothing.
+ * 3. Otherwise the approval rules of `browserPolicyDecision` apply. The rules that read the arguments themselves
+ *    (upload paths, evaluate expression, userscript source) therefore only see arguments that passed the schema.
+ */
+export function browserCallDecision(...params) {
+    const [name, args, mode = 'standard'] = params;
+    if (findAction(name) && isBrowserActionExposed(name, mode, args ?? {}) && argsRejectedByExecutor(name, args))
+        return { kind: 'allow' };
+    return browserPolicyDecision(...params);
+}
 //# sourceMappingURL=approval-policy.js.map

package/lib/approval-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-policy.js","sourceRoot":"","sources":["../src/approval-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAsB,MAAM,iBAAiB,CAAA;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EAAE,sBAAsB,EAAuB,MAAM,cAAc,CAAA;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAOlD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAA;AAExD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,GAAG,GAAG,GAAG,EAAU,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AAKrG;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAe;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;IACxH,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAA;AAC/E,CAAC;AAED,oFAAoF;AACpF,SAAS,WAAW,CAAC,IAAa;IAChC,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAA8C,CAAA;IACzG,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACnE,MAAM,OAAO,GAAG,KAAK,CAAC,OAA8C,CAAA;IACpE,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;QACnM,IAAI,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,qEAAqE;AACrE,SAAS,gBAAgB,CAAC,IAAY,EAAE,IAAa;IACnD,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAA;IACvF,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,UAAU,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAA;IAC7H,IAAI,IAAI,KAAK,WAAW,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;IACpG,IAAI,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC3H,IAAI,IAAI,KAAK,WAAW;QAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;IACpF,IAAI,IAAI,KAAK,YAAY;QAAE,MAAM,CAAC,IAAI,CAAC,UAAU,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1G,OAAO,GAAG,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;AAC7F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,KAA+B,EAAE,IAAoB;IACrG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IACzD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACvG,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,mDAAmD,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;IAC3I,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC9E,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,4DAA4D,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;AAC1H,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAY,EAAE,IAAa,EAAE,OAAuB,UAAU,EAAE,SAAmC,EAAE,UAAqC,EAAE,KAAgB;IAE5J,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,0BAA0B,IAAI,kEAAkE,EAAE,CAAA;IACnI,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,IAAI,kCAAkC,IAAI,EAAE,EAAE,CAAA;QACpJ,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;YACxB,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,IAAI,IAAI,KAAK,WAAW;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,kDAAkD,IAAI,EAAE,EAAE,CAAA;gBACnH,IAAI,IAAI,KAAK,UAAU;oBAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAA;gBACpI,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;YAC1B,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,IAAI,IAAI,KAAK,WAAW;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,sDAAsD,IAAI,EAAE,EAAE,CAAA;gBACvH,IAAI,IAAI,KAAK,cAAc;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;gBACrD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,6DAA6D,EAAE,CAAA;YACtG,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAE,IAA4B,EAAE,KAAK,CAAC;oBAC/D,CAAC,CAAE,IAA6B,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAa;oBAC7F,CAAC,CAAC,EAAE,CAAA;gBACN,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,2CAA2C,EAAE,CAAA;gBAC3G,IAAI,IAAI,KAAK,WAAW;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,mDAAmD,IAAI,EAAE,EAAE,CAAA;gBACpH,IAAI,IAAI,KAAK,cAAc;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;gBACrD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,4EAA4E,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;YACzK,CAAC;YACD,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,UAAU,GAAI,IAAiC,EAAE,UAAU,CAAA;gBACjE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,mCAAmC,EAAE,CAAA;gBACrI,IAAI,UAAU,CAAC,MAAM,GAAG,MAAM;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,uCAAuC,EAAE,CAAA;gBAC/G,IAAI,IAAI,KAAK,WAAW;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,2DAA2D,IAAI,EAAE,EAAE,CAAA;gBAC5H,IAAI,IAAI,KAAK,cAAc;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;gBACrD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,uJAAuJ,EAAE,CAAA;YAChP,CAAC;YACD,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAAwC,CAAA;gBACjE,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAA;gBACrJ,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC9D,IAAI,CAAC,UAAU,CAAC,KAAK;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,+BAA+B,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;gBACtH,IAAI,IAAI,KAAK,WAAW;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,uDAAuD,IAAI,EAAE,EAAE,CAAA;gBACxH,IAAI,IAAI,KAAK,cAAc;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;gBACrD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;gBACxC,OAAO;oBACL,IAAI,EAAE,KAAK;oBACX,MAAM,EAAE,GAAG,IAAI,8BAA8B,UAAU,CAAC,QAAQ,CAAC,IAAI,MAAM,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,IAAI,mBAAmB,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBAC7K,CAAA;YACH,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAAuB,CAAA;gBAChD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAa,CAAC,CAAC,CAAC,EAAE,CAAA;gBAC/G,IAAI,IAAI,KAAK,WAAW;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,2DAA2D,IAAI,EAAE,EAAE,CAAA;gBAC5H,IAAI,IAAI,KAAK,cAAc;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;gBACrD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,qEAAqE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,EAAE,CAAA;YAC1J,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAAwB,CAAA;gBACjD,OAAO,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAwB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;YAC1G,CAAC;YACD,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,EAAE,GAAI,IAAyB,EAAE,EAAE,CAAA;gBACzC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;gBACrH,IAAI,IAAI,KAAK,WAAW;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,+DAA+D,IAAI,EAAE,EAAE,CAAA;gBAChI,IAAI,IAAI,KAAK,cAAc,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,SAAS,KAAK,QAAQ,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;gBAC1G,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,KAAK,mDAAmD,EAAE,CAAA;YACpG,CAAC;YACD,KAAK,eAAe,CAAC,CAAC,CAAC;gBACrB,MAAM,OAAO,GAAG,MAAM,CAAE,IAA6B,EAAE,MAAM,IAAI,EAAE,CAAC,CAAA;gBACpE,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;gBACnE,IAAI,IAAI,KAAK,WAAW;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,0DAA0D,IAAI,EAAE,EAAE,CAAA;gBAC3H,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;oBACvB,IAAI,IAAI,KAAK,cAAc;wBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;oBACrD,iHAAiH;oBACjH,gEAAgE;oBAChE,IAAI,IAAI,KAAK,YAAY,IAAI,SAAS,KAAK,QAAQ,IAAI,UAAU,EAAE,CAAC;wBAClE,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,GAAG,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;wBAC1E,IAAI,YAAY,CAAC,IAAI,KAAK,OAAO;4BAAE,OAAO,YAAY,CAAA;oBACxD,CAAC;oBACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,QAAQ,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,gEAAgE,EAAE,CAAA;gBACrJ,CAAC;gBACD,IAAI,IAAI,KAAK,UAAU;oBAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,OAAO,IAAI,eAAe,kDAAkD,EAAE,CAAA;gBAChJ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;YAC1B,CAAC;YACD,KAAK,MAAM;gBACT,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;QAC5B,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,UAAU,IAAK,IAA6B,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QAChF,IAAI,IAAI,KAAK,WAAW;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,yDAAyD,IAAI,EAAE,EAAE,CAAA;QAC1H,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;QACrD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAA;IACzF,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAE,IAA6B,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9F,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7H,IAAI,IAAI,KAAK,WAAW;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,2DAA2D,IAAI,EAAE,EAAE,CAAA;QAC5H,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,GAAG,IAAI,EAAE,CAAA;IACvG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC1B,CAAC"}
+{"version":3,"file":"approval-policy.js","sourceRoot":"","sources":["../src/approval-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAsB,MAAM,iBAAiB,CAAA;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EAAE,sBAAsB,EAAuB,MAAM,cAAc,CAAA;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAU7D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAA;AAExD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,GAAG,GAAG,GAAG,EAAU,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AAKrG;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAe;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;IACxH,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAA;AAC/E,CAAC;AAED,oFAAoF;AACpF,SAAS,WAAW,CAAC,IAAa;IAChC,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAA8C,CAAA;IACzG,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACnE,MAAM,OAAO,GAAG,KAAK,CAAC,OAA8C,CAAA;IACpE,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;QACnM,IAAI,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,qEAAqE;AACrE,SAAS,gBAAgB,CAAC,IAAY,EAAE,IAAa;IACnD,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAA;IACvF,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,UAAU,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAA;IAC7H,IAAI,IAAI,KAAK,WAAW,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;IACpG,IAAI,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC3H,IAAI,IAAI,KAAK,WAAW;QAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;IACpF,IAAI,IAAI,KAAK,YAAY;QAAE,MAAM,CAAC,IAAI,CAAC,UAAU,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1G,OAAO,GAAG,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;AAC7F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,KAA+B,EAAE,IAAoB;IACrG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IACzD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACvG,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,mDAAmD,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;IAC3I,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC9E,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,4DAA4D,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;AAC1H,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAY,EAAE,IAAa,EAAE,OAAuB,UAAU,EAAE,SAAmC,EAAE,UAAqC,EAAE,KAAgB,EAAE,aAA6B;IAE3L,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,0BAA0B,IAAI,kEAAkE,EAAE,CAAA;IACnI,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,IAAI,kCAAkC,IAAI,EAAE,EAAE,CAAA;QACpJ,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;YACxB,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,IAAI,IAAI,KAAK,WAAW;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,kDAAkD,IAAI,EAAE,EAAE,CAAA;gBACnH,IAAI,IAAI,KAAK,UAAU;oBAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAA;gBACpI,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;YAC1B,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,IAAI,IAAI,KAAK,WAAW;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,sDAAsD,IAAI,EAAE,EAAE,CAAA;gBACvH,IAAI,IAAI,KAAK,cAAc;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;gBACrD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,6DAA6D,EAAE,CAAA;YACtG,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAE,IAA4B,EAAE,KAAK,CAAC;oBAC/D,CAAC,CAAE,IAA6B,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAa;oBAC7F,CAAC,CAAC,EAAE,CAAA;gBACN,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,2CAA2C,EAAE,CAAA;gBAC3G,IAAI,IAAI,KAAK,WAAW;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,mDAAmD,IAAI,EAAE,EAAE,CAAA;gBACpH,IAAI,IAAI,KAAK,cAAc;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;gBACrD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,4EAA4E,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;YACzK,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,yGAAyG;gBACzG,8FAA8F;gBAC9F,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,EAAE;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;gBAChE,IAAI,aAAa,IAAI,aAAa,CAAC,SAAS,KAAK,QAAQ;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;gBACnF,MAAM,IAAI,GAAG,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iDAAiD,CAAA;gBACnH,IAAI,IAAI,KAAK,WAAW;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,yDAAyD,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAA;gBAC9I,IAAI,IAAI,KAAK,cAAc;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;gBACrD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,mCAAmC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAA;YAC7F,CAAC;YACD,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,GAAG,GAAI,IAA0B,EAAE,GAAG,CAAA;gBAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,iBAAiB,EAAE,CAAA;gBACrG,IAAI,IAAI,KAAK,WAAW;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,+CAA+C,IAAI,EAAE,EAAE,CAAA;gBAChH,IAAI,IAAI,KAAK,cAAc;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;gBACrD,MAAM,QAAQ,GAAI,IAA+B,EAAE,QAAQ,CAAA;gBAC3D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,6FAA6F,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;YAC5N,CAAC;YACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,iHAAiH;gBACjH,iGAAiG;gBACjG,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAAkE,CAAA;gBAC3F,MAAM,OAAO,GAAG;oBACd,GAAG,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,2DAA2D,CAAC,CAAC,CAAC,CAAC,EAAE;oBACvJ,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,CAAC,EAAE;iBACnJ,CAAA;gBACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;gBAClD,IAAI,IAAI,KAAK,WAAW;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,oFAAoF,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAA;gBAC5K,IAAI,IAAI,KAAK,cAAc;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;gBACrD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,4CAA4C,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;YACvK,CAAC;YACD,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,UAAU,GAAI,IAAiC,EAAE,UAAU,CAAA;gBACjE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,mCAAmC,EAAE,CAAA;gBACrI,IAAI,UAAU,CAAC,MAAM,GAAG,MAAM;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,uCAAuC,EAAE,CAAA;gBAC/G,IAAI,IAAI,KAAK,WAAW;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,2DAA2D,IAAI,EAAE,EAAE,CAAA;gBAC5H,IAAI,IAAI,KAAK,cAAc;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;gBACrD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,uJAAuJ,EAAE,CAAA;YAChP,CAAC;YACD,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAAwC,CAAA;gBACjE,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAA;gBACrJ,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC9D,IAAI,CAAC,UAAU,CAAC,KAAK;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,+BAA+B,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;gBACtH,IAAI,IAAI,KAAK,WAAW;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,uDAAuD,IAAI,EAAE,EAAE,CAAA;gBACxH,IAAI,IAAI,KAAK,cAAc;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;gBACrD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;gBACxC,OAAO;oBACL,IAAI,EAAE,KAAK;oBACX,MAAM,EAAE,GAAG,IAAI,8BAA8B,UAAU,CAAC,QAAQ,CAAC,IAAI,MAAM,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,IAAI,mBAAmB,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBAC7K,CAAA;YACH,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAAuB,CAAA;gBAChD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAa,CAAC,CAAC,CAAC,EAAE,CAAA;gBAC/G,IAAI,IAAI,KAAK,WAAW;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,2DAA2D,IAAI,EAAE,EAAE,CAAA;gBAC5H,IAAI,IAAI,KAAK,cAAc;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;gBACrD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,qEAAqE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,EAAE,CAAA;YAC1J,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAAwB,CAAA;gBACjD,OAAO,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAwB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;YAC1G,CAAC;YACD,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,EAAE,GAAI,IAAyB,EAAE,EAAE,CAAA;gBACzC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;gBACrH,IAAI,IAAI,KAAK,WAAW;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,+DAA+D,IAAI,EAAE,EAAE,CAAA;gBAChI,IAAI,IAAI,KAAK,cAAc,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,SAAS,KAAK,QAAQ,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;gBAC1G,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,KAAK,mDAAmD,EAAE,CAAA;YACpG,CAAC;YACD,KAAK,eAAe,CAAC,CAAC,CAAC;gBACrB,MAAM,OAAO,GAAG,MAAM,CAAE,IAA6B,EAAE,MAAM,IAAI,EAAE,CAAC,CAAA;gBACpE,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;gBACnE,IAAI,IAAI,KAAK,WAAW;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,0DAA0D,IAAI,EAAE,EAAE,CAAA;gBAC3H,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;oBACvB,IAAI,IAAI,KAAK,cAAc;wBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;oBACrD,iHAAiH;oBACjH,gEAAgE;oBAChE,IAAI,IAAI,KAAK,YAAY,IAAI,SAAS,KAAK,QAAQ,IAAI,UAAU,EAAE,CAAC;wBAClE,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,GAAG,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;wBAC1E,IAAI,YAAY,CAAC,IAAI,KAAK,OAAO;4BAAE,OAAO,YAAY,CAAA;oBACxD,CAAC;oBACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,QAAQ,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,gEAAgE,EAAE,CAAA;gBACrJ,CAAC;gBACD,IAAI,IAAI,KAAK,UAAU;oBAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,OAAO,IAAI,eAAe,kDAAkD,EAAE,CAAA;gBAChJ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;YAC1B,CAAC;YACD,KAAK,MAAM;gBACT,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;QAC5B,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,UAAU,IAAK,IAA6B,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QAChF,IAAI,IAAI,KAAK,WAAW;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,yDAAyD,IAAI,EAAE,EAAE,CAAA;QAC1H,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;QACrD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAA;IACzF,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAE,IAA6B,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9F,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7H,IAAI,IAAI,KAAK,WAAW;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,2DAA2D,IAAI,EAAE,EAAE,CAAA;QAC5H,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,GAAG,IAAI,EAAE,CAAA;IACvG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAG,MAAgD;IACrF,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,GAAG,UAAU,CAAC,GAAG,MAAM,CAAA;IAC9C,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,IAAI,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IACtI,OAAO,qBAAqB,CAAC,GAAG,MAAM,CAAC,CAAA;AACzC,CAAC"}

package/lib/auth-profiles.d.ts

@@ -10,8 +10,11 @@ export interface ResolvedAuthProfile extends AuthProfileConfig {
 }
 export declare function hostAllowed(hostname: string, domains: readonly string[]): boolean;
 export declare class AuthProfileStore {
-    private readonly profiles;
+    private profiles;
     constructor(profiles?: Record<string, AuthProfileConfig>);
+    /** Swap in the effective profiles (baseline plus policy overlay); sessions resolve against them from the next call on. */
+    replace(profiles: Record<string, AuthProfileConfig>): void;
+    get(id: string): AuthProfileConfig | undefined;
     resolve(id: string, targetUrl: string): ResolvedAuthProfile;
     list(): {
         id: string;

package/lib/auth-profiles.js

@@ -10,6 +10,9 @@ export class AuthProfileStore {
     constructor(profiles = {}) {
         this.profiles = profiles;
     }
+    /** Swap in the effective profiles (baseline plus policy overlay); sessions resolve against them from the next call on. */
+    replace(profiles) { this.profiles = profiles; }
+    get(id) { return this.profiles[id]; }
     resolve(id, targetUrl) {
         const profile = this.profiles[id];
         if (!profile)

package/lib/auth-profiles.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-profiles.js","sourceRoot":"","sources":["../src/auth-profiles.ts"],"names":[],"mappings":"AAYA,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,OAA0B;IACtE,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACtD,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACjF,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAA;IAC9E,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,OAAO,gBAAgB;IACE;IAA7B,YAA6B,WAA8C,EAAE;QAAhD,aAAQ,GAAR,QAAQ,CAAwC;IAAG,CAAC;IAEjF,OAAO,CAAC,EAAU,EAAE,SAAiB;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QACjC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAA;QAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAA;QAC9B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,EAAE,GAAG,sBAAsB,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC3I,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,EAAE,GAAG,0BAA0B,CAAC,CAAA;QACzG,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,KAAK,CAAA;QAClD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,EAAE,GAAG,qCAAqC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;QAC7H,CAAC;aAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,EAAE,GAAG,oCAAoC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;QACzG,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,CAAA;IACzC,CAAC;IAED,IAAI;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,KAAK,EAAE,CAAC,CAAC,CAAA;IAChN,CAAC;CACF;AACD,OAAO,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"auth-profiles.js","sourceRoot":"","sources":["../src/auth-profiles.ts"],"names":[],"mappings":"AAYA,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,OAA0B;IACtE,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACtD,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACjF,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAA;IAC9E,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,OAAO,gBAAgB;IACP;IAApB,YAAoB,WAA8C,EAAE;QAAhD,aAAQ,GAAR,QAAQ,CAAwC;IAAG,CAAC;IAExE,0HAA0H;IAC1H,OAAO,CAAC,QAA2C,IAAU,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA,CAAC,CAAC;IAEvF,GAAG,CAAC,EAAU,IAAmC,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA,CAAC,CAAC;IAE3E,OAAO,CAAC,EAAU,EAAE,SAAiB;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QACjC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAA;QAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAA;QAC9B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,EAAE,GAAG,sBAAsB,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC3I,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,EAAE,GAAG,0BAA0B,CAAC,CAAA;QACzG,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,KAAK,CAAA;QAClD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,EAAE,GAAG,qCAAqC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;QAC7H,CAAC;aAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,EAAE,GAAG,oCAAoC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;QACzG,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,CAAA;IACzC,CAAC;IAED,IAAI;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,KAAK,EAAE,CAAC,CAAC,CAAA;IAChN,CAAC;CACF;AACD,OAAO,EAAE,MAAM,SAAS,CAAA"}

package/lib/automation-assets-rpc.js

@@ -3,6 +3,7 @@ import { ActivationRefusedError } from "./automation-assets.js";
 import { executeAutomationAsset, executeDraftInputSets } from "./automation-execution.js";
 import { convertV1ToV2Draft } from "./automation-convert.js";
 import { promptsDumpText } from "./prompts.js";
+import { promptsDumpYaml } from "./prompts-yaml.js";
 import { stripAnsi } from "./actions/errors.js";
 /**
  * This plugin's own logical RPC channel.
@@ -121,10 +122,35 @@ export function registerAutomationAssetRpc(ctx, store, service, promptsStatus) {
                     case 'prompts':
                         value = promptsStatus ? promptsStatus() : null;
                         break;
+                    // The policy overlay (see policy-overlay.ts): what the settings card's overlay section shows and clears.
+                    case 'policy':
+                        value = service.policyReport({ auditLimit: 20 });
+                        break;
+                    // Which browser a launch would use and whether OpenCLI is installed: the card's "runtime" notices. Read-only, launches nothing.
+                    case 'runtime': {
+                        const status = await service.status();
+                        value = {
+                            browser: status.browser, systemBrowsers: status.systemBrowsers, chromiumInstalled: status.chromiumInstalled,
+                            opencli: { enabled: status.opencliEnabled, installed: status.opencliInstalled, ...status.opencliSource ? { source: status.opencliSource } : {}, ...status.opencliInstallHint ? { hint: status.opencliInstallHint } : {} },
+                        };
+                        break;
+                    }
+                    case 'policyReset': {
+                        const scope = payload.scope;
+                        if (scope !== 'all' && scope !== 'usagePolicy' && scope !== 'authProfile')
+                            throw new Error('scope must be all, usagePolicy or authProfile');
+                        await service.changePolicy({ kind: 'reset', scope, ...typeof payload.id === 'string' ? { id: payload.id } : {} }, { source: 'panel', action: 'panel.reset', reason: 'Cleared from the settings card', ...expectedRevision(payload) !== undefined ? { expectedRevision: expectedRevision(payload) } : {} });
+                        value = service.policyReport({ auditLimit: 20 });
+                        break;
+                    }
                     // The same JSON `prompts:dump` prints, for installs that have no script environment.
                     case 'promptsDefaults':
                         value = { json: promptsDumpText() };
                         break;
+                    // The same defaults as commented YAML (every section says where the model reads it), in the card's language.
+                    case 'promptsDefaultsYaml':
+                        value = { yaml: promptsDumpYaml(payload.lang === 'zh' ? 'zh' : 'en') };
+                        break;
                     case 'status':
                         value = store.setStatus(stringField(payload, 'id'), stringField(payload, 'status'), { expectedRevision: expectedRevision(payload) });
                         break;

package/lib/automation-assets-rpc.js.map

@@ -1 +1 @@
-{"version":3,"file":"automation-assets-rpc.js","sourceRoot":"","sources":["../src/automation-assets-rpc.ts"],"names":[],"mappings":"AAAA,iEAAiE;AAIjE,OAAO,EAAE,sBAAsB,EAA+E,MAAM,wBAAwB,CAAA;AAE5I,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAE/C;;;;;;;;GAQG;AACH,MAAM,OAAO,GAAG,qBAAqB,CAAA;AAErC,SAAS,MAAM,CAAC,OAAgB;IAC9B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IAC3H,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC1G,OAAO,OAAkC,CAAA;AAC3C,CAAC;AAED,SAAS,WAAW,CAAC,OAAgC,EAAE,IAAY;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAA;IAC9H,OAAO,KAAK,CAAA;AACd,CAAC;AAED,iHAAiH;AACjH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACF;IAAtC,YAAY,OAAe,EAAW,OAAgC;QACpE,KAAK,CAAC,OAAO,CAAC,CAAA;QADsB,YAAO,GAAP,OAAO,CAAyB;QAEpE,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;IAC/B,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,OAAgC;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAA;IACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACjH,OAAO,KAAK,CAAA;AACd,CAAC;AAED,kIAAkI;AAClI,MAAM,UAAU,0BAA0B,CAAC,GAAY,EAAE,KAA2B,EAAE,OAAuB,EAAE,aAA6B;IAC1I,GAAG,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC,aAAa,EAAE,EAAE;QACxD,4EAA4E;QAC5E,uEAAuE;QACvE,4EAA4E;QAC5E,yEAAyE;QACzE,wCAAwC;QACxC,wEAAwE;QACxE,6EAA6E;QAC7E,MAAM,UAAU,GAAI,aAAa,CAAC,IAOhC,CAAC,UAAU,CAAA;QACb,MAAM,OAAO,GAAyB,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE;YACnE,IAAI,CAAC;gBACH,wEAAwE;gBACxE,wEAAwE;gBACxE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,CAAA;gBAClC,IAAI,KAAc,CAAA;gBAClB,QAAQ,QAAQ,EAAE,CAAC;oBACjB,KAAK,UAAU;wBAAE,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;wBAAC,MAAK;oBAChD,KAAK,KAAK;wBAAE,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC;wBAAC,MAAK;oBACxE,KAAK,MAAM;wBAAE,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,KAA0E,CAAC,CAAC;wBAAC,MAAK;oBAC/H,KAAK,MAAM;wBAAE,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;wBAAC,MAAK;oBAClE,KAAK,WAAW;wBAAE,KAAK,GAAG,KAAK,CAAC,kBAAkB,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;wBAAC,MAAK;oBACrF,KAAK,SAAS;wBAAE,KAAK,CAAC,gBAAgB,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;wBAAC,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;wBAAC,MAAK;oBACnG,KAAK,UAAU;wBAAE,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;wBAAC,MAAK;oBAC1E,KAAK,MAAM,CAAC,CAAC,CAAC;wBACZ,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;4BACpC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;gCAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAA;4BACtH,oIAAoI;4BACpI,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;4BACvL,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gCACtB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;gCACvD,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;gCACtM,MAAM,IAAI,eAAe,CACvB,MAAM,CAAC,eAAe,EAAE,OAAO,IAAI,aAAa,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,OAAO,kBAAkB,MAAM,EAAE,SAAS,CAAC,UAAU,EAAE,OAAO,IAAI,MAAM,EAAE,SAAS,CAAC,OAAO,IAAI,6BAA6B,EAAE,EACpN,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CACzJ,CAAA;4BACH,CAAC;4BACD,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;4BACpB,MAAK;wBACP,CAAC;wBACD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;wBAC9L,yGAAyG;wBACzG,uGAAuG;wBACvG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;4BACtB,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;4BAClC,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;4BACtL,MAAM,IAAI,eAAe,CACvB,MAAM,CAAC,eAAe,EAAE,OAAO,IAAI,SAAS,CAAC,UAAU,EAAE,OAAO,IAAI,SAAS,CAAC,OAAO,IAAI,kCAAkC,EAC3H,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,CAAC,eAAe,EAAE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CACrK,CAAA;wBACH,CAAC;wBACD,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;wBACpB,MAAK;oBACP,CAAC;oBACD,KAAK,SAAS,CAAC,CAAC,CAAC;wBACf,0GAA0G;wBAC1G,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAA;wBACpD,IAAI,CAAC,MAAM;4BAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;wBAC1D,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;wBAC7C,KAAK,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,qBAAqB,EAAE,UAAU,CAAC,qBAAqB,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAA;wBACtI,MAAK;oBACP,CAAC;oBACD,KAAK,SAAS;wBAAE,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;wBAAC,MAAK;oBACrE,qFAAqF;oBACrF,KAAK,iBAAiB;wBAAE,KAAK,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,CAAC;wBAAC,MAAK;oBAClE,KAAK,QAAQ;wBAAE,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,OAAO,EAAE,QAAQ,CAA0B,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;wBAAC,MAAK;oBACnL,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAoB,EAAE,OAAO,EAAE,sCAAsC,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAA;gBAC9I,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;YAC5B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,YAAY,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,YAAY,sBAAsB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;gBAC3K,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAsB,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAA;YAClK,CAAC;QACH,CAAC,CAAA;QACD,aAAa,CAAC,MAAM,CAClB,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,EAC7C,2CAA2C,CAC5C,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"automation-assets-rpc.js","sourceRoot":"","sources":["../src/automation-assets-rpc.ts"],"names":[],"mappings":"AAAA,iEAAiE;AAIjE,OAAO,EAAE,sBAAsB,EAA+E,MAAM,wBAAwB,CAAA;AAE5I,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAE/C;;;;;;;;GAQG;AACH,MAAM,OAAO,GAAG,qBAAqB,CAAA;AAErC,SAAS,MAAM,CAAC,OAAgB;IAC9B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IAC3H,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC1G,OAAO,OAAkC,CAAA;AAC3C,CAAC;AAED,SAAS,WAAW,CAAC,OAAgC,EAAE,IAAY;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAA;IAC9H,OAAO,KAAK,CAAA;AACd,CAAC;AAED,iHAAiH;AACjH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACF;IAAtC,YAAY,OAAe,EAAW,OAAgC;QACpE,KAAK,CAAC,OAAO,CAAC,CAAA;QADsB,YAAO,GAAP,OAAO,CAAyB;QAEpE,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;IAC/B,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,OAAgC;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAA;IACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACjH,OAAO,KAAK,CAAA;AACd,CAAC;AAED,kIAAkI;AAClI,MAAM,UAAU,0BAA0B,CAAC,GAAY,EAAE,KAA2B,EAAE,OAAuB,EAAE,aAA6B;IAC1I,GAAG,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC,aAAa,EAAE,EAAE;QACxD,4EAA4E;QAC5E,uEAAuE;QACvE,4EAA4E;QAC5E,yEAAyE;QACzE,wCAAwC;QACxC,wEAAwE;QACxE,6EAA6E;QAC7E,MAAM,UAAU,GAAI,aAAa,CAAC,IAOhC,CAAC,UAAU,CAAA;QACb,MAAM,OAAO,GAAyB,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE;YACnE,IAAI,CAAC;gBACH,wEAAwE;gBACxE,wEAAwE;gBACxE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,CAAA;gBAClC,IAAI,KAAc,CAAA;gBAClB,QAAQ,QAAQ,EAAE,CAAC;oBACjB,KAAK,UAAU;wBAAE,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;wBAAC,MAAK;oBAChD,KAAK,KAAK;wBAAE,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC;wBAAC,MAAK;oBACxE,KAAK,MAAM;wBAAE,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,KAA0E,CAAC,CAAC;wBAAC,MAAK;oBAC/H,KAAK,MAAM;wBAAE,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;wBAAC,MAAK;oBAClE,KAAK,WAAW;wBAAE,KAAK,GAAG,KAAK,CAAC,kBAAkB,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;wBAAC,MAAK;oBACrF,KAAK,SAAS;wBAAE,KAAK,CAAC,gBAAgB,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;wBAAC,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;wBAAC,MAAK;oBACnG,KAAK,UAAU;wBAAE,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;wBAAC,MAAK;oBAC1E,KAAK,MAAM,CAAC,CAAC,CAAC;wBACZ,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;4BACpC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;gCAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAA;4BACtH,oIAAoI;4BACpI,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;4BACvL,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gCACtB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;gCACvD,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;gCACtM,MAAM,IAAI,eAAe,CACvB,MAAM,CAAC,eAAe,EAAE,OAAO,IAAI,aAAa,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,OAAO,kBAAkB,MAAM,EAAE,SAAS,CAAC,UAAU,EAAE,OAAO,IAAI,MAAM,EAAE,SAAS,CAAC,OAAO,IAAI,6BAA6B,EAAE,EACpN,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CACzJ,CAAA;4BACH,CAAC;4BACD,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;4BACpB,MAAK;wBACP,CAAC;wBACD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;wBAC9L,yGAAyG;wBACzG,uGAAuG;wBACvG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;4BACtB,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;4BAClC,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;4BACtL,MAAM,IAAI,eAAe,CACvB,MAAM,CAAC,eAAe,EAAE,OAAO,IAAI,SAAS,CAAC,UAAU,EAAE,OAAO,IAAI,SAAS,CAAC,OAAO,IAAI,kCAAkC,EAC3H,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,CAAC,eAAe,EAAE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CACrK,CAAA;wBACH,CAAC;wBACD,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;wBACpB,MAAK;oBACP,CAAC;oBACD,KAAK,SAAS,CAAC,CAAC,CAAC;wBACf,0GAA0G;wBAC1G,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAA;wBACpD,IAAI,CAAC,MAAM;4BAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;wBAC1D,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;wBAC7C,KAAK,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,qBAAqB,EAAE,UAAU,CAAC,qBAAqB,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAA;wBACtI,MAAK;oBACP,CAAC;oBACD,KAAK,SAAS;wBAAE,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;wBAAC,MAAK;oBACrE,yGAAyG;oBACzG,KAAK,QAAQ;wBAAE,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;wBAAC,MAAK;oBACtE,gIAAgI;oBAChI,KAAK,SAAS,CAAC,CAAC,CAAC;wBACf,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAA;wBACrC,KAAK,GAAG;4BACN,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;4BAC3G,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,cAAc,EAAE,SAAS,EAAE,MAAM,CAAC,gBAAgB,EAAE,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;yBAC1N,CAAA;wBACD,MAAK;oBACP,CAAC;oBACD,KAAK,aAAa,CAAC,CAAC,CAAC;wBACnB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;wBAC3B,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,aAAa;4BAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;wBAC3I,MAAM,OAAO,CAAC,YAAY,CACxB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EACrF,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,gCAAgC,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACxL,CAAA;wBACD,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;wBAChD,MAAK;oBACP,CAAC;oBACD,qFAAqF;oBACrF,KAAK,iBAAiB;wBAAE,KAAK,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,CAAC;wBAAC,MAAK;oBAClE,6GAA6G;oBAC7G,KAAK,qBAAqB;wBAAE,KAAK,GAAG,EAAE,IAAI,EAAE,eAAe,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;wBAAC,MAAK;oBACzG,KAAK,QAAQ;wBAAE,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,OAAO,EAAE,QAAQ,CAA0B,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;wBAAC,MAAK;oBACnL,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAoB,EAAE,OAAO,EAAE,sCAAsC,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAA;gBAC9I,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;YAC5B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,YAAY,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,YAAY,sBAAsB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;gBAC3K,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAsB,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAA;YAClK,CAAC;QACH,CAAC,CAAA;QACD,aAAa,CAAC,MAAM,CAClB,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,EAC7C,2CAA2C,CAC5C,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/lib/browser-service.d.ts

@@ -8,7 +8,7 @@
  * - render / snapshot / searchResults are the drop-in replacements for
  *   web-search-pro's former PlaywrightManager (rules-aware page extraction and
  *   platform search-page list extraction run in the page itself).
- * - opencli(...) runs the bundled @jackwener/opencli (no global CLI).
+ * - opencli(...) runs @jackwener/opencli when it is installed (optional, see deps.ts).
  * - The interactive surface (open/click/type/hover/setFiles/evaluate/scroll/read/screenshot/closePage)
  *   drives ONE persistent context+page, giving the model multi-step browsing.
  *
@@ -18,7 +18,8 @@
  * doubled (\\s) so the evaluated page code sees a correct \s.
  * @module dsh-browser/browser-service
  */
-import { type CliResult } from './deps.ts';
+import { type CliResult, type OpencliSource } from './deps.ts';
+import { type BrowserPlan, type SystemBrowser } from './system-browser.ts';
 import type { ResolvedConfig } from './config.ts';
 import { type ResolvedAuthProfile } from './auth-profiles.ts';
 import { type ResolvedRulePack } from './rule-packs.ts';
@@ -28,9 +29,12 @@ import { type UserscriptValidation } from './scripts.ts';
 import { type AutomationMode } from './freedom.ts';
 import { type OpencliCatalogFilter, type OpencliCatalogItem } from './opencli-catalog.ts';
 import { UsageGovernor } from './usage-policy.ts';
+import { type AuditEntry, type ChangeMeta, type Direction, type PolicyChange, type PolicyDiff } from './policy-overlay.ts';
 import { type BrowserTarget } from './locator.ts';
 import { SessionJournal } from './journal.ts';
 import { type ObserveRegion, type ObserveSection } from './observe.ts';
+import { type CallContextInput, type ContextOptions } from './context-options.ts';
+import { type DownloadRecord } from './downloads.ts';
 export interface RenderRule {
     hostname: string;
     contentSelectors: string[];
@@ -76,6 +80,15 @@ export interface InteractiveState {
     screenshotPath?: string;
     /** The page the action ran on closed itself (a popup's own close button): url/title/text describe the page the session fell back to, or are empty. */
     closedPage?: true;
+    /** target.open only: the context options in effect, when the call set any or the context was rebuilt. */
+    contextOptions?: Record<string, unknown>;
+    /** target.open only: where each value of `contextOptions` comes from: `call` (this call), `session` (an earlier call kept by the context), `default` (configuration). */
+    contextSources?: Record<string, 'call' | 'session' | 'default'>;
+    /** target.open only: the session's context was replaced because the call needed different options (or login state); its pages are gone. */
+    contextRebuilt?: {
+        changed: string[];
+        note: string;
+    };
 }
 /** The page state after a recipe, plus what the run did ({@link RecipeRunResult}). */
 export interface RecipeServiceResult extends InteractiveState, RecipeRunResult {
@@ -100,6 +113,22 @@ export interface EvaluateResult {
 export interface FileUploadResult extends InteractiveState {
     files: string[];
 }
+/** The outcome of `target.download`: where the file is and what it is. */
+export interface DownloadResult {
+    id: string;
+    /** The URL that was asked for. */
+    url: string;
+    /** The URL the bytes finally came from (after redirects), when it differs. */
+    finalUrl?: string;
+    /** Absolute path of the saved file, inside `downloadDir`. */
+    path: string;
+    /** The saved file's name (may carry a `-1` style suffix when the name was taken). */
+    filename: string;
+    bytes: number;
+    sha256: string;
+    suggestedFilename: string;
+    source: 'request' | 'browser';
+}
 export type { BrowserFrameSpec, BrowserLocatorSpec, BrowserTarget } from './locator.ts';
 export interface BrowserConsoleRecord {
     type: string;
@@ -160,6 +189,10 @@ export interface BrowserStatus {
     opencliEnabled: boolean;
     opencliInstalled: boolean;
     opencliEntryPath?: string;
+    /** Where OpenCLI was found (`plugin`, `path`, `global-npm`, ...). Absent when it is not installed. */
+    opencliSource?: OpencliSource;
+    /** Present while OpenCLI is enabled but not installed: how to install it. OpenCLI is optional; this is not a warning. */
+    opencliInstallHint?: string;
     automationMode: AutomationMode;
     /** Tool names registered for the model under the configured toolSurface. */
     exposedTools: string[];
@@ -170,9 +203,32 @@ export interface BrowserStatus {
     externalUserscriptPolicy: 'deny' | 'ask' | 'allow';
     pageEvaluatePolicy: 'deny' | 'ask' | 'allow';
     fileUploadPolicy: 'deny' | 'ask' | 'allow';
+    downloadPolicy: 'deny' | 'ask' | 'allow';
+    /** Directory downloads are saved to, and the size cap of one download. */
+    downloadDir: string;
+    downloadMaxBytes: number;
+    /** Context options applied to every context (viewport, user agent, locale, time zone, proxy server); only the ones that are set. */
+    contextDefaults: Record<string, unknown>;
     opencliRunPolicy: 'deny' | 'ask' | 'allow';
     chromiumInstalled: boolean;
     chromiumExecutablePath?: string;
+    /**
+     * The browser a launch will use, decided without launching one. `ready: false` means nothing can be launched yet and
+     * `installAdvice` says what to do; `source: system-browser` means the Playwright Chromium is missing and Chrome / Edge is used instead.
+     */
+    browser: {
+        ready: boolean;
+        source: BrowserPlan['source'];
+        path?: string;
+        note?: string;
+        installAdvice?: string;
+    };
+    /** System Chrome / Edge found on this machine (what the automatic fallback can use). */
+    systemBrowsers: {
+        channel: string;
+        name: string;
+        path: string;
+    }[];
     usagePolicy: ResolvedConfig['usagePolicy'];
     usageGovernor: ReturnType<UsageGovernor['snapshot']>;
     authProfiles: {
@@ -222,6 +278,16 @@ interface SessionState {
     generationClock: number;
     profile?: ResolvedAuthProfile;
     rulePack?: ResolvedRulePack;
+    /** Creation options of the live context (viewport, user agent, locale, time zone, proxy); compared on the next target.open. */
+    contextOptions?: ContextOptions;
+    /** Downloads this session saved or failed to save, newest last, capped. Memory only; the files are on disk. */
+    downloads: DownloadRecord[];
+    /** Counter behind the `d1`, `d2`, ... download ids of this session. */
+    nextDownload: number;
+    /** Save jobs of browser download events, so target.download can wait for the one its navigation triggered. */
+    downloadJobs: WeakMap<object, Promise<DownloadRecord>>;
+    /** Filename a running target.download wants for the download its navigation triggers (consumed by that one event). */
+    downloadFilename?: string;
     captureConsole: boolean;
     captureNetwork: boolean;
     capturedConsole: BrowserConsoleRecord[];
@@ -268,6 +334,7 @@ export interface SessionIdentity {
 }
 export declare class BrowserService {
     private readonly config;
+    private readonly probe;
     private browser;
     private launching?;
     /** Per-session interactive state. Replaces the former global activePage. */
@@ -277,13 +344,53 @@ export declare class BrowserService {
     private clock;
     private readonly authProfiles;
     private readonly usageGovernor;
+    /** The managed policy overlay merged over the configured authProfiles and usagePolicy (see policy-overlay.ts). */
+    private readonly policyStore;
     private opencliCatalogCache?;
     /** Per-session exploration journals (see src/journal.ts). Released with the session, never written to disk. */
     private readonly journals;
     /** How many sessions may hold a context+page at once before LRU eviction. */
     private readonly sessionLimit;
-    constructor(config: ResolvedConfig);
+    /**
+     * `probe` replaces what the service reads from the machine (system browsers, file existence); tests use it, the
+     * plugin never passes it.
+     */
+    constructor(config: ResolvedConfig, probe?: {
+        systemBrowsers?: () => SystemBrowser[];
+        exists?: (file: string) => boolean;
+    });
     available(): boolean;
+    /** Pick up an overlay file that changed on disk (another process, the panel). Cheap: one stat. */
+    private refreshPolicy;
+    private applyEffectivePolicy;
+    /** What a policy change would do, without doing it; `ok: false` carries why it is invalid. */
+    previewPolicyChange(change: PolicyChange): {
+        ok: true;
+        direction: Direction;
+        lines: string[];
+    } | {
+        ok: false;
+        message: string;
+    };
+    /**
+     * Apply a policy change: validated, written atomically with an audit entry, effective at once. Sessions whose
+     * context holds a login state this change took away are closed, so a revoked domain stops working immediately
+     * instead of at the next page load.
+     */
+    changePolicy(change: PolicyChange, meta: ChangeMeta): Promise<{
+        revision: number;
+        direction: Direction;
+        diff: PolicyDiff;
+        audit: AuditEntry;
+        sessionsClosed: number;
+        before: Record<string, unknown>;
+        after: Record<string, unknown>;
+    }>;
+    /** The effective policy, where each value comes from, and the newest audit entries. */
+    policyReport(opts?: {
+        auditLimit?: number;
+        viewerSession?: string;
+    }): Record<string, unknown>;
     /**
      * This session's exploration journal, created on first use. It outlives `target.close` (the session is
      * still the same) and is released when the session is evicted or the service closes. A session that never
@@ -339,9 +446,24 @@ export declare class BrowserService {
     private handleBrowserDisconnected;
     private trackBrowser;
     private ensure;
+    private systemBrowsers;
+    /** What a launch would use right now. `pw` is the loaded runtime; without it (not installed) the Playwright Chromium path is unknown. */
+    private browserPlan;
+    /** The message for a launch that found no browser. Says which setting was wrong when the user chose one. */
+    private launchFailure;
     /** Run `playwright install chromium` from the bundled playwright CLI. */
     installChromium(): Promise<CliResult>;
     private navigate;
+    /**
+     * `newContext()` arguments that do not depend on the login state: the configured viewport, user agent, locale,
+     * time zone and proxy (or the per-call override that replaced them), plus downloads for interactive contexts.
+     *
+     * Proxy: Playwright applies `proxy` at context level on its own. Measured on Chromium 1243 (headless shell) with
+     * Playwright 1.62 and Patchright 1.62, a context created with `proxy` and a browser launched WITHOUT any launch
+     * `proxy` sent both page navigation and `context.request` through the proxy, so no `proxy: { server: 'per-context' }`
+     * launch option is set. (Chromium bypasses the proxy for loopback hosts regardless; that is the browser's rule.)
+     */
+    private contextCreationOptions;
     private transientContext;
     private persistAndClose;
     render(url: string, rules: readonly RenderRule[], opts?: {
@@ -415,6 +537,13 @@ export declare class BrowserService {
      * or mutating another's page, cookies, console or network log.
      */
     private ensureActivePage;
+    /**
+     * {@link ensureActivePage} plus what it had to do to the session's context. `context` carries the per-call creation
+     * options of `target.open`: an option the call leaves out keeps what the live context has (a context is only
+     * rebuilt for a value that is different, never because a later call said nothing), and a new context starts from
+     * the configured defaults. `rebuilt` names what differed when a live page was closed to make room for the new context.
+     */
+    private ensurePage;
     /**
      * Add a page to the session's list and wire its capture and close handling.
      * Idempotent: the context 'page' event and the explicit call both land here.
@@ -443,7 +572,7 @@ export declare class BrowserService {
         rulePack?: string;
         capture?: readonly ('console' | 'network')[];
         session?: string;
-    }): Promise<InteractiveState>;
+    } & CallContextInput): Promise<InteractiveState>;
     click(target: BrowserTarget, opts?: {
         expectGeneration?: number;
         timeoutMs?: number;
@@ -557,6 +686,38 @@ export declare class BrowserService {
         session?: string;
     }): Promise<Record<string, unknown>>;
     private observeOnce;
+    private pushDownload;
+    private failedDownload;
+    /**
+     * Save one browser download event (navigation to an attachment, a click, a script-created link) into the
+     * download directory and record the outcome in the session that owns the page. Never rejects: a failure is a
+     * `failed` record with the partial file removed, so nothing half-written is ever reported as a result.
+     */
+    private saveBrowserDownload;
+    /**
+     * `target.download`: save a URL into the download directory.
+     *
+     * First an HTTP request made through the session's own context (its cookies and login state, its proxy and
+     * user agent); if that does not produce bytes, the URL is opened in a throwaway page of the same context and the
+     * attachment download that navigation triggers is captured. A request that returns nothing is an error, never a
+     * zero-byte file. The session's own page is not navigated.
+     */
+    download(url: string, opts?: {
+        filename?: string;
+        timeoutMs?: number;
+        signal?: AbortSignal;
+        session?: string;
+    }): Promise<DownloadResult>;
+    /** `inspect.downloads`: this session's download records (newest last); reading never creates a session bucket. */
+    downloadRecords(opts?: {
+        limit?: number;
+        clear?: boolean;
+        session?: string;
+    }): {
+        downloadDir: string;
+        records: DownloadRecord[];
+        total: number;
+    };
     consoleMessages(opts?: {
         level?: string;
         limit?: number;