@burtson-labs/host-kit 0.4.2 → 0.4.3

package/dist/permissionMode.js

@@ -0,0 +1,175 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AutoApprovalLedger = exports.PERMISSION_MODES = void 0;
+exports.isPermissionMode = isPermissionMode;
+exports.resolvePermissionMode = resolvePermissionMode;
+exports.shouldAutoApprove = shouldAutoApprove;
+exports.decidePermission = decidePermission;
+exports.PERMISSION_MODES = ['ask', 'auto', 'dangerous'];
+function isPermissionMode(value) {
+    return typeof value === 'string' && exports.PERMISSION_MODES.includes(value);
+}
+/**
+ * Resolve the effective mode. Precedence: runtime override > env > settings >
+ * default.
+ *
+ * `BANDIT_AUTO_APPROVE=1` predates this module and meant "skip the permission
+ * policy entirely" — a full bypass. It keeps that meaning and maps to
+ * `dangerous`, with a deprecation notice. Quietly re-pointing it at `auto`
+ * would have been the friendlier-looking choice and the wrong one: every
+ * existing CI job using it would start prompting for `elevated` calls, and a
+ * non-interactive prompt denies, so pipelines would fail in a way that looks
+ * like a Bandit bug rather than a config change.
+ */
+function resolvePermissionMode(input = {}) {
+    const env = input.env ?? process.env;
+    if (input.override) {
+        return { mode: input.override, source: 'override' };
+    }
+    const explicit = env.BANDIT_PERMISSION_MODE?.trim().toLowerCase();
+    if (explicit) {
+        if (isPermissionMode(explicit)) {
+            return { mode: explicit, source: 'env' };
+        }
+        return {
+            mode: 'ask',
+            source: 'default',
+            deprecation: `BANDIT_PERMISSION_MODE="${explicit}" is not a valid mode (expected: ${exports.PERMISSION_MODES.join(', ')}). Falling back to "ask".`
+        };
+    }
+    if (/^(1|true)$/i.test(env.BANDIT_DANGEROUSLY_APPROVE_ALL ?? '')) {
+        return { mode: 'dangerous', source: 'env' };
+    }
+    if (/^(1|true)$/i.test(env.BANDIT_AUTO_APPROVE ?? '')) {
+        return {
+            mode: 'dangerous',
+            source: 'env',
+            deprecation: 'BANDIT_AUTO_APPROVE is deprecated and still means "approve everything". '
+                + 'Use BANDIT_DANGEROUSLY_APPROVE_ALL=1 for that, or BANDIT_PERMISSION_MODE=auto '
+                + 'for the new auto mode, which keeps prompting for destructive calls.'
+        };
+    }
+    if (input.settingsMode) {
+        const fromSettings = input.settingsMode.trim().toLowerCase();
+        if (isPermissionMode(fromSettings)) {
+            return { mode: fromSettings, source: 'settings' };
+        }
+        return {
+            mode: 'ask',
+            source: 'default',
+            deprecation: `permissions.mode="${input.settingsMode}" in .bandit/settings.json is not a valid mode (expected: ${exports.PERMISSION_MODES.join(', ')}). Falling back to "ask".`
+        };
+    }
+    return { mode: 'ask', source: 'default' };
+}
+/**
+ * Should this call skip the prompt under the given mode?
+ *
+ * Callers must still run the security guard and PreToolUse hooks first — this
+ * function answers only "does the mode waive the user prompt", never "is this
+ * call safe."
+ */
+function shouldAutoApprove(mode, risk) {
+    if (mode === 'dangerous') {
+        return { autoApprove: true, reason: 'permission mode is "dangerous" (all prompts disabled)' };
+    }
+    if (mode !== 'auto') {
+        return { autoApprove: false, reason: 'permission mode is "ask"' };
+    }
+    if (risk.tier === 'routine') {
+        return { autoApprove: true, reason: `auto mode: routine call (${risk.rule})` };
+    }
+    return {
+        autoApprove: false,
+        reason: risk.tier === 'critical'
+            ? `auto mode always asks before destructive calls (${risk.rule})`
+            : `auto mode asks before non-routine calls (${risk.rule})`
+    };
+}
+/**
+ * The single precedence chain both hosts use. Previously each host open-coded
+ * this order and they had already drifted (the extension gained a turn-local
+ * auto-grant the CLI never had, the CLI gained an env short-circuit the
+ * extension never had). One function, one order, one set of tests:
+ *
+ *   1. `deny` from policy — nothing overrides an explicit deny.
+ *   2. **The critical floor.** A `critical` call always asks, even when a
+ *      stored rule says allow. This is what stops a saved grant from widening
+ *      into destruction: approving `git push origin main` for the session
+ *      stores `run_command:git push*`, which as a bare glob would also cover
+ *      `git push --force`. It doesn't, because force-push classifies critical
+ *      and lands here. Same protection covers a hand-written `run_command:git *`
+ *      in settings.json, which had this hole before the floor existed.
+ *   3. `dangerous` mode — no floor, by name and by design.
+ *   4. `auto` mode — routine runs unattended.
+ *   5. Otherwise the policy decides.
+ *
+ * The security guard and PreToolUse hooks run BEFORE this, in the host. This
+ * function answers "does the user have to be asked", not "is this call safe".
+ */
+function decidePermission(input) {
+    const { mode, risk, policyDecision } = input;
+    if (policyDecision === 'deny') {
+        return { action: 'deny', reason: 'denied by permission policy' };
+    }
+    if (mode === 'dangerous') {
+        return { action: 'allow', reason: 'permission mode is "dangerous" (all prompts disabled)' };
+    }
+    if (risk.tier === 'critical') {
+        return {
+            action: 'ask',
+            reason: `destructive or irreversible (${risk.rule}) — always requires explicit approval`,
+            flooredByRisk: policyDecision === 'allow'
+        };
+    }
+    if (mode === 'auto' && risk.tier === 'routine') {
+        return { action: 'allow', reason: `auto mode: routine call (${risk.rule})` };
+    }
+    if (policyDecision === 'allow') {
+        return { action: 'allow', reason: 'allowed by permission policy' };
+    }
+    return {
+        action: 'ask',
+        reason: mode === 'auto'
+            ? `auto mode asks before non-routine calls (${risk.rule})`
+            : `permission mode is "ask" (${risk.rule})`
+    };
+}
+/**
+ * In-memory record of what auto mode did this session.
+ *
+ * Auto-approval without a record is indistinguishable from a bypass — the user
+ * has no way to answer "what did it do while I wasn't looking?". `/permissions`
+ * renders this.
+ */
+class AutoApprovalLedger {
+    constructor(limit = 500) {
+        this.entries = [];
+        this.limit = limit;
+    }
+    record(entry) {
+        this.entries.push(entry);
+        if (this.entries.length > this.limit)
+            this.entries.shift();
+    }
+    all() {
+        return this.entries;
+    }
+    size() {
+        return this.entries.length;
+    }
+    /** Counts per tool, most-used first — the useful shape for a summary line. */
+    summary() {
+        const counts = new Map();
+        for (const e of this.entries)
+            counts.set(e.tool, (counts.get(e.tool) ?? 0) + 1);
+        return [...counts.entries()]
+            .map(([tool, count]) => ({ tool, count }))
+            .sort((a, b) => b.count - a.count);
+    }
+    clear() {
+        this.entries.length = 0;
+    }
+}
+exports.AutoApprovalLedger = AutoApprovalLedger;
+//# sourceMappingURL=permissionMode.js.map

package/dist/permissionMode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionMode.js","sourceRoot":"","sources":["../src/permissionMode.ts"],"names":[],"mappings":";;;AAyBA,4CAEC;AA+BD,sDA+CC;AAgBD,8CAgBC;AAsCD,4CAiCC;AAzLY,QAAA,gBAAgB,GAA8B,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAU,CAAC;AAEjG,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,wBAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9F,CAAC;AAmBD;;;;;;;;;;;GAWG;AACH,SAAgB,qBAAqB,CAAC,QAA0B,EAAE;IAChE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAErC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClE,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,2BAA2B,QAAQ,oCAAoC,wBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B;SAC3I,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,8BAA8B,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,KAAK;YACb,WAAW,EACT,0EAA0E;kBACxE,gFAAgF;kBAChF,qEAAqE;SAC1E,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7D,IAAI,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACpD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,qBAAqB,KAAK,CAAC,YAAY,6DAA6D,wBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B;SACxK,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AASD;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAAC,IAAoB,EAAE,IAAoB;IAC1E,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,4BAA4B,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;IACjF,CAAC;IACD,OAAO;QACL,WAAW,EAAE,KAAK;QAClB,MAAM,EAAE,IAAI,CAAC,IAAI,KAAK,UAAU;YAC9B,CAAC,CAAC,mDAAmD,IAAI,CAAC,IAAI,GAAG;YACjE,CAAC,CAAC,4CAA4C,IAAI,CAAC,IAAI,GAAG;KAC7D,CAAC;AACJ,CAAC;AAiBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,gBAAgB,CAAC,KAA8B;IAC7D,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IAE7C,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;IAC9F,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,gCAAgC,IAAI,CAAC,IAAI,uCAAuC;YACxF,aAAa,EAAE,cAAc,KAAK,OAAO;SAC1C,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,4BAA4B,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;IAC/E,CAAC;IAED,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IACrE,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,IAAI,KAAK,MAAM;YACrB,CAAC,CAAC,4CAA4C,IAAI,CAAC,IAAI,GAAG;YAC1D,CAAC,CAAC,6BAA6B,IAAI,CAAC,IAAI,GAAG;KAC9C,CAAC;AACJ,CAAC;AAWD;;;;;;GAMG;AACH,MAAa,kBAAkB;IAI7B,YAAY,KAAK,GAAG,GAAG;QAHN,YAAO,GAAyB,EAAE,CAAC;QAIlD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,MAAM,CAAC,KAAyB;QAC9B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IAC7D,CAAC;IAED,GAAG;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED,8EAA8E;IAC9E,OAAO;QACL,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;aACzB,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;aACzC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;CACF;AAjCD,gDAiCC"}

package/dist/permissions.d.ts

@@ -64,6 +64,16 @@ export declare class SessionPermissionStore {
     private readonly allow;
     /** Remember an "always allow for this session" choice. */
     grant(toolName: string, primary?: string): void;
+    /**
+     * Store a pre-computed policy rule verbatim.
+     *
+     * Prefer this over `grant()` for anything driven by a user choice: the rule
+     * comes from `grantRuleFor()`, which is also what the permission card
+     * renders, so the stored scope is exactly the scope the user was shown.
+     * `grant()` builds the rule from a tool name and a raw primary, which is how
+     * "always allow `npx create-vite my-app`" ended up persisting `run_command:npx`.
+     */
+    grantRule(rule: string): void;
     /** Returns a policy fragment reflecting session grants only. */
     toPolicy(): PermissionPolicy;
     clear(): void;

package/dist/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AA0FD,eAAO,MAAM,WAAW,QAAO,gBAAsD,CAAC;AAEtF;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,CAMxF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,gBAAgB,EACxB,WAAW,CAAC,EAAE,MAAM,GACnB,kBAAkB,CAepB;AA2ED;;;GAGG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAE3C,0DAA0D;IAC1D,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;IAI/C,gEAAgE;IAChE,QAAQ,IAAI,gBAAgB;IAI5B,KAAK,IAAI,IAAI;IAIb,IAAI,IAAI,MAAM;CAGf"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AA0FD,eAAO,MAAM,WAAW,QAAO,gBAAsD,CAAC;AAEtF;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,CAMxF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,gBAAgB,EACxB,WAAW,CAAC,EAAE,MAAM,GACnB,kBAAkB,CAepB;AA2ED;;;GAGG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAE3C,0DAA0D;IAC1D,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;IAI/C;;;;;;;;OAQG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI7B,gEAAgE;IAChE,QAAQ,IAAI,gBAAgB;IAI5B,KAAK,IAAI,IAAI;IAIb,IAAI,IAAI,MAAM;CAGf"}

package/dist/permissions.js

@@ -256,6 +256,18 @@ class SessionPermissionStore {
     grant(toolName, primary) {
         this.allow.add(primary ? `${toolName}:${primary}` : toolName);
     }
+    /**
+     * Store a pre-computed policy rule verbatim.
+     *
+     * Prefer this over `grant()` for anything driven by a user choice: the rule
+     * comes from `grantRuleFor()`, which is also what the permission card
+     * renders, so the stored scope is exactly the scope the user was shown.
+     * `grant()` builds the rule from a tool name and a raw primary, which is how
+     * "always allow `npx create-vite my-app`" ended up persisting `run_command:npx`.
+     */
+    grantRule(rule) {
+        this.allow.add(rule);
+    }
     /** Returns a policy fragment reflecting session grants only. */
     toPolicy() {
         return { allow: [...this.allow], deny: [], ask: [] };

package/dist/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;;AAwGH,sCAMC;AAoBD,gDAoBC;AA5ID,oFAAoF;AACpF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;AAE7G;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,iBAAiB,GAAa;IAClC,eAAe,EAAS,qEAAqE;IAC7F,eAAe,EAAS,8CAA8C;IACtE,eAAe,EAAS,6CAA6C;IACrE,eAAe,EAAS,wCAAwC;IAChE,eAAe,EAAS,4BAA4B;IACpD,cAAc,EAAU,eAAe;IACvC,gBAAgB,EAAQ,iBAAiB;IACzC,aAAa,EAAW,wBAAwB;IAChD,aAAa,EAAW,oCAAoC;IAC5D,aAAa,EAAW,2BAA2B;IACnD,YAAY,EAAY,yDAAyD;IACjF,eAAe,EAAS,0BAA0B;IAClD,gBAAgB,EAAQ,sCAAsC;IAC9D,eAAe,EAAS,qCAAqC;IAC7D,kBAAkB,EAAM,iBAAiB;IACzC,cAAc,EAAU,0BAA0B;IAClD,cAAc,EAAU,mBAAmB;IAC3C,eAAe,EAAS,4DAA4D;IACpF,cAAc,EAAU,wBAAwB;IAChD,aAAa,EAAW,iDAAiD;IACzE,eAAe,EAAS,aAAa;IACrC,eAAe,EAAS,eAAe;IACvC,cAAc,EAAU,kBAAkB;IAC1C,eAAe,EAAS,mCAAmC;IAC3D,cAAc,EAAU,sDAAsD;IAC9E,YAAY,EAAY,iDAAiD;IACzE,gBAAgB,EAAQ,eAAe;IACvC,cAAc,EAAU,YAAY;IACpC,gBAAgB,EAAQ,iBAAiB;IACzC,eAAe,EAAS,uBAAuB;IAC/C,gBAAgB,EAAQ,qCAAqC;IAC7D,cAAc,EAAU,uCAAuC;IAC/D,eAAe,EAAS,cAAc;IACtC,cAAc,EAAU,gBAAgB;CACzC,CAAC;AAEF;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClD,kDAAkD;IAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAClD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC3D,CAAC;AAEM,MAAM,WAAW,GAAG,GAAqB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;AAAzE,QAAA,WAAW,eAA8D;AAEtF;;;GAGG;AACH,SAAgB,aAAa,CAAC,CAAmB,EAAE,CAAmB;IACpE,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,kBAAkB,CAChC,QAAgB,EAChB,OAAe,EACf,MAAwB,EACxB,WAAoB;IAEpB,wEAAwE;IACxE,IAAI,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3E,IAAI,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7E,IAAI,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAEzE,0EAA0E;IAC1E,iEAAiE;IACjE,qEAAqE;IACrE,kEAAkE;IAClE,iEAAiE;IACjE,oDAAoD;IACpD,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CACjB,QAAgB,EAChB,OAAe,EACf,QAAkB,EAClB,WAAoB;IAEpB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,4DAA4D;YAC5D,IAAI,OAAO,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACtC,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,QAAQ;YAAE,SAAS;QACpC,8DAA8D;QAC9D,gEAAgE;QAChE,kEAAkE;QAClE,8DAA8D;QAC9D,2DAA2D;QAC3D,wBAAwB;QACxB,IAAI,WAAW,IAAI,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAChE,IAAI,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,OAAe,EAAE,KAAa;IAC/C,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,CAAC,EAAE,CAAC;YAAC,CAAC;YACjC,GAAG,IAAI,IAAI,CAAC;QACd,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,GAAG,IAAI,GAAG,CAAC;QACb,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACjC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBAAC,GAAG,IAAI,KAAK,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1E,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC;YACrB,CAAC,GAAG,GAAG,CAAC;QACV,CAAC;aAAM,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAClC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,GAAG,IAAI,GAAG,CAAC;IACX,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAa,sBAAsB;IAAnC;QACmB,UAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAmB7C,CAAC;IAjBC,0DAA0D;IAC1D,KAAK,CAAC,QAAgB,EAAE,OAAgB;QACtC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;IAED,gEAAgE;IAChE,QAAQ;QACN,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IACvD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;CACF;AApBD,wDAoBC"}
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;;AAwGH,sCAMC;AAoBD,gDAoBC;AA5ID,oFAAoF;AACpF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;AAE7G;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,iBAAiB,GAAa;IAClC,eAAe,EAAS,qEAAqE;IAC7F,eAAe,EAAS,8CAA8C;IACtE,eAAe,EAAS,6CAA6C;IACrE,eAAe,EAAS,wCAAwC;IAChE,eAAe,EAAS,4BAA4B;IACpD,cAAc,EAAU,eAAe;IACvC,gBAAgB,EAAQ,iBAAiB;IACzC,aAAa,EAAW,wBAAwB;IAChD,aAAa,EAAW,oCAAoC;IAC5D,aAAa,EAAW,2BAA2B;IACnD,YAAY,EAAY,yDAAyD;IACjF,eAAe,EAAS,0BAA0B;IAClD,gBAAgB,EAAQ,sCAAsC;IAC9D,eAAe,EAAS,qCAAqC;IAC7D,kBAAkB,EAAM,iBAAiB;IACzC,cAAc,EAAU,0BAA0B;IAClD,cAAc,EAAU,mBAAmB;IAC3C,eAAe,EAAS,4DAA4D;IACpF,cAAc,EAAU,wBAAwB;IAChD,aAAa,EAAW,iDAAiD;IACzE,eAAe,EAAS,aAAa;IACrC,eAAe,EAAS,eAAe;IACvC,cAAc,EAAU,kBAAkB;IAC1C,eAAe,EAAS,mCAAmC;IAC3D,cAAc,EAAU,sDAAsD;IAC9E,YAAY,EAAY,iDAAiD;IACzE,gBAAgB,EAAQ,eAAe;IACvC,cAAc,EAAU,YAAY;IACpC,gBAAgB,EAAQ,iBAAiB;IACzC,eAAe,EAAS,uBAAuB;IAC/C,gBAAgB,EAAQ,qCAAqC;IAC7D,cAAc,EAAU,uCAAuC;IAC/D,eAAe,EAAS,cAAc;IACtC,cAAc,EAAU,gBAAgB;CACzC,CAAC;AAEF;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClD,kDAAkD;IAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAClD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC3D,CAAC;AAEM,MAAM,WAAW,GAAG,GAAqB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;AAAzE,QAAA,WAAW,eAA8D;AAEtF;;;GAGG;AACH,SAAgB,aAAa,CAAC,CAAmB,EAAE,CAAmB;IACpE,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,kBAAkB,CAChC,QAAgB,EAChB,OAAe,EACf,MAAwB,EACxB,WAAoB;IAEpB,wEAAwE;IACxE,IAAI,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3E,IAAI,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7E,IAAI,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAEzE,0EAA0E;IAC1E,iEAAiE;IACjE,qEAAqE;IACrE,kEAAkE;IAClE,iEAAiE;IACjE,oDAAoD;IACpD,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CACjB,QAAgB,EAChB,OAAe,EACf,QAAkB,EAClB,WAAoB;IAEpB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,4DAA4D;YAC5D,IAAI,OAAO,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACtC,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,QAAQ;YAAE,SAAS;QACpC,8DAA8D;QAC9D,gEAAgE;QAChE,kEAAkE;QAClE,8DAA8D;QAC9D,2DAA2D;QAC3D,wBAAwB;QACxB,IAAI,WAAW,IAAI,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAChE,IAAI,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,OAAe,EAAE,KAAa;IAC/C,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,CAAC,EAAE,CAAC;YAAC,CAAC;YACjC,GAAG,IAAI,IAAI,CAAC;QACd,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,GAAG,IAAI,GAAG,CAAC;QACb,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACjC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBAAC,GAAG,IAAI,KAAK,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1E,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC;YACrB,CAAC,GAAG,GAAG,CAAC;QACV,CAAC;aAAM,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAClC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,GAAG,IAAI,GAAG,CAAC;IACX,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAa,sBAAsB;IAAnC;QACmB,UAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAgC7C,CAAC;IA9BC,0DAA0D;IAC1D,KAAK,CAAC,QAAgB,EAAE,OAAgB;QACtC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;;OAQG;IACH,SAAS,CAAC,IAAY;QACpB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,gEAAgE;IAChE,QAAQ;QACN,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IACvD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;CACF;AAjCD,wDAiCC"}

package/dist/riskTiers.d.ts

@@ -0,0 +1,21 @@
+export type RiskTier = 'routine' | 'elevated' | 'critical';
+export interface RiskAssessment {
+    tier: RiskTier;
+    /** One sentence, user-facing. Rendered as the card's risk line. */
+    why: string;
+    /** Stable identifier for the rule that decided this (logging / tests). */
+    rule: string;
+}
+export interface RiskContext {
+    workspaceRoot?: string;
+    homeDir?: string;
+}
+/**
+ * Classify a tool call. Never throws — an unknown tool is `elevated`, because
+ * the safe default for "we don't recognize this" is "ask", not "run it".
+ */
+export declare function classifyRisk(call: {
+    name: string;
+    params: Record<string, string>;
+}, ctx?: RiskContext): RiskAssessment;
+//# sourceMappingURL=riskTiers.d.ts.map

package/dist/riskTiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"riskTiers.d.ts","sourceRoot":"","sources":["../src/riskTiers.ts"],"names":[],"mappings":"AAkCA,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAE3D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,QAAQ,CAAC;IACf,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAsLD;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,EACtD,GAAG,GAAE,WAAgB,GACpB,cAAc,CA+FhB"}

package/dist/riskTiers.js

@@ -0,0 +1,324 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyRisk = classifyRisk;
+/**
+ * Risk classification for tool calls — the single place that answers "how bad
+ * is it if this runs and the user wasn't paying attention?"
+ *
+ * Three tiers:
+ *
+ *  - `routine`   Reversible, inside the workspace, no external effect. Reading
+ *                files, editing tracked source, running the test suite. Losing
+ *                one of these to an inattentive approval costs a `git diff`.
+ *  - `elevated`  Real consequences, still recoverable: new files, dependency
+ *                installs, git state changes, network reads, subagents.
+ *  - `critical`  Destructive, irreversible, outside the workspace, or sending
+ *                data somewhere. Deletes, force-push, global installs,
+ *                credential paths, egress with a body.
+ *
+ * Two consumers:
+ *
+ *  1. **Auto mode** auto-approves `routine` and nothing else. `critical` is a
+ *     hard floor — it prompts no matter what the config says. See
+ *     `permissionMode.ts`.
+ *  2. **The permission card**, which uses `why` as its risk line and the tier
+ *     for visual weight, so an `rm -rf` prompt doesn't look like a `read_file`
+ *     prompt. Both hosts previously hand-rolled this from separate string
+ *     matching that had already drifted apart.
+ *
+ * Design rule: **classify by what the call CAN do, not by what it probably
+ * means.** When a command's blast radius depends on arguments we can't
+ * evaluate (`npm run <script>` runs whatever package.json says; `make` runs
+ * the Makefile), it does not get to be `routine`. Guessing generously here is
+ * how an auto mode silently becomes a full bypass.
+ */
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const READ_ONLY_TOOLS = new Set([
+    'read_file', 'list_files', 'ls', 'search_code', 'find_directory',
+    'read_memory', 'todo_write', 'check_task', 'list_tasks', 'ask_user'
+]);
+const EDIT_TOOLS = new Set(['apply_edit', 'replace_range']);
+/** Commands whose whole job is to build, check, or describe — no state change. */
+const ROUTINE_COMMANDS = new Set([
+    'tsc', 'eslint', 'prettier', 'jest', 'vitest', 'mocha', 'playwright',
+    'pytest', 'ruff', 'mypy', 'black', 'gofmt', 'rustc', 'javac',
+    'ls', 'cat', 'head', 'tail', 'grep', 'find', 'jq', 'yq', 'wc', 'which', 'echo', 'pwd'
+]);
+/** Read-only git subcommands. Anything not listed is treated as state-changing. */
+const ROUTINE_GIT = new Set([
+    'status', 'log', 'diff', 'show', 'blame', 'ls-files', 'rev-parse',
+    'describe', 'shortlog', 'whatchanged', 'cat-file', 'remote'
+]);
+/**
+ * Subcommands that only build/test/inspect for package managers that ALSO have
+ * destructive subcommands. Anything else on these binaries escalates.
+ */
+const ROUTINE_SUBCOMMANDS = {
+    npm: new Set(['test', 'run-script', 'ls', 'list', 'view', 'outdated', 'why', 'ping']),
+    pnpm: new Set(['test', 'ls', 'list', 'why', 'outdated']),
+    yarn: new Set(['test', 'list', 'why', 'outdated']),
+    cargo: new Set(['build', 'check', 'test', 'clippy', 'fmt', 'tree']),
+    go: new Set(['build', 'test', 'vet', 'fmt', 'list']),
+    dotnet: new Set(['build', 'test', 'restore', 'format']),
+    mvn: new Set(['compile', 'test', 'verify']),
+    gradle: new Set(['build', 'test', 'check']),
+    bundle: new Set(['exec', 'list', 'check']),
+    composer: new Set(['validate', 'show', 'outdated']),
+    swift: new Set(['build', 'test'])
+};
+const CRITICAL_COMMAND_RULES = [
+    {
+        id: 'destructive-fs',
+        why: 'Deletes or overwrites files irreversibly.',
+        test: (c) => /\b(rm|rmdir|shred|srm)\b/.test(c) || /\bdd\b/.test(c) || /\bmkfs\b/.test(c)
+    },
+    {
+        id: 'privilege-escalation',
+        why: 'Runs with elevated privileges.',
+        test: (c) => /\b(sudo|doas|su)\b/.test(c)
+    },
+    {
+        id: 'git-history-rewrite',
+        why: 'Rewrites git history or discards committed work — hard to recover.',
+        test: (c) => /\bgit\b[\s\S]*\bpush\b[\s\S]*(--force\b|--force-with-lease\b|\s-f\b)/.test(c) ||
+            /\bgit\b[\s\S]*\breset\b[\s\S]*--hard\b/.test(c) ||
+            /\bgit\b[\s\S]*\bclean\b[\s\S]*-[a-z]*f/.test(c) ||
+            /\bgit\b[\s\S]*\b(rebase|filter-branch|reflog\s+expire)\b/.test(c)
+    },
+    {
+        id: 'global-install',
+        why: 'Installs software outside this project, affecting your whole machine.',
+        test: (c) => /\bnpm\b[\s\S]*\b(i|install|add)\b[\s\S]*\s(-g|--global)\b/.test(c) ||
+            /\b(pnpm|yarn)\b[\s\S]*\bglobal\b/.test(c) ||
+            /\bbrew\b[\s\S]*\b(install|upgrade|uninstall)\b/.test(c) ||
+            /\b(pipx|gem)\b[\s\S]*\binstall\b/.test(c) ||
+            /\bpip3?\b[\s\S]*\binstall\b(?![\s\S]*(-r|--requirement|-e\b))/.test(c) ||
+            /\bcargo\b[\s\S]*\binstall\b/.test(c) ||
+            /\bgo\b[\s\S]*\binstall\b/.test(c)
+    },
+    {
+        id: 'publish',
+        why: 'Publishes a package or release to a public registry.',
+        test: (c) => /\b(npm|pnpm|yarn)\b[\s\S]*\bpublish\b/.test(c) || /\bcargo\b[\s\S]*\bpublish\b/.test(c) || /\btwine\b[\s\S]*\bupload\b/.test(c)
+    },
+    {
+        id: 'network-egress',
+        why: 'Sends data off this machine.',
+        test: (c) => /\b(curl|wget)\b[\s\S]*(-d\b|--data\b|-F\b|--form\b|-T\b|--upload-file\b|-X\s*(POST|PUT|PATCH|DELETE))/i.test(c) ||
+            /\b(scp|sftp|rsync)\b[\s\S]*:/.test(c) ||
+            /\b(nc|netcat|ncat|telnet)\b/.test(c)
+    },
+    {
+        id: 'process-control',
+        why: 'Kills processes or changes system state.',
+        test: (c) => /\b(kill|killall|pkill|shutdown|reboot|halt|launchctl|systemctl|service)\b/.test(c)
+    },
+    {
+        id: 'permission-change',
+        why: 'Changes file ownership or permissions.',
+        test: (c) => /\b(chmod|chown|chgrp)\b/.test(c)
+    }
+];
+const ELEVATED_COMMAND_RULES = [
+    {
+        id: 'dependency-install',
+        why: 'Adds or updates project dependencies.',
+        test: (c) => /\b(npm|pnpm|yarn|bun)\b[\s\S]*\b(i|install|add|update|upgrade|ci)\b/.test(c) ||
+            /\bpip3?\b[\s\S]*\binstall\b/.test(c) ||
+            /\b(bundle|composer)\b[\s\S]*\b(install|update)\b/.test(c) ||
+            /\bcargo\b[\s\S]*\b(add|update)\b/.test(c) ||
+            /\bgo\b[\s\S]*\b(get|mod)\b/.test(c)
+    },
+    {
+        id: 'git-state-change',
+        why: 'Changes git state in this repository.',
+        test: (c, argv) => (argv[0] === 'git' || argv[0]?.endsWith('/git') === true) && !ROUTINE_GIT.has(argv[1] ?? '')
+    },
+    {
+        id: 'github-cli',
+        why: 'Acts on GitHub — may open, comment on, or merge work.',
+        test: (_c, argv) => argv[0] === 'gh'
+    },
+    {
+        id: 'container',
+        why: 'Runs or changes containers.',
+        test: (_c, argv) => argv[0] === 'docker' || argv[0] === 'docker-compose' || argv[0] === 'podman'
+    },
+    {
+        id: 'project-scripts',
+        why: 'Runs project-defined scripts, which can do anything the project author wrote.',
+        test: (_c, argv) => argv[0] === 'make' || argv[0] === 'cmake' || argv[0] === 'rake' ||
+            (argv[0] === 'npm' && argv[1] === 'run') ||
+            (argv[0] === 'pnpm' && argv[1] === 'run') ||
+            (argv[0] === 'yarn' && argv[1] === 'run') ||
+            argv[0] === 'npx' || argv[0] === 'osascript'
+    }
+];
+const CREDENTIAL_PATH = /(^|\/)(\.ssh|\.aws|\.gnupg|\.kube|\.docker|\.netrc|\.npmrc|\.pypirc)(\/|$)|(^|\/)\.env(\.|$)|id_rsa|id_ed25519|credentials$/i;
+/** Split a run_command invocation into a normalized argv + full string. */
+function commandParts(params) {
+    const rawCmd = (params.cmd ?? '').trim();
+    const rawArgs = (params.args ?? '').trim();
+    const full = `${rawCmd}${rawArgs ? ' ' + rawArgs : ''}`.trim();
+    const argv = full.split(/\s+/).filter(Boolean);
+    if (argv[0]) {
+        // Normalize `/usr/local/bin/git` → `git` so rules match on the binary.
+        argv[0] = argv[0].split('/').pop() ?? argv[0];
+    }
+    return { full, argv };
+}
+function isOutsideWorkspace(rawPath, ctx) {
+    if (!ctx.workspaceRoot || !rawPath)
+        return false;
+    const home = ctx.homeDir ?? os.homedir();
+    const expanded = rawPath.trim().replace(/^~(?=\/|$)/, home);
+    const resolved = path.resolve(ctx.workspaceRoot, expanded);
+    const root = path.resolve(ctx.workspaceRoot);
+    return resolved !== root && !resolved.startsWith(root + path.sep);
+}
+/** Any param value that names a credential file. */
+function touchesCredentials(params) {
+    return Object.values(params).some((v) => typeof v === 'string' && CREDENTIAL_PATH.test(v));
+}
+/**
+ * MCP-bridged tools arrive as `<server>.<tool>` or `mcp__<server>__<tool>`.
+ * Names that send, delete, or revoke reach outside the machine irreversibly;
+ * other mutations are recoverable.
+ */
+function stripNamespace(name) {
+    const dot = name.indexOf('.');
+    if (dot > 0)
+        return name.slice(dot + 1);
+    if (name.startsWith('mcp__')) {
+        const parts = name.split('__');
+        return parts[parts.length - 1] ?? name;
+    }
+    return name;
+}
+const IRREVERSIBLE_MCP = /^(send|delete|trash|remove|revoke|purge|destroy|archive|cancel)[A-Z_]/;
+const MUTATING_MCP = /^(create|update|modify|add|insert|replace|rename|move|copy|upload|write|append|clear|set|post|reply|batch|duplicate|grant|apply|triage|quick[Aa]dd)[A-Z_]/;
+/**
+ * Classify a tool call. Never throws — an unknown tool is `elevated`, because
+ * the safe default for "we don't recognize this" is "ask", not "run it".
+ */
+function classifyRisk(call, ctx = {}) {
+    try {
+        const name = call.name;
+        const params = call.params ?? {};
+        if (touchesCredentials(params)) {
+            return { tier: 'critical', rule: 'credential-path', why: 'Touches a credentials or secrets file.' };
+        }
+        // Any file-touching tool aimed outside the workspace is critical
+        // regardless of which tool it is — that is the boundary the user
+        // actually reasons about.
+        const pathParam = params.path ?? '';
+        if (pathParam && isOutsideWorkspace(pathParam, ctx)) {
+            return { tier: 'critical', rule: 'outside-workspace', why: 'Writes outside your project folder.' };
+        }
+        if (name === 'delete_file') {
+            return { tier: 'critical', rule: 'delete', why: 'Permanently deletes a file.' };
+        }
+        if (READ_ONLY_TOOLS.has(name)) {
+            return { tier: 'routine', rule: 'read-only', why: 'Reads local state only.' };
+        }
+        if (EDIT_TOOLS.has(name)) {
+            return { tier: 'routine', rule: 'in-workspace-edit', why: 'Edits a file in your project. Review the diff.' };
+        }
+        if (name === 'write_file') {
+            // Distinguished from apply_edit: write_file replaces a whole file and is
+            // the tool a model reaches for when creating something new.
+            return { tier: 'elevated', rule: 'whole-file-write', why: 'Creates or replaces an entire file.' };
+        }
+        if (name === 'apply_patch') {
+            return { tier: 'elevated', rule: 'multi-file-patch', why: 'Changes several files at once.' };
+        }
+        if (name === 'web_fetch' || name === 'web_search') {
+            return { tier: 'elevated', rule: 'network-read', why: 'Fetches external content into the conversation.' };
+        }
+        if (name === 'task') {
+            return { tier: 'elevated', rule: 'subagent', why: 'Starts a subagent with its own tool access.' };
+        }
+        if (name === 'run_command' || name === 'watch_command') {
+            const { full, argv } = commandParts(params);
+            if (!full)
+                return { tier: 'elevated', rule: 'empty-command', why: 'Runs a shell command.' };
+            for (const rule of CRITICAL_COMMAND_RULES) {
+                if (rule.test(full, argv))
+                    return { tier: 'critical', rule: rule.id, why: rule.why };
+            }
+            for (const rule of ELEVATED_COMMAND_RULES) {
+                if (rule.test(full, argv))
+                    return { tier: 'elevated', rule: rule.id, why: rule.why };
+            }
+            const bin = argv[0] ?? '';
+            const sub = argv[1] ?? '';
+            if (bin === 'git') {
+                return ROUTINE_GIT.has(sub)
+                    ? { tier: 'routine', rule: 'git-read', why: 'Reads git state.' }
+                    : { tier: 'elevated', rule: 'git-state-change', why: 'Changes git state in this repository.' };
+            }
+            const allowedSubs = ROUTINE_SUBCOMMANDS[bin];
+            if (allowedSubs) {
+                return allowedSubs.has(sub)
+                    ? { tier: 'routine', rule: 'build-or-test', why: 'Builds or tests this project.' }
+                    : { tier: 'elevated', rule: 'package-manager', why: `Runs \`${bin} ${sub}\`, which can change project state.` };
+            }
+            if (ROUTINE_COMMANDS.has(bin)) {
+                return { tier: 'routine', rule: 'build-or-test', why: 'Builds, checks, or inspects this project.' };
+            }
+            // Recognized-but-unclassified binary. Not routine — see the design rule
+            // at the top of this file.
+            return { tier: 'elevated', rule: 'unclassified-command', why: 'Runs in your shell with your permissions.' };
+        }
+        const bare = stripNamespace(name);
+        if (IRREVERSIBLE_MCP.test(bare)) {
+            return { tier: 'critical', rule: 'mcp-irreversible', why: 'Sends or deletes data in a connected service.' };
+        }
+        if (MUTATING_MCP.test(bare)) {
+            return { tier: 'elevated', rule: 'mcp-mutating', why: 'Changes data in a connected service.' };
+        }
+        if (/^(list|get|search|read|find|fetch|query|describe)[A-Z_]/.test(bare)) {
+            return { tier: 'routine', rule: 'mcp-read', why: 'Reads from a connected service.' };
+        }
+        return { tier: 'elevated', rule: 'unknown-tool', why: 'Bandit is asking before using this capability.' };
+    }
+    catch {
+        // A classifier crash must not become an auto-approval.
+        return { tier: 'critical', rule: 'classifier-error', why: 'Could not assess this call, so it requires review.' };
+    }
+}
+//# sourceMappingURL=riskTiers.js.map

package/dist/riskTiers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"riskTiers.js","sourceRoot":"","sources":["../src/riskTiers.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyOA,oCAkGC;AA3UD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,2CAA6B;AAC7B,uCAAyB;AAiBzB,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB;IAChE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU;CACpE,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC;AAE5D,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY;IACpE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO;IAC5D,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;CACtF,CAAC,CAAC;AAEH,mFAAmF;AACnF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW;IACjE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ;CAC5D,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,mBAAmB,GAAgC;IACvD,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACrF,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IACxD,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IAClD,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACnE,EAAE,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvD,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACnD,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAIF,MAAM,sBAAsB,GAAkB;IAC5C;QACE,EAAE,EAAE,gBAAgB;QACpB,GAAG,EAAE,2CAA2C;QAChD,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;KAC1F;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,GAAG,EAAE,gCAAgC;QACrC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;KAC1C;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,GAAG,EAAE,oEAAoE;QACzE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CACV,sEAAsE,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9E,wCAAwC,CAAC,IAAI,CAAC,CAAC,CAAC;YAChD,wCAAwC,CAAC,IAAI,CAAC,CAAC,CAAC;YAChD,0DAA0D,CAAC,IAAI,CAAC,CAAC,CAAC;KACrE;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,GAAG,EAAE,uEAAuE;QAC5E,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CACV,2DAA2D,CAAC,IAAI,CAAC,CAAC,CAAC;YACnE,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,gDAAgD,CAAC,IAAI,CAAC,CAAC,CAAC;YACxD,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,+DAA+D,CAAC,IAAI,CAAC,CAAC,CAAC;YACvE,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC;YACrC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;KACrC;IACD;QACE,EAAE,EAAE,SAAS;QACb,GAAG,EAAE,sDAAsD;QAC3D,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,uCAAuC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;KAC9I;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,GAAG,EAAE,8BAA8B;QACnC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CACV,wGAAwG,CAAC,IAAI,CAAC,CAAC,CAAC;YAChH,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC;YACtC,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC;KACxC;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,GAAG,EAAE,0CAA0C;QAC/C,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,2EAA2E,CAAC,IAAI,CAAC,CAAC,CAAC;KACjG;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,GAAG,EAAE,wCAAwC;QAC7C,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;KAC/C;CACF,CAAC;AAEF,MAAM,sBAAsB,GAAkB;IAC5C;QACE,EAAE,EAAE,oBAAoB;QACxB,GAAG,EAAE,uCAAuC;QAC5C,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,qEAAqE,CAAC,IAAI,CAAC,CAAC,CAAC;YACxF,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC;YACrC,kDAAkD,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1D,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;KACvC;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,GAAG,EAAE,uCAAuC;QAC5C,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KAChH;IACD;QACE,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,uDAAuD;QAC5D,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;KACrC;IACD;QACE,EAAE,EAAE,WAAW;QACf,GAAG,EAAE,6BAA6B;QAClC,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;KACjG;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,GAAG,EAAE,+EAA+E;QACpF,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;YACjF,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC;YACxC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC;YACzC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC;YACzC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW;KAC/C;CACF,CAAC;AAEF,MAAM,eAAe,GAAG,8HAA8H,CAAC;AAEvJ,2EAA2E;AAC3E,SAAS,YAAY,CAAC,MAA8B;IAClD,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACZ,uEAAuE;QACvE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe,EAAE,GAAgB;IAC3D,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC7C,OAAO,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;AACpE,CAAC;AAED,oDAAoD;AACpD,SAAS,kBAAkB,CAAC,MAA8B;IACxD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,gBAAgB,GAAG,uEAAuE,CAAC;AACjG,MAAM,YAAY,GAAG,2JAA2J,CAAC;AAEjL;;;GAGG;AACH,SAAgB,YAAY,CAC1B,IAAsD,EACtD,MAAmB,EAAE;IAErB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QAEjC,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,wCAAwC,EAAE,CAAC;QACtG,CAAC;QAED,iEAAiE;QACjE,iEAAiE;QACjE,0BAA0B;QAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACpC,IAAI,SAAS,IAAI,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,qCAAqC,EAAE,CAAC;QACrG,CAAC;QAED,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,6BAA6B,EAAE,CAAC;QAClF,CAAC;QAED,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,yBAAyB,EAAE,CAAC;QAChF,CAAC;QAED,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,gDAAgD,EAAE,CAAC;QAC/G,CAAC;QAED,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YAC1B,yEAAyE;YACzE,4DAA4D;YAC5D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,qCAAqC,EAAE,CAAC;QACpG,CAAC;QAED,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gCAAgC,EAAE,CAAC;QAC/F,CAAC;QAED,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YAClD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,iDAAiD,EAAE,CAAC;QAC5G,CAAC;QAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,6CAA6C,EAAE,CAAC;QACpG,CAAC;QAED,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YACvD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC;YAE5F,KAAK,MAAM,IAAI,IAAI,sBAAsB,EAAE,CAAC;gBAC1C,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YACvF,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,sBAAsB,EAAE,CAAC;gBAC1C,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YACvF,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;gBAClB,OAAO,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;oBACzB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,kBAAkB,EAAE;oBAChE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,uCAAuC,EAAE,CAAC;YACnG,CAAC;YACD,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YAC7C,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;oBACzB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,+BAA+B,EAAE;oBAClF,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,UAAU,GAAG,IAAI,GAAG,qCAAqC,EAAE,CAAC;YACpH,CAAC;YACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,2CAA2C,EAAE,CAAC;YACtG,CAAC;YACD,wEAAwE;YACxE,2BAA2B;YAC3B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,2CAA2C,EAAE,CAAC;QAC9G,CAAC;QAED,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,+CAA+C,EAAE,CAAC;QAC9G,CAAC;QACD,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,sCAAsC,EAAE,CAAC;QACjG,CAAC;QACD,IAAI,yDAAyD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,iCAAiC,EAAE,CAAC;QACvF,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,gDAAgD,EAAE,CAAC;IAC3G,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;QACvD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,oDAAoD,EAAE,CAAC;IACnH,CAAC;AACH,CAAC"}

package/dist/securityGuard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"securityGuard.d.ts","sourceRoot":"","sources":["../src/securityGuard.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,qBAAqB;IACpC;oEACgE;IAChE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;qBACiB;IACjB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AA6ED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,EACtD,QAAQ,EAAE,qBAAqB,GAAG,SAAS,EAC3C,GAAG,GAAE,oBAAyB,GAC7B,qBAAqB,CA8BvB"}
+{"version":3,"file":"securityGuard.d.ts","sourceRoot":"","sources":["../src/securityGuard.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,qBAAqB;IACpC;oEACgE;IAChE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;qBACiB;IACjB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AA2KD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,EACtD,QAAQ,EAAE,qBAAqB,GAAG,SAAS,EAC3C,GAAG,GAAE,oBAAyB,GAC7B,qBAAqB,CA4CvB"}