@claude-flow/security 3.0.0-alpha.8 → 3.0.0

package/dist/plugins/integrity-verifier.js

@@ -0,0 +1,186 @@
+/**
+ * PluginIntegrityVerifier — install-layer security for plugin supply chain.
+ *
+ * Implements P1 of ADR-145 (ruvnet/ruflo#2254): Stage-1 Ed25519 signature
+ * verification at `plugins install`. Stage-2 (semantic-intent scan against
+ * SCH attacks) lands in P2; per-namespace write ACLs land in P3-P4.
+ *
+ * Threat model
+ * ------------
+ * Ruflo's plugin install path fetches manifests from IPFS via Pinata with
+ * NO signature verification and NO intent analysis. Two attacks land today:
+ *
+ *   - DDIPE (arXiv:2604.03081): malicious logic embedded in plugin docs and
+ *     config templates. 11.6-33.5% bypass rate across 4 frameworks/5 models;
+ *     2.5% evade both detection and alignment. Stage-1 signing blocks the
+ *     static-payload variants.
+ *
+ *   - SCH (arXiv:2605.14460): malicious intent wrapped as natural-language
+ *     "compliance rules" in plugin descriptions. The agent generates the
+ *     harmful code at runtime — no static payload exists. 77.67% breach
+ *     success, 0.00% scanner detection. Stage-2 (P2) catches this; Stage-1
+ *     does not.
+ *
+ * Scope (P1)
+ * ----------
+ * - Ed25519 signature verification of a detached signature over the manifest.
+ * - Trust-anchor allowlist: the publisher's signing key fingerprint must be
+ *   in `trust-anchors.json`, gated on CODEOWNERS review.
+ * - Backwards compatible: default mode is warn-only. `CLAUDE_FLOW_STRICT_PLUGINS=true`
+ *   makes verification a hard gate.
+ *
+ * Non-goals (P1)
+ * --------------
+ * - Semantic intent scan (SCH defence). Lands in P2 with a pattern-rule
+ *   fallback for environments without LLM credentials.
+ * - Sandboxing the plugin runtime. Orthogonal blast-radius concern.
+ *
+ * Reference: ADR-145, arXiv:2605.14460 (SCH), arXiv:2604.03081 (DDIPE),
+ * arXiv:2604.16548 (Mnemonic Sovereignty survey).
+ */
+import { createHash } from 'node:crypto';
+import * as nodeCrypto from 'node:crypto';
+/**
+ * Canonical JSON serialisation for hashing. Deterministic key ordering at
+ * every nesting level. Pure; identical input → identical output bytes.
+ */
+export function canonicalize(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return '[' + value.map(canonicalize).join(',') + ']';
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    return '{' + keys.map(k => JSON.stringify(k) + ':' + canonicalize(obj[k])).join(',') + '}';
+}
+/** Hex-encoded SHA-256 of the canonical-JSON manifest. */
+export function hashManifest(manifest) {
+    return createHash('sha256').update(canonicalize(manifest)).digest('hex');
+}
+/** Short fingerprint for telemetry — first 16 hex chars of the key. */
+export function fingerprint(publicKey) {
+    return publicKey.slice(0, 16);
+}
+/**
+ * Find the trust anchor that vouches for a manifest. Returns the matched
+ * anchor (with anchor.publicKey === signer.publicKey) or null.
+ *
+ * Scope-matching uses a minimal glob: `*` at the end of the scope string
+ * matches any suffix. Empty/missing scope matches every plugin id.
+ */
+export function findAnchor(anchors, pluginId, signerPublicKey, now) {
+    for (const a of anchors) {
+        if (a.publicKey !== signerPublicKey)
+            continue;
+        if (a.expiresAt && new Date(a.expiresAt).getTime() <= now)
+            continue;
+        if (!a.scope || a.scope === '*' || a.scope === pluginId)
+            return a;
+        if (a.scope.endsWith('*') && pluginId.startsWith(a.scope.slice(0, -1)))
+            return a;
+    }
+    return null;
+}
+/**
+ * `PluginIntegrityVerifier` — Stage-1 verifier (signature + trust anchor).
+ *
+ * Pure-ish: holds the trust-anchor list and clock, no other state. Safe to
+ * construct per-invocation or share.
+ */
+export class PluginIntegrityVerifier {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Verify a signed manifest. Returns the verification status; the caller
+     * decides what to do with `signature-missing` / `manifest-hash-mismatch`
+     * etc. based on its strict-mode policy.
+     */
+    async verify(signed) {
+        const now = (this.config.now ?? Date.now)();
+        const pluginId = signed.manifest?.id ?? '<unknown>';
+        if (!signed.signature || !signed.publicKey) {
+            return { status: 'signature-missing', pluginId, ts: now };
+        }
+        // Re-hash the manifest and compare to the signed hash.
+        const recomputed = hashManifest(signed.manifest);
+        if (recomputed !== signed.manifestHash) {
+            return {
+                status: 'manifest-hash-mismatch',
+                pluginId,
+                signerFingerprint: fingerprint(signed.publicKey),
+                ts: now,
+                detail: `expected ${signed.manifestHash}, got ${recomputed}`,
+            };
+        }
+        // Find a trust anchor that vouches for this signer + plugin.
+        const anchor = findAnchor(this.config.trustAnchors.anchors, pluginId, signed.publicKey, now);
+        if (!anchor) {
+            return {
+                status: 'unknown-signer',
+                pluginId,
+                signerFingerprint: fingerprint(signed.publicKey),
+                ts: now,
+            };
+        }
+        // Ed25519 verify. Probe @noble/ed25519 (already a workspace dep); fall
+        // back to the failure status if it isn't resolvable in this environment
+        // (mirrors verify.mjs's #1880 precondition pattern).
+        const ed = await loadEd25519();
+        if (!ed) {
+            return {
+                status: 'signature-invalid',
+                pluginId,
+                signerFingerprint: fingerprint(signed.publicKey),
+                ts: now,
+                detail: '@noble/ed25519 not available — cannot verify',
+            };
+        }
+        // Required by @noble/ed25519 v2 for sync sha512.
+        if (!ed.etc.sha512Sync) {
+            ed.etc.sha512Sync = (...m) => {
+                const h = nodeCrypto.createHash('sha512');
+                for (const x of m)
+                    h.update(x);
+                return h.digest();
+            };
+        }
+        let ok = false;
+        try {
+            const sigBytes = hexToBytes(signed.signature);
+            const msgBytes = hexToBytes(signed.manifestHash);
+            const pubBytes = hexToBytes(signed.publicKey);
+            ok = await ed.verify(sigBytes, msgBytes, pubBytes);
+        }
+        catch {
+            ok = false;
+        }
+        if (!ok) {
+            return {
+                status: 'signature-invalid',
+                pluginId,
+                signerFingerprint: fingerprint(signed.publicKey),
+                ts: now,
+            };
+        }
+        return { status: 'pass', pluginId, signerFingerprint: fingerprint(signed.publicKey), ts: now };
+    }
+}
+// ─── helpers ────────────────────────────────────────────────────────────
+function hexToBytes(hex) {
+    const out = new Uint8Array(hex.length >>> 1);
+    for (let i = 0; i < out.length; i++)
+        out[i] = parseInt(hex.substr(i * 2, 2), 16);
+    return out;
+}
+async function loadEd25519() {
+    try {
+        const mod = await import('@noble/ed25519');
+        return mod;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=integrity-verifier.js.map

package/dist/plugins/integrity-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity-verifier.js","sourceRoot":"","sources":["../../src/plugins/integrity-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,UAAU,MAAM,aAAa,CAAC;AAmE1C;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAC/E,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AAC7F,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,QAAwB;IACnD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,OAAmC,EACnC,QAAgB,EAChB,eAAuB,EACvB,GAAW;IAEX,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,eAAe;YAAE,SAAS;QAC9C,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,GAAG;YAAE,SAAS;QACpE,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;QAClE,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IACL;IAA7B,YAA6B,MAAsB;QAAtB,WAAM,GAAN,MAAM,CAAgB;IAAG,CAAC;IAEvD;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,MAA4B;QACvC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,WAAW,CAAC;QAEpD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3C,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;QAC5D,CAAC;QAED,uDAAuD;QACvD,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,UAAU,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;YACvC,OAAO;gBACL,MAAM,EAAE,wBAAwB;gBAChC,QAAQ;gBACR,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC;gBAChD,EAAE,EAAE,GAAG;gBACP,MAAM,EAAE,YAAY,MAAM,CAAC,YAAY,SAAS,UAAU,EAAE;aAC7D,CAAC;QACJ,CAAC;QAED,6DAA6D;QAC7D,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC7F,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,MAAM,EAAE,gBAAgB;gBACxB,QAAQ;gBACR,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC;gBAChD,EAAE,EAAE,GAAG;aACR,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,qDAAqD;QACrD,MAAM,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO;gBACL,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ;gBACR,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC;gBAChD,EAAE,EAAE,GAAG;gBACP,MAAM,EAAE,8CAA8C;aACvD,CAAC;QACJ,CAAC;QAED,iDAAiD;QACjD,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;YACvB,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,GAAG,CAAe,EAAc,EAAE;gBACrD,MAAM,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC1C,KAAK,MAAM,CAAC,IAAI,CAAC;oBAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC/B,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;YACpB,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,EAAE,GAAG,KAAK,CAAC;QACf,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9C,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,EAAE,GAAG,KAAK,CAAC;QACb,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO;gBACL,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ;gBACR,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC;gBAChD,EAAE,EAAE,GAAG;aACR,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;IACjG,CAAC;CACF;AAED,2EAA2E;AAE3E,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,GAAG,CAAC;AACb,CAAC;AAOD,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC3C,OAAO,GAA8B,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/policy/canonical.d.ts

@@ -0,0 +1,5 @@
+export declare function canonicalizePolicy(value: unknown): string;
+export declare function policyHash(value: unknown): string;
+export declare function signPolicyHash(hash: string, key: string | Buffer): string;
+export declare function verifyPolicySignature(hash: string, signature: string, key: string | Buffer): boolean;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/policy/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../src/policy/canonical.ts"],"names":[],"mappings":"AAkBA,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEzD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEjD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEzE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAIpG"}

package/dist/policy/canonical.js

@@ -0,0 +1,30 @@
+import { createHash, createHmac, timingSafeEqual } from 'node:crypto';
+function normalize(value) {
+    if (Array.isArray(value))
+        return value.map(normalize);
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value)
+            .filter(([, item]) => item !== undefined)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([key, item]) => [key, normalize(item)]));
+    }
+    if (typeof value === 'number' && !Number.isFinite(value)) {
+        throw new TypeError('Policy canonicalization rejects non-finite numbers');
+    }
+    return value;
+}
+export function canonicalizePolicy(value) {
+    return JSON.stringify(normalize(value));
+}
+export function policyHash(value) {
+    return `sha256:${createHash('sha256').update(canonicalizePolicy(value)).digest('hex')}`;
+}
+export function signPolicyHash(hash, key) {
+    return createHmac('sha256', key).update(hash).digest('base64url');
+}
+export function verifyPolicySignature(hash, signature, key) {
+    const expected = Buffer.from(signPolicyHash(hash, key));
+    const actual = Buffer.from(signature);
+    return expected.length === actual.length && timingSafeEqual(expected, actual);
+}
+//# sourceMappingURL=canonical.js.map

package/dist/policy/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../src/policy/canonical.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEtE,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;aACxC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAChD,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAoB;IAC/D,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,SAAiB,EAAE,GAAoB;IACzF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAChF,CAAC"}

package/dist/policy/engine.d.ts

@@ -0,0 +1,34 @@
+import type { BudgetLimit, PolicyApproval, PolicyDecision, PolicyEngineOptions, PolicyRequest, PolicyRule, PolicyState } from './types.js';
+export declare class AgenticPolicyEngine {
+    private readonly now;
+    private readonly signingKey?;
+    private readonly keyId?;
+    private readonly evidenceVerifier?;
+    private readonly approvalIssuerVerifier?;
+    private state;
+    constructor(options?: PolicyEngineOptions);
+    static fromState(state: PolicyState, options?: Omit<PolicyEngineOptions, 'mode' | 'rules' | 'budgets' | 'usage' | 'approvals' | 'receipts'>): AgenticPolicyEngine;
+    exportState(): PolicyState;
+    setMode(mode: PolicyState['mode']): void;
+    setConfiguredMode(mode: PolicyState['mode']): void;
+    upsertRule(rule: PolicyRule): void;
+    setBudget(limit: BudgetLimit): void;
+    issueApproval(approval: Omit<PolicyApproval, 'uses' | 'issuedAt'> & {
+        uses?: number;
+        issuedAt?: number;
+    }): PolicyApproval;
+    revokeApproval(id: string): boolean;
+    evaluate(request: PolicyRequest): PolicyDecision;
+    verifyLedger(): {
+        valid: boolean;
+        length: number;
+        error?: string;
+    };
+    private applyBudget;
+    private applyApproval;
+    private consumeBudget;
+    private appendReceipt;
+    private validateRequest;
+}
+export declare function createLegacyCompatibleState(source?: string): PolicyState;
+//# sourceMappingURL=engine.d.ts.map

package/dist/policy/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/policy/engine.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,WAAW,EAEX,cAAc,EACd,cAAc,EAEd,mBAAmB,EAEnB,aAAa,EACb,UAAU,EACV,WAAW,EACZ,MAAM,YAAY,CAAC;AASpB,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAkB;IAC9C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAgE;IAClG,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAA8B;IACtE,OAAO,CAAC,KAAK,CAAc;gBAEf,OAAO,GAAE,mBAAwB;IAiB7C,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,GAAE,IAAI,CAAC,mBAAmB,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,WAAW,GAAG,UAAU,CAAM,GAAG,mBAAmB;IAgBrK,WAAW,IAAI,WAAW;IAI1B,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI;IAIxC,iBAAiB,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI;IAMlD,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI;IAgBlC,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI;IAWnC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,cAAc;IAmBzH,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAOnC,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,cAAc;IAoBhD,YAAY,IAAI;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IA0BlE,OAAO,CAAC,WAAW;IA2BnB,OAAO,CAAC,aAAa;IAyBrB,OAAO,CAAC,aAAa;IAkBrB,OAAO,CAAC,aAAa;IAwBrB,OAAO,CAAC,eAAe;CAcxB;AAED,wBAAgB,2BAA2B,CAAC,MAAM,SAAgB,GAAG,WAAW,CAY/E"}

package/dist/policy/engine.js

@@ -0,0 +1,285 @@
+import { policyHash, signPolicyHash, verifyPolicySignature } from './canonical.js';
+import { evaluatePolicy } from './evaluator.js';
+import { POLICY_STATE_VERSION } from './types.js';
+function wildcard(pattern, value) {
+    if (!pattern)
+        return true;
+    if (!value)
+        return false;
+    return pattern === '*' || pattern === value || (pattern.endsWith('*') && value.startsWith(pattern.slice(0, -1)));
+}
+export class AgenticPolicyEngine {
+    now;
+    signingKey;
+    keyId;
+    evidenceVerifier;
+    approvalIssuerVerifier;
+    state;
+    constructor(options = {}) {
+        this.now = options.now ?? Date.now;
+        this.signingKey = options.signingKey;
+        this.keyId = options.keyId;
+        this.evidenceVerifier = options.evidenceVerifier;
+        this.approvalIssuerVerifier = options.approvalIssuerVerifier;
+        this.state = {
+            version: POLICY_STATE_VERSION,
+            mode: options.mode ?? 'legacy',
+            rules: [...(options.rules ?? [])],
+            budgets: [...(options.budgets ?? [])],
+            usage: [...(options.usage ?? [])],
+            approvals: [...(options.approvals ?? [])],
+            receipts: [...(options.receipts ?? [])],
+        };
+    }
+    static fromState(state, options = {}) {
+        const engine = new AgenticPolicyEngine({
+            ...options,
+            mode: state.mode,
+            rules: state.rules,
+            budgets: state.budgets,
+            usage: state.usage,
+            approvals: state.approvals,
+            receipts: state.receipts,
+        });
+        engine.state.migratedAt = state.migratedAt;
+        engine.state.migratedFrom = state.migratedFrom;
+        engine.state.configuredMode = state.configuredMode;
+        return engine;
+    }
+    exportState() {
+        return structuredClone(this.state);
+    }
+    setMode(mode) {
+        this.state.mode = mode;
+    }
+    setConfiguredMode(mode) {
+        this.state.configuredMode = mode;
+        const rank = { legacy: 0, observe: 1, enforce: 2 };
+        if (rank[mode] > rank[this.state.mode])
+            this.state.mode = mode;
+    }
+    upsertRule(rule) {
+        if (!rule.id || !rule.actions.length)
+            throw new Error('invalid-policy-rule');
+        for (const value of [
+            rule.constraints?.maxCostUsd,
+            rule.constraints?.maxTokens,
+            rule.constraints?.maxConcurrency,
+        ]) {
+            if (value !== undefined && (!Number.isFinite(value) || value < 0)) {
+                throw new Error('invalid-policy-rule-limit');
+            }
+        }
+        const index = this.state.rules.findIndex((item) => item.id === rule.id);
+        if (index >= 0)
+            this.state.rules[index] = structuredClone(rule);
+        else
+            this.state.rules.push(structuredClone(rule));
+    }
+    setBudget(limit) {
+        if (limit.periodMs <= 0)
+            throw new Error('invalid-budget-period');
+        if (!Number.isFinite(limit.periodMs)
+            || [limit.maxCostUsd, limit.maxTokens].some((value) => (value !== undefined && (!Number.isFinite(value) || value < 0))))
+            throw new Error('invalid-budget-limit');
+        const index = this.state.budgets.findIndex((item) => item.id === limit.id);
+        if (index >= 0)
+            this.state.budgets[index] = structuredClone(limit);
+        else
+            this.state.budgets.push(structuredClone(limit));
+    }
+    issueApproval(approval) {
+        if (approval.issuedBy === approval.principal)
+            throw new Error('self-approval-forbidden');
+        if (this.approvalIssuerVerifier?.(approval.issuedBy) !== true) {
+            throw new Error('untrusted-approval-issuer');
+        }
+        const issuedAt = approval.issuedAt ?? this.now();
+        const record = { ...approval, issuedAt, uses: approval.uses ?? 0 };
+        if (this.state.approvals.some((item) => item.id === record.id))
+            throw new Error('duplicate-approval-id');
+        if (!record.id
+            || record.expiresAt <= issuedAt
+            || !Number.isInteger(record.maxUses)
+            || record.maxUses <= 0
+            || !Number.isInteger(record.uses)
+            || record.uses < 0
+            || record.uses > record.maxUses)
+            throw new Error('invalid-approval');
+        this.state.approvals.push(record);
+        return structuredClone(record);
+    }
+    revokeApproval(id) {
+        const approval = this.state.approvals.find((item) => item.id === id);
+        if (!approval || approval.revokedAt)
+            return false;
+        approval.revokedAt = this.now();
+        return true;
+    }
+    evaluate(request) {
+        const normalized = {
+            ...request,
+            requestId: request.requestId ?? crypto.randomUUID(),
+            // Caller time is evidence only; expiry, budgets, and receipts always use
+            // the authority's clock.
+            context: { ...request.context, now: this.now() },
+        };
+        this.validateRequest(normalized);
+        const verifiedEvidenceIds = (normalized.context?.evidence ?? [])
+            .filter((evidence) => evidence.id && this.evidenceVerifier?.(evidence, normalized) === true)
+            .map((evidence) => evidence.id);
+        let decision = evaluatePolicy(normalized, this.state.rules, this.state.mode, verifiedEvidenceIds);
+        decision = this.applyBudget(normalized, decision);
+        decision = this.applyApproval(normalized, decision);
+        const receipt = this.appendReceipt(normalized, decision);
+        this.consumeBudget(normalized, decision);
+        return { ...decision, receiptId: receipt.payload.receiptId };
+    }
+    verifyLedger() {
+        let previous = null;
+        for (let i = 0; i < this.state.receipts.length; i++) {
+            const receipt = this.state.receipts[i];
+            if (receipt.payload.sequence !== i || receipt.payload.previousReceiptHash !== previous) {
+                return { valid: false, length: i, error: 'receipt-chain-mismatch' };
+            }
+            const hash = policyHash(receipt.payload);
+            const { receiptId, ...unsignedIdPayload } = receipt.payload;
+            if (hash !== receipt.hash || receiptId !== policyHash(unsignedIdPayload)) {
+                return { valid: false, length: i, error: 'receipt-hash-mismatch' };
+            }
+            if (this.signingKey && !receipt.signature) {
+                return { valid: false, length: i, error: 'receipt-signature-missing' };
+            }
+            if (receipt.signature && !this.signingKey) {
+                return { valid: false, length: i, error: 'receipt-signing-key-required' };
+            }
+            if (receipt.signature && this.signingKey && !verifyPolicySignature(hash, receipt.signature, this.signingKey)) {
+                return { valid: false, length: i, error: 'receipt-signature-invalid' };
+            }
+            previous = receipt.hash;
+        }
+        return { valid: true, length: this.state.receipts.length };
+    }
+    applyBudget(request, decision) {
+        if (decision.outcome === 'denied')
+            return decision;
+        const now = request.context?.now ?? this.now();
+        for (const limit of this.state.budgets) {
+            if (!wildcard(limit.principal, request.identity.id)
+                || !wildcard(limit.action, request.action.type)
+                || !wildcard(limit.resource, request.action.resource))
+                continue;
+            let usage = this.state.usage.find((item) => item.limitId === limit.id);
+            if (!usage || now - usage.windowStartedAt >= limit.periodMs) {
+                usage = { limitId: limit.id, windowStartedAt: now, costUsd: 0, tokens: 0 };
+            }
+            if (limit.maxCostUsd !== undefined && usage.costUsd + (request.action.costUsd ?? 0) > limit.maxCostUsd) {
+                return { ...decision, outcome: 'denied', enforcedOutcome: this.state.mode === 'enforce' ? 'denied' : 'allowed', reason: `budget-exceeded:${limit.id}` };
+            }
+            if (limit.maxCostUsd !== undefined && request.action.costUsd === undefined) {
+                return { ...decision, outcome: 'denied', enforcedOutcome: this.state.mode === 'enforce' ? 'denied' : 'allowed', reason: `budget-metering-required:${limit.id}:costUsd` };
+            }
+            if (limit.maxTokens !== undefined && request.action.tokens === undefined) {
+                return { ...decision, outcome: 'denied', enforcedOutcome: this.state.mode === 'enforce' ? 'denied' : 'allowed', reason: `budget-metering-required:${limit.id}:tokens` };
+            }
+            if (limit.maxTokens !== undefined && usage.tokens + (request.action.tokens ?? 0) > limit.maxTokens) {
+                return { ...decision, outcome: 'denied', enforcedOutcome: this.state.mode === 'enforce' ? 'denied' : 'allowed', reason: `budget-exceeded:${limit.id}` };
+            }
+        }
+        return decision;
+    }
+    applyApproval(request, decision) {
+        if (decision.outcome !== 'approval_required')
+            return decision;
+        const now = request.context?.now ?? this.now();
+        const ids = new Set(request.context?.approvalIds ?? []);
+        const approval = this.state.approvals.find((item) => (ids.has(item.id)
+            && !item.revokedAt
+            && item.expiresAt > now
+            && item.uses < item.maxUses
+            && wildcard(item.principal, request.identity.id)
+            && item.actions.some((action) => wildcard(action, request.action.type))
+            && (!item.resources?.length || item.resources.some((resource) => wildcard(resource, request.action.resource)))));
+        if (!approval)
+            return decision;
+        approval.uses += 1;
+        return {
+            ...decision,
+            outcome: 'allowed',
+            enforcedOutcome: 'allowed',
+            reason: `approved-by:${approval.id}`,
+            approvalId: approval.id,
+            obligations: [],
+        };
+    }
+    consumeBudget(request, decision) {
+        if (decision.enforcedOutcome !== 'allowed')
+            return;
+        const now = request.context?.now ?? this.now();
+        for (const limit of this.state.budgets) {
+            if (!wildcard(limit.principal, request.identity.id)
+                || !wildcard(limit.action, request.action.type)
+                || !wildcard(limit.resource, request.action.resource))
+                continue;
+            let usage = this.state.usage.find((item) => item.limitId === limit.id);
+            if (!usage || now - usage.windowStartedAt >= limit.periodMs) {
+                usage = { limitId: limit.id, windowStartedAt: now, costUsd: 0, tokens: 0 };
+                this.state.usage = this.state.usage.filter((item) => item.limitId !== limit.id);
+                this.state.usage.push(usage);
+            }
+            usage.costUsd += request.action.costUsd ?? 0;
+            usage.tokens += request.action.tokens ?? 0;
+        }
+    }
+    appendReceipt(request, decision) {
+        const previous = this.state.receipts.at(-1)?.hash ?? null;
+        const sequence = this.state.receipts.length;
+        const payloadWithoutId = {
+            previousReceiptHash: previous,
+            sequence,
+            issuedAt: request.context?.now ?? this.now(),
+            request,
+            decision,
+            policyHash: policyHash({ mode: this.state.mode, rules: this.state.rules, budgets: this.state.budgets }),
+        };
+        const receiptId = policyHash(payloadWithoutId);
+        const payload = { receiptId, ...payloadWithoutId };
+        const hash = policyHash(payload);
+        const receipt = {
+            payload,
+            hash,
+            signature: this.signingKey ? signPolicyHash(hash, this.signingKey) : undefined,
+            keyId: this.signingKey ? (this.keyId ?? 'local') : undefined,
+        };
+        this.state.receipts.push(receipt);
+        return receipt;
+    }
+    validateRequest(request) {
+        if (!request.identity?.id || !request.identity.type || !request.action?.type) {
+            throw new Error('invalid-policy-request');
+        }
+        for (const [name, value] of [
+            ['costUsd', request.action.costUsd],
+            ['tokens', request.action.tokens],
+            ['concurrency', request.action.concurrency],
+        ]) {
+            if (value !== undefined && (!Number.isFinite(value) || value < 0)) {
+                throw new Error(`invalid-policy-action-${name}`);
+            }
+        }
+    }
+}
+export function createLegacyCompatibleState(source = 'pre-ADR-324') {
+    return {
+        version: POLICY_STATE_VERSION,
+        mode: 'legacy',
+        migratedFrom: source,
+        migratedAt: Date.now(),
+        rules: [],
+        budgets: [],
+        usage: [],
+        approvals: [],
+        receipts: [],
+    };
+}
+//# sourceMappingURL=engine.js.map

package/dist/policy/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/policy/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAahD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,SAAS,QAAQ,CAAC,OAA2B,EAAE,KAAyB;IACtE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnH,CAAC;AAED,MAAM,OAAO,mBAAmB;IACb,GAAG,CAAe;IAClB,UAAU,CAAmB;IAC7B,KAAK,CAAU;IACf,gBAAgB,CAAiE;IACjF,sBAAsB,CAA+B;IAC9D,KAAK,CAAc;IAE3B,YAAY,UAA+B,EAAE;QAC3C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjD,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;QAC7D,IAAI,CAAC,KAAK,GAAG;YACX,OAAO,EAAE,oBAAoB;YAC7B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,QAAQ;YAC9B,KAAK,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACjC,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YACrC,KAAK,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACjC,SAAS,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACzC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;SACxC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,KAAkB,EAAE,UAAwG,EAAE;QAC7I,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC;YACrC,GAAG,OAAO;YACV,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QACnD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,WAAW;QACT,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,CAAC,IAAyB;QAC/B,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IACzB,CAAC;IAED,iBAAiB,CAAC,IAAyB;QACzC,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;QACjC,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAW,CAAC;QAC5D,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IACjE,CAAC;IAED,UAAU,CAAC,IAAgB;QACzB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC7E,KAAK,MAAM,KAAK,IAAI;YAClB,IAAI,CAAC,WAAW,EAAE,UAAU;YAC5B,IAAI,CAAC,WAAW,EAAE,SAAS;YAC3B,IAAI,CAAC,WAAW,EAAE,cAAc;SACjC,EAAE,CAAC;YACF,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,IAAI,KAAK,IAAI,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;;YAC3D,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,SAAS,CAAC,KAAkB;QAC1B,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;eAC/B,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACrD,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAC9D,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3E,IAAI,KAAK,IAAI,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;;YAC9D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,aAAa,CAAC,QAA0F;QACtG,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACzF,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACjD,MAAM,MAAM,GAAmB,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;QACnF,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACzG,IAAI,CAAC,MAAM,CAAC,EAAE;eACT,MAAM,CAAC,SAAS,IAAI,QAAQ;eAC5B,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;eACjC,MAAM,CAAC,OAAO,IAAI,CAAC;eACnB,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;eAC9B,MAAM,CAAC,IAAI,GAAG,CAAC;eACf,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,cAAc,CAAC,EAAU;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAClD,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ,CAAC,OAAsB;QAC7B,MAAM,UAAU,GAAkB;YAChC,GAAG,OAAO;YACV,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE;YACnD,yEAAyE;YACzE,yBAAyB;YACzB,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;SACjD,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QACjC,MAAM,mBAAmB,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,CAAC;aAC7D,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,IAAI,CAAC;aAC3F,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAG,CAAC,CAAC;QACnC,IAAI,QAAQ,GAAG,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QAClG,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAClD,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACzC,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC/D,CAAC;IAED,YAAY;QACV,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC;YACxC,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,mBAAmB,KAAK,QAAQ,EAAE,CAAC;gBACvF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;YACtE,CAAC;YACD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACzC,MAAM,EAAE,SAAS,EAAE,GAAG,iBAAiB,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;YAC5D,IAAI,IAAI,KAAK,OAAO,CAAC,IAAI,IAAI,SAAS,KAAK,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACzE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;YACrE,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;YACzE,CAAC;YACD,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;YAC5E,CAAC;YACD,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7G,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;YACzE,CAAC;YACD,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC7D,CAAC;IAEO,WAAW,CAAC,OAAsB,EAAE,QAA2C;QACrF,IAAI,QAAQ,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QACnD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;mBAC9C,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;mBAC5C,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAClE,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC5D,KAAK,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAC7E,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;gBACvG,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,mBAAmB,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YAC1J,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC3E,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,4BAA4B,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;YAC3K,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzE,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,4BAA4B,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;YAC1K,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;gBACnG,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,mBAAmB,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YAC1J,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,aAAa,CAAC,OAAsB,EAAE,QAA2C;QACvF,IAAI,QAAQ,CAAC,OAAO,KAAK,mBAAmB;YAAE,OAAO,QAAQ,CAAC;QAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CACnD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;eACb,CAAC,IAAI,CAAC,SAAS;eACf,IAAI,CAAC,SAAS,GAAG,GAAG;eACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO;eACxB,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;eAC7C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;eACpE,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC/G,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC/B,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC;QACnB,OAAO;YACL,GAAG,QAAQ;YACX,OAAO,EAAE,SAAS;YAClB,eAAe,EAAE,SAAS;YAC1B,MAAM,EAAE,eAAe,QAAQ,CAAC,EAAE,EAAE;YACpC,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,WAAW,EAAE,EAAE;SAChB,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,OAAsB,EAAE,QAA2C;QACvF,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;YAAE,OAAO;QACnD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;mBAC9C,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;mBAC5C,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAClE,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC5D,KAAK,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;gBAC3E,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;gBAChF,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;YACD,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;YAC7C,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,OAAsB,EAAE,QAA2C;QACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC5C,MAAM,gBAAgB,GAAG;YACvB,mBAAmB,EAAE,QAAQ;YAC7B,QAAQ;YACR,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE;YAC5C,OAAO;YACP,QAAQ;YACR,UAAU,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;SACxG,CAAC;QACF,MAAM,SAAS,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,EAAE,SAAS,EAAE,GAAG,gBAAgB,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,OAAO,GAAkB;YAC7B,OAAO;YACP,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;YAC9E,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;SAC7D,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,eAAe,CAAC,OAAsB;QAC5C,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;YAC1B,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;YACnC,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YACjC,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;SACnC,EAAE,CAAC;YACX,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAM,GAAG,aAAa;IAChE,OAAO;QACL,OAAO,EAAE,oBAAoB;QAC7B,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,MAAM;QACpB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;QACtB,KAAK,EAAE,EAAE;QACT,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,EAAE;QACT,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC"}

package/dist/policy/envelope.d.ts

@@ -0,0 +1,9 @@
+import type { CapabilityEnvelope, PolicyAction } from './types.js';
+export interface EnvelopeCheck {
+    allowed: boolean;
+    reason?: string;
+}
+export declare function checkCapabilityEnvelope(action: PolicyAction, envelope: CapabilityEnvelope | undefined, now?: number): EnvelopeCheck;
+export declare function isEnvelopeReduction(parent: CapabilityEnvelope, child: CapabilityEnvelope): boolean;
+export declare function delegateEnvelope(parent: CapabilityEnvelope, child: CapabilityEnvelope): CapabilityEnvelope;
+//# sourceMappingURL=envelope.d.ts.map

package/dist/policy/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../../src/policy/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEnE,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAkBD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,kBAAkB,GAAG,SAAS,EACxC,GAAG,SAAa,GACf,aAAa,CA+Bf;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAyBlG;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,kBAAkB,GACxB,kBAAkB,CAkBpB"}