@clawdstrike/openclaw 0.1.0

package/dist/plugin.js

@@ -0,0 +1,234 @@
+/**
+ * OpenClaw plugin entry point for Clawdstrike
+ *
+ * Follows the OpenClaw plugin API: https://docs.openclaw.ai/plugin
+ */
+import { PolicyEngine } from "./policy/engine.js";
+// Re-export existing utilities for external use
+export * from "./index.js";
+/**
+ * Plugin registration function (function format per OpenClaw docs)
+ */
+export default function clawdstrikePlugin(api) {
+    const logger = api.logger ?? console;
+    // Load config from plugin settings
+    const getConfig = () => {
+        const pluginConfig = api.config?.plugins?.entries?.["clawdstrike-security"]?.config ?? {};
+        return {
+            policy: pluginConfig.policy,
+            mode: pluginConfig.mode ?? "deterministic",
+            logLevel: pluginConfig.logLevel ?? "info",
+            guards: pluginConfig.guards ?? {
+                forbidden_path: true,
+                egress: true,
+                secret_leak: true,
+                patch_integrity: true,
+            },
+        };
+    };
+    // Register the policy_check tool
+    api.registerTool({
+        name: "policy_check",
+        description: "Check if an action is allowed by the security policy. Use this BEFORE attempting potentially restricted operations like file access, network requests, or command execution.",
+        parameters: {
+            type: "object",
+            properties: {
+                action: {
+                    type: "string",
+                    enum: ["file_read", "file_write", "network", "command", "tool_call"],
+                    description: "The type of action to check",
+                },
+                resource: {
+                    type: "string",
+                    description: "The resource to check (file path, domain/URL, command string, or tool name)",
+                },
+            },
+            required: ["action", "resource"],
+        },
+        async execute(_id, params) {
+            try {
+                const config = getConfig();
+                const engine = new PolicyEngine(config);
+                const action = params.action ?? "tool_call";
+                const resource = params.resource ?? "";
+                const event = buildEvent(action, resource);
+                const decision = await engine.evaluate(event);
+                const isDenied = decision.status === 'deny' || decision.denied;
+                const isWarn = decision.status === 'warn' || decision.warn;
+                const result = {
+                    allowed: !isDenied,
+                    denied: isDenied,
+                    warn: isWarn,
+                    guard: decision.guard,
+                    reason: decision.reason,
+                    message: formatDecision(decision),
+                    suggestion: isDenied ? getSuggestion(action, resource) : undefined,
+                };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(result, null, 2),
+                        },
+                    ],
+                };
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({ error: true, message }, null, 2),
+                        },
+                    ],
+                };
+            }
+        },
+    });
+    // Register CLI commands
+    api.registerCli(({ program }) => {
+        const clawdstrike = program
+            .command("clawdstrike")
+            .description("Clawdstrike security management");
+        clawdstrike
+            .command("status")
+            .description("Show Clawdstrike plugin status")
+            .action(() => {
+            const config = getConfig();
+            console.log("Clawdstrike Security Plugin");
+            console.log("---------------------------");
+            console.log(`Mode: ${config.mode}`);
+            console.log(`Policy: ${config.policy ?? "(default)"}`);
+            console.log(`Log Level: ${config.logLevel}`);
+            console.log("Guards:");
+            Object.entries(config.guards ?? {}).forEach(([name, enabled]) => {
+                console.log(`  ${name}: ${enabled ? "enabled" : "disabled"}`);
+            });
+        });
+        clawdstrike
+            .command("check <action> <resource>")
+            .description("Check if an action is allowed")
+            .action(async (action, resource) => {
+            const config = getConfig();
+            const engine = new PolicyEngine(config);
+            const event = buildEvent(action, resource);
+            const decision = await engine.evaluate(event);
+            console.log(formatDecision(decision));
+            if (decision.status === 'deny' || decision.denied) {
+                console.log(`Suggestion: ${getSuggestion(action, resource)}`);
+                process.exitCode = 1;
+            }
+        });
+    }, { commands: ["clawdstrike"] });
+    logger.info?.("[clawdstrike] Plugin registered");
+}
+function buildEvent(action, resource) {
+    const now = new Date();
+    const eventId = `policy-check-${now.getTime()}-${Math.random().toString(36).slice(2, 8)}`;
+    const timestamp = now.toISOString();
+    switch (action) {
+        case "file_read":
+            return {
+                eventId,
+                eventType: "file_read",
+                timestamp,
+                data: { type: "file", path: resource, operation: "read" },
+            };
+        case "file_write":
+            return {
+                eventId,
+                eventType: "file_write",
+                timestamp,
+                data: { type: "file", path: resource, operation: "write" },
+            };
+        case "network":
+        case "network_egress": {
+            const { host, port, url } = parseNetworkTarget(resource);
+            return {
+                eventId,
+                eventType: "network_egress",
+                timestamp,
+                data: { type: "network", host, port, url },
+            };
+        }
+        case "command":
+        case "command_exec": {
+            const parts = resource.trim().split(/\s+/).filter(Boolean);
+            const [command, ...args] = parts;
+            return {
+                eventId,
+                eventType: "command_exec",
+                timestamp,
+                data: { type: "command", command: command ?? "", args },
+            };
+        }
+        case "tool_call":
+        default:
+            return {
+                eventId,
+                eventType: "tool_call",
+                timestamp,
+                data: { type: "tool", toolName: resource, parameters: {} },
+            };
+    }
+}
+function parseNetworkTarget(target) {
+    const trimmed = (target ?? "").trim();
+    if (!trimmed)
+        return { host: "", port: 0 };
+    try {
+        const parsed = new URL(trimmed);
+        const port = parsed.port
+            ? Number.parseInt(parsed.port, 10)
+            : parsed.protocol === "http:"
+                ? 80
+                : 443;
+        return { host: parsed.hostname, port, url: trimmed };
+    }
+    catch {
+        try {
+            const parsed = new URL(`https://${trimmed}`);
+            const port = parsed.port ? Number.parseInt(parsed.port, 10) : 443;
+            return { host: parsed.hostname, port, url: `https://${trimmed}` };
+        }
+        catch {
+            return { host: trimmed.split("/")[0] ?? trimmed, port: 443 };
+        }
+    }
+}
+function formatDecision(decision) {
+    const isDenied = decision.status === 'deny' || decision.denied;
+    const isWarn = decision.status === 'warn' || decision.warn;
+    if (isDenied) {
+        const guard = decision.guard ? ` by ${decision.guard}` : "";
+        const reason = decision.reason ? `: ${decision.reason}` : "";
+        return `Denied${guard}${reason}`;
+    }
+    if (isWarn) {
+        const msg = decision.message ?? decision.reason ?? "Policy warning";
+        return `Warning: ${msg}`;
+    }
+    return "Action allowed";
+}
+function getSuggestion(action, resource) {
+    if ((action === "file_write" || action === "file_read") && resource.includes(".ssh")) {
+        return "SSH keys are protected. Consider using a different credential storage method.";
+    }
+    if ((action === "file_write" || action === "file_read") && resource.includes(".aws")) {
+        return "AWS credentials are protected. Use environment variables or IAM roles instead.";
+    }
+    if (action === "network_egress" || action === "network") {
+        return "Try using an allowed domain like api.github.com or pypi.org.";
+    }
+    if ((action === "command_exec" || action === "command") &&
+        resource.includes("sudo")) {
+        return "Privileged commands are restricted. Try running without sudo.";
+    }
+    if ((action === "command_exec" || action === "command") &&
+        (resource.includes("rm -rf") || resource.includes("dd if="))) {
+        return "Destructive commands are blocked. Consider safer alternatives.";
+    }
+    return "Consider an alternative approach that works within the security policy.";
+}
+//# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,gDAAgD;AAChD,cAAc,YAAY,CAAC;AAE3B;;GAEG;AACH,MAAM,CAAC,OAAO,UAAU,iBAAiB,CAAC,GAAQ;IAChD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC;IAErC,mCAAmC;IACnC,MAAM,SAAS,GAAG,GAAsB,EAAE;QACxC,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,sBAAsB,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC;QAC1F,OAAO;YACL,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,eAAe;YAC1C,QAAQ,EAAE,YAAY,CAAC,QAAQ,IAAI,MAAM;YACzC,MAAM,EAAE,YAAY,CAAC,MAAM,IAAI;gBAC7B,cAAc,EAAE,IAAI;gBACpB,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,IAAI;gBACjB,eAAe,EAAE,IAAI;aACtB;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,iCAAiC;IACjC,GAAG,CAAC,YAAY,CAAC;QACf,IAAI,EAAE,cAAc;QACpB,WAAW,EACT,8KAA8K;QAChL,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC;oBACpE,WAAW,EAAE,6BAA6B;iBAC3C;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,6EAA6E;iBAChF;aACF;YACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;SACjC;QACD,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,MAA4C;YACrE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;gBAExC,MAAM,MAAM,GAAI,MAAM,CAAC,MAA4B,IAAI,WAAW,CAAC;gBACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;gBAEvC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC3C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAY,CAAC,CAAC;gBAErD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC;gBAC/D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC;gBAC3D,MAAM,MAAM,GAAG;oBACb,OAAO,EAAE,CAAC,QAAQ;oBAClB,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,MAAM;oBACZ,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC;oBACjC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;iBACnE,CAAC;gBAEF,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;yBACtC;qBACF;iBACF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;yBACxD;qBACF;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,wBAAwB;IACxB,GAAG,CAAC,WAAW,CACb,CAAC,EAAE,OAAO,EAAoB,EAAE,EAAE;QAChC,MAAM,WAAW,GAAG,OAAO;aACxB,OAAO,CAAC,aAAa,CAAC;aACtB,WAAW,CAAC,iCAAiC,CAAC,CAAC;QAElD,WAAW;aACR,OAAO,CAAC,QAAQ,CAAC;aACjB,WAAW,CAAC,gCAAgC,CAAC;aAC7C,MAAM,CAAC,GAAG,EAAE;YACX,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE;gBAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;YAChE,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEL,WAAW;aACR,OAAO,CAAC,2BAA2B,CAAC;aACpC,WAAW,CAAC,+BAA+B,CAAC;aAC5C,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,QAAgB,EAAE,EAAE;YACjD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,UAAU,CAAC,MAA2B,EAAE,QAAQ,CAAC,CAAC;YAChE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAY,CAAC,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;YACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,eAAe,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC9D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,CAAC;IACP,CAAC,EACD,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAC9B,CAAC;IAEF,MAAM,CAAC,IAAI,EAAE,CAAC,iCAAiC,CAAC,CAAC;AACnD,CAAC;AAsCD,SAAS,UAAU,CAAC,MAAyB,EAAE,QAAgB;IAC7D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,gBAAgB,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC1F,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAEpC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,WAAW;YACd,OAAO;gBACL,OAAO;gBACP,SAAS,EAAE,WAAW;gBACtB,SAAS;gBACT,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE;aAC1D,CAAC;QACJ,KAAK,YAAY;YACf,OAAO;gBACL,OAAO;gBACP,SAAS,EAAE,YAAY;gBACvB,SAAS;gBACT,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE;aAC3D,CAAC;QACJ,KAAK,SAAS,CAAC;QACf,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACzD,OAAO;gBACL,OAAO;gBACP,SAAS,EAAE,gBAAgB;gBAC3B,SAAS;gBACT,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;aAC3C,CAAC;QACJ,CAAC;QACD,KAAK,SAAS,CAAC;QACf,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3D,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC;YACjC,OAAO;gBACL,OAAO;gBACP,SAAS,EAAE,cAAc;gBACzB,SAAS;gBACT,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE;aACxD,CAAC;QACJ,CAAC;QACD,KAAK,WAAW,CAAC;QACjB;YACE,OAAO;gBACL,OAAO;gBACP,SAAS,EAAE,WAAW;gBACtB,SAAS;gBACT,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;aAC3D,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAE3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI;YACtB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAClC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO;gBAC3B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,GAAG,CAAC;QACV,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAClE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,OAAO,EAAE,EAAE,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,QAAkB;IACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC;IAC/D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,OAAO,SAAS,KAAK,GAAG,MAAM,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,IAAI,gBAAgB,CAAC;QACpE,OAAO,YAAY,GAAG,EAAE,CAAC;IAC3B,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,QAAgB;IACrD,IAAI,CAAC,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,WAAW,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrF,OAAO,+EAA+E,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,WAAW,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrF,OAAO,gFAAgF,CAAC;IAC1F,CAAC;IACD,IAAI,MAAM,KAAK,gBAAgB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACxD,OAAO,8DAA8D,CAAC;IACxE,CAAC;IACD,IACE,CAAC,MAAM,KAAK,cAAc,IAAI,MAAM,KAAK,SAAS,CAAC;QACnD,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EACzB,CAAC;QACD,OAAO,+DAA+D,CAAC;IACzE,CAAC;IACD,IACE,CAAC,MAAM,KAAK,cAAc,IAAI,MAAM,KAAK,SAAS,CAAC;QACnD,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAC5D,CAAC;QACD,OAAO,gEAAgE,CAAC;IAC1E,CAAC;IACD,OAAO,yEAAyE,CAAC;AACnF,CAAC"}

package/dist/policy/engine.d.ts

@@ -0,0 +1,31 @@
+import type { Decision, ClawdstrikeConfig, Policy, PolicyEvent } from '../types.js';
+export declare class PolicyEngine {
+    private readonly config;
+    private readonly policy;
+    private readonly forbiddenPathGuard;
+    private readonly egressGuard;
+    private readonly secretLeakGuard;
+    private readonly patchIntegrityGuard;
+    private readonly threatIntelEngine;
+    constructor(config?: ClawdstrikeConfig);
+    enabledGuards(): string[];
+    getPolicy(): Policy;
+    lintPolicy(policyRef: string): Promise<{
+        valid: boolean;
+        errors: string[];
+        warnings: string[];
+    }>;
+    redactSecrets(content: string): string;
+    sanitizeOutput(content: string): string;
+    evaluate(event: PolicyEvent): Promise<Decision>;
+    private applyMode;
+    private evaluateDeterministic;
+    private checkFilesystem;
+    private checkEgress;
+    private checkExecution;
+    private checkToolCall;
+    private checkPatch;
+    private applyOnViolation;
+    private guardResultToDecision;
+}
+//# sourceMappingURL=engine.d.ts.map

package/dist/policy/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/policy/engine.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,QAAQ,EAAkB,iBAAiB,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAcpG,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAsB;IAC1D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAmC;gBAEzD,MAAM,GAAE,iBAAsB;IAU1C,aAAa,IAAI,MAAM,EAAE;IAWzB,SAAS,IAAI,MAAM;IAIb,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAStG,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAItC,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAOjC,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAoBrD,OAAO,CAAC,SAAS;IAsBjB,OAAO,CAAC,qBAAqB;IAoB7B,OAAO,CAAC,eAAe;IAwCvB,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,aAAa;IA0CrB,OAAO,CAAC,UAAU;IAsBlB,OAAO,CAAC,gBAAgB;IAqBxB,OAAO,CAAC,qBAAqB;CAO9B"}

package/dist/policy/engine.js

@@ -0,0 +1,282 @@
+import { homedir } from 'node:os';
+import path from 'node:path';
+import { createPolicyEngineFromPolicy } from '@clawdstrike/policy';
+import { mergeConfig } from '../config.js';
+import { EgressGuard, ForbiddenPathGuard, PatchIntegrityGuard, SecretLeakGuard } from '../guards/index.js';
+import { sanitizeOutputText } from '../sanitizer/output-sanitizer.js';
+import { loadPolicy } from './loader.js';
+import { validatePolicy } from './validator.js';
+function expandHome(p) {
+    return p.replace(/^~(?=\/|$)/, homedir());
+}
+function normalizePathForPrefix(p) {
+    return path.resolve(expandHome(p));
+}
+export class PolicyEngine {
+    config;
+    policy;
+    forbiddenPathGuard;
+    egressGuard;
+    secretLeakGuard;
+    patchIntegrityGuard;
+    threatIntelEngine;
+    constructor(config = {}) {
+        this.config = mergeConfig(config);
+        this.policy = loadPolicy(this.config.policy);
+        this.forbiddenPathGuard = new ForbiddenPathGuard();
+        this.egressGuard = new EgressGuard();
+        this.secretLeakGuard = new SecretLeakGuard();
+        this.patchIntegrityGuard = new PatchIntegrityGuard();
+        this.threatIntelEngine = buildThreatIntelEngine(this.policy);
+    }
+    enabledGuards() {
+        const g = this.config.guards;
+        const enabled = [];
+        if (g.forbidden_path)
+            enabled.push('forbidden_path');
+        if (g.egress)
+            enabled.push('egress');
+        if (g.secret_leak)
+            enabled.push('secret_leak');
+        if (g.patch_integrity)
+            enabled.push('patch_integrity');
+        if (g.mcp_tool)
+            enabled.push('mcp_tool');
+        return enabled;
+    }
+    getPolicy() {
+        return this.policy;
+    }
+    async lintPolicy(policyRef) {
+        try {
+            const policy = loadPolicy(policyRef);
+            return validatePolicy(policy);
+        }
+        catch (err) {
+            return { valid: false, errors: [String(err)], warnings: [] };
+        }
+    }
+    redactSecrets(content) {
+        return this.secretLeakGuard.redact(content);
+    }
+    sanitizeOutput(content) {
+        // 1) Secrets (high-confidence tokens).
+        const secretsRedacted = this.secretLeakGuard.redact(content);
+        // 2) PII (emails/phones/SSN/CC, etc).
+        return sanitizeOutputText(secretsRedacted).sanitized;
+    }
+    async evaluate(event) {
+        const base = this.evaluateDeterministic(event);
+        // Fail fast on deterministic violations to avoid unnecessary external calls.
+        const baseDenied = base.status === 'deny' || base.denied;
+        const baseWarn = base.status === 'warn' || base.warn;
+        if (baseDenied || baseWarn) {
+            return this.applyMode(base, this.config.mode);
+        }
+        if (this.threatIntelEngine) {
+            const ti = await this.threatIntelEngine.evaluate(toCanonicalEvent(event));
+            const tiApplied = this.applyOnViolation(ti);
+            const combined = combineDecisions(base, tiApplied);
+            return this.applyMode(combined, this.config.mode);
+        }
+        return this.applyMode(base, this.config.mode);
+    }
+    applyMode(result, mode) {
+        if (mode === 'audit') {
+            return { status: 'allow', allowed: true, denied: false, warn: false };
+        }
+        const isDenied = result.status === 'deny' || result.denied;
+        if (mode === 'advisory' && isDenied) {
+            return {
+                status: 'warn',
+                allowed: true,
+                denied: false,
+                warn: true,
+                reason: result.reason,
+                guard: result.guard,
+                severity: result.severity,
+                message: result.reason,
+            };
+        }
+        return result;
+    }
+    evaluateDeterministic(event) {
+        const allowed = { status: 'allow', allowed: true, denied: false, warn: false };
+        switch (event.eventType) {
+            case 'file_read':
+            case 'file_write':
+                return this.checkFilesystem(event);
+            case 'network_egress':
+                return this.checkEgress(event);
+            case 'command_exec':
+                return this.checkExecution(event);
+            case 'tool_call':
+                return this.checkToolCall(event);
+            case 'patch_apply':
+                return this.checkPatch(event);
+            default:
+                return allowed;
+        }
+    }
+    checkFilesystem(event) {
+        if (!this.config.guards.forbidden_path) {
+            return { status: 'allow', allowed: true, denied: false, warn: false };
+        }
+        // First, enforce forbidden path patterns.
+        const forbidden = this.forbiddenPathGuard.checkSync(event, this.policy);
+        const mapped = this.guardResultToDecision(forbidden);
+        const mappedDenied = mapped.status === 'deny' || mapped.denied;
+        const mappedWarn = mapped.status === 'warn' || mapped.warn;
+        if (mappedDenied || mappedWarn) {
+            return this.applyOnViolation(mapped);
+        }
+        // Then, enforce write roots if configured.
+        if (event.eventType === 'file_write' && event.data.type === 'file') {
+            const allowedWriteRoots = this.policy.filesystem?.allowed_write_roots;
+            if (allowedWriteRoots && allowedWriteRoots.length > 0) {
+                const filePath = normalizePathForPrefix(event.data.path);
+                const ok = allowedWriteRoots.some((root) => {
+                    const rootPath = normalizePathForPrefix(root);
+                    return filePath === rootPath || filePath.startsWith(rootPath + path.sep);
+                });
+                if (!ok) {
+                    return this.applyOnViolation({
+                        status: 'deny',
+                        allowed: false,
+                        denied: true,
+                        warn: false,
+                        reason: 'Write path not in allowed roots',
+                        guard: 'forbidden_path',
+                        severity: 'high',
+                    });
+                }
+            }
+        }
+        return { status: 'allow', allowed: true, denied: false, warn: false };
+    }
+    checkEgress(event) {
+        if (!this.config.guards.egress) {
+            return { status: 'allow', allowed: true, denied: false, warn: false };
+        }
+        const res = this.egressGuard.checkSync(event, this.policy);
+        const mapped = this.guardResultToDecision(res);
+        return this.applyOnViolation(mapped);
+    }
+    checkExecution(event) {
+        if (!this.config.guards.patch_integrity) {
+            return { status: 'allow', allowed: true, denied: false, warn: false };
+        }
+        const res = this.patchIntegrityGuard.checkSync(event, this.policy);
+        const mapped = this.guardResultToDecision(res);
+        return this.applyOnViolation(mapped);
+    }
+    checkToolCall(event) {
+        // Optional tool allow/deny list.
+        if (event.data.type === 'tool') {
+            const tools = this.policy.tools;
+            const toolName = event.data.toolName.toLowerCase();
+            const denied = tools?.denied?.map((x) => x.toLowerCase()) ?? [];
+            if (denied.includes(toolName)) {
+                return this.applyOnViolation({
+                    status: 'deny',
+                    allowed: false,
+                    denied: true,
+                    warn: false,
+                    reason: `Tool '${event.data.toolName}' is denied by policy`,
+                    guard: 'mcp_tool',
+                    severity: 'high',
+                });
+            }
+            const allowed = tools?.allowed?.map((x) => x.toLowerCase()) ?? [];
+            if (allowed.length > 0 && !allowed.includes(toolName)) {
+                return this.applyOnViolation({
+                    status: 'deny',
+                    allowed: false,
+                    denied: true,
+                    warn: false,
+                    reason: `Tool '${event.data.toolName}' is not in allowed tool list`,
+                    guard: 'mcp_tool',
+                    severity: 'high',
+                });
+            }
+        }
+        if (!this.config.guards.secret_leak) {
+            return { status: 'allow', allowed: true, denied: false, warn: false };
+        }
+        const res = this.secretLeakGuard.checkSync(event, this.policy);
+        const mapped = this.guardResultToDecision(res);
+        return this.applyOnViolation(mapped);
+    }
+    checkPatch(event) {
+        if (this.config.guards.patch_integrity) {
+            const r1 = this.patchIntegrityGuard.checkSync(event, this.policy);
+            const mapped1 = this.guardResultToDecision(r1);
+            const applied1 = this.applyOnViolation(mapped1);
+            const applied1Denied = applied1.status === 'deny' || applied1.denied;
+            const applied1Warn = applied1.status === 'warn' || applied1.warn;
+            if (applied1Denied || applied1Warn)
+                return applied1;
+        }
+        if (this.config.guards.secret_leak) {
+            const r2 = this.secretLeakGuard.checkSync(event, this.policy);
+            const mapped2 = this.guardResultToDecision(r2);
+            const applied2 = this.applyOnViolation(mapped2);
+            const applied2Denied = applied2.status === 'deny' || applied2.denied;
+            const applied2Warn = applied2.status === 'warn' || applied2.warn;
+            if (applied2Denied || applied2Warn)
+                return applied2;
+        }
+        return { status: 'allow', allowed: true, denied: false, warn: false };
+    }
+    applyOnViolation(decision) {
+        const action = this.policy.on_violation;
+        const isDenied = decision.status === 'deny' || decision.denied;
+        if (!isDenied)
+            return decision;
+        if (action === 'warn') {
+            return {
+                status: 'warn',
+                allowed: true,
+                denied: false,
+                warn: true,
+                reason: decision.reason,
+                guard: decision.guard,
+                severity: decision.severity,
+                message: decision.reason,
+            };
+        }
+        return decision;
+    }
+    guardResultToDecision(result) {
+        if (result.status === 'allow')
+            return { status: 'allow', allowed: true, denied: false, warn: false };
+        if (result.status === 'warn') {
+            return { status: 'warn', allowed: true, denied: false, warn: true, reason: result.reason, guard: result.guard, message: result.reason };
+        }
+        return { status: 'deny', allowed: false, denied: true, warn: false, reason: result.reason, guard: result.guard, severity: result.severity };
+    }
+}
+function buildThreatIntelEngine(policy) {
+    const custom = policy.guards?.custom;
+    if (!Array.isArray(custom) || custom.length === 0) {
+        return null;
+    }
+    const canonicalPolicy = {
+        version: '1.1.0',
+        guards: { custom },
+    };
+    return createPolicyEngineFromPolicy(canonicalPolicy);
+}
+function toCanonicalEvent(event) {
+    // OpenClaw events are compatible with adapter-core's PolicyEvent shape. Keep the
+    // raw eventId/timestamp/metadata for audit trails.
+    return event;
+}
+function combineDecisions(base, next) {
+    const nextDenied = next.status === 'deny' || next.denied;
+    const nextWarn = next.status === 'warn' || next.warn;
+    if (nextDenied || nextWarn)
+        return next;
+    return base;
+}
+//# sourceMappingURL=engine.js.map

package/dist/policy/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/policy/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,4BAA4B,EAAkC,MAAM,qBAAqB,CAAC;AAEnG,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE3G,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAEtE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,sBAAsB,CAAC,CAAS;IACvC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,OAAO,YAAY;IACN,MAAM,CAA8B;IACpC,MAAM,CAAS;IACf,kBAAkB,CAAqB;IACvC,WAAW,CAAc;IACzB,eAAe,CAAkB;IACjC,mBAAmB,CAAsB;IACzC,iBAAiB,CAAmC;IAErE,YAAY,SAA4B,EAAE;QACxC,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACnD,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC7C,IAAI,CAAC,mBAAmB,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACrD,IAAI,CAAC,iBAAiB,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,aAAa;QACX,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,cAAc;YAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACrD,IAAI,CAAC,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,CAAC,WAAW;YAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC,eAAe;YAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,SAAiB;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;YACrC,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,aAAa,CAAC,OAAe;QAC3B,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,cAAc,CAAC,OAAe;QAC5B,uCAAuC;QACvC,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7D,sCAAsC;QACtC,OAAO,kBAAkB,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAkB;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAE/C,6EAA6E;QAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC;QACrD,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAc,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IAEO,SAAS,CAAC,MAAgB,EAAE,IAAoB;QACtD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACxE,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;QAC3D,IAAI,IAAI,KAAK,UAAU,IAAI,QAAQ,EAAE,CAAC;YACpC,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,MAAM,CAAC,MAAM;aACvB,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,qBAAqB,CAAC,KAAkB;QAC9C,MAAM,OAAO,GAAa,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAEzF,QAAQ,KAAK,CAAC,SAAS,EAAE,CAAC;YACxB,KAAK,WAAW,CAAC;YACjB,KAAK,YAAY;gBACf,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YACrC,KAAK,gBAAgB;gBACnB,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACjC,KAAK,cAAc;gBACjB,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YACpC,KAAK,WAAW;gBACd,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YACnC,KAAK,aAAa;gBAChB,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAChC;gBACE,OAAO,OAAO,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,KAAkB;QACxC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YACvC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACxE,CAAC;QAED,0CAA0C;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;QAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC;QAC3D,IAAI,YAAY,IAAI,UAAU,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QAED,2CAA2C;QAC3C,IAAI,KAAK,CAAC,SAAS,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACnE,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,mBAAmB,CAAC;YACtE,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzD,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;oBACzC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;oBAC9C,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC3E,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,OAAO,IAAI,CAAC,gBAAgB,CAAC;wBAC3B,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,IAAI;wBACZ,IAAI,EAAE,KAAK;wBACX,MAAM,EAAE,iCAAiC;wBACzC,KAAK,EAAE,gBAAgB;wBACvB,QAAQ,EAAE,MAAM;qBACjB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACxE,CAAC;IAEO,WAAW,CAAC,KAAkB;QACpC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAC/B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACxE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAEO,cAAc,CAAC,KAAkB;QACvC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YACxC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACxE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAEO,aAAa,CAAC,KAAkB;QACtC,iCAAiC;QACjC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAEnD,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;YAChE,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC,gBAAgB,CAAC;oBAC3B,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,IAAI;oBACZ,IAAI,EAAE,KAAK;oBACX,MAAM,EAAE,SAAS,KAAK,CAAC,IAAI,CAAC,QAAQ,uBAAuB;oBAC3D,KAAK,EAAE,UAAU;oBACjB,QAAQ,EAAE,MAAM;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;YAClE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtD,OAAO,IAAI,CAAC,gBAAgB,CAAC;oBAC3B,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,IAAI;oBACZ,IAAI,EAAE,KAAK;oBACX,MAAM,EAAE,SAAS,KAAK,CAAC,IAAI,CAAC,QAAQ,+BAA+B;oBACnE,KAAK,EAAE,UAAU;oBACjB,QAAQ,EAAE,MAAM;iBACjB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACpC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACxE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAEO,UAAU,CAAC,KAAkB;QACnC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YACvC,MAAM,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC;YACrE,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC;YACjE,IAAI,cAAc,IAAI,YAAY;gBAAE,OAAO,QAAQ,CAAC;QACtD,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACnC,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC;YACrE,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC;YACjE,IAAI,cAAc,IAAI,YAAY;gBAAE,OAAO,QAAQ,CAAC;QACtD,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACxE,CAAC;IAEO,gBAAgB,CAAC,QAAkB;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC;QAC/D,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE/B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,OAAO,EAAE,QAAQ,CAAC,MAAM;aACzB,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,qBAAqB,CAAC,MAA6F;QACzH,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACrG,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QAC1I,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC9I,CAAC;CACF;AAED,SAAS,sBAAsB,CAAC,MAAc;IAC5C,MAAM,MAAM,GAAI,MAAM,CAAC,MAAc,EAAE,MAAM,CAAC;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,eAAe,GAAoB;QACvC,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,EAAE,MAAM,EAAE;KACnB,CAAC;IAEF,OAAO,4BAA4B,CAAC,eAAsB,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAkB;IAC1C,iFAAiF;IACjF,mDAAmD;IACnD,OAAO,KAAwC,CAAC;AAClD,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAc,EAAE,IAAc;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC;IACrD,IAAI,UAAU,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/policy/index.d.ts

@@ -0,0 +1,4 @@
+export { PolicyEngine } from './engine.js';
+export { validatePolicy } from './validator.js';
+export { loadPolicy, loadPolicyFromString, PolicyLoadError } from './loader.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}

package/dist/policy/index.js

@@ -0,0 +1,4 @@
+export { PolicyEngine } from './engine.js';
+export { validatePolicy } from './validator.js';
+export { loadPolicy, loadPolicyFromString, PolicyLoadError } from './loader.js';
+//# sourceMappingURL=index.js.map

package/dist/policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}

package/dist/policy/loader.d.ts

@@ -0,0 +1,10 @@
+import type { Policy } from '../types.js';
+export declare class PolicyLoadError extends Error {
+    readonly cause?: unknown;
+    constructor(message: string, opts?: {
+        cause?: unknown;
+    });
+}
+export declare function loadPolicyFromString(content: string): Policy;
+export declare function loadPolicy(ref: string): Policy;
+//# sourceMappingURL=loader.d.ts.map

package/dist/policy/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/policy/loader.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAO1C,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEb,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAKxD;AAmCD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAkB5D;AAuHD,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAM9C"}