@clawdstrike/openclaw 0.1.2 → 0.2.1

package/README.md

@@ -1,9 +1,94 @@
 # @clawdstrike/openclaw
 
-Clawdstrike security plugin for OpenClaw.
+Clawdstrike security plugin for OpenClaw. Provides tool-layer guardrails (preflight policy checks + post-action output blocking/redaction) for AI agents running in OpenClaw.
 
 See [Enforcement Tiers & Integration Contract](https://github.com/backbay-labs/clawdstrike/blob/main/docs/src/concepts/enforcement-tiers.md) for what is enforceable at the tool boundary (and what requires a sandbox/broker).
 
-## Getting started
+## Installation
 
-See the [OpenClaw adapter getting-started guide](https://github.com/backbay-labs/clawdstrike/blob/main/packages/adapters/clawdstrike-openclaw/docs/getting-started.md).
+```bash
+npm install @clawdstrike/openclaw
+```
+
+## Getting Started
+
+See the [OpenClaw adapter getting-started guide](https://github.com/backbay-labs/clawdstrike/blob/main/packages/adapters/clawdstrike-openclaw/docs/getting-started.md) for full setup instructions.
+
+## Usage
+
+### FrameworkAdapter API
+
+```ts
+import { OpenClawAdapter, PolicyEngine } from '@clawdstrike/openclaw';
+
+const engine = new PolicyEngine({ policy: 'strict' });
+const adapter = new OpenClawAdapter(engine);
+
+const ctx = adapter.createContext({ userId: 'user-1' });
+const result = await adapter.interceptToolCall(ctx, {
+  name: 'bash',
+  parameters: { cmd: 'echo hello' },
+});
+
+if (!result.proceed) {
+  console.error('Blocked:', result.decision.message);
+}
+```
+
+### Policy checking
+
+```ts
+import { checkPolicy } from '@clawdstrike/openclaw';
+import type { ClawdstrikeConfig } from '@clawdstrike/openclaw';
+
+const config: ClawdstrikeConfig = { policy: 'default' };
+const decision = await checkPolicy(config, 'file_read', '~/.ssh/id_rsa');
+console.log(decision.status); // "deny"
+```
+
+### OpenClaw plugin hooks
+
+The package exports hook handlers for direct OpenClaw integration:
+
+- `agentBootstrapHandler` -- Injects security prompt at session start
+- `toolPreflightHandler` -- Preflight policy check before tool execution
+- `cuaBridgeHandler` -- Computer-use agent bridge with CUA-specific checks
+
+### CLI
+
+```bash
+# Installed via the bin entry
+clawdstrike policy lint ./policy.yaml
+clawdstrike audit query --denied
+clawdstrike audit export ./audit-dump.jsonl
+clawdstrike why <event-id>
+```
+
+## Development Testing
+
+When running this package from the monorepo workspace, build local package dependencies first:
+
+```bash
+bun --cwd packages/adapters/clawdstrike-openclaw run test:workspace
+bun --cwd packages/adapters/clawdstrike-openclaw run typecheck:workspace
+```
+
+These commands build `@clawdstrike/policy` and `@clawdstrike/adapter-core` before running tests/typecheck.
+
+## API Overview
+
+| Export | Description |
+|--------|-------------|
+| `PolicyEngine` | Core policy evaluation engine |
+| `OpenClawAdapter` | Standard `FrameworkAdapter` implementation |
+| `loadPolicy` / `validatePolicy` | Policy loading and validation |
+| `checkPolicy` / `policyCheckTool` | Policy check utilities |
+| `AuditStore` / `OpenClawAuditLogger` | Audit event storage and logging |
+| `ReceiptSigner` | Decision receipt signing |
+| `generateSecurityPrompt` | Security system prompt generation |
+| `openclawTranslator` | OpenClaw config translation |
+| `registerCli` / `createCli` | CLI registration helpers |
+
+## License
+
+Apache-2.0

package/dist/audit/adapter-logger.d.ts

@@ -1,5 +1,5 @@
-import type { AuditEvent, AuditLogger } from '@clawdstrike/adapter-core';
-import type { AuditStore } from './store.js';
+import type { AuditEvent, AuditLogger } from "@clawdstrike/adapter-core";
+import type { AuditStore } from "./store.js";
 export interface OpenClawAuditLoggerOptions {
     store?: AuditStore;
     maxEvents?: number;
@@ -18,7 +18,7 @@ export declare class OpenClawAuditLogger implements AuditLogger {
     log(event: AuditEvent): Promise<void>;
     getSessionEvents(sessionId: string): Promise<AuditEvent[]>;
     getContextEvents(contextId: string): Promise<AuditEvent[]>;
-    export(format: 'json' | 'csv' | 'jsonl'): Promise<string>;
+    export(format: "json" | "csv" | "jsonl"): Promise<string>;
     prune(olderThan: Date): Promise<number>;
 }
 //# sourceMappingURL=adapter-logger.d.ts.map

package/dist/audit/adapter-logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter-logger.d.ts","sourceRoot":"","sources":["../../src/audit/adapter-logger.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAEzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,WAAW,0BAA0B;IACzC,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,YAAW,WAAW;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyB;gBAEnC,OAAO,GAAE,0BAA+B;IAK9C,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAerC,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAI1D,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAI1D,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAIzD,KAAK,CAAC,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;CAG9C"}
+{"version":3,"file":"adapter-logger.d.ts","sourceRoot":"","sources":["../../src/audit/adapter-logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAGzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,WAAW,0BAA0B;IACzC,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,YAAW,WAAW;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyB;gBAEnC,OAAO,GAAE,0BAA+B;IAK9C,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAerC,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAI1D,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAI1D,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAIzD,KAAK,CAAC,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;CAG9C"}

package/dist/audit/adapter-logger.js

@@ -1,4 +1,4 @@
-import { InMemoryAuditLogger } from '@clawdstrike/adapter-core';
+import { InMemoryAuditLogger } from "@clawdstrike/adapter-core";
 /**
  * OpenClawAuditLogger bridges the adapter-core `AuditLogger` interface with
  * openclaw's existing `AuditStore` JSONL persistence layer.
@@ -18,8 +18,8 @@ export class OpenClawAuditLogger {
         if (this.store) {
             this.store.append({
                 type: event.type,
-                resource: event.toolName ?? '',
-                decision: event.decision?.status === 'deny' ? 'denied' : 'allowed',
+                resource: event.toolName ?? "",
+                decision: event.decision?.status === "deny" ? "denied" : "allowed",
                 guard: event.decision?.guard,
                 reason: event.decision?.reason ?? event.decision?.message,
                 runId: event.sessionId,

package/dist/audit/adapter-logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"adapter-logger.js","sourceRoot":"","sources":["../../src/audit/adapter-logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAUhE;;;;;;GAMG;AACH,MAAM,OAAO,mBAAmB;IACb,MAAM,CAAsB;IAC5B,KAAK,CAAyB;IAE/C,YAAY,UAAsC,EAAE;QAClD,IAAI,CAAC,MAAM,GAAG,IAAI,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAiB;QACzB,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAE7B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;gBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAClE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK;gBAC5B,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,OAAO;gBACzD,KAAK,EAAE,KAAK,CAAC,SAAS;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,SAAiB;QACtC,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,SAAiB;QACtC,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAgC;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAe;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;CACF"}
+{"version":3,"file":"adapter-logger.js","sourceRoot":"","sources":["../../src/audit/adapter-logger.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAShE;;;;;;GAMG;AACH,MAAM,OAAO,mBAAmB;IACb,MAAM,CAAsB;IAC5B,KAAK,CAAyB;IAE/C,YAAY,UAAsC,EAAE;QAClD,IAAI,CAAC,MAAM,GAAG,IAAI,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAiB;QACzB,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAE7B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;gBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAClE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK;gBAC5B,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,OAAO;gBACzD,KAAK,EAAE,KAAK,CAAC,SAAS;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,SAAiB;QACtC,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,SAAiB;QACtC,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAgC;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAe;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;CACF"}

package/dist/audit/store.d.ts

@@ -3,7 +3,7 @@ export interface AuditEvent {
     timestamp: number;
     type: string;
     resource: string;
-    decision: 'allowed' | 'denied';
+    decision: "allowed" | "denied";
     guard?: string;
     reason?: string;
     runId?: string;
@@ -13,7 +13,7 @@ export declare class AuditStore {
     private events;
     constructor(path?: string);
     private load;
-    append(event: Omit<AuditEvent, 'id' | 'timestamp'>): AuditEvent;
+    append(event: Omit<AuditEvent, "id" | "timestamp">): AuditEvent;
     query(options?: {
         since?: number;
         guard?: string;

package/dist/audit/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/audit/store.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,MAAM,CAAoB;gBAEtB,IAAI,GAAE,MAA4B;IAK9C,OAAO,CAAC,IAAI;IAUZ,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,WAAW,CAAC,GAAG,UAAU;IAiB/D,KAAK,CAAC,OAAO,GAAE;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;KACX,GAAG,UAAU,EAAE;IAmBrB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAI3C,KAAK,IAAI,IAAI;CAMd"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/audit/store.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,MAAM,CAAoB;gBAEtB,IAAI,GAAE,MAA4B;IAK9C,OAAO,CAAC,IAAI;IAUZ,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,WAAW,CAAC,GAAG,UAAU;IAiB/D,KAAK,CACH,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GACjF,UAAU,EAAE;IAmBf,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAI3C,KAAK,IAAI,IAAI;CAMd"}

package/dist/audit/store.js

@@ -1,19 +1,19 @@
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs';
-import { dirname } from 'path';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { dirname } from "path";
 export class AuditStore {
     path;
     events = [];
-    constructor(path = '.hush/audit.jsonl') {
+    constructor(path = ".hush/audit.jsonl") {
         this.path = path;
         this.load();
     }
     load() {
         if (existsSync(this.path)) {
-            const content = readFileSync(this.path, 'utf-8');
+            const content = readFileSync(this.path, "utf-8");
             this.events = content
-                .split('\n')
-                .filter(line => line.trim())
-                .map(line => JSON.parse(line));
+                .split("\n")
+                .filter((line) => line.trim())
+                .map((line) => JSON.parse(line));
         }
     }
     append(event) {
@@ -27,19 +27,19 @@ export class AuditStore {
         if (!existsSync(dir)) {
             mkdirSync(dir, { recursive: true });
         }
-        writeFileSync(this.path, this.events.map(e => JSON.stringify(e)).join('\n') + '\n');
+        writeFileSync(this.path, this.events.map((e) => JSON.stringify(e)).join("\n") + "\n");
         return fullEvent;
     }
     query(options = {}) {
         let results = [...this.events];
         if (options.since) {
-            results = results.filter(e => e.timestamp >= options.since);
+            results = results.filter((e) => e.timestamp >= options.since);
         }
         if (options.guard) {
-            results = results.filter(e => e.guard === options.guard);
+            results = results.filter((e) => e.guard === options.guard);
         }
         if (options.denied) {
-            results = results.filter(e => e.decision === 'denied');
+            results = results.filter((e) => e.decision === "denied");
         }
         if (options.limit) {
             results = results.slice(-options.limit);
@@ -47,12 +47,12 @@ export class AuditStore {
         return results;
     }
     getById(id) {
-        return this.events.find(e => e.id === id);
+        return this.events.find((e) => e.id === id);
     }
     clear() {
         this.events = [];
         if (existsSync(this.path)) {
-            writeFileSync(this.path, '');
+            writeFileSync(this.path, "");
         }
     }
 }

package/dist/audit/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/audit/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAa/B,MAAM,OAAO,UAAU;IACb,IAAI,CAAS;IACb,MAAM,GAAiB,EAAE,CAAC;IAElC,YAAY,OAAe,mBAAmB;QAC5C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAEO,IAAI;QACV,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,GAAG,OAAO;iBAClB,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;iBAC3B,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAA2C;QAChD,MAAM,SAAS,GAAe;YAC5B,GAAG,KAAK;YACR,EAAE,EAAE,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;YACjE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE5B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAEpF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,UAKF,EAAE;QACJ,IAAI,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/B,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,KAAM,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,CAAC,EAAU;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/audit/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAa/B,MAAM,OAAO,UAAU;IACb,IAAI,CAAS;IACb,MAAM,GAAiB,EAAE,CAAC;IAElC,YAAY,OAAe,mBAAmB;QAC5C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAEO,IAAI;QACV,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,GAAG,OAAO;iBAClB,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;iBAC7B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAA2C;QAChD,MAAM,SAAS,GAAe;YAC5B,GAAG,KAAK;YACR,EAAE,EAAE,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;YACjE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE5B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAEtF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CACH,UAAgF,EAAE;QAElF,IAAI,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/B,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,KAAM,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,CAAC,EAAU;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF"}

package/dist/classification.d.ts

@@ -5,7 +5,7 @@
  * and tool-guard hooks.  This module is self-contained — it only depends on
  * the EventType type from the package's own types module.
  */
-import type { EventType } from './types.js';
+import type { EventType } from "./types.js";
 /** Read-only tokens: if ANY token matches and no destructive token is present, tool is read-only */
 export declare const READ_ONLY_TOKENS: Set<string>;
 /** Destructive tokens: if ANY token matches, tool is destructive */
@@ -21,7 +21,7 @@ export declare const NETWORK_TOKENS: Set<string>;
  * Tokenize a tool name by splitting on common delimiters and camel-case boundaries.
  */
 export declare function tokenize(toolName: string): string[];
-export type ToolClassification = 'read_only' | 'destructive' | 'unknown';
+export type ToolClassification = "read_only" | "destructive" | "unknown";
 /**
  * Classify a tool based on its name tokens.
  * - If ANY token is destructive -> destructive

package/dist/classification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"classification.d.ts","sourceRoot":"","sources":["../src/classification.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAI5C,oGAAoG;AACpG,eAAO,MAAM,gBAAgB,aAK3B,CAAC;AAEH,oEAAoE;AACpE,eAAO,MAAM,kBAAkB,aAM7B,CAAC;AAEH,0EAA0E;AAC1E,eAAO,MAAM,qBAAqB,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAK9F,CAAC;AAEF,+CAA+C;AAC/C,eAAO,MAAM,cAAc,aAA+F,CAAC;AAI3H;;GAEG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAQnD;AAID,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,aAAa,GAAG,SAAS,CAAC;AAEzE;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAgBjE;AAID;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CA2BzE"}
+{"version":3,"file":"classification.d.ts","sourceRoot":"","sources":["../src/classification.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAI5C,oGAAoG;AACpG,eAAO,MAAM,gBAAgB,aA0B3B,CAAC;AAEH,oEAAoE;AACpE,eAAO,MAAM,kBAAkB,aAqC7B,CAAC;AAEH,0EAA0E;AAC1E,eAAO,MAAM,qBAAqB,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAW9F,CAAC;AAEF,+CAA+C;AAC/C,eAAO,MAAM,cAAc,aAUzB,CAAC;AAIH;;GAEG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAUnD;AAID,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,aAAa,GAAG,SAAS,CAAC;AAEzE;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAgBjE;AAID;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CA2BzE"}

package/dist/classification.js

@@ -8,40 +8,108 @@
 // ── Token Sets ───────────────────────────────────────────────────────
 /** Read-only tokens: if ANY token matches and no destructive token is present, tool is read-only */
 export const READ_ONLY_TOKENS = new Set([
-    'read', 'list', 'get', 'search', 'view', 'show', 'find', 'describe',
-    'info', 'status', 'check', 'ls', 'cat', 'head', 'tail',
-    'which', 'echo', 'pwd', 'env', 'whoami', 'hostname', 'uname', 'date',
-    'glob', 'grep',
+    "read",
+    "list",
+    "get",
+    "search",
+    "view",
+    "show",
+    "find",
+    "describe",
+    "info",
+    "status",
+    "check",
+    "ls",
+    "cat",
+    "head",
+    "tail",
+    "which",
+    "echo",
+    "pwd",
+    "env",
+    "whoami",
+    "hostname",
+    "uname",
+    "date",
+    "glob",
+    "grep",
 ]);
 /** Destructive tokens: if ANY token matches, tool is destructive */
 export const DESTRUCTIVE_TOKENS = new Set([
-    'write', 'delete', 'remove', 'rm', 'kill', 'exec', 'run', 'install',
-    'uninstall', 'create', 'update', 'modify', 'patch', 'put', 'post',
-    'move', 'mv', 'rename', 'chmod', 'chown', 'drop', 'truncate',
-    'edit', 'command', 'bash', 'save', 'overwrite', 'unlink', 'terminal',
-    'append', 'replace', 'deploy', 'push', 'send', 'publish', 'upload',
+    "write",
+    "delete",
+    "remove",
+    "rm",
+    "kill",
+    "exec",
+    "run",
+    "install",
+    "uninstall",
+    "create",
+    "update",
+    "modify",
+    "patch",
+    "put",
+    "post",
+    "move",
+    "mv",
+    "rename",
+    "chmod",
+    "chown",
+    "drop",
+    "truncate",
+    "edit",
+    "command",
+    "bash",
+    "save",
+    "overwrite",
+    "unlink",
+    "terminal",
+    "append",
+    "replace",
+    "deploy",
+    "push",
+    "send",
+    "publish",
+    "upload",
 ]);
 /** Destructive token-to-event-type mapping for specific policy routing */
 export const DESTRUCTIVE_EVENT_MAP = [
-    { tokens: new Set(['write', 'edit', 'create', 'save', 'overwrite', 'append', 'replace']), eventType: 'file_write' },
-    { tokens: new Set(['delete', 'remove', 'unlink', 'rm']), eventType: 'file_write' },
-    { tokens: new Set(['shell', 'bash', 'exec', 'command', 'terminal', 'run']), eventType: 'command_exec' },
-    { tokens: new Set(['patch', 'diff']), eventType: 'patch_apply' },
+    {
+        tokens: new Set(["write", "edit", "create", "save", "overwrite", "append", "replace"]),
+        eventType: "file_write",
+    },
+    { tokens: new Set(["delete", "remove", "unlink", "rm"]), eventType: "file_write" },
+    {
+        tokens: new Set(["shell", "bash", "exec", "command", "terminal", "run"]),
+        eventType: "command_exec",
+    },
+    { tokens: new Set(["patch", "diff"]), eventType: "patch_apply" },
 ];
 /** Network tokens for egress classification */
-export const NETWORK_TOKENS = new Set(['fetch', 'http', 'web', 'curl', 'request', 'api', 'download', 'socket', 'connect']);
+export const NETWORK_TOKENS = new Set([
+    "fetch",
+    "http",
+    "web",
+    "curl",
+    "request",
+    "api",
+    "download",
+    "socket",
+    "connect",
+]);
 // ── Tokenizer ────────────────────────────────────────────────────────
 /**
  * Tokenize a tool name by splitting on common delimiters and camel-case boundaries.
  */
 export function tokenize(toolName) {
-    return toolName
+    return (toolName
         // Split `fooBar` -> `foo Bar`, `HTTPFetch` -> `HTTP Fetch`
-        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
-        .replace(/([A-Z])([A-Z][a-z])/g, '$1 $2')
+        .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+        .replace(/([A-Z])([A-Z][a-z])/g, "$1 $2")
         .toLowerCase()
         .split(/[_\-/\s.]+/)
-        .filter(Boolean);
+        .filter(Boolean));
 }
 /**
  * Classify a tool based on its name tokens.
@@ -61,10 +129,10 @@ export function classifyTool(tokens) {
         }
     }
     if (hasDestructive)
-        return 'destructive';
+        return "destructive";
     if (hasReadOnly)
-        return 'read_only';
-    return 'unknown';
+        return "read_only";
+    return "unknown";
 }
 // ── Event Type Inference (name-only) ─────────────────────────────────
 /**
@@ -78,22 +146,22 @@ export function classifyTool(tokens) {
 export function inferEventTypeFromName(toolName) {
     const tokens = tokenize(toolName);
     const classification = classifyTool(tokens);
-    if (classification === 'read_only') {
+    if (classification === "read_only") {
         // Read-only tools may still perform network egress (e.g. web_search, http_get).
-        if (tokens.some(t => NETWORK_TOKENS.has(t))) {
-            return 'network_egress';
+        if (tokens.some((t) => NETWORK_TOKENS.has(t))) {
+            return "network_egress";
         }
-        return 'file_read';
+        return "file_read";
     }
     // Check specific destructive event types via DESTRUCTIVE_EVENT_MAP.
     for (const { tokens: matchTokens, eventType } of DESTRUCTIVE_EVENT_MAP) {
-        if (tokens.some(t => matchTokens.has(t))) {
+        if (tokens.some((t) => matchTokens.has(t))) {
             return eventType;
         }
     }
     // Check network tokens.
-    if (tokens.some(t => NETWORK_TOKENS.has(t))) {
-        return 'network_egress';
+    if (tokens.some((t) => NETWORK_TOKENS.has(t))) {
+        return "network_egress";
     }
     // No confident classification — return null so callers can apply their
     // own fallback logic (e.g. parameter inspection).

package/dist/classification.js.map

@@ -1 +1 @@
-{"version":3,"file":"classification.js","sourceRoot":"","sources":["../src/classification.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,wEAAwE;AAExE,oGAAoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IACtC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU;IACnE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;IACtD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM;IACpE,MAAM,EAAE,MAAM;CACf,CAAC,CAAC;AAEH,oEAAoE;AACpE,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACxC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS;IACnE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM;IACjE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU;IAC5D,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU;IACpE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ;CACnE,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,qBAAqB,GAAiE;IACjG,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE;IACnH,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE;IAClF,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE;IACvG,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE;CACjE,CAAC;AAEF,+CAA+C;AAC/C,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAE3H,wEAAwE;AAExE;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACvC,OAAO,QAAQ;QACb,2DAA2D;SAC1D,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,sBAAsB,EAAE,OAAO,CAAC;SACxC,WAAW,EAAE;SACb,KAAK,CAAC,YAAY,CAAC;SACnB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAMD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,MAAgB;IAC3C,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC;QACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IAED,IAAI,cAAc;QAAE,OAAO,aAAa,CAAC;IACzC,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IACpC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wEAAwE;AAExE;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAE5C,IAAI,cAAc,KAAK,WAAW,EAAE,CAAC;QACnC,gFAAgF;QAChF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,oEAAoE;IACpE,KAAK,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,qBAAqB,EAAE,CAAC;QACvE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,uEAAuE;IACvE,kDAAkD;IAClD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"classification.js","sourceRoot":"","sources":["../src/classification.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,wEAAwE;AAExE,oGAAoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IACtC,MAAM;IACN,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,UAAU;IACV,MAAM;IACN,QAAQ;IACR,OAAO;IACP,IAAI;IACJ,KAAK;IACL,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,KAAK;IACL,KAAK;IACL,QAAQ;IACR,UAAU;IACV,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH,oEAAoE;AACpE,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACxC,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,IAAI;IACJ,MAAM;IACN,MAAM;IACN,KAAK;IACL,SAAS;IACT,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,KAAK;IACL,MAAM;IACN,MAAM;IACN,IAAI;IACJ,QAAQ;IACR,OAAO;IACP,OAAO;IACP,MAAM;IACN,UAAU;IACV,MAAM;IACN,SAAS;IACT,MAAM;IACN,MAAM;IACN,WAAW;IACX,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,MAAM;IACN,MAAM;IACN,SAAS;IACT,QAAQ;CACT,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,qBAAqB,GAAiE;IACjG;QACE,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QACtF,SAAS,EAAE,YAAY;KACxB;IACD,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE;IAClF;QACE,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QACxE,SAAS,EAAE,cAAc;KAC1B;IACD,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE;CACjE,CAAC;AAEF,+CAA+C;AAC/C,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IACpC,OAAO;IACP,MAAM;IACN,KAAK;IACL,MAAM;IACN,SAAS;IACT,KAAK;IACL,UAAU;IACV,QAAQ;IACR,SAAS;CACV,CAAC,CAAC;AAEH,wEAAwE;AAExE;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACvC,OAAO,CACL,QAAQ;QACN,2DAA2D;SAC1D,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,sBAAsB,EAAE,OAAO,CAAC;SACxC,WAAW,EAAE;SACb,KAAK,CAAC,YAAY,CAAC;SACnB,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;AACJ,CAAC;AAMD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,MAAgB;IAC3C,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC;QACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IAED,IAAI,cAAc;QAAE,OAAO,aAAa,CAAC;IACzC,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IACpC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wEAAwE;AAExE;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAE5C,IAAI,cAAc,KAAK,WAAW,EAAE,CAAC;QACnC,gFAAgF;QAChF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,oEAAoE;IACpE,KAAK,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,qBAAqB,EAAE,CAAC;QACvE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,uEAAuE;IACvE,kDAAkD;IAClD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { createCli } from './index.js';
+import { createCli } from "./index.js";
 const program = createCli();
 program.parse();
 //# sourceMappingURL=bin.js.map

package/dist/cli/commands/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/audit.ts"],"names":[],"mappings":"AAGA,UAAU,YAAY;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,cAAc;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,aAAa;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,aAAa;oBACH,YAAY,GAAQ,OAAO,CAAC,IAAI,CAAC;qBAwC/B,MAAM,YAAW,cAAc,GAAQ,OAAO,CAAC,IAAI,CAAC;iBAyDxD,MAAM,YAAW,aAAa,GAAQ,OAAO,CAAC,IAAI,CAAC;CAOvE,CAAC"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/audit.ts"],"names":[],"mappings":"AAGA,UAAU,YAAY;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,cAAc;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,aAAa;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,aAAa;oBACH,YAAY,GAAQ,OAAO,CAAC,IAAI,CAAC;qBAwC/B,MAAM,YAAW,cAAc,GAAQ,OAAO,CAAC,IAAI,CAAC;iBA+DxD,MAAM,YAAW,aAAa,GAAQ,OAAO,CAAC,IAAI,CAAC;CAOvE,CAAC"}

package/dist/cli/commands/audit.js

@@ -1,8 +1,8 @@
-import { writeFileSync } from 'fs';
-import { AuditStore } from '../../audit/store.js';
+import { writeFileSync } from "fs";
+import { AuditStore } from "../../audit/store.js";
 export const auditCommands = {
     async query(options = {}) {
-        const store = new AuditStore(options.auditPath || '.hush/audit.jsonl');
+        const store = new AuditStore(options.auditPath || ".hush/audit.jsonl");
         const queryOptions = {
             limit: 50,
         };
@@ -18,14 +18,14 @@ export const auditCommands = {
         }
         const events = store.query(queryOptions);
         if (events.length === 0) {
-            console.log('No audit events found');
+            console.log("No audit events found");
             return;
         }
-        console.log('Audit Events:');
-        console.log('=============');
+        console.log("Audit Events:");
+        console.log("=============");
         for (const event of events) {
             const date = new Date(event.timestamp).toISOString();
-            const status = event.decision === 'allowed' ? 'ALLOWED' : 'DENIED';
+            const status = event.decision === "allowed" ? "ALLOWED" : "DENIED";
             console.log(`\n[${date}] ${event.id}`);
             console.log(`  Action: ${event.type}`);
             console.log(`  Resource: ${event.resource}`);
@@ -37,54 +37,54 @@ export const auditCommands = {
         }
     },
     async explain(eventId, options = {}) {
-        const store = new AuditStore(options.auditPath || '.hush/audit.jsonl');
+        const store = new AuditStore(options.auditPath || ".hush/audit.jsonl");
         const event = store.getById(eventId);
         if (!event) {
             console.log(`Event ${eventId} not found`);
             return;
         }
-        console.log('Event Details');
-        console.log('=============');
+        console.log("Event Details");
+        console.log("=============");
         console.log(`\nEvent ID:    ${event.id}`);
         console.log(`Timestamp:   ${new Date(event.timestamp).toISOString()}`);
         console.log(`Action:      ${event.type}`);
         console.log(`Resource:    ${event.resource}`);
-        console.log(`Decision:    ${event.decision === 'allowed' ? 'ALLOWED' : 'DENIED'}`);
+        console.log(`Decision:    ${event.decision === "allowed" ? "ALLOWED" : "DENIED"}`);
         if (event.guard) {
             console.log(`\nGuard:       ${event.guard}`);
         }
         if (event.reason) {
             console.log(`Reason:      ${event.reason}`);
         }
-        if (event.decision === 'denied') {
-            console.log('\nRemediation:');
-            console.log('------------');
-            const guard = (event.guard || '').trim();
-            if (guard === 'forbidden_path' || guard === 'ForbiddenPathGuard') {
-                console.log('This path is protected by the forbidden_path guard.');
-                console.log('To allow access, remove it from filesystem.forbidden_paths in your policy.');
+        if (event.decision === "denied") {
+            console.log("\nRemediation:");
+            console.log("------------");
+            const guard = (event.guard || "").trim();
+            if (guard === "forbidden_path" || guard === "ForbiddenPathGuard") {
+                console.log("This path is protected by the forbidden_path guard.");
+                console.log("To allow access, remove it from filesystem.forbidden_paths in your policy.");
                 return;
             }
-            if (guard === 'egress' || guard === 'EgressAllowlistGuard') {
-                console.log('This domain is blocked by the egress policy.');
-                console.log('To allow access, add it to egress.allowed_domains (or change egress.mode) in your policy.');
+            if (guard === "egress" || guard === "EgressAllowlistGuard") {
+                console.log("This domain is blocked by the egress policy.");
+                console.log("To allow access, add it to egress.allowed_domains (or change egress.mode) in your policy.");
                 return;
             }
-            if (guard === 'secret_leak' || guard === 'SecretLeakGuard') {
-                console.log('Tool output contained a value that looks like a secret.');
-                console.log('Remove/redact secrets from tool output or adjust your workflow to avoid printing credentials.');
+            if (guard === "secret_leak" || guard === "SecretLeakGuard") {
+                console.log("Tool output contained a value that looks like a secret.");
+                console.log("Remove/redact secrets from tool output or adjust your workflow to avoid printing credentials.");
                 return;
             }
-            if (guard === 'patch_integrity' || guard === 'PatchIntegrityGuard') {
-                console.log('The patch/command matched a dangerous pattern.');
-                console.log('Avoid unsafe commands/patterns (e.g., curl|bash, rm -rf /) or update execution.denied_patterns.');
+            if (guard === "patch_integrity" || guard === "PatchIntegrityGuard") {
+                console.log("The patch/command matched a dangerous pattern.");
+                console.log("Avoid unsafe commands/patterns (e.g., curl|bash, rm -rf /) or update execution.denied_patterns.");
                 return;
             }
-            console.log('Review your policy configuration to understand why this was blocked.');
+            console.log("Review your policy configuration to understand why this was blocked.");
         }
     },
     async export(file, options = {}) {
-        const store = new AuditStore(options.auditPath || '.hush/audit.jsonl');
+        const store = new AuditStore(options.auditPath || ".hush/audit.jsonl");
         const events = store.query({});
         writeFileSync(file, JSON.stringify(events, null, 2));
         console.log(`Exported ${events.length} events to ${file}`);

package/dist/cli/commands/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/cli/commands/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAiBlD,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,KAAK,CAAC,KAAK,CAAC,UAAwB,EAAE;QACpC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,mBAAmB,CAAC,CAAC;QAEvE,MAAM,YAAY,GAAyE;YACzF,KAAK,EAAE,EAAE;SACV,CAAC;QAEF,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC1C,YAAY,CAAC,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,YAAY,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QACrC,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,YAAY,CAAC,MAAM,GAAG,IAAI,CAAC;QAC7B,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAEzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAE7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,EAAE,CAAC,CAAC;YACrC,IAAI,KAAK,CAAC,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,UAA0B,EAAE;QACzD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,mBAAmB,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAErC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,SAAS,OAAO,YAAY,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEnF,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAEzC,IAAI,KAAK,KAAK,gBAAgB,IAAI,KAAK,KAAK,oBAAoB,EAAE,CAAC;gBACjE,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;gBACnE,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;gBAC1F,OAAO;YACT,CAAC;YAED,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,sBAAsB,EAAE,CAAC;gBAC3D,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;gBAC5D,OAAO,CAAC,GAAG,CAAC,2FAA2F,CAAC,CAAC;gBACzG,OAAO;YACT,CAAC;YAED,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,iBAAiB,EAAE,CAAC;gBAC3D,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;gBACvE,OAAO,CAAC,GAAG,CAAC,+FAA+F,CAAC,CAAC;gBAC7G,OAAO;YACT,CAAC;YAED,IAAI,KAAK,KAAK,iBAAiB,IAAI,KAAK,KAAK,qBAAqB,EAAE,CAAC;gBACnE,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;gBAC9D,OAAO,CAAC,GAAG,CAAC,iGAAiG,CAAC,CAAC;gBAC/G,OAAO;YACT,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,UAAyB,EAAE;QACpD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,mBAAmB,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAE/B,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,MAAM,cAAc,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;CACF,CAAC"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/cli/commands/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAiBlD,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,KAAK,CAAC,KAAK,CAAC,UAAwB,EAAE;QACpC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,mBAAmB,CAAC,CAAC;QAEvE,MAAM,YAAY,GAAyE;YACzF,KAAK,EAAE,EAAE;SACV,CAAC;QAEF,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC1C,YAAY,CAAC,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,YAAY,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QACrC,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,YAAY,CAAC,MAAM,GAAG,IAAI,CAAC;QAC7B,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAEzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAE7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,EAAE,CAAC,CAAC;YACrC,IAAI,KAAK,CAAC,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,UAA0B,EAAE;QACzD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,mBAAmB,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAErC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,SAAS,OAAO,YAAY,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEnF,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAEzC,IAAI,KAAK,KAAK,gBAAgB,IAAI,KAAK,KAAK,oBAAoB,EAAE,CAAC;gBACjE,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;gBACnE,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;gBAC1F,OAAO;YACT,CAAC;YAED,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,sBAAsB,EAAE,CAAC;gBAC3D,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;gBAC5D,OAAO,CAAC,GAAG,CACT,2FAA2F,CAC5F,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,iBAAiB,EAAE,CAAC;gBAC3D,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;gBACvE,OAAO,CAAC,GAAG,CACT,+FAA+F,CAChG,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,KAAK,KAAK,iBAAiB,IAAI,KAAK,KAAK,qBAAqB,EAAE,CAAC;gBACnE,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;gBAC9D,OAAO,CAAC,GAAG,CACT,iGAAiG,CAClG,CAAC;gBACF,OAAO;YACT,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,UAAyB,EAAE;QACpD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,mBAAmB,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAE/B,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,MAAM,cAAc,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;CACF,CAAC"}

package/dist/cli/commands/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/policy.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,cAAc;eACR,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;mBA4BnB;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAQ,OAAO,CAAC,IAAI,CAAC;oBAatC,MAAM,YAAW;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAQ,OAAO,CAAC,IAAI,CAAC;gBAmB7D,MAAM,SAAS,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAsCxD,CAAC"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/policy.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,cAAc;eACR,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;mBA8BnB;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAQ,OAAO,CAAC,IAAI,CAAC;oBAatC,MAAM,YAAW;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAQ,OAAO,CAAC,IAAI,CAAC;gBAmB7D,MAAM,SAAS,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAsCxD,CAAC"}