@deftai/directive-core 0.87.0 → 0.89.0

package/dist/authz/actions.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Operator-facing authz actions: UAT start/suspend, grant mint/revoke (#2944).
+ * All mint paths stamp human-origin `operator-cli` provenance.
+ */
+import type { AuthzOperation, AuthzState, HumanOriginGrant, UatLease } from "./types.js";
+export interface StartUatInput {
+    readonly projectRoot: string;
+    readonly campaignId: string;
+    readonly actor?: string;
+    readonly note?: string | null;
+    readonly now?: Date;
+}
+export declare function startUatLease(input: StartUatInput): {
+    state: AuthzState;
+    lease: UatLease;
+};
+export interface SuspendUatInput {
+    readonly projectRoot: string;
+    readonly actor?: string;
+    readonly now?: Date;
+}
+export declare function suspendUatLease(input: SuspendUatInput): AuthzState;
+export interface MintGrantInput {
+    readonly projectRoot: string;
+    readonly actor?: string;
+    readonly operations: readonly AuthzOperation[];
+    readonly surfaces?: readonly string[];
+    readonly cohortId?: string | null;
+    readonly planRef?: string | null;
+    readonly repo?: string | null;
+    readonly branch?: string | null;
+    readonly worktree?: string | null;
+    readonly storyIds?: readonly string[];
+    readonly issueIds?: readonly number[];
+    readonly expiresAt?: string | null;
+    readonly singleUse?: boolean;
+    readonly eventRef?: string | null;
+    readonly grantId?: string;
+    readonly now?: Date;
+    /** When true, pin grant id into state.activeGrantIds. */
+    readonly pinActive?: boolean;
+}
+export declare function mintHumanOriginGrant(input: MintGrantInput): HumanOriginGrant;
+export interface RevokeGrantInput {
+    readonly projectRoot: string;
+    readonly grantId: string;
+    readonly now?: Date;
+}
+export declare function revokeGrant(input: RevokeGrantInput): HumanOriginGrant | null;
+export declare function showAuthzSnapshot(projectRoot: string): {
+    state: AuthzState;
+    activeGrants: HumanOriginGrant[];
+    allGrants: HumanOriginGrant[];
+};
+//# sourceMappingURL=actions.d.ts.map

package/dist/authz/actions.js

@@ -0,0 +1,125 @@
+/**
+ * Operator-facing authz actions: UAT start/suspend, grant mint/revoke (#2944).
+ * All mint paths stamp human-origin `operator-cli` provenance.
+ */
+import { randomBytes } from "node:crypto";
+import { listActiveHumanGrants, listGrants, loadAuthzState, mintOperatorOrigin, saveAuthzState, saveGrant, utcIso, } from "./store.js";
+import { AUTHZ_OPERATIONS } from "./types.js";
+function newGrantId(now) {
+    const ts = (now ?? new Date())
+        .toISOString()
+        .replace(/[-:TZ.]/g, "")
+        .slice(0, 14);
+    const suffix = randomBytes(3).toString("hex");
+    return `grant-${ts}-${suffix}`;
+}
+export function startUatLease(input) {
+    const actor = input.actor ?? "operator";
+    const origin = mintOperatorOrigin(actor, "deft authz:uat-start", input.now);
+    const lease = {
+        active: true,
+        campaignId: input.campaignId.trim(),
+        startedAt: origin.mintedAt,
+        startedBy: origin,
+        suspendedAt: null,
+        note: input.note ?? null,
+    };
+    if (lease.campaignId.length === 0) {
+        throw new Error("campaignId must be non-empty");
+    }
+    const prev = loadAuthzState(input.projectRoot);
+    const state = {
+        schemaVersion: 1,
+        uat: lease,
+        activeGrantIds: prev.activeGrantIds,
+    };
+    saveAuthzState(input.projectRoot, state);
+    return { state, lease };
+}
+export function suspendUatLease(input) {
+    const prev = loadAuthzState(input.projectRoot);
+    if (prev.uat === null || !prev.uat.active) {
+        return prev;
+    }
+    const state = {
+        schemaVersion: 1,
+        uat: {
+            ...prev.uat,
+            active: false,
+            suspendedAt: utcIso(input.now),
+        },
+        activeGrantIds: prev.activeGrantIds,
+    };
+    saveAuthzState(input.projectRoot, state);
+    return state;
+}
+export function mintHumanOriginGrant(input) {
+    if (input.operations.length === 0) {
+        throw new Error("operations must include at least one AuthzOperation");
+    }
+    const allowed = new Set(AUTHZ_OPERATIONS);
+    for (const op of input.operations) {
+        if (!allowed.has(op)) {
+            throw new Error(`unknown operation: ${op}`);
+        }
+    }
+    const origin = mintOperatorOrigin(input.actor ?? "operator", "deft authz:grant", input.now, input.eventRef ?? null);
+    const grant = {
+        schemaVersion: 1,
+        id: input.grantId ?? newGrantId(input.now),
+        origin,
+        scope: {
+            planRef: input.planRef ?? null,
+            repo: input.repo ?? null,
+            branch: input.branch ?? null,
+            worktree: input.worktree ?? null,
+            surfaces: input.surfaces ?? [],
+            operations: [...input.operations],
+            storyIds: input.storyIds ?? [],
+            issueIds: input.issueIds ?? [],
+            cohortId: input.cohortId ?? null,
+        },
+        semantics: {
+            expiresAt: input.expiresAt ?? null,
+            singleUse: input.singleUse === true,
+            usedAt: null,
+            revokedAt: null,
+        },
+    };
+    saveGrant(input.projectRoot, grant);
+    if (input.pinActive) {
+        const prev = loadAuthzState(input.projectRoot);
+        const ids = new Set(prev.activeGrantIds);
+        ids.add(grant.id);
+        saveAuthzState(input.projectRoot, {
+            schemaVersion: 1,
+            uat: prev.uat,
+            activeGrantIds: [...ids],
+        });
+    }
+    return grant;
+}
+export function revokeGrant(input) {
+    const all = listGrants(input.projectRoot);
+    const found = all.find((g) => g.id === input.grantId);
+    if (found === undefined)
+        return null;
+    const revoked = {
+        ...found,
+        semantics: {
+            ...found.semantics,
+            revokedAt: utcIso(input.now),
+        },
+    };
+    saveGrant(input.projectRoot, revoked);
+    return revoked;
+}
+export function showAuthzSnapshot(projectRoot) {
+    const state = loadAuthzState(projectRoot);
+    return {
+        state,
+        activeGrants: listActiveHumanGrants(projectRoot, state),
+        allGrants: listGrants(projectRoot),
+    };
+}
+//# sourceMappingURL=actions.js.map

package/dist/authz/classify.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Map hook tool invocations to authz operation classes (#2944).
+ * Reuses #2711 push/merge shell classification; adds PR create/advance detection
+ * for UAT denials without re-owning runtimeAuthority Shell matchers.
+ *
+ * Token walks are O(n) — no nested-quantifier regex on untrusted shell input
+ * (CodeQL js/polynomial-redos).
+ */
+import { classifyMcpTool, classifyShellCommand, listShellOps } from "../policy/runtime-authority.js";
+import type { AuthzOperation } from "./types.js";
+export type AuthzClassifiedOp = AuthzOperation | "test" | "evidence" | "unknown";
+/** Best-effort shell classification for UAT-sensitive ops beyond push/merge. */
+export declare function classifyShellAuthzOps(command: string): AuthzClassifiedOp[];
+/** Map a PreToolUse tool name + optional shell command to authz ops. */
+export declare function classifyHookAuthzOps(input: {
+    readonly toolName: string;
+    readonly shellCommand: string | null;
+    readonly isDirectWrite: boolean;
+    readonly mcpArgsText?: string | null;
+}): AuthzClassifiedOp[];
+/** Re-export #2711 classifiers for composition docs/tests. */
+export { classifyMcpTool, classifyShellCommand, listShellOps };
+//# sourceMappingURL=classify.d.ts.map

package/dist/authz/classify.js

@@ -0,0 +1,217 @@
+/**
+ * Map hook tool invocations to authz operation classes (#2944).
+ * Reuses #2711 push/merge shell classification; adds PR create/advance detection
+ * for UAT denials without re-owning runtimeAuthority Shell matchers.
+ *
+ * Token walks are O(n) — no nested-quantifier regex on untrusted shell input
+ * (CodeQL js/polynomial-redos).
+ */
+import { classifyMcpTool, classifyShellCommand, listShellOps, } from "../policy/runtime-authority.js";
+/** Split on whitespace without nested quantifiers (O(n)). */
+function shellTokens(command) {
+    const out = [];
+    let cur = "";
+    for (let i = 0; i < command.length; i++) {
+        const c = command[i];
+        if (c === undefined)
+            break;
+        if (c === " " || c === "\t" || c === "\n" || c === "\r") {
+            if (cur.length > 0) {
+                out.push(cur);
+                cur = "";
+            }
+            continue;
+        }
+        cur += c;
+    }
+    if (cur.length > 0)
+        out.push(cur);
+    return out;
+}
+function normalizeToken(token) {
+    return token.replace(/['"\\]/g, "").toLowerCase();
+}
+function isEnvAssign(token) {
+    const eq = token.indexOf("=");
+    if (eq <= 0)
+        return false;
+    return /^[A-Za-z_][A-Za-z0-9_]*$/.test(token.slice(0, eq));
+}
+/**
+ * Walk tokens looking for `gh [opts] <resource> <verb>` patterns (O(n)).
+ * Returns the resource+verb pair when found.
+ */
+/** gh global flags that take a separate value token. */
+const GH_VALUE_FLAGS = new Set(["-R", "--repo", "-a", "--app", "-h", "--hostname", "-p", "--jq"]);
+function findGhResourceVerb(tokens) {
+    let i = 0;
+    while (i < tokens.length && isEnvAssign(tokens[i]))
+        i++;
+    const wrap = tokens[i] !== undefined ? normalizeToken(tokens[i]) : "";
+    if (wrap === "sudo" || wrap === "env" || wrap === "command") {
+        i++;
+        while (i < tokens.length && isEnvAssign(tokens[i]))
+            i++;
+    }
+    const bin = tokens[i] !== undefined ? normalizeToken(tokens[i]) : "";
+    if (bin !== "gh" && bin !== "gh.exe")
+        return null;
+    i++;
+    while (i < tokens.length) {
+        const t = tokens[i];
+        if (t === undefined)
+            break;
+        const n = normalizeToken(t);
+        if (!n.startsWith("-"))
+            break;
+        // --flag=value form consumes one token.
+        if (n.startsWith("--") && n.includes("=")) {
+            i++;
+            continue;
+        }
+        // Value-taking short/long flags: -R owner/repo, --repo owner/repo
+        if (GH_VALUE_FLAGS.has(t) || GH_VALUE_FLAGS.has(n)) {
+            i += 2;
+            continue;
+        }
+        i++;
+    }
+    const resource = tokens[i] !== undefined ? normalizeToken(tokens[i]) : "";
+    const verb = tokens[i + 1] !== undefined ? normalizeToken(tokens[i + 1]) : "";
+    if (resource.length === 0 || verb.length === 0)
+        return null;
+    return { resource, verb };
+}
+const TEST_BINS = new Set(["vitest", "pytest", "cargo", "npm", "pnpm", "yarn", "task"]);
+const TEST_SECOND = new Set(["test"]);
+const DEPLOY_PAIRS = [
+    ["terraform", "apply"],
+    ["helm", "upgrade"],
+    ["kubectl", "apply"],
+    ["fly", "deploy"],
+    ["vercel", "deploy"],
+];
+function hasGoTest(tokens) {
+    for (let i = 0; i < tokens.length - 1; i++) {
+        if (normalizeToken(tokens[i]) === "go" &&
+            normalizeToken(tokens[i + 1]) === "test") {
+            return true;
+        }
+    }
+    return false;
+}
+function hasTestRunner(tokens) {
+    if (hasGoTest(tokens))
+        return true;
+    for (let i = 0; i < tokens.length; i++) {
+        const t = normalizeToken(tokens[i]);
+        if (TEST_BINS.has(t)) {
+            // vitest/pytest alone, or npm/pnpm/yarn/task/cargo + test
+            if (t === "vitest" || t === "pytest")
+                return true;
+            const next = tokens[i + 1] !== undefined ? normalizeToken(tokens[i + 1]) : "";
+            if (TEST_SECOND.has(next))
+                return true;
+        }
+    }
+    return false;
+}
+function hasDeploy(tokens) {
+    for (let i = 0; i < tokens.length - 1; i++) {
+        const a = normalizeToken(tokens[i]);
+        const b = normalizeToken(tokens[i + 1]);
+        for (const [bin, verb] of DEPLOY_PAIRS) {
+            if (a === bin && b === verb)
+                return true;
+        }
+    }
+    return false;
+}
+function hasGhApiPath(tokens, needle) {
+    let sawGh = false;
+    let sawApi = false;
+    for (const raw of tokens) {
+        const t = normalizeToken(raw);
+        if (t === "gh" || t === "gh.exe") {
+            sawGh = true;
+            continue;
+        }
+        if (sawGh && t === "api") {
+            sawApi = true;
+            continue;
+        }
+        if (sawApi && t.includes(needle))
+            return true;
+    }
+    return false;
+}
+/** Best-effort shell classification for UAT-sensitive ops beyond push/merge. */
+export function classifyShellAuthzOps(command) {
+    const cmd = command.trim();
+    if (cmd.length === 0)
+        return [];
+    const found = new Set();
+    for (const op of listShellOps(cmd)) {
+        found.add(op);
+    }
+    const tokens = shellTokens(cmd);
+    const gh = findGhResourceVerb(tokens);
+    if (gh !== null) {
+        if (gh.resource === "pr" &&
+            (gh.verb === "create" || gh.verb === "edit" || gh.verb === "ready" || gh.verb === "reopen")) {
+            found.add("pr");
+        }
+        // Surface merge when listShellOps misses global flags like --repo (#2711 compose).
+        if (gh.resource === "pr" && gh.verb === "merge") {
+            found.add("merge");
+        }
+        if (gh.resource === "issue" && gh.verb === "create") {
+            found.add("issue_mutation");
+        }
+        if (gh.resource === "repo" && gh.verb === "edit") {
+            found.add("settings");
+        }
+    }
+    if (hasGhApiPath(tokens, "/issues"))
+        found.add("issue_mutation");
+    if (hasGhApiPath(tokens, "/settings"))
+        found.add("settings");
+    if (hasTestRunner(tokens))
+        found.add("test");
+    if (hasDeploy(tokens))
+        found.add("deployment");
+    return [...found];
+}
+/** Map a PreToolUse tool name + optional shell command to authz ops. */
+export function classifyHookAuthzOps(input) {
+    const { toolName, shellCommand, isDirectWrite } = input;
+    if (isDirectWrite)
+        return ["edit"];
+    const lower = toolName.toLowerCase();
+    if (lower.includes("bash") || lower.includes("shell") || lower === "run_terminal_cmd") {
+        // Missing command string: fail open (host gap) — same posture as #2711.
+        if (shellCommand === null)
+            return [];
+        // Empty classification (git status, tests without product verbs, …) is not gated.
+        return classifyShellAuthzOps(shellCommand);
+    }
+    // MCP / bare names via #2711 classifier + PR heuristics (token-ish name checks).
+    const mcpOp = classifyMcpTool(toolName, input.mcpArgsText ?? null);
+    if (mcpOp !== null)
+        return [mcpOp];
+    const name = lower.replace(/[^a-z0-9_]/g, "_");
+    if (name.includes("create_pull_request") ||
+        name.includes("pull_request_create") ||
+        name.includes("pr_create") ||
+        name === "create_pull_request") {
+        return ["pr"];
+    }
+    if (name.includes("create_issue") || name.includes("issue_create")) {
+        return ["issue_mutation"];
+    }
+    // Unrelated tools — not gated by Wave 1 authz (prefer fail-open over false deny).
+    return [];
+}
+/** Re-export #2711 classifiers for composition docs/tests. */
+export { classifyMcpTool, classifyShellCommand, listShellOps };
+//# sourceMappingURL=classify.js.map

package/dist/authz/closed-verb.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Closed-verb evaluator for release-class high-blast verbs (#1095 Wave 4 / #2948).
+ *
+ * Allow only when:
+ *   (a) DEFT_ALLOW_<VERB>=1 ephemeral env bypass, OR
+ *   (b) a matching human-origin grant whose operations cover the verb and
+ *       surfaces cover the target (empty surfaces = any target).
+ *
+ * Agent-authored / rejected-origin grants never satisfy. Does not invent a
+ * second mint path — grants come from Wave 1 mintHumanOriginGrant / authz:grant.
+ */
+import type { ClosedVerbDecision, HumanOriginGrant } from "./types.js";
+import { type VerbClassificationTable } from "./verb-classification.js";
+export type EnvMap = Readonly<Record<string, string | undefined>>;
+export interface EvaluateClosedVerbInput {
+    readonly verb: string;
+    /** Release version / tag / target id (e.g. 0.30.0 or v0.30.0). */
+    readonly target: string | null;
+    readonly grants: readonly HumanOriginGrant[];
+    /** Env map; defaults to process.env when omitted. */
+    readonly env?: EnvMap;
+    readonly now?: Date;
+    /** Injected table for unit tests; otherwise load from projectRoot or builtin. */
+    readonly classification?: VerbClassificationTable;
+    /** Project root — loads conventions/verb-classification.json when set. */
+    readonly projectRoot?: string | null;
+    /** Optional structural context — when grant pins repo/branch, must match. */
+    readonly repo?: string | null;
+    readonly branch?: string | null;
+}
+/** Normalise version/target for surface matching (strip leading v, lower-case). */
+export declare function normaliseClosedVerbTarget(target: string | null | undefined): string | null;
+/** Surface forms that match a target (version, v-version, raw). */
+export declare function targetSurfaceCandidates(target: string | null): string[];
+/**
+ * Closed-verb gate. Fail closed for unknown verbs and missing grants.
+ * Loads conventions/verb-classification.json when projectRoot is provided.
+ */
+export declare function evaluateClosedVerb(input: EvaluateClosedVerbInput): ClosedVerbDecision;
+/** Map verb name → DEFT_ALLOW_* key (from loaded/builtin table). */
+export declare function closedVerbEnvBypassKey(verb: string, projectRoot?: string | null): string | null;
+//# sourceMappingURL=closed-verb.d.ts.map