@evalops/maestro 0.10.8 → 0.10.10

package/dist/safety/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/safety/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AAEH,OAAO,EAEN,UAAU,EAEV,YAAY,EACZ,KAAK,GACL,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAW,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEzC,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,IAAI,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EACN,eAAe,EACf,sBAAsB,GACtB,MAAM,uCAAuC,CAAC;AAE/C,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAyE7C,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACnC,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAC1B,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7C,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;KAC9C,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjD,yBAAyB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACvD,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;KACnD,CAAC,CACF;CACD,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;AAE1D,MAAM,aAAa,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AAE5E,IAAI,YAAY,GAA4B,IAAI,CAAC;AACjD,IAAI,aAAoC,CAAC;AAEzC,SAAS,kBAAkB;IAC1B,IAAI,aAAa;QAAE,OAAO;IAE1B,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;QACnC,gCAAgC;QAChC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO;QAEpC,aAAa,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,EAAE;YAC/C,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC5B,0BAA0B;gBAC1B,YAAY,GAAG,IAAI,CAAC;gBACpB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC7B,aAAa,EAAE,KAAK,EAAE,CAAC;oBACvB,aAAa,GAAG,SAAS,CAAC;gBAC3B,CAAC;YACF,CAAC;iBAAM,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACnC,gEAAgE;gBAChE,gFAAgF;gBAChF,YAAY,GAAG,IAAI,CAAC;YACrB,CAAC;QACF,CAAC,CAAC,CAAC;QACH,qDAAqD;QACrD,aAAa,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,oDAAoD;QACpD,4CAA4C;IAC7C,CAAC;AACF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAK,GAAG,KAAK;IACvC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,mEAAmE;IACnE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,YAAY,GAAG,IAAI,CAAC;QACpB,IAAI,aAAa,EAAE,CAAC;YACnB,aAAa,CAAC,KAAK,EAAE,CAAC;YACtB,aAAa,GAAG,SAAS,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,YAAY,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC;IACrB,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,aAAa,CAAmB,GAAG,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,uDAAuD;gBACvD,MAAM,IAAI,KAAK,CACd,mBAAmB,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5E,CAAC;YACH,CAAC;YACD,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;YAC3B,kBAAkB,EAAE,CAAC;YACrB,OAAO,YAAY,CAAC;QACrB,CAAC;QACD,oDAAoD;QACpD,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,CACX,4CAA4C,EAC5C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CACzD,CAAC;QACF,kFAAkF;QAClF,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CACrB,OAA8B;IAE9B,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QACtD,CAAC,CAAE,OAAO,CAAC,IAAgC;QAC3C,CAAC,CAAC,IAAI,CAAC;AACT,CAAC;AAED,SAAS,YAAY,CACpB,OAA8B,EAC9B,GAAW;IAEX,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,OAA8B;IACpD,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA8B;IAI/D,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,MAAM,GAAG,UAAU,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,mBAAmB;SAC/G,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,gCAAgC;IAChC,IACC,MAAM,CAAC,KAAK;QACZ,OAAO,CAAC,IAAI,EAAE,KAAK;QACnB,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,EAClC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;YAC3C,WAAW,EAAE,MAAM,CAAC,KAAK;YACzB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;SAC7B,CAAC,CAAC;QACH,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,qDAAqD,MAAM,CAAC,KAAK,8BAA8B,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG;SAC5H,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1C,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,CAAC,QAAQ,sCAAsC;aACvE,CAAC;QACH,CAAC;QACD,IAAI,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,CAAC,QAAQ,+CAA+C;aAChF,CAAC;QACH,CAAC;IACF,CAAC;IAED,iDAAiD;IACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACb,+CAA+C;YAC/C,MAAM,mBAAmB,GAAG;gBAC3B,sBAAsB,CAAC,YAAY;gBACnC,sBAAsB,CAAC,UAAU;gBACjC,sBAAsB,CAAC,UAAU;gBACjC,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,OAAO;gBAC9B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;aAC/B,CAAC;YACF,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;gBAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EACL,yIAAyI;qBAC1I,CAAC;gBACH,CAAC;YACF,CAAC;YAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;gBAE1C,iEAAiE;gBACjE,2EAA2E;gBAC3E,qDAAqD;gBACrD,MAAM,uBAAuB,GAC5B,mFAAmF,CAAC,IAAI,CACvF,OAAO,CACP,CAAC;gBACH,IACC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,uBAAuB,CAAC;oBAC5C,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAC1B,CAAC;oBACF,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EACL,+GAA+G;qBAChH,CAAC;gBACH,CAAC;gBAED,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;gBAEjD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACxB,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBACvC,OAAO;4BACN,OAAO,EAAE,KAAK;4BACd,MAAM,EAAE,eAAe,GAAG,6CAA6C;yBACvE,CAAC;oBACH,CAAC;oBACD,IAAI,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC5B,OAAO;4BACN,OAAO,EAAE,KAAK;4BACd,MAAM,EAAE,eAAe,GAAG,+CAA+C;yBACzE,CAAC;oBACH,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IAED,yBAAyB;IACzB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,YAAY,CAAC;QACrB,CAAC;IACF,CAAC;IAED,oBAAoB;IACpB,IAAI,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QACpD,IAAI,yBAAyB,IAAI,yBAAyB,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,eAAe,GACpB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;YAChE,IAAI,eAAe,GAAG,yBAAyB,EAAE,CAAC;gBACjD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,oCAAoC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,yBAAyB,wCAAwC;iBAC5I,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IACrC,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC3B,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAI/C,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,MAAM,GAAG,UAAU,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,kBAAkB;SAC9G,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,OAAO,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CACjC,OAA4B,EAC5B,KAA4D;IAK5D,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAEtC,uBAAuB;QACvB,IACC,MAAM,CAAC,yBAAyB;YAChC,MAAM,CAAC,yBAAyB,GAAG,CAAC,EACnC,CAAC;YACF,MAAM,eAAe,GACpB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;YACxD,IAAI,eAAe,GAAG,MAAM,CAAC,yBAAyB,EAAE,CAAC;gBACxD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,oCAAoC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,yBAAyB,wCAAwC;iBACnJ,CAAC;YACH,CAAC;QACF,CAAC;QAED,oBAAoB;QACpB,IAAI,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;YAClE,IAAI,KAAK,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;gBACrC,IAAI,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,mBAAmB,EAAE,CAAC;oBACnD,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,iCAAiC,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,mBAAmB,uCAAuC;qBAC9H,CAAC;gBACH,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,sDAAsD;gBACtD,gGAAgG;gBAChG,qGAAqG;gBACrG,2EAA2E;gBAC3E,4DAA4D;gBAC5D,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,kCAAkC,MAAM,CAAC,mBAAmB,mEAAmE;iBACvI,CAAC;YACH,CAAC;QACF,CAAC;QAED,kCAAkC;QAClC,IAAI,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;YACtE,IAAI,KAAK,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBAC7C,IAAI,KAAK,CAAC,kBAAkB,GAAG,MAAM,CAAC,qBAAqB,EAAE,CAAC;oBAC7D,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,sCAAsC,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,qBAAqB,8DAA8D;qBACpK,CAAC;gBACH,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,iDAAiD;gBACjD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,uCAAuC,MAAM,CAAC,qBAAqB,qEAAqE;iBAChJ,CAAC;YACH,CAAC;QACF,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,yCAAyC,KAAK,EAAE;SACxD,CAAC;IACH,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC9B,wEAAwE;IACxE,wFAAwF;IACxF,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,OAAO,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC/B,IAAI,CAAC;QACJ,OAAO,UAAU,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC","sourcesContent":["/**\n * Enterprise Policy System - Access Control and Safety Enforcement\n *\n * This module implements enterprise-grade policy enforcement for the Composer CLI,\n * enabling organizations to control what tools, models, paths, and network hosts\n * can be accessed during agent execution.\n *\n * ## Policy File Location\n *\n * Policies are loaded from `~/.maestro/policy.json`. This file is typically\n * deployed by enterprise IT and should be protected with appropriate permissions.\n *\n * ## Policy Structure\n *\n * ```json\n * {\n *   \"orgId\": \"org-12345\",\n *   \"tools\": {\n *     \"allowed\": [\"Read\", \"Grep\", \"Glob\"],\n *     \"blocked\": [\"Bash\", \"Write\"]\n *   },\n *   \"models\": {\n *     \"allowed\": [\"anthropic/claude-*\"],\n *     \"blocked\": [\"openai/*\"]\n *   },\n *   \"paths\": {\n *     \"allowed\": [\"/home/user/projects/**\"],\n *     \"blocked\": [\"/etc/**\", \"/root/**\"]\n *   },\n *   \"network\": {\n *     \"allowedHosts\": [\"api.github.com\"],\n *     \"blockedHosts\": [\"*.internal.corp\"],\n *     \"blockLocalhost\": true,\n *     \"blockPrivateIPs\": true\n *   },\n *   \"limits\": {\n *     \"maxTokensPerSession\": 100000,\n *     \"maxSessionDurationMinutes\": 60,\n *     \"maxConcurrentSessions\": 3\n *   }\n * }\n * ```\n *\n * ## Rule Evaluation\n *\n * Policies use an allow/block list pattern with the following evaluation order:\n *\n * 1. If `blocked` list exists and matches → **DENY**\n * 2. If `allowed` list exists and doesn't match → **DENY**\n * 3. Otherwise → **ALLOW**\n *\n * This means:\n * - If only `allowed` is specified, everything else is blocked\n * - If only `blocked` is specified, everything else is allowed\n * - If both are specified, blocked takes precedence\n *\n * ## Pattern Matching\n *\n * Patterns support glob syntax via the `minimatch` library:\n *\n * | Pattern             | Matches                              |\n * |---------------------|--------------------------------------|\n * | `*`                 | Any single segment                   |\n * | `**`                | Any number of segments               |\n * | `*.md`              | Any file ending in .md               |\n * | `src/** (all .ts)`  | Any .ts file under src/              |\n *\n * ## Network Safety\n *\n * Network policies can block:\n * - Specific hosts by name or pattern\n * - Localhost (127.0.0.1, ::1)\n * - Private IP ranges (10.x, 172.16-31.x, 192.168.x)\n *\n * DNS resolution is performed to validate hosts before connection.\n *\n * ## Hot Reloading\n *\n * The policy file is watched for changes and automatically reloaded.\n * This enables policy updates without restarting active sessions.\n *\n * ## Error Handling\n *\n * Policy violations throw `PolicyError` which includes:\n * - The violated rule type (tool, model, path, network)\n * - A user-friendly error message\n * - Context about what was blocked\n *\n * @module safety/policy\n */\n\nimport {\n\ttype FSWatcher,\n\texistsSync,\n\tlstatSync,\n\treadFileSync,\n\twatch,\n} from \"node:fs\";\nimport { join, resolve } from \"node:path\";\nimport { Type } from \"@sinclair/typebox\";\nimport type { ActionApprovalContext } from \"../agent/action-approval.js\";\nimport { PATHS } from \"../config/constants.js\";\nimport { extractDependencies } from \"../utils/dependency-extractor.js\";\nimport { safeJsonParse } from \"../utils/json.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport { expandHomeDir, resolveRealPath } from \"../utils/path-matcher.js\";\nimport { compileTypeboxSchema } from \"../utils/typebox-ajv.js\";\nimport { dangerousPatterns as shellDangerousPatterns } from \"./bash-safety-analyzer.js\";\nimport { checkModelAccess } from \"./validators/model-policy-validator.js\";\nimport { checkNetworkPolicy } from \"./validators/network-policy-validator.js\";\nimport {\n\tcheckPathPolicy,\n\textractPolicyFilePaths,\n} from \"./validators/path-policy-validator.js\";\n\nconst logger = createLogger(\"safety:policy\");\n\n/**\n * Enterprise policy configuration interface.\n *\n * Defines all available policy controls that organizations can configure\n * to restrict agent behavior according to their security requirements.\n */\nexport interface EnterprisePolicy {\n\t/** Organization identifier for audit logging and policy association */\n\torgId?: string;\n\n\t/** Tool execution restrictions (e.g., block Bash, allow only Read) */\n\ttools?: {\n\t\t/** Whitelist of allowed tool names (glob patterns supported) */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked tool names (takes precedence over allowed) */\n\t\tblocked?: string[];\n\t};\n\n\t/** Package/dependency installation restrictions */\n\tdependencies?: {\n\t\t/** Whitelist of allowed package patterns */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked package patterns */\n\t\tblocked?: string[];\n\t};\n\n\t/** Model access restrictions (format: \"provider/model-id\") */\n\tmodels?: {\n\t\t/** Whitelist of allowed model patterns (e.g., \"anthropic/*\") */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked model patterns */\n\t\tblocked?: string[];\n\t};\n\n\t/** File system path restrictions */\n\tpaths?: {\n\t\t/** Whitelist of allowed path patterns (e.g., \"/home/user/projects/**\") */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked path patterns (e.g., \"/etc/**\") */\n\t\tblocked?: string[];\n\t};\n\n\t/** Network access restrictions */\n\tnetwork?: {\n\t\t/** Whitelist of allowed hostnames (e.g., \"api.github.com\") */\n\t\tallowedHosts?: string[];\n\t\t/** Blacklist of blocked hostnames (e.g., \"*.internal.corp\") */\n\t\tblockedHosts?: string[];\n\t\t/** Block access to localhost (127.0.0.1, ::1) */\n\t\tblockLocalhost?: boolean;\n\t\t/** Block access to private IP ranges (10.x, 172.16-31.x, 192.168.x) */\n\t\tblockPrivateIPs?: boolean;\n\t};\n\n\t/**\n\t * Session limits for resource control.\n\t *\n\t * NOTE: These are schema definitions for policy configuration.\n\t * Actual enforcement requires integration with the billing/token-tracker system.\n\t * Currently exposed via getPolicyLimits() for consumers that want to implement limits.\n\t */\n\tlimits?: {\n\t\t/** Maximum tokens per session before termination */\n\t\tmaxTokensPerSession?: number;\n\t\t/** Maximum session duration in minutes */\n\t\tmaxSessionDurationMinutes?: number;\n\t\t/** Maximum concurrent active sessions */\n\t\tmaxConcurrentSessions?: number;\n\t};\n}\n\nconst PolicySchema = Type.Object({\n\torgId: Type.Optional(Type.String()),\n\ttools: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tdependencies: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tmodels: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tpaths: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tnetwork: Type.Optional(\n\t\tType.Object({\n\t\t\tallowedHosts: Type.Optional(Type.Array(Type.String())),\n\t\t\tblockedHosts: Type.Optional(Type.Array(Type.String())),\n\t\t\tblockLocalhost: Type.Optional(Type.Boolean()),\n\t\t\tblockPrivateIPs: Type.Optional(Type.Boolean()),\n\t\t}),\n\t),\n\tlimits: Type.Optional(\n\t\tType.Object({\n\t\t\tmaxTokensPerSession: Type.Optional(Type.Number()),\n\t\t\tmaxSessionDurationMinutes: Type.Optional(Type.Number()),\n\t\t\tmaxConcurrentSessions: Type.Optional(Type.Number()),\n\t\t}),\n\t),\n});\n\nconst validatePolicy = compileTypeboxSchema(PolicySchema);\n\nconst getPolicyPath = (): string => join(PATHS.MAESTRO_HOME, \"policy.json\");\n\nlet cachedPolicy: EnterprisePolicy | null = null;\nlet policyWatcher: FSWatcher | undefined;\n\nfunction startPolicyWatcher() {\n\tif (policyWatcher) return;\n\n\ttry {\n\t\tconst policyPath = getPolicyPath();\n\t\t// Only watch if the file exists\n\t\tif (!existsSync(policyPath)) return;\n\n\t\tpolicyWatcher = watch(policyPath, (eventType) => {\n\t\t\tif (eventType === \"rename\") {\n\t\t\t\t// File deleted or renamed\n\t\t\t\tcachedPolicy = null;\n\t\t\t\tif (!existsSync(policyPath)) {\n\t\t\t\t\tpolicyWatcher?.close();\n\t\t\t\t\tpolicyWatcher = undefined;\n\t\t\t\t}\n\t\t\t} else if (eventType === \"change\") {\n\t\t\t\t// File modified - invalidate cache so next loadPolicy() reloads\n\t\t\t\t// We don't proactively reload here to avoid race conditions with partial writes\n\t\t\t\tcachedPolicy = null;\n\t\t\t}\n\t\t});\n\t\t// Prevent the watcher from keeping the process alive\n\t\tpolicyWatcher.unref();\n\t} catch (error) {\n\t\t// Ignore watcher errors (e.g. system limit reached)\n\t\t// We fall back to standard caching behavior\n\t}\n}\n\nexport function loadPolicy(force = false): EnterprisePolicy | null {\n\tconst policyPath = getPolicyPath();\n\t// Check if file exists first - if not, clear cache and return null\n\tif (!existsSync(policyPath)) {\n\t\tcachedPolicy = null;\n\t\tif (policyWatcher) {\n\t\t\tpolicyWatcher.close();\n\t\t\tpolicyWatcher = undefined;\n\t\t}\n\t\treturn null;\n\t}\n\n\tif (cachedPolicy && !force) {\n\t\treturn cachedPolicy;\n\t}\n\n\ttry {\n\t\tconst raw = readFileSync(policyPath, \"utf8\");\n\t\tconst result = safeJsonParse<EnterprisePolicy>(raw);\n\t\tif (result.success) {\n\t\t\tif (!validatePolicy(result.data)) {\n\t\t\t\t// Invalid schema - throw to block access (fail closed)\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Invalid schema: ${validatePolicy.errors?.map((e) => e.message).join(\", \")}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tcachedPolicy = result.data;\n\t\t\tstartPolicyWatcher();\n\t\t\treturn cachedPolicy;\n\t\t}\n\t\t// Parse error - throw to block access (fail closed)\n\t\tthrow new Error(`JSON parse error: ${result.error.message}`);\n\t} catch (error) {\n\t\tlogger.error(\n\t\t\t\"Critical: Failed to load enterprise policy\",\n\t\t\terror instanceof Error ? error : new Error(String(error)),\n\t\t);\n\t\t// Throw to ensure we fail closed (block access) rather than treating as no policy\n\t\tthrow error;\n\t}\n}\n\nfunction getArgsObject(\n\tcontext: ActionApprovalContext,\n): Record<string, unknown> | null {\n\treturn context.args && typeof context.args === \"object\"\n\t\t? (context.args as Record<string, unknown>)\n\t\t: null;\n}\n\nfunction getStringArg(\n\tcontext: ActionApprovalContext,\n\tkey: string,\n): string | null {\n\tconst args = getArgsObject(context);\n\tif (!args) {\n\t\treturn null;\n\t}\n\tconst value = args[key];\n\treturn typeof value === \"string\" ? value : null;\n}\n\nfunction getCommandArg(context: ActionApprovalContext): string | null {\n\treturn getStringArg(context, \"command\");\n}\n\nexport async function checkPolicy(context: ActionApprovalContext): Promise<{\n\tallowed: boolean;\n\treason?: string;\n}> {\n\tlet policy: EnterprisePolicy | null;\n\ttry {\n\t\tpolicy = loadPolicy();\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Enterprise policy error: ${error instanceof Error ? error.message : \"Unknown error\"}. Access blocked.`,\n\t\t};\n\t}\n\n\tif (!policy) {\n\t\treturn { allowed: true };\n\t}\n\n\t// 0. Organization Context Check\n\tif (\n\t\tpolicy.orgId &&\n\t\tcontext.user?.orgId &&\n\t\tpolicy.orgId !== context.user.orgId\n\t) {\n\t\tlogger.warn(\"Org mismatch, action blocked\", {\n\t\t\tpolicyOrgId: policy.orgId,\n\t\t\tuserOrgId: context.user.orgId,\n\t\t});\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Organization mismatch: This machine is managed by ${policy.orgId}, but you are signed in to ${context.user.orgId}.`,\n\t\t};\n\t}\n\n\t// 1. Tool Constraints\n\tif (policy.tools) {\n\t\tconst { allowed, blocked } = policy.tools;\n\t\tif (allowed && !allowed.includes(context.toolName)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason: `Tool \"${context.toolName}\" is not in the approved tools list.`,\n\t\t\t};\n\t\t}\n\t\tif (blocked?.includes(context.toolName)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason: `Tool \"${context.toolName}\" is explicitly blocked by enterprise policy.`,\n\t\t\t};\n\t\t}\n\t}\n\n\t// 2. Dangerous Patterns & Dependency Constraints\n\tif (context.toolName === \"bash\" || context.toolName === \"background_tasks\") {\n\t\tconst command = getCommandArg(context);\n\t\tif (command) {\n\t\t\t// Check for obfuscation and dangerous patterns\n\t\t\tconst obfuscationPatterns = [\n\t\t\t\tshellDangerousPatterns.base64Decode,\n\t\t\t\tshellDangerousPatterns.opensslEnc,\n\t\t\t\tshellDangerousPatterns.pythonEval,\n\t\t\t\tshellDangerousPatterns.perlEval,\n\t\t\t\tshellDangerousPatterns.nodeEval,\n\t\t\t\tshellDangerousPatterns.phpEval,\n\t\t\t\tshellDangerousPatterns.rubyEval,\n\t\t\t\tshellDangerousPatterns.evalCall,\n\t\t\t\tshellDangerousPatterns.execCall,\n\t\t\t];\n\t\t\tfor (const pattern of obfuscationPatterns) {\n\t\t\t\tif (pattern.test(command)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Command contains obfuscated or dangerous patterns (e.g. base64 decoding, inline code execution) which are blocked by enterprise policy.\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (policy.dependencies) {\n\t\t\t\tconst deps = extractDependencies(command);\n\n\t\t\t\t// Check for shell metacharacters in any package install command,\n\t\t\t\t// even when no explicit package names are extracted (e.g., \"npm install\").\n\t\t\t\t// This prevents bypass via \"npm install && rm -rf /\"\n\t\t\t\tconst isPackageInstallCommand =\n\t\t\t\t\t/(?:npm|yarn|pnpm|bun|pip|pip3|gem|cargo|go\\s+get|composer)\\s+(?:install|add|i\\b)/i.test(\n\t\t\t\t\t\tcommand,\n\t\t\t\t\t);\n\t\t\t\tif (\n\t\t\t\t\t(deps.length > 0 || isPackageInstallCommand) &&\n\t\t\t\t\t/[;&|`$()<>]/.test(command)\n\t\t\t\t) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Command contains shell metacharacters which are not allowed by enterprise policy during package installation.\",\n\t\t\t\t\t};\n\t\t\t\t}\n\n\t\t\t\tconst { allowed, blocked } = policy.dependencies;\n\n\t\t\t\tfor (const dep of deps) {\n\t\t\t\t\tif (allowed && !allowed.includes(dep)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\t\treason: `Dependency \"${dep}\" is not in the approved dependencies list.`,\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t\tif (blocked?.includes(dep)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\t\treason: `Dependency \"${dep}\" is explicitly blocked by enterprise policy.`,\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\t// 3. Path Constraints\n\tif (policy.paths) {\n\t\tconst filePaths = extractPolicyFilePaths(context);\n\t\tconst pathCheck = checkPathPolicy(filePaths, policy.paths);\n\t\tif (!pathCheck.allowed) {\n\t\t\treturn pathCheck;\n\t\t}\n\t}\n\n\t// 4. Network Constraints\n\tif (policy.network) {\n\t\tconst networkCheck = await checkNetworkPolicy(context, policy.network);\n\t\tif (!networkCheck.allowed) {\n\t\t\treturn networkCheck;\n\t\t}\n\t}\n\n\t// 5. Session Limits\n\tif (policy.limits && context.session) {\n\t\tconst { maxSessionDurationMinutes } = policy.limits;\n\t\tif (maxSessionDurationMinutes && maxSessionDurationMinutes > 0) {\n\t\t\tconst durationMinutes =\n\t\t\t\t(Date.now() - context.session.startedAt.getTime()) / 1000 / 60;\n\t\t\tif (durationMinutes > maxSessionDurationMinutes) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session duration limit exceeded (${Math.floor(durationMinutes)}/${maxSessionDurationMinutes} minutes). Please start a new session.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n\nexport class PolicyError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"PolicyError\";\n\t}\n}\n\n/**\n * Check if a model is allowed by policy\n * Called separately from tool checks since model selection happens at a different time\n */\nexport function checkModelPolicy(modelId: string): {\n\tallowed: boolean;\n\treason?: string;\n} {\n\tlet policy: EnterprisePolicy | null;\n\ttry {\n\t\tpolicy = loadPolicy();\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Enterprise policy error: ${error instanceof Error ? error.message : \"Unknown error\"}. Model blocked.`,\n\t\t};\n\t}\n\n\tif (!policy?.models) {\n\t\treturn { allowed: true };\n\t}\n\n\treturn checkModelAccess(modelId, policy.models);\n}\n\n/**\n * Check if the current session has exceeded policy limits\n */\nexport function checkSessionLimits(\n\tsession: { startedAt: Date },\n\tusage?: { tokenCount?: number; activeSessionCount?: number },\n): {\n\tallowed: boolean;\n\treason?: string;\n} {\n\ttry {\n\t\tconst limits = getPolicyLimits();\n\t\tif (!limits) return { allowed: true };\n\n\t\t// Check duration limit\n\t\tif (\n\t\t\tlimits.maxSessionDurationMinutes &&\n\t\t\tlimits.maxSessionDurationMinutes > 0\n\t\t) {\n\t\t\tconst durationMinutes =\n\t\t\t\t(Date.now() - session.startedAt.getTime()) / 1000 / 60;\n\t\t\tif (durationMinutes > limits.maxSessionDurationMinutes) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session duration limit exceeded (${Math.floor(durationMinutes)}/${limits.maxSessionDurationMinutes} minutes). Please start a new session.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Check token limit\n\t\tif (limits.maxTokensPerSession && limits.maxTokensPerSession > 0) {\n\t\t\tif (usage?.tokenCount !== undefined) {\n\t\t\t\tif (usage.tokenCount > limits.maxTokensPerSession) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `Session token limit exceeded (${usage.tokenCount}/${limits.maxTokensPerSession} tokens). Please start a new session.`,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Usage undefined but limit is set - should we block?\n\t\t\t\t// To be safe (fail-closed) for strict limits, we probably should if we can't verify compliance.\n\t\t\t\t// However, if usage is undefined because metrics are disabled/failing, this might be too aggressive.\n\t\t\t\t// Given user feedback \"Fail-Open Error Handling\", we should warn or block.\n\t\t\t\t// Let's block if we can't verify usage against a set limit.\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session token limit is active (${limits.maxTokensPerSession}) but token usage data is unavailable. Access blocked for safety.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Check concurrent sessions limit\n\t\tif (limits.maxConcurrentSessions && limits.maxConcurrentSessions > 0) {\n\t\t\tif (usage?.activeSessionCount !== undefined) {\n\t\t\t\tif (usage.activeSessionCount > limits.maxConcurrentSessions) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `Concurrent session limit exceeded (${usage.activeSessionCount}/${limits.maxConcurrentSessions}). Please close existing sessions before starting a new one.`,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Same fail-closed logic for concurrent sessions\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Concurrent session limit is active (${limits.maxConcurrentSessions}) but session count data is unavailable. Access blocked for safety.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\treturn { allowed: true };\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Policy error checking session limits: ${error}`,\n\t\t};\n\t}\n}\n\n/**\n * Get the current policy limits\n */\nexport function getPolicyLimits(): EnterprisePolicy[\"limits\"] | null {\n\t// Catch errors and return null (no limits) to prevent crashing callers.\n\t// Strict enforcement should rely on checkSessionLimits() which handles its own loading.\n\ttry {\n\t\tconst policy = loadPolicy();\n\t\treturn policy?.limits ?? null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Get the full loaded policy (for admin UI display)\n */\nexport function getCurrentPolicy(): EnterprisePolicy | null {\n\ttry {\n\t\treturn loadPolicy();\n\t} catch {\n\t\treturn null;\n\t}\n}\n"]}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/safety/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAEH,OAAO,EAEN,UAAU,EACV,SAAS,EACT,YAAY,EACZ,KAAK,GACL,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,IAAI,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EACN,eAAe,EACf,sBAAsB,GACtB,MAAM,uCAAuC,CAAC;AAE/C,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AA+E7C,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACnC,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAC1B,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KAClD,CAAC,CACF;IACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7C,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;KAC9C,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjD,yBAAyB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACvD,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;KACnD,CAAC,CACF;CACD,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;AAY1D,MAAM,iBAAiB,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AAChF,MAAM,uBAAuB,GAAG,GAAW,EAAE,CAC5C,IAAI,CAAC,UAAU,EAAE,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;AAEhD,SAAS,2BAA2B;IACnC,OAAO,WAAW,CAAC;QAClB,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAC1D,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC/C,iBAAiB,EAAE;QACnB,uBAAuB,EAAE;KACzB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B;IAClC,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;IACjD,OAAO,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;AAC9C,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,IAAY,EAAW,EAAE;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC;QACJ,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,GAAkB,EAAE;IAClD,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,OAAO,IAAI,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAC9D,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IAClB,CAAC;AACF,CAAC,CAAC;AAEF,IAAI,YAAY,GAA4B,IAAI,CAAC;AACjD,IAAI,eAAe,GAAkB,IAAI,CAAC;AAC1C,IAAI,kBAAkB,GAAuB,EAAE,CAAC;AAChD,IAAI,cAAc,GAAgB,EAAE,CAAC;AAErC,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,gBAAgB;IACxB,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,MAAM,cAAc,GAAG,0BAA0B,EAAE,CAAC;IACpD,IAAI,cAAc,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,mBAAmB,GAAG,sBAAsB,EAAE,CAAC;IACrD,IAAI,mBAAmB,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,WAAW;SAClB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAuB;IACjD,OAAO,OAAO;SACZ,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;SAClE,IAAI,CAAC,GAAG,CAAC,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB;IAC3B,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IACD,cAAc,GAAG,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAuB;IACnD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO;IAEtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,gCAAgC;YAChC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAS;YAEzC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;gBAChD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC5B,0BAA0B;oBAC1B,YAAY,GAAG,IAAI,CAAC;oBACpB,eAAe,GAAG,IAAI,CAAC;oBACvB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;wBAChC,mBAAmB,EAAE,CAAC;oBACvB,CAAC;gBACF,CAAC;qBAAM,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;oBACnC,gEAAgE;oBAChE,gFAAgF;oBAChF,YAAY,GAAG,IAAI,CAAC;oBACpB,eAAe,GAAG,IAAI,CAAC;gBACxB,CAAC;YACF,CAAC,CAAC,CAAC;YACH,qDAAqD;YACrD,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,oDAAoD;YACpD,4CAA4C;QAC7C,CAAC;IACF,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CACvB,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IACC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EACjD,CAAC;QACF,MAAM,IAAI,KAAK,CACd,yBAAyB,GAAG,+BAA+B,CAC3D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,oBAAoB,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,oBAAoB,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAC3B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,qBAAqB,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,mBAAmB,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAe;IACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC;IACf,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,YAAY,CAAC;AACrB,CAAC;AAED,SAAS,uBAAuB,CAC/B,MAAqB,EACrB,SAAiB,EACjB,QAAgB,EAChB,OAAe;IAEf,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE9C,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAe;IAC1C,MAAM,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,MAAM,GAAqB,EAAE,CAAC;IAEpC,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,MAAM,YAAY,GAAG,uBAAuB,CAC3C,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CACf,CAAC;IACF,MAAM,YAAY,GAAG,uBAAuB,CAC3C,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CACf,CAAC;IACF,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,CAAC,KAAK,GAAG;YACd,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,uBAAuB,CAC5C,MAAM,EACN,QAAQ,EACR,SAAS,EACT,gBAAgB,CAChB,CAAC;IACF,MAAM,aAAa,GAAG,uBAAuB,CAC5C,MAAM,EACN,QAAQ,EACR,SAAS,EACT,gBAAgB,CAChB,CAAC;IACF,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,CAAC,MAAM,GAAG;YACf,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,uBAAuB,CAC7C,MAAM,EACN,OAAO,EACP,SAAS,EACT,iBAAiB,CACjB,CAAC;IACF,MAAM,YAAY,GAAG,uBAAuB,CAC3C,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CACf,CAAC;IACF,IAAI,cAAc,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,CAAC,KAAK,GAAG;YACd,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,uBAAuB,CAClD,MAAM,EACN,cAAc,EACd,SAAS,EACT,sBAAsB,CACtB,CAAC;IACF,MAAM,mBAAmB,GAAG,uBAAuB,CAClD,MAAM,EACN,cAAc,EACd,SAAS,EACT,sBAAsB,CACtB,CAAC;IACF,IAAI,mBAAmB,KAAK,SAAS,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC5E,MAAM,CAAC,YAAY,GAAG;YACrB,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE;gBAClC,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE;gBAClC,CAAC,CAAC,EAAE,CAAC;SACN,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,uBAAuB,CAC7C,MAAM,EACN,QAAQ,EACR,UAAU,EACV,iBAAiB,CACjB,CAAC;IACF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACvE,MAAM,eAAe,GAAG,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAC1E,IACC,YAAY,KAAK,SAAS;YAC1B,YAAY,KAAK,SAAS;YAC1B,cAAc,KAAK,SAAS;YAC5B,eAAe,KAAK,SAAS,EAC5B,CAAC;YACF,MAAM,CAAC,OAAO,GAAG;gBAChB,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7D,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,mBAAmB,GAAG,kBAAkB,CAC7C,MAAM,EACN,wBAAwB,CACxB,CAAC;IACF,MAAM,yBAAyB,GAAG,kBAAkB,CACnD,MAAM,EACN,8BAA8B,CAC9B,CAAC;IACF,MAAM,qBAAqB,GAAG,kBAAkB,CAC/C,MAAM,EACN,yBAAyB,CACzB,CAAC;IACF,IACC,mBAAmB,KAAK,SAAS;QACjC,yBAAyB,KAAK,SAAS;QACvC,qBAAqB,KAAK,SAAS,EAClC,CAAC;QACF,MAAM,CAAC,MAAM,GAAG;YACf,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,yBAAyB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,yBAAyB,EAAE;gBAC/B,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CACnB,IAA0B,EAC1B,KAA2B;IAE3B,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,iBAAiB,CACzB,IAAwB,EACxB,KAAyB;IAEzB,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,MAAM,CAClC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,CAAC,CAC5D,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,IAAI,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,yBAAyB,CACjC,UAAkE,EAClE,eAAuE;IAEvE,MAAM,OAAO,GAAG,eAAe,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,CAAC;IAChE,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAC3E,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrE,OAAO;QACN,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAC1B,UAAuC,EACvC,eAA4C;IAE5C,MAAM,YAAY,GACjB,eAAe,EAAE,YAAY,IAAI,UAAU,EAAE,YAAY,CAAC;IAC3D,MAAM,YAAY,GAAG,WAAW,CAC/B,UAAU,EAAE,YAAY,EACxB,eAAe,EAAE,YAAY,CAC7B,CAAC;IACF,MAAM,cAAc,GACnB,UAAU,EAAE,cAAc,KAAK,IAAI;QACnC,eAAe,EAAE,cAAc,KAAK,IAAI,CAAC;IAC1C,MAAM,eAAe,GACpB,UAAU,EAAE,eAAe,KAAK,IAAI;QACpC,eAAe,EAAE,eAAe,KAAK,IAAI,CAAC;IAE3C,IACC,YAAY,KAAK,SAAS;QAC1B,YAAY,KAAK,SAAS;QAC1B,CAAC,cAAc;QACf,CAAC,eAAe,EACf,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,OAAO;QACN,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACzB,UAAsC,EACtC,eAA2C;IAE3C,MAAM,mBAAmB,GAAG,iBAAiB,CAC5C,UAAU,EAAE,mBAAmB,EAC/B,eAAe,EAAE,mBAAmB,CACpC,CAAC;IACF,MAAM,yBAAyB,GAAG,iBAAiB,CAClD,UAAU,EAAE,yBAAyB,EACrC,eAAe,EAAE,yBAAyB,CAC1C,CAAC;IACF,MAAM,qBAAqB,GAAG,iBAAiB,CAC9C,UAAU,EAAE,qBAAqB,EACjC,eAAe,EAAE,qBAAqB,CACtC,CAAC;IAEF,IACC,mBAAmB,KAAK,SAAS;QACjC,yBAAyB,KAAK,SAAS;QACvC,qBAAqB,KAAK,SAAS,EAClC,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,OAAO;QACN,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,yBAAyB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE,yBAAyB,EAAE;YAC/B,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACrB,UAAmC,EACnC,eAAwC;IAExC,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC;IACxC,IAAI,CAAC,eAAe;QAAE,OAAO,UAAU,CAAC;IAExC,MAAM,MAAM,GAAqB;QAChC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK;YAC5C,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;KACN,CAAC;IAEF,MAAM,KAAK,GAAG,yBAAyB,CACtC,UAAU,CAAC,KAAK,EAChB,eAAe,CAAC,KAAK,CACrB,CAAC;IACF,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAEhC,MAAM,YAAY,GAAG,yBAAyB,CAC7C,UAAU,CAAC,YAAY,EACvB,eAAe,CAAC,YAAY,CAC5B,CAAC;IACF,IAAI,YAAY;QAAE,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;IAErD,MAAM,MAAM,GAAG,yBAAyB,CACvC,UAAU,CAAC,MAAM,EACjB,eAAe,CAAC,MAAM,CACtB,CAAC;IACF,IAAI,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAEnC,MAAM,KAAK,GAAG,yBAAyB,CACtC,UAAU,CAAC,KAAK,EAChB,eAAe,CAAC,KAAK,CACrB,CAAC;IACF,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAEhC,MAAM,cAAc,GAAG,WAAW,CACjC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAC3B,eAAe,CAAC,MAAM,EAAE,QAAQ,CAChC,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACpB,MAAM,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CACjC,UAAU,CAAC,OAAO,EAClB,eAAe,CAAC,OAAO,CACvB,CAAC;IACF,IAAI,OAAO;QAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAEtC,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IAC5E,IAAI,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAEnC,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAwB,EAAE,UAAkB;IACzE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACd,qBAAqB,UAAU,KAAK,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7F,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAoB;IAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,aAAa,CAAmB,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACd,uBAAuB,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAC7D,CAAC;QACH,CAAC;QACD,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,MAAM,eAAe,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,oBAAoB,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,eAAe,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAK,GAAG,KAAK;IACvC,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,mEAAmE;IACnE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,YAAY,GAAG,IAAI,CAAC;QACpB,eAAe,GAAG,IAAI,CAAC;QACvB,kBAAkB,GAAG,EAAE,CAAC;QACxB,mBAAmB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,YAAY,IAAI,eAAe,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7D,OAAO,YAAY,CAAC;IACrB,CAAC;IAED,IAAI,CAAC;QACJ,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YACnC,mBAAmB,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,UAAU,GAA4B,IAAI,CAAC;QAC/C,IAAI,eAAe,GAA4B,IAAI,CAAC;QAEpD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;gBAC7B,UAAU,GAAG,YAAY,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACP,eAAe,GAAG,YAAY,CAAC;YAChC,CAAC;QACF,CAAC;QAED,YAAY,GAAG,aAAa,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAC1D,kBAAkB,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,MAAM,CACxD,CAAC,MAAM,EAA8B,EAAE,CAAC,MAAM,KAAK,IAAI,CACvD,CAAC;QACF,eAAe,GAAG,SAAS,CAAC;QAC5B,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,YAAY,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,CACX,4CAA4C,EAC5C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CACzD,CAAC;QACF,kFAAkF;QAClF,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CACrB,OAA8B;IAE9B,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QACtD,CAAC,CAAE,OAAO,CAAC,IAAgC;QAC3C,CAAC,CAAC,IAAI,CAAC;AACT,CAAC;AAED,SAAS,YAAY,CACpB,OAA8B,EAC9B,GAAW;IAEX,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,OAA8B;IACpD,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,wBAAwB,CAChC,MAAwB;IAExB,OAAO,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,GAAgB;IACjD,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAwB;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAC1D,OAAO,CACN,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CACzE,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC7B,MAAwB,EACxB,OAA8B;IAE9B,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,gEAAgE;SACxE,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4DAA4D;SACpE,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EACL,8EAA8E;aAC/E,CAAC;QACH,CAAC;IACF,CAAC;IAED,IACC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9B,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EACrC,CAAC;QACF,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EACL,+EAA+E;SAChF,CAAC;IACH,CAAC;IAED,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC;QAC7C,IAAI,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC3E,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EACL,yEAAyE;aAC1E,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA8B;IAI/D,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,MAAM,GAAG,UAAU,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,mBAAmB;SAC/G,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QACf,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,MAAwB,EACxB,OAA8B;IAK9B,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjE,IAAI,iBAAiB,EAAE,CAAC;QACvB,OAAO,iBAAiB,CAAC;IAC1B,CAAC;IAED,gCAAgC;IAChC,IACC,MAAM,CAAC,KAAK;QACZ,OAAO,CAAC,IAAI,EAAE,KAAK;QACnB,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,EAClC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;YAC3C,WAAW,EAAE,MAAM,CAAC,KAAK;YACzB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;SAC7B,CAAC,CAAC;QACH,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,qDAAqD,MAAM,CAAC,KAAK,8BAA8B,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG;SAC5H,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1C,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,CAAC,QAAQ,sCAAsC;aACvE,CAAC;QACH,CAAC;QACD,IAAI,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,CAAC,QAAQ,+CAA+C;aAChF,CAAC;QACH,CAAC;IACF,CAAC;IAED,iDAAiD;IACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACb,+CAA+C;YAC/C,MAAM,mBAAmB,GAAG;gBAC3B,sBAAsB,CAAC,YAAY;gBACnC,sBAAsB,CAAC,UAAU;gBACjC,sBAAsB,CAAC,UAAU;gBACjC,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,OAAO;gBAC9B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;aAC/B,CAAC;YACF,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;gBAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EACL,yIAAyI;qBAC1I,CAAC;gBACH,CAAC;YACF,CAAC;YAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;gBAE1C,iEAAiE;gBACjE,2EAA2E;gBAC3E,qDAAqD;gBACrD,MAAM,uBAAuB,GAC5B,mFAAmF,CAAC,IAAI,CACvF,OAAO,CACP,CAAC;gBACH,IACC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,uBAAuB,CAAC;oBAC5C,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAC1B,CAAC;oBACF,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EACL,+GAA+G;qBAChH,CAAC;gBACH,CAAC;gBAED,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;gBAEjD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACxB,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBACvC,OAAO;4BACN,OAAO,EAAE,KAAK;4BACd,MAAM,EAAE,eAAe,GAAG,6CAA6C;yBACvE,CAAC;oBACH,CAAC;oBACD,IAAI,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC5B,OAAO;4BACN,OAAO,EAAE,KAAK;4BACd,MAAM,EAAE,eAAe,GAAG,+CAA+C;yBACzE,CAAC;oBACH,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IAED,yBAAyB;IACzB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,YAAY,CAAC;QACrB,CAAC;IACF,CAAC;IAED,oBAAoB;IACpB,IAAI,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QACpD,IAAI,yBAAyB,IAAI,yBAAyB,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,eAAe,GACpB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;YAChE,IAAI,eAAe,GAAG,yBAAyB,EAAE,CAAC;gBACjD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,oCAAoC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,yBAAyB,wCAAwC;iBAC5I,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IACrC,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC3B,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAI/C,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,MAAM,GAAG,UAAU,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,kBAAkB;SAC9G,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YACzB,SAAS;QACV,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QACf,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CACjC,OAA4B,EAC5B,KAA4D;IAK5D,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAEtC,uBAAuB;QACvB,IACC,MAAM,CAAC,yBAAyB;YAChC,MAAM,CAAC,yBAAyB,GAAG,CAAC,EACnC,CAAC;YACF,MAAM,eAAe,GACpB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;YACxD,IAAI,eAAe,GAAG,MAAM,CAAC,yBAAyB,EAAE,CAAC;gBACxD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,oCAAoC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,yBAAyB,wCAAwC;iBACnJ,CAAC;YACH,CAAC;QACF,CAAC;QAED,oBAAoB;QACpB,IAAI,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;YAClE,IAAI,KAAK,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;gBACrC,IAAI,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,mBAAmB,EAAE,CAAC;oBACnD,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,iCAAiC,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,mBAAmB,uCAAuC;qBAC9H,CAAC;gBACH,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,sDAAsD;gBACtD,gGAAgG;gBAChG,qGAAqG;gBACrG,2EAA2E;gBAC3E,4DAA4D;gBAC5D,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,kCAAkC,MAAM,CAAC,mBAAmB,mEAAmE;iBACvI,CAAC;YACH,CAAC;QACF,CAAC;QAED,kCAAkC;QAClC,IAAI,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;YACtE,IAAI,KAAK,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBAC7C,IAAI,KAAK,CAAC,kBAAkB,GAAG,MAAM,CAAC,qBAAqB,EAAE,CAAC;oBAC7D,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,sCAAsC,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,qBAAqB,8DAA8D;qBACpK,CAAC;gBACH,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,iDAAiD;gBACjD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,uCAAuC,MAAM,CAAC,qBAAqB,qEAAqE;iBAChJ,CAAC;YACH,CAAC;QACF,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,yCAAyC,KAAK,EAAE;SACxD,CAAC;IACH,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC9B,wEAAwE;IACxE,wFAAwF;IACxF,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,OAAO,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC/B,IAAI,CAAC;QACJ,OAAO,UAAU,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC","sourcesContent":["/**\n * Enterprise Policy System - Access Control and Safety Enforcement\n *\n * This module implements enterprise-grade policy enforcement for the Composer CLI,\n * enabling organizations to control what tools, models, paths, and network hosts\n * can be accessed during agent execution.\n *\n * ## Policy File Location\n *\n * Policies are loaded from `~/.maestro/policy.json` (or the legacy Composer\n * policy file as a fallback) and `.maestro/workspace.toml` in the current\n * workspace. The global JSON file is typically deployed by enterprise IT and\n * should be protected with appropriate permissions. Workspace TOML applies a\n * stricter project-specific layer.\n *\n * ## Policy Structure\n *\n * ```json\n * {\n *   \"orgId\": \"org-12345\",\n *   \"tools\": {\n *     \"allowed\": [\"Read\", \"Grep\", \"Glob\"],\n *     \"blocked\": [\"Bash\", \"Write\"]\n *   },\n *   \"models\": {\n *     \"allowed\": [\"anthropic/claude-*\"],\n *     \"blocked\": [\"openai/*\"]\n *   },\n *   \"paths\": {\n *     \"allowed\": [\"/home/user/projects/**\"],\n *     \"blocked\": [\"/etc/**\", \"/root/**\"]\n *   },\n *   \"network\": {\n *     \"allowedHosts\": [\"api.github.com\"],\n *     \"blockedHosts\": [\"*.internal.corp\"],\n *     \"blockLocalhost\": true,\n *     \"blockPrivateIPs\": true\n *   },\n *   \"limits\": {\n *     \"maxTokensPerSession\": 100000,\n *     \"maxSessionDurationMinutes\": 60,\n *     \"maxConcurrentSessions\": 3\n *   }\n * }\n * ```\n *\n * Workspace policies use TOML keys such as `allowed_models`, `blocked_tools`,\n * `file_boundaries`, and `max_tokens_per_session`.\n *\n * ## Rule Evaluation\n *\n * Policies use an allow/block list pattern with the following evaluation order:\n *\n * 1. If `blocked` list exists and matches → **DENY**\n * 2. If `allowed` list exists and doesn't match → **DENY**\n * 3. Otherwise → **ALLOW**\n *\n * This means:\n * - If only `allowed` is specified, everything else is blocked\n * - If only `blocked` is specified, everything else is allowed\n * - If both are specified, blocked takes precedence\n *\n * ## Pattern Matching\n *\n * Patterns support glob syntax via the `minimatch` library:\n *\n * | Pattern             | Matches                              |\n * |---------------------|--------------------------------------|\n * | `*`                 | Any single segment                   |\n * | `**`                | Any number of segments               |\n * | `*.md`              | Any file ending in .md               |\n * | `src/** (all .ts)`  | Any .ts file under src/              |\n *\n * ## Network Safety\n *\n * Network policies can block:\n * - Specific hosts by name or pattern\n * - Localhost (127.0.0.1, ::1)\n * - Private IP ranges (10.x, 172.16-31.x, 192.168.x)\n *\n * DNS resolution is performed to validate hosts before connection.\n *\n * ## Hot Reloading\n *\n * The policy file is watched for changes and automatically reloaded.\n * This enables policy updates without restarting active sessions.\n *\n * ## Error Handling\n *\n * Policy violations throw `PolicyError` which includes:\n * - The violated rule type (tool, model, path, network)\n * - A user-friendly error message\n * - Context about what was blocked\n *\n * @module safety/policy\n */\n\nimport {\n\ttype FSWatcher,\n\texistsSync,\n\tlstatSync,\n\treadFileSync,\n\twatch,\n} from \"node:fs\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { Type } from \"@sinclair/typebox\";\nimport { parse as parseTOML } from \"smol-toml\";\nimport type { ActionApprovalContext } from \"../agent/action-approval.js\";\nimport { PATHS } from \"../config/constants.js\";\nimport { extractDependencies } from \"../utils/dependency-extractor.js\";\nimport { safeJsonParse } from \"../utils/json.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport { getHomeDir, resolveEnvPath } from \"../utils/path-expansion.js\";\nimport { expandHomeDir, resolveRealPath } from \"../utils/path-matcher.js\";\nimport { uniquePaths } from \"../utils/path-utils.js\";\nimport { compileTypeboxSchema } from \"../utils/typebox-ajv.js\";\nimport { dangerousPatterns as shellDangerousPatterns } from \"./bash-safety-analyzer.js\";\nimport { checkModelAccess } from \"./validators/model-policy-validator.js\";\nimport { checkNetworkPolicy } from \"./validators/network-policy-validator.js\";\nimport {\n\tcheckPathPolicy,\n\textractPolicyFilePaths,\n} from \"./validators/path-policy-validator.js\";\n\nconst logger = createLogger(\"safety:policy\");\n\n/**\n * Enterprise policy configuration interface.\n *\n * Defines all available policy controls that organizations can configure\n * to restrict agent behavior according to their security requirements.\n */\nexport interface EnterprisePolicy {\n\t/** Organization identifier for audit logging and policy association */\n\torgId?: string;\n\n\t/** Tool execution restrictions (e.g., block Bash, allow only Read) */\n\ttools?: {\n\t\t/** Whitelist of allowed tool names (glob patterns supported) */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked tool names (takes precedence over allowed) */\n\t\tblocked?: string[];\n\t};\n\n\t/** Package/dependency installation restrictions */\n\tdependencies?: {\n\t\t/** Whitelist of allowed package patterns */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked package patterns */\n\t\tblocked?: string[];\n\t};\n\n\t/** Model access restrictions (format: \"provider/model-id\") */\n\tmodels?: {\n\t\t/** Whitelist of allowed model patterns (e.g., \"anthropic/*\") */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked model patterns */\n\t\tblocked?: string[];\n\t};\n\n\t/** Required skill names for workspace-controlled workflows */\n\tskills?: {\n\t\t/** Skills that must be available for this workspace */\n\t\trequired?: string[];\n\t};\n\n\t/** File system path restrictions */\n\tpaths?: {\n\t\t/** Whitelist of allowed path patterns (e.g., \"/home/user/projects/**\") */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked path patterns (e.g., \"/etc/**\") */\n\t\tblocked?: string[];\n\t};\n\n\t/** Network access restrictions */\n\tnetwork?: {\n\t\t/** Whitelist of allowed hostnames (e.g., \"api.github.com\") */\n\t\tallowedHosts?: string[];\n\t\t/** Blacklist of blocked hostnames (e.g., \"*.internal.corp\") */\n\t\tblockedHosts?: string[];\n\t\t/** Block access to localhost (127.0.0.1, ::1) */\n\t\tblockLocalhost?: boolean;\n\t\t/** Block access to private IP ranges (10.x, 172.16-31.x, 192.168.x) */\n\t\tblockPrivateIPs?: boolean;\n\t};\n\n\t/**\n\t * Session limits for resource control.\n\t *\n\t * NOTE: These are schema definitions for policy configuration.\n\t * Actual enforcement requires integration with the billing/token-tracker system.\n\t * Currently exposed via getPolicyLimits() for consumers that want to implement limits.\n\t */\n\tlimits?: {\n\t\t/** Maximum tokens per session before termination */\n\t\tmaxTokensPerSession?: number;\n\t\t/** Maximum session duration in minutes */\n\t\tmaxSessionDurationMinutes?: number;\n\t\t/** Maximum concurrent active sessions */\n\t\tmaxConcurrentSessions?: number;\n\t};\n}\n\nconst PolicySchema = Type.Object({\n\torgId: Type.Optional(Type.String()),\n\ttools: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tdependencies: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tmodels: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tskills: Type.Optional(\n\t\tType.Object({\n\t\t\trequired: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tpaths: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tnetwork: Type.Optional(\n\t\tType.Object({\n\t\t\tallowedHosts: Type.Optional(Type.Array(Type.String())),\n\t\t\tblockedHosts: Type.Optional(Type.Array(Type.String())),\n\t\t\tblockLocalhost: Type.Optional(Type.Boolean()),\n\t\t\tblockPrivateIPs: Type.Optional(Type.Boolean()),\n\t\t}),\n\t),\n\tlimits: Type.Optional(\n\t\tType.Object({\n\t\t\tmaxTokensPerSession: Type.Optional(Type.Number()),\n\t\t\tmaxSessionDurationMinutes: Type.Optional(Type.Number()),\n\t\t\tmaxConcurrentSessions: Type.Optional(Type.Number()),\n\t\t}),\n\t),\n});\n\nconst validatePolicy = compileTypeboxSchema(PolicySchema);\n\ntype PolicyFormat = \"json\" | \"toml\";\ntype PolicyScope = \"user\" | \"workspace\";\ntype UnknownRecord = Record<string, unknown>;\n\ninterface PolicySource {\n\tpath: string;\n\tformat: PolicyFormat;\n\tscope: PolicyScope;\n}\n\nconst getUserPolicyPath = (): string => join(PATHS.MAESTRO_HOME, \"policy.json\");\nconst getLegacyUserPolicyPath = (): string =>\n\tjoin(getHomeDir(), \".composer\", \"policy.json\");\n\nfunction getUserPolicyPathCandidates(): string[] {\n\treturn uniquePaths([\n\t\tresolveEnvPath(process.env.MAESTRO_ENTERPRISE_POLICY_PATH),\n\t\tresolveEnvPath(process.env.MAESTRO_POLICY_PATH),\n\t\tgetUserPolicyPath(),\n\t\tgetLegacyUserPolicyPath(),\n\t]);\n}\n\nfunction getEffectiveUserPolicyPath(): string | null {\n\tconst candidates = getUserPolicyPathCandidates();\n\treturn candidates.find(isPolicyFile) ?? null;\n}\n\nconst isPolicyFile = (path: string): boolean => {\n\tif (!existsSync(path)) return false;\n\ttry {\n\t\treturn lstatSync(path).isFile();\n\t} catch {\n\t\treturn false;\n\t}\n};\n\nconst getWorkspacePolicyPath = (): string | null => {\n\tlet current = resolve(process.cwd());\n\twhile (true) {\n\t\tconst candidate = join(current, \".maestro\", \"workspace.toml\");\n\t\tif (isPolicyFile(candidate)) {\n\t\t\treturn candidate;\n\t\t}\n\t\tconst parent = dirname(current);\n\t\tif (parent === current) {\n\t\t\treturn null;\n\t\t}\n\t\tcurrent = parent;\n\t}\n};\n\nlet cachedPolicy: EnterprisePolicy | null = null;\nlet cachedPolicyKey: string | null = null;\nlet cachedPolicyLayers: EnterprisePolicy[] = [];\nlet policyWatchers: FSWatcher[] = [];\n\nfunction isRecord(value: unknown): value is UnknownRecord {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction getPolicySources(): PolicySource[] {\n\tconst sources: PolicySource[] = [];\n\tconst userPolicyPath = getEffectiveUserPolicyPath();\n\tif (userPolicyPath) {\n\t\tsources.push({ path: userPolicyPath, format: \"json\", scope: \"user\" });\n\t}\n\n\tconst workspacePolicyPath = getWorkspacePolicyPath();\n\tif (workspacePolicyPath) {\n\t\tsources.push({\n\t\t\tpath: workspacePolicyPath,\n\t\t\tformat: \"toml\",\n\t\t\tscope: \"workspace\",\n\t\t});\n\t}\n\treturn sources;\n}\n\nfunction getPolicyCacheKey(sources: PolicySource[]): string {\n\treturn sources\n\t\t.map((source) => `${source.scope}:${source.format}:${source.path}`)\n\t\t.join(\"|\");\n}\n\nfunction closePolicyWatchers() {\n\tfor (const watcher of policyWatchers) {\n\t\twatcher.close();\n\t}\n\tpolicyWatchers = [];\n}\n\nfunction startPolicyWatchers(sources: PolicySource[]) {\n\tif (policyWatchers.length > 0) return;\n\n\tfor (const source of sources) {\n\t\ttry {\n\t\t\t// Only watch if the file exists\n\t\t\tif (!isPolicyFile(source.path)) continue;\n\n\t\t\tconst watcher = watch(source.path, (eventType) => {\n\t\t\t\tif (eventType === \"rename\") {\n\t\t\t\t\t// File deleted or renamed\n\t\t\t\t\tcachedPolicy = null;\n\t\t\t\t\tcachedPolicyKey = null;\n\t\t\t\t\tif (!isPolicyFile(source.path)) {\n\t\t\t\t\t\tclosePolicyWatchers();\n\t\t\t\t\t}\n\t\t\t\t} else if (eventType === \"change\") {\n\t\t\t\t\t// File modified - invalidate cache so next loadPolicy() reloads\n\t\t\t\t\t// We don't proactively reload here to avoid race conditions with partial writes\n\t\t\t\t\tcachedPolicy = null;\n\t\t\t\t\tcachedPolicyKey = null;\n\t\t\t\t}\n\t\t\t});\n\t\t\t// Prevent the watcher from keeping the process alive\n\t\t\twatcher.unref();\n\t\t\tpolicyWatchers.push(watcher);\n\t\t} catch (error) {\n\t\t\t// Ignore watcher errors (e.g. system limit reached)\n\t\t\t// We fall back to standard caching behavior\n\t\t}\n\t}\n}\n\nfunction readStringArray(\n\tsource: UnknownRecord,\n\tkey: string,\n): string[] | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (\n\t\t!Array.isArray(value) ||\n\t\t!value.every((entry) => typeof entry === \"string\")\n\t) {\n\t\tthrow new Error(\n\t\t\t`Workspace policy key \"${key}\" must be an array of strings`,\n\t\t);\n\t}\n\treturn value;\n}\n\nfunction readOptionalString(\n\tsource: UnknownRecord,\n\tkey: string,\n): string | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (typeof value !== \"string\") {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a string`);\n\t}\n\treturn value;\n}\n\nfunction readOptionalNumber(\n\tsource: UnknownRecord,\n\tkey: string,\n): number | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (typeof value !== \"number\") {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a number`);\n\t}\n\treturn value;\n}\n\nfunction readOptionalBoolean(\n\tsource: UnknownRecord,\n\tkey: string,\n): boolean | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (typeof value !== \"boolean\") {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a boolean`);\n\t}\n\treturn value;\n}\n\nfunction readOptionalRecord(\n\tsource: UnknownRecord,\n\tkey: string,\n): UnknownRecord | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (!isRecord(value)) {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a table`);\n\t}\n\treturn value;\n}\n\nfunction selectWorkspacePolicyRoot(parsed: unknown): UnknownRecord {\n\tif (!isRecord(parsed)) {\n\t\tthrow new Error(\"Workspace policy must be a TOML table\");\n\t}\n\n\tconst nestedPolicy = parsed.policy;\n\tif (nestedPolicy === undefined) {\n\t\treturn parsed;\n\t}\n\tif (!isRecord(nestedPolicy)) {\n\t\tthrow new Error('Workspace policy key \"policy\" must be a table');\n\t}\n\treturn nestedPolicy;\n}\n\nfunction getWorkspaceStringArray(\n\tsource: UnknownRecord,\n\ttableName: string,\n\ttableKey: string,\n\tflatKey: string,\n): string[] | undefined {\n\tconst flatValue = readStringArray(source, flatKey);\n\tif (flatValue !== undefined) return flatValue;\n\n\tconst table = readOptionalRecord(source, tableName);\n\treturn table ? readStringArray(table, tableKey) : undefined;\n}\n\nfunction mapWorkspacePolicy(parsed: unknown): EnterprisePolicy {\n\tconst source = selectWorkspacePolicyRoot(parsed);\n\tconst policy: EnterprisePolicy = {};\n\n\tconst orgId = readOptionalString(source, \"org_id\");\n\tif (orgId !== undefined) {\n\t\tpolicy.orgId = orgId;\n\t}\n\n\tconst allowedTools = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"tools\",\n\t\t\"allowed\",\n\t\t\"allowed_tools\",\n\t);\n\tconst blockedTools = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"tools\",\n\t\t\"blocked\",\n\t\t\"blocked_tools\",\n\t);\n\tif (allowedTools !== undefined || blockedTools !== undefined) {\n\t\tpolicy.tools = {\n\t\t\t...(allowedTools !== undefined ? { allowed: allowedTools } : {}),\n\t\t\t...(blockedTools !== undefined ? { blocked: blockedTools } : {}),\n\t\t};\n\t}\n\n\tconst allowedModels = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"models\",\n\t\t\"allowed\",\n\t\t\"allowed_models\",\n\t);\n\tconst blockedModels = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"models\",\n\t\t\"blocked\",\n\t\t\"blocked_models\",\n\t);\n\tif (allowedModels !== undefined || blockedModels !== undefined) {\n\t\tpolicy.models = {\n\t\t\t...(allowedModels !== undefined ? { allowed: allowedModels } : {}),\n\t\t\t...(blockedModels !== undefined ? { blocked: blockedModels } : {}),\n\t\t};\n\t}\n\n\tconst fileBoundaries = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"paths\",\n\t\t\"allowed\",\n\t\t\"file_boundaries\",\n\t);\n\tconst blockedPaths = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"paths\",\n\t\t\"blocked\",\n\t\t\"blocked_paths\",\n\t);\n\tif (fileBoundaries !== undefined || blockedPaths !== undefined) {\n\t\tpolicy.paths = {\n\t\t\t...(fileBoundaries !== undefined ? { allowed: fileBoundaries } : {}),\n\t\t\t...(blockedPaths !== undefined ? { blocked: blockedPaths } : {}),\n\t\t};\n\t}\n\n\tconst allowedDependencies = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"dependencies\",\n\t\t\"allowed\",\n\t\t\"allowed_dependencies\",\n\t);\n\tconst blockedDependencies = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"dependencies\",\n\t\t\"blocked\",\n\t\t\"blocked_dependencies\",\n\t);\n\tif (allowedDependencies !== undefined || blockedDependencies !== undefined) {\n\t\tpolicy.dependencies = {\n\t\t\t...(allowedDependencies !== undefined\n\t\t\t\t? { allowed: allowedDependencies }\n\t\t\t\t: {}),\n\t\t\t...(blockedDependencies !== undefined\n\t\t\t\t? { blocked: blockedDependencies }\n\t\t\t\t: {}),\n\t\t};\n\t}\n\n\tconst requiredSkills = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"skills\",\n\t\t\"required\",\n\t\t\"required_skills\",\n\t);\n\tif (requiredSkills !== undefined) {\n\t\tpolicy.skills = { required: requiredSkills };\n\t}\n\n\tconst network = readOptionalRecord(source, \"network\");\n\tif (network) {\n\t\tconst allowedHosts = readStringArray(network, \"allowed_hosts\");\n\t\tconst blockedHosts = readStringArray(network, \"blocked_hosts\");\n\t\tconst blockLocalhost = readOptionalBoolean(network, \"block_localhost\");\n\t\tconst blockPrivateIPs = readOptionalBoolean(network, \"block_private_ips\");\n\t\tif (\n\t\t\tallowedHosts !== undefined ||\n\t\t\tblockedHosts !== undefined ||\n\t\t\tblockLocalhost !== undefined ||\n\t\t\tblockPrivateIPs !== undefined\n\t\t) {\n\t\t\tpolicy.network = {\n\t\t\t\t...(allowedHosts !== undefined ? { allowedHosts } : {}),\n\t\t\t\t...(blockedHosts !== undefined ? { blockedHosts } : {}),\n\t\t\t\t...(blockLocalhost !== undefined ? { blockLocalhost } : {}),\n\t\t\t\t...(blockPrivateIPs !== undefined ? { blockPrivateIPs } : {}),\n\t\t\t};\n\t\t}\n\t}\n\n\tconst maxTokensPerSession = readOptionalNumber(\n\t\tsource,\n\t\t\"max_tokens_per_session\",\n\t);\n\tconst maxSessionDurationMinutes = readOptionalNumber(\n\t\tsource,\n\t\t\"max_session_duration_minutes\",\n\t);\n\tconst maxConcurrentSessions = readOptionalNumber(\n\t\tsource,\n\t\t\"max_concurrent_sessions\",\n\t);\n\tif (\n\t\tmaxTokensPerSession !== undefined ||\n\t\tmaxSessionDurationMinutes !== undefined ||\n\t\tmaxConcurrentSessions !== undefined\n\t) {\n\t\tpolicy.limits = {\n\t\t\t...(maxTokensPerSession !== undefined ? { maxTokensPerSession } : {}),\n\t\t\t...(maxSessionDurationMinutes !== undefined\n\t\t\t\t? { maxSessionDurationMinutes }\n\t\t\t\t: {}),\n\t\t\t...(maxConcurrentSessions !== undefined ? { maxConcurrentSessions } : {}),\n\t\t};\n\t}\n\n\treturn policy;\n}\n\nfunction uniqueUnion(\n\tleft: string[] | undefined,\n\tright: string[] | undefined,\n): string[] | undefined {\n\tconst values = [...(left ?? []), ...(right ?? [])];\n\treturn values.length > 0 ? [...new Set(values)] : undefined;\n}\n\nfunction minPositiveNumber(\n\tleft: number | undefined,\n\tright: number | undefined,\n): number | undefined {\n\tconst values = [left, right].filter(\n\t\t(value): value is number => value !== undefined && value > 0,\n\t);\n\tif (values.length === 0) {\n\t\treturn left ?? right;\n\t}\n\treturn Math.min(...values);\n}\n\nfunction mergeAllowedBlockedPolicy(\n\tuserPolicy: { allowed?: string[]; blocked?: string[] } | undefined,\n\tworkspacePolicy: { allowed?: string[]; blocked?: string[] } | undefined,\n): { allowed?: string[]; blocked?: string[] } | undefined {\n\tconst allowed = workspacePolicy?.allowed ?? userPolicy?.allowed;\n\tconst blocked = uniqueUnion(userPolicy?.blocked, workspacePolicy?.blocked);\n\tif (allowed === undefined && blocked === undefined) return undefined;\n\treturn {\n\t\t...(allowed !== undefined ? { allowed } : {}),\n\t\t...(blocked !== undefined ? { blocked } : {}),\n\t};\n}\n\nfunction mergeNetworkPolicy(\n\tuserPolicy: EnterprisePolicy[\"network\"],\n\tworkspacePolicy: EnterprisePolicy[\"network\"],\n): EnterprisePolicy[\"network\"] {\n\tconst allowedHosts =\n\t\tworkspacePolicy?.allowedHosts ?? userPolicy?.allowedHosts;\n\tconst blockedHosts = uniqueUnion(\n\t\tuserPolicy?.blockedHosts,\n\t\tworkspacePolicy?.blockedHosts,\n\t);\n\tconst blockLocalhost =\n\t\tuserPolicy?.blockLocalhost === true ||\n\t\tworkspacePolicy?.blockLocalhost === true;\n\tconst blockPrivateIPs =\n\t\tuserPolicy?.blockPrivateIPs === true ||\n\t\tworkspacePolicy?.blockPrivateIPs === true;\n\n\tif (\n\t\tallowedHosts === undefined &&\n\t\tblockedHosts === undefined &&\n\t\t!blockLocalhost &&\n\t\t!blockPrivateIPs\n\t) {\n\t\treturn undefined;\n\t}\n\n\treturn {\n\t\t...(allowedHosts !== undefined ? { allowedHosts } : {}),\n\t\t...(blockedHosts !== undefined ? { blockedHosts } : {}),\n\t\t...(blockLocalhost ? { blockLocalhost } : {}),\n\t\t...(blockPrivateIPs ? { blockPrivateIPs } : {}),\n\t};\n}\n\nfunction mergePolicyLimits(\n\tuserPolicy: EnterprisePolicy[\"limits\"],\n\tworkspacePolicy: EnterprisePolicy[\"limits\"],\n): EnterprisePolicy[\"limits\"] {\n\tconst maxTokensPerSession = minPositiveNumber(\n\t\tuserPolicy?.maxTokensPerSession,\n\t\tworkspacePolicy?.maxTokensPerSession,\n\t);\n\tconst maxSessionDurationMinutes = minPositiveNumber(\n\t\tuserPolicy?.maxSessionDurationMinutes,\n\t\tworkspacePolicy?.maxSessionDurationMinutes,\n\t);\n\tconst maxConcurrentSessions = minPositiveNumber(\n\t\tuserPolicy?.maxConcurrentSessions,\n\t\tworkspacePolicy?.maxConcurrentSessions,\n\t);\n\n\tif (\n\t\tmaxTokensPerSession === undefined &&\n\t\tmaxSessionDurationMinutes === undefined &&\n\t\tmaxConcurrentSessions === undefined\n\t) {\n\t\treturn undefined;\n\t}\n\n\treturn {\n\t\t...(maxTokensPerSession !== undefined ? { maxTokensPerSession } : {}),\n\t\t...(maxSessionDurationMinutes !== undefined\n\t\t\t? { maxSessionDurationMinutes }\n\t\t\t: {}),\n\t\t...(maxConcurrentSessions !== undefined ? { maxConcurrentSessions } : {}),\n\t};\n}\n\nfunction mergePolicies(\n\tuserPolicy: EnterprisePolicy | null,\n\tworkspacePolicy: EnterprisePolicy | null,\n): EnterprisePolicy | null {\n\tif (!userPolicy) return workspacePolicy;\n\tif (!workspacePolicy) return userPolicy;\n\n\tconst policy: EnterprisePolicy = {\n\t\t...(userPolicy.orgId || workspacePolicy.orgId\n\t\t\t? { orgId: workspacePolicy.orgId ?? userPolicy.orgId }\n\t\t\t: {}),\n\t};\n\n\tconst tools = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.tools,\n\t\tworkspacePolicy.tools,\n\t);\n\tif (tools) policy.tools = tools;\n\n\tconst dependencies = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.dependencies,\n\t\tworkspacePolicy.dependencies,\n\t);\n\tif (dependencies) policy.dependencies = dependencies;\n\n\tconst models = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.models,\n\t\tworkspacePolicy.models,\n\t);\n\tif (models) policy.models = models;\n\n\tconst paths = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.paths,\n\t\tworkspacePolicy.paths,\n\t);\n\tif (paths) policy.paths = paths;\n\n\tconst requiredSkills = uniqueUnion(\n\t\tuserPolicy.skills?.required,\n\t\tworkspacePolicy.skills?.required,\n\t);\n\tif (requiredSkills) {\n\t\tpolicy.skills = { required: requiredSkills };\n\t}\n\n\tconst network = mergeNetworkPolicy(\n\t\tuserPolicy.network,\n\t\tworkspacePolicy.network,\n\t);\n\tif (network) policy.network = network;\n\n\tconst limits = mergePolicyLimits(userPolicy.limits, workspacePolicy.limits);\n\tif (limits) policy.limits = limits;\n\n\treturn policy;\n}\n\nfunction validateLoadedPolicy(policy: EnterprisePolicy, sourcePath: string) {\n\tif (!validatePolicy(policy)) {\n\t\tthrow new Error(\n\t\t\t`Invalid schema in ${sourcePath}: ${validatePolicy.errors?.map((e) => e.message).join(\", \")}`,\n\t\t);\n\t}\n}\n\nfunction loadPolicySource(source: PolicySource): EnterprisePolicy {\n\tconst raw = readFileSync(source.path, \"utf8\");\n\tif (source.format === \"json\") {\n\t\tconst result = safeJsonParse<EnterprisePolicy>(raw);\n\t\tif (!result.success) {\n\t\t\tthrow new Error(\n\t\t\t\t`JSON parse error in ${source.path}: ${result.error.message}`,\n\t\t\t);\n\t\t}\n\t\tvalidateLoadedPolicy(result.data, source.path);\n\t\treturn result.data;\n\t}\n\n\tconst workspacePolicy = mapWorkspacePolicy(parseTOML(raw));\n\tvalidateLoadedPolicy(workspacePolicy, source.path);\n\treturn workspacePolicy;\n}\n\nexport function loadPolicy(force = false): EnterprisePolicy | null {\n\tconst sources = getPolicySources();\n\t// Check if file exists first - if not, clear cache and return null\n\tif (sources.length === 0) {\n\t\tcachedPolicy = null;\n\t\tcachedPolicyKey = null;\n\t\tcachedPolicyLayers = [];\n\t\tclosePolicyWatchers();\n\t\treturn null;\n\t}\n\n\tconst policyKey = getPolicyCacheKey(sources);\n\tif (cachedPolicy && cachedPolicyKey === policyKey && !force) {\n\t\treturn cachedPolicy;\n\t}\n\n\ttry {\n\t\tif (cachedPolicyKey !== policyKey) {\n\t\t\tclosePolicyWatchers();\n\t\t}\n\n\t\tlet userPolicy: EnterprisePolicy | null = null;\n\t\tlet workspacePolicy: EnterprisePolicy | null = null;\n\n\t\tfor (const source of sources) {\n\t\t\tconst loadedPolicy = loadPolicySource(source);\n\t\t\tif (source.scope === \"user\") {\n\t\t\t\tuserPolicy = loadedPolicy;\n\t\t\t} else {\n\t\t\t\tworkspacePolicy = loadedPolicy;\n\t\t\t}\n\t\t}\n\n\t\tcachedPolicy = mergePolicies(userPolicy, workspacePolicy);\n\t\tcachedPolicyLayers = [userPolicy, workspacePolicy].filter(\n\t\t\t(policy): policy is EnterprisePolicy => policy !== null,\n\t\t);\n\t\tcachedPolicyKey = policyKey;\n\t\tstartPolicyWatchers(sources);\n\t\treturn cachedPolicy;\n\t} catch (error) {\n\t\tlogger.error(\n\t\t\t\"Critical: Failed to load enterprise policy\",\n\t\t\terror instanceof Error ? error : new Error(String(error)),\n\t\t);\n\t\t// Throw to ensure we fail closed (block access) rather than treating as no policy\n\t\tthrow error;\n\t}\n}\n\nfunction getArgsObject(\n\tcontext: ActionApprovalContext,\n): Record<string, unknown> | null {\n\treturn context.args && typeof context.args === \"object\"\n\t\t? (context.args as Record<string, unknown>)\n\t\t: null;\n}\n\nfunction getStringArg(\n\tcontext: ActionApprovalContext,\n\tkey: string,\n): string | null {\n\tconst args = getArgsObject(context);\n\tif (!args) {\n\t\treturn null;\n\t}\n\tconst value = args[key];\n\treturn typeof value === \"string\" ? value : null;\n}\n\nfunction getCommandArg(context: ActionApprovalContext): string | null {\n\treturn getStringArg(context, \"command\");\n}\n\nfunction getEffectivePolicyLayers(\n\tpolicy: EnterprisePolicy,\n): EnterprisePolicy[] {\n\treturn cachedPolicyLayers.length > 0 ? cachedPolicyLayers : [policy];\n}\n\nfunction hasOwnKey(value: object, key: PropertyKey): boolean {\n\treturn Object.prototype.hasOwnProperty.call(value, key);\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n\treturn typeof value === \"string\" && value.trim().length > 0;\n}\n\nfunction hasActiveDurationLimit(policy: EnterprisePolicy): boolean {\n\tconst duration = policy.limits?.maxSessionDurationMinutes;\n\treturn (\n\t\ttypeof duration === \"number\" && Number.isFinite(duration) && duration > 0\n\t);\n}\n\nfunction validatePolicyContext(\n\tpolicy: EnterprisePolicy,\n\tcontext: ActionApprovalContext,\n): { allowed: false; reason: string } | null {\n\tif (!isNonEmptyString(context.toolName)) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: \"Policy evaluation context is missing required field: toolName.\",\n\t\t};\n\t}\n\n\tif (!hasOwnKey(context, \"args\")) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: \"Policy evaluation context is missing required field: args.\",\n\t\t};\n\t}\n\n\tif (context.user) {\n\t\tif (!isNonEmptyString(context.user.orgId)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason:\n\t\t\t\t\t\"Policy evaluation context has invalid user context: missing organization id.\",\n\t\t\t};\n\t\t}\n\t}\n\n\tif (\n\t\tisNonEmptyString(policy.orgId) &&\n\t\t!isNonEmptyString(context.user?.orgId)\n\t) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason:\n\t\t\t\t\"Organization-bound policy requires user organization context. Access blocked.\",\n\t\t};\n\t}\n\n\tif (hasActiveDurationLimit(policy)) {\n\t\tconst startedAt = context.session?.startedAt;\n\t\tif (!(startedAt instanceof Date) || !Number.isFinite(startedAt.getTime())) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason:\n\t\t\t\t\t\"Session duration policy requires session start context. Access blocked.\",\n\t\t\t};\n\t\t}\n\t}\n\n\treturn null;\n}\n\nexport async function checkPolicy(context: ActionApprovalContext): Promise<{\n\tallowed: boolean;\n\treason?: string;\n}> {\n\tlet policy: EnterprisePolicy | null;\n\ttry {\n\t\tpolicy = loadPolicy();\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Enterprise policy error: ${error instanceof Error ? error.message : \"Unknown error\"}. Access blocked.`,\n\t\t};\n\t}\n\n\tif (!policy) {\n\t\treturn { allowed: true };\n\t}\n\n\tfor (const policyLayer of getEffectivePolicyLayers(policy)) {\n\t\tconst result = await checkPolicyLayer(policyLayer, context);\n\t\tif (!result.allowed) {\n\t\t\treturn result;\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n\nasync function checkPolicyLayer(\n\tpolicy: EnterprisePolicy,\n\tcontext: ActionApprovalContext,\n): Promise<{\n\tallowed: boolean;\n\treason?: string;\n}> {\n\tconst contextValidation = validatePolicyContext(policy, context);\n\tif (contextValidation) {\n\t\treturn contextValidation;\n\t}\n\n\t// 0. Organization Context Check\n\tif (\n\t\tpolicy.orgId &&\n\t\tcontext.user?.orgId &&\n\t\tpolicy.orgId !== context.user.orgId\n\t) {\n\t\tlogger.warn(\"Org mismatch, action blocked\", {\n\t\t\tpolicyOrgId: policy.orgId,\n\t\t\tuserOrgId: context.user.orgId,\n\t\t});\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Organization mismatch: This machine is managed by ${policy.orgId}, but you are signed in to ${context.user.orgId}.`,\n\t\t};\n\t}\n\n\t// 1. Tool Constraints\n\tif (policy.tools) {\n\t\tconst { allowed, blocked } = policy.tools;\n\t\tif (allowed && !allowed.includes(context.toolName)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason: `Tool \"${context.toolName}\" is not in the approved tools list.`,\n\t\t\t};\n\t\t}\n\t\tif (blocked?.includes(context.toolName)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason: `Tool \"${context.toolName}\" is explicitly blocked by enterprise policy.`,\n\t\t\t};\n\t\t}\n\t}\n\n\t// 2. Dangerous Patterns & Dependency Constraints\n\tif (context.toolName === \"bash\" || context.toolName === \"background_tasks\") {\n\t\tconst command = getCommandArg(context);\n\t\tif (command) {\n\t\t\t// Check for obfuscation and dangerous patterns\n\t\t\tconst obfuscationPatterns = [\n\t\t\t\tshellDangerousPatterns.base64Decode,\n\t\t\t\tshellDangerousPatterns.opensslEnc,\n\t\t\t\tshellDangerousPatterns.pythonEval,\n\t\t\t\tshellDangerousPatterns.perlEval,\n\t\t\t\tshellDangerousPatterns.nodeEval,\n\t\t\t\tshellDangerousPatterns.phpEval,\n\t\t\t\tshellDangerousPatterns.rubyEval,\n\t\t\t\tshellDangerousPatterns.evalCall,\n\t\t\t\tshellDangerousPatterns.execCall,\n\t\t\t];\n\t\t\tfor (const pattern of obfuscationPatterns) {\n\t\t\t\tif (pattern.test(command)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Command contains obfuscated or dangerous patterns (e.g. base64 decoding, inline code execution) which are blocked by enterprise policy.\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (policy.dependencies) {\n\t\t\t\tconst deps = extractDependencies(command);\n\n\t\t\t\t// Check for shell metacharacters in any package install command,\n\t\t\t\t// even when no explicit package names are extracted (e.g., \"npm install\").\n\t\t\t\t// This prevents bypass via \"npm install && rm -rf /\"\n\t\t\t\tconst isPackageInstallCommand =\n\t\t\t\t\t/(?:npm|yarn|pnpm|bun|pip|pip3|gem|cargo|go\\s+get|composer)\\s+(?:install|add|i\\b)/i.test(\n\t\t\t\t\t\tcommand,\n\t\t\t\t\t);\n\t\t\t\tif (\n\t\t\t\t\t(deps.length > 0 || isPackageInstallCommand) &&\n\t\t\t\t\t/[;&|`$()<>]/.test(command)\n\t\t\t\t) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Command contains shell metacharacters which are not allowed by enterprise policy during package installation.\",\n\t\t\t\t\t};\n\t\t\t\t}\n\n\t\t\t\tconst { allowed, blocked } = policy.dependencies;\n\n\t\t\t\tfor (const dep of deps) {\n\t\t\t\t\tif (allowed && !allowed.includes(dep)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\t\treason: `Dependency \"${dep}\" is not in the approved dependencies list.`,\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t\tif (blocked?.includes(dep)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\t\treason: `Dependency \"${dep}\" is explicitly blocked by enterprise policy.`,\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\t// 3. Path Constraints\n\tif (policy.paths) {\n\t\tconst filePaths = extractPolicyFilePaths(context);\n\t\tconst pathCheck = checkPathPolicy(filePaths, policy.paths);\n\t\tif (!pathCheck.allowed) {\n\t\t\treturn pathCheck;\n\t\t}\n\t}\n\n\t// 4. Network Constraints\n\tif (policy.network) {\n\t\tconst networkCheck = await checkNetworkPolicy(context, policy.network);\n\t\tif (!networkCheck.allowed) {\n\t\t\treturn networkCheck;\n\t\t}\n\t}\n\n\t// 5. Session Limits\n\tif (policy.limits && context.session) {\n\t\tconst { maxSessionDurationMinutes } = policy.limits;\n\t\tif (maxSessionDurationMinutes && maxSessionDurationMinutes > 0) {\n\t\t\tconst durationMinutes =\n\t\t\t\t(Date.now() - context.session.startedAt.getTime()) / 1000 / 60;\n\t\t\tif (durationMinutes > maxSessionDurationMinutes) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session duration limit exceeded (${Math.floor(durationMinutes)}/${maxSessionDurationMinutes} minutes). Please start a new session.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n\nexport class PolicyError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"PolicyError\";\n\t}\n}\n\n/**\n * Check if a model is allowed by policy\n * Called separately from tool checks since model selection happens at a different time\n */\nexport function checkModelPolicy(modelId: string): {\n\tallowed: boolean;\n\treason?: string;\n} {\n\tlet policy: EnterprisePolicy | null;\n\ttry {\n\t\tpolicy = loadPolicy();\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Enterprise policy error: ${error instanceof Error ? error.message : \"Unknown error\"}. Model blocked.`,\n\t\t};\n\t}\n\n\tif (!policy) {\n\t\treturn { allowed: true };\n\t}\n\n\tfor (const policyLayer of getEffectivePolicyLayers(policy)) {\n\t\tif (!policyLayer.models) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst result = checkModelAccess(modelId, policyLayer.models);\n\t\tif (!result.allowed) {\n\t\t\treturn result;\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n\n/**\n * Check if the current session has exceeded policy limits\n */\nexport function checkSessionLimits(\n\tsession: { startedAt: Date },\n\tusage?: { tokenCount?: number; activeSessionCount?: number },\n): {\n\tallowed: boolean;\n\treason?: string;\n} {\n\ttry {\n\t\tconst limits = getPolicyLimits();\n\t\tif (!limits) return { allowed: true };\n\n\t\t// Check duration limit\n\t\tif (\n\t\t\tlimits.maxSessionDurationMinutes &&\n\t\t\tlimits.maxSessionDurationMinutes > 0\n\t\t) {\n\t\t\tconst durationMinutes =\n\t\t\t\t(Date.now() - session.startedAt.getTime()) / 1000 / 60;\n\t\t\tif (durationMinutes > limits.maxSessionDurationMinutes) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session duration limit exceeded (${Math.floor(durationMinutes)}/${limits.maxSessionDurationMinutes} minutes). Please start a new session.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Check token limit\n\t\tif (limits.maxTokensPerSession && limits.maxTokensPerSession > 0) {\n\t\t\tif (usage?.tokenCount !== undefined) {\n\t\t\t\tif (usage.tokenCount > limits.maxTokensPerSession) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `Session token limit exceeded (${usage.tokenCount}/${limits.maxTokensPerSession} tokens). Please start a new session.`,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Usage undefined but limit is set - should we block?\n\t\t\t\t// To be safe (fail-closed) for strict limits, we probably should if we can't verify compliance.\n\t\t\t\t// However, if usage is undefined because metrics are disabled/failing, this might be too aggressive.\n\t\t\t\t// Given user feedback \"Fail-Open Error Handling\", we should warn or block.\n\t\t\t\t// Let's block if we can't verify usage against a set limit.\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session token limit is active (${limits.maxTokensPerSession}) but token usage data is unavailable. Access blocked for safety.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Check concurrent sessions limit\n\t\tif (limits.maxConcurrentSessions && limits.maxConcurrentSessions > 0) {\n\t\t\tif (usage?.activeSessionCount !== undefined) {\n\t\t\t\tif (usage.activeSessionCount > limits.maxConcurrentSessions) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `Concurrent session limit exceeded (${usage.activeSessionCount}/${limits.maxConcurrentSessions}). Please close existing sessions before starting a new one.`,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Same fail-closed logic for concurrent sessions\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Concurrent session limit is active (${limits.maxConcurrentSessions}) but session count data is unavailable. Access blocked for safety.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\treturn { allowed: true };\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Policy error checking session limits: ${error}`,\n\t\t};\n\t}\n}\n\n/**\n * Get the current policy limits\n */\nexport function getPolicyLimits(): EnterprisePolicy[\"limits\"] | null {\n\t// Catch errors and return null (no limits) to prevent crashing callers.\n\t// Strict enforcement should rely on checkSessionLimits() which handles its own loading.\n\ttry {\n\t\tconst policy = loadPolicy();\n\t\treturn policy?.limits ?? null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Get the full loaded policy (for admin UI display)\n */\nexport function getCurrentPolicy(): EnterprisePolicy | null {\n\ttry {\n\t\treturn loadPolicy();\n\t} catch {\n\t\treturn null;\n\t}\n}\n"]}

package/dist/sdk-tools.d.ts

@@ -93,9 +93,19 @@ export declare const TodoInputSchema: import("@sinclair/typebox").TObject<{
 }>;
 export type TodoItem = Static<typeof TodoItemSchema>;
 export type TodoInput = Static<typeof TodoInputSchema>;
+export declare const AskUserOptionPreviewSchema: import("@sinclair/typebox").TObject<{
+    kind: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"markdown">, import("@sinclair/typebox").TLiteral<"text">, import("@sinclair/typebox").TLiteral<"diff">]>;
+    title: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    body: import("@sinclair/typebox").TString;
+}>;
 export declare const QuestionOptionSchema: import("@sinclair/typebox").TObject<{
     label: import("@sinclair/typebox").TString;
     description: import("@sinclair/typebox").TString;
+    preview: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+        kind: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"markdown">, import("@sinclair/typebox").TLiteral<"text">, import("@sinclair/typebox").TLiteral<"diff">]>;
+        title: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        body: import("@sinclair/typebox").TString;
+    }>>;
 }>;
 export declare const QuestionSchema: import("@sinclair/typebox").TObject<{
     question: import("@sinclair/typebox").TString;
@@ -103,6 +113,11 @@ export declare const QuestionSchema: import("@sinclair/typebox").TObject<{
     options: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
         label: import("@sinclair/typebox").TString;
         description: import("@sinclair/typebox").TString;
+        preview: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+            kind: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"markdown">, import("@sinclair/typebox").TLiteral<"text">, import("@sinclair/typebox").TLiteral<"diff">]>;
+            title: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+            body: import("@sinclair/typebox").TString;
+        }>>;
     }>>;
     multiSelect: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
 }>;
@@ -113,11 +128,17 @@ export declare const AskUserInputSchema: import("@sinclair/typebox").TObject<{
         options: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
             label: import("@sinclair/typebox").TString;
             description: import("@sinclair/typebox").TString;
+            preview: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+                kind: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"markdown">, import("@sinclair/typebox").TLiteral<"text">, import("@sinclair/typebox").TLiteral<"diff">]>;
+                title: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+                body: import("@sinclair/typebox").TString;
+            }>>;
         }>>;
         multiSelect: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
     }>>;
 }>;
 export type AskUserQuestionOption = Static<typeof QuestionOptionSchema>;
+export type AskUserOptionPreview = Static<typeof AskUserOptionPreviewSchema>;
 export type AskUserQuestion = Static<typeof QuestionSchema>;
 export type AskUserInput = Static<typeof AskUserInputSchema>;
 export declare const WebSearchInputSchema: import("@sinclair/typebox").TObject<{

package/dist/sdk-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdk-tools.d.ts","sourceRoot":"","sources":["../src/sdk-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,OAAO,EAAQ,MAAM,mBAAmB,CAAC;AAMpE,eAAO,MAAM,eAAe;;;;;;EAwC1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC;AAMvD,eAAO,MAAM,mBAAmB;;;EAW9B,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;EA2C1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC;AAMvD,eAAO,MAAM,gBAAgB;;;EAQ3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAMzD,eAAO,MAAM,eAAe;;;;;EAuB1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC;AAMvD,eAAO,MAAM,iBAAiB;;;;;;;;;;EA0D5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAM3D,eAAO,MAAM,eAAe;;;EAU1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC;AAMvD,eAAO,MAAM,uBAAuB;;;;;;;EAiClC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAMvE,eAAO,MAAM,cAAc;;;;EAoBzB,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;EAI1B,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC;AACrD,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC;AAMvD,eAAO,MAAM,oBAAoB;;;EAW/B,CAAC;AAEH,eAAO,MAAM,cAAc;;;;;;;;EAsBzB,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;EAM7B,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC;AACxE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC;AAC5D,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAM7D,eAAO,MAAM,oBAAoB;;;;EAe/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMjE,eAAO,MAAM,mBAAmB;;;EAQ9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAM/D,eAAO,MAAM,gBAAgB;;;;;;EA4B3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAMzD,MAAM,MAAM,gBAAgB,GACzB,SAAS,GACT,SAAS,GACT,UAAU,GACV,SAAS,GACT,WAAW,GACX,SAAS,GACT,iBAAiB,GACjB,SAAS,GACT,YAAY,GACZ,cAAc,GACd,aAAa,GACb,UAAU,CAAC;AAMd,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAa/C,CAAC;AAEF;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAEnE"}
+{"version":3,"file":"sdk-tools.d.ts","sourceRoot":"","sources":["../src/sdk-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,OAAO,EAAQ,MAAM,mBAAmB,CAAC;AAMpE,eAAO,MAAM,eAAe;;;;;;EAwC1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC;AAMvD,eAAO,MAAM,mBAAmB;;;EAW9B,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;EA2C1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC;AAMvD,eAAO,MAAM,gBAAgB;;;EAQ3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAMzD,eAAO,MAAM,eAAe;;;;;EAuB1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC;AAMvD,eAAO,MAAM,iBAAiB;;;;;;;;;;EA0D5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAM3D,eAAO,MAAM,eAAe;;;EAU1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC;AAMvD,eAAO,MAAM,uBAAuB;;;;;;;EAiClC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAMvE,eAAO,MAAM,cAAc;;;;EAoBzB,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;EAI1B,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC;AACrD,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC;AAMvD,eAAO,MAAM,0BAA0B;;;;EAoBrC,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;EAY/B,CAAC;AAEH,eAAO,MAAM,cAAc;;;;;;;;;;;;;EAsBzB,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;EAM7B,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC;AACxE,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC7E,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC;AAC5D,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAM7D,eAAO,MAAM,oBAAoB;;;;EAe/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMjE,eAAO,MAAM,mBAAmB;;;EAQ9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAM/D,eAAO,MAAM,gBAAgB;;;;;;EA4B3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAMzD,MAAM,MAAM,gBAAgB,GACzB,SAAS,GACT,SAAS,GACT,UAAU,GACV,SAAS,GACT,WAAW,GACX,SAAS,GACT,iBAAiB,GACjB,SAAS,GACT,YAAY,GACZ,cAAc,GACd,aAAa,GACb,UAAU,CAAC;AAMd,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAa/C,CAAC;AAEF;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAEnE"}

package/dist/sdk-tools.js

@@ -233,6 +233,21 @@ export const TodoInputSchema = Type.Object({
 // ============================================================================
 // Ask User Tool
 // ============================================================================
+export const AskUserOptionPreviewSchema = Type.Object({
+    kind: Type.Union([Type.Literal("markdown"), Type.Literal("text"), Type.Literal("diff")], {
+        description: "Preview format. Raw HTML is intentionally unsupported; use markdown, text, or diff.",
+    }),
+    title: Type.Optional(Type.String({
+        description: "Optional short preview title.",
+        minLength: 1,
+        maxLength: 80,
+    })),
+    body: Type.String({
+        description: "Preview content shown with the option.",
+        minLength: 1,
+        maxLength: 12_000,
+    }),
+});
 export const QuestionOptionSchema = Type.Object({
     label: Type.String({
         description: "Display text for this option (1-5 words)",
@@ -244,6 +259,7 @@ export const QuestionOptionSchema = Type.Object({
         minLength: 1,
         maxLength: 200,
     }),
+    preview: Type.Optional(AskUserOptionPreviewSchema),
 });
 export const QuestionSchema = Type.Object({
     question: Type.String({

package/dist/sdk-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"sdk-tools.js","sourceRoot":"","sources":["../src/sdk-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAA6B,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEpE,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QACjB,WAAW,EAAE,iDAAiD;QAC9D,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,+CAA+C;QAC5D,OAAO,EAAE,CAAC;KACV,CAAC,CACF;IACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,iCAAiC;QAC9C,OAAO,EAAE,CAAC;KACV,CAAC,CACF;IACD,IAAI,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,KAAK,CACT,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EACpE;QACC,WAAW,EAAE,2CAA2C;QACxD,OAAO,EAAE,QAAQ;KACjB,CACD,CACD;IACD,QAAQ,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,KAAK,CACT;QACC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QACrB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;KACrB,EACD;QACC,WAAW,EAAE,4BAA4B;QACzC,OAAO,EAAE,OAAO;KAChB,CACD,CACD;CACD,CAAC,CAAC;AAIH,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9C,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC;QACpB,WAAW,EAAE,gCAAgC;QAC7C,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,EAAE;KACX,CAAC,CACF;CACD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QACjB,WAAW,EAAE,0BAA0B;QACvC,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EAAE,gCAAgC;QAC7C,SAAS,EAAE,CAAC;KACZ,CAAC,CACF;IACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EAAE,uCAAuC;QACpD,OAAO,EAAE,EAAE;KACX,CAAC,CACF;IACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE;QAC/B,WAAW,EAAE,sCAAsC;QACnD,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,EAAE;KACZ,CAAC,CACF;IACD,UAAU,EAAE,IAAI,CAAC,QAAQ,CACxB,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,yBAAyB;QACtC,OAAO,EAAE,KAAK;KACd,CAAC,CACF;IACD,UAAU,EAAE,IAAI,CAAC,QAAQ,CACxB,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,uCAAuC;QACpD,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;KACV,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,iCAAiC;QAC9C,OAAO,EAAE,KAAK;KACd,CAAC,CACF;CACD,CAAC,CAAC;AAIH,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QACjB,WAAW,EAAE,2BAA2B;QACxC,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC;QACpB,WAAW,EAAE,8BAA8B;KAC3C,CAAC;CACF,CAAC,CAAC;AAIH,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC;QACpB,WAAW,EAAE,wBAAwB;QACrC,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,sCAAsC;QACnD,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,MAAM;KACf,CAAC,CACF;IACD,WAAW,EAAE,IAAI,CAAC,QAAQ,CACzB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EAAE,0DAA0D;KACvE,CAAC,CACF;IACD,eAAe,EAAE,IAAI,CAAC,QAAQ,CAC7B,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,2BAA2B;QACxC,OAAO,EAAE,KAAK;KACd,CAAC,CACF;CACD,CAAC,CAAC;AAIH,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC;QACpB,WAAW,EAAE,0CAA0C;QACvD,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,IAAI,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EAAE,gCAAgC;KAC7C,CAAC,CACF;IACD,IAAI,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EAAE,2DAA2D;KACxE,CAAC,CACF;IACD,UAAU,EAAE,IAAI,CAAC,QAAQ,CACxB,IAAI,CAAC,KAAK,CACT;QACC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;KACrB,EACD;QACC,WAAW,EAAE,aAAa;QAC1B,OAAO,EAAE,oBAAoB;KAC7B,CACD,CACD;IACD,aAAa,EAAE,IAAI,CAAC,QAAQ,CAC3B,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,CAAC;KACV,CAAC,CACF;IACD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAC1B,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,mCAAmC;QAChD,OAAO,EAAE,CAAC;KACV,CAAC,CACF;IACD,eAAe,EAAE,IAAI,CAAC,QAAQ,CAC7B,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,yBAAyB;QACtC,OAAO,EAAE,KAAK;KACd,CAAC,CACF;IACD,SAAS,EAAE,IAAI,CAAC,QAAQ,CACvB,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,iCAAiC;QAC9C,OAAO,EAAE,CAAC;KACV,CAAC,CACF;IACD,SAAS,EAAE,IAAI,CAAC,QAAQ,CACvB,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,uBAAuB;QACpC,OAAO,EAAE,KAAK;KACd,CAAC,CACF;CACD,CAAC,CAAC;AAIH,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC;QACpB,WAAW,EAAE,+CAA+C;QAC5D,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,IAAI,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EAAE,wBAAwB;KACrC,CAAC,CACF;CACD,CAAC,CAAC;AAIH,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC,MAAM,CAAC;IAClD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QACjB,WAAW,EAAE,4CAA4C;QACzD,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EAAE,iBAAiB;KAC9B,CAAC,CACF;IACD,SAAS,EAAE,IAAI,CAAC,QAAQ,CACvB,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,8BAA8B;QAC3C,OAAO,EAAE,CAAC;KACV,CAAC,CACF;IACD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC;QACtB,WAAW,EAAE,iCAAiC;KAC9C,CAAC;IACF,QAAQ,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE;QAC5D,WAAW,EAAE,WAAW;KACxB,CAAC,CACF;IACD,QAAQ,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,KAAK,CACT,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EACzE;QACC,WAAW,EAAE,WAAW;QACxB,OAAO,EAAE,SAAS;KAClB,CACD,CACD;CACD,CAAC,CAAC;AAIH,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;IACzC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC;QACpB,WAAW,EAAE,sBAAsB;QACnC,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,MAAM,EAAE,IAAI,CAAC,KAAK,CACjB;QACC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;KACzB,EACD;QACC,WAAW,EAAE,aAAa;KAC1B,CACD;IACD,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;QACvB,WAAW,EACV,wEAAwE;QACzE,SAAS,EAAE,CAAC;KACZ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE;QACjC,WAAW,EAAE,uBAAuB;KACpC,CAAC;CACF,CAAC,CAAC;AAKH,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;QAClB,WAAW,EAAE,0CAA0C;QACvD,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,EAAE;KACb,CAAC;IACF,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC;QACxB,WAAW,EAAE,uCAAuC;QACpD,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,GAAG;KACd,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC;QACrB,WAAW,EAAE,8BAA8B;QAC3C,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,GAAG;KACd,CAAC;IACF,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,4BAA4B;QACzC,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,EAAE;KACb,CAAC;IACF,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE;QACzC,WAAW,EAAE,iCAAiC;QAC9C,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,CAAC;KACX,CAAC;IACF,WAAW,EAAE,IAAI,CAAC,QAAQ,CACzB,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,kCAAkC;QAC/C,OAAO,EAAE,KAAK;KACd,CAAC,CACF;CACD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC7C,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE;QACrC,WAAW,EAAE,wBAAwB;QACrC,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,CAAC;KACX,CAAC;CACF,CAAC,CAAC;AAMH,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;QAClB,WAAW,EAAE,kBAAkB;QAC/B,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,cAAc,EAAE,IAAI,CAAC,QAAQ,CAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE;QACzB,WAAW,EAAE,yCAAyC;KACtD,CAAC,CACF;IACD,cAAc,EAAE,IAAI,CAAC,QAAQ,CAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE;QACzB,WAAW,EAAE,oCAAoC;KACjD,CAAC,CACF;CACD,CAAC,CAAC;AAIH,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC;QAChB,WAAW,EAAE,+BAA+B;QAC5C,MAAM,EAAE,KAAK;KACb,CAAC;IACF,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,sCAAsC;KACnD,CAAC;CACF,CAAC,CAAC;AAIH,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3C,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC;QACxB,WAAW,EAAE,0CAA0C;QACvD,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,mCAAmC;QAChD,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC;QACzB,WAAW,EACV,0EAA0E;KAC3E,CAAC;IACF,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,KAAK,CACT,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EACrE;QACC,WAAW,EACV,+EAA+E;KAChF,CACD,CACD;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EACV,+IAA+I;KAChJ,CAAC,CACF;CACD,CAAC,CAAC;AAsBH,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,WAAW,GAA4B;IACnD,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,gBAAgB;IACvB,IAAI,EAAE,eAAe;IACrB,MAAM,EAAE,iBAAiB;IACzB,IAAI,EAAE,eAAe;IACrB,aAAa,EAAE,uBAAuB;IACtC,IAAI,EAAE,eAAe;IACrB,QAAQ,EAAE,kBAAkB;IAC5B,SAAS,EAAE,oBAAoB;IAC/B,QAAQ,EAAE,mBAAmB;IAC7B,KAAK,EAAE,gBAAgB;CACvB,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC7C,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC","sourcesContent":["/**\n * SDK Tool Types Export\n *\n * This file exports TypeBox schemas and TypeScript types for all built-in tools,\n * enabling type-safe tool integration for SDK consumers.\n *\n * @example\n * ```typescript\n * import type { ReadInput, EditInput, BashInput } from '@evalops/composer/sdk-tools';\n *\n * const readParams: ReadInput = {\n *   path: '/path/to/file',\n *   offset: 1,\n *   limit: 100\n * };\n * ```\n */\n\nimport { type Static, type TSchema, Type } from \"@sinclair/typebox\";\n\n// ============================================================================\n// Read Tool\n// ============================================================================\n\nexport const ReadInputSchema = Type.Object({\n\tpath: Type.String({\n\t\tdescription: \"Path to the file to read (relative or absolute)\",\n\t\tminLength: 1,\n\t}),\n\toffset: Type.Optional(\n\t\tType.Integer({\n\t\t\tdescription: \"Line number to start reading from (1-indexed)\",\n\t\t\tminimum: 1,\n\t\t}),\n\t),\n\tlimit: Type.Optional(\n\t\tType.Integer({\n\t\t\tdescription: \"Maximum number of lines to read\",\n\t\t\tminimum: 1,\n\t\t}),\n\t),\n\tmode: Type.Optional(\n\t\tType.Union(\n\t\t\t[Type.Literal(\"normal\"), Type.Literal(\"head\"), Type.Literal(\"tail\")],\n\t\t\t{\n\t\t\t\tdescription: 'Reading mode: \"normal\", \"head\", or \"tail\"',\n\t\t\t\tdefault: \"normal\",\n\t\t\t},\n\t\t),\n\t),\n\tencoding: Type.Optional(\n\t\tType.Union(\n\t\t\t[\n\t\t\t\tType.Literal(\"utf-8\"),\n\t\t\t\tType.Literal(\"utf-16le\"),\n\t\t\t\tType.Literal(\"latin1\"),\n\t\t\t\tType.Literal(\"ascii\"),\n\t\t\t],\n\t\t\t{\n\t\t\t\tdescription: \"Text encoding for the file\",\n\t\t\t\tdefault: \"utf-8\",\n\t\t\t},\n\t\t),\n\t),\n});\n\nexport type ReadInput = Static<typeof ReadInputSchema>;\n\n// ============================================================================\n// Edit Tool\n// ============================================================================\n\nexport const EditOperationSchema = Type.Object({\n\toldText: Type.String({\n\t\tdescription: \"Exact text to find and replace\",\n\t\tminLength: 1,\n\t}),\n\tnewText: Type.Optional(\n\t\tType.String({\n\t\t\tdescription: \"Replacement text (omit or empty string to delete)\",\n\t\t\tdefault: \"\",\n\t\t}),\n\t),\n});\n\nexport const EditInputSchema = Type.Object({\n\tpath: Type.String({\n\t\tdescription: \"Path to the file to edit\",\n\t\tminLength: 1,\n\t}),\n\toldText: Type.Optional(\n\t\tType.String({\n\t\t\tdescription: \"Exact text to find and replace\",\n\t\t\tminLength: 1,\n\t\t}),\n\t),\n\tnewText: Type.Optional(\n\t\tType.String({\n\t\t\tdescription: \"New text to replace the old text with\",\n\t\t\tdefault: \"\",\n\t\t}),\n\t),\n\tedits: Type.Optional(\n\t\tType.Array(EditOperationSchema, {\n\t\t\tdescription: \"Multiple edits to apply sequentially\",\n\t\t\tminItems: 1,\n\t\t\tmaxItems: 50,\n\t\t}),\n\t),\n\treplaceAll: Type.Optional(\n\t\tType.Boolean({\n\t\t\tdescription: \"Replace all occurrences\",\n\t\t\tdefault: false,\n\t\t}),\n\t),\n\toccurrence: Type.Optional(\n\t\tType.Integer({\n\t\t\tdescription: \"Which occurrence to replace (1-based)\",\n\t\t\tminimum: 1,\n\t\t\tdefault: 1,\n\t\t}),\n\t),\n\tdryRun: Type.Optional(\n\t\tType.Boolean({\n\t\t\tdescription: \"Preview without writing changes\",\n\t\t\tdefault: false,\n\t\t}),\n\t),\n});\n\nexport type EditInput = Static<typeof EditInputSchema>;\n\n// ============================================================================\n// Write Tool\n// ============================================================================\n\nexport const WriteInputSchema = Type.Object({\n\tpath: Type.String({\n\t\tdescription: \"Path to the file to write\",\n\t\tminLength: 1,\n\t}),\n\tcontent: Type.String({\n\t\tdescription: \"Content to write to the file\",\n\t}),\n});\n\nexport type WriteInput = Static<typeof WriteInputSchema>;\n\n// ============================================================================\n// Bash Tool\n// ============================================================================\n\nexport const BashInputSchema = Type.Object({\n\tcommand: Type.String({\n\t\tdescription: \"The command to execute\",\n\t\tminLength: 1,\n\t}),\n\ttimeout: Type.Optional(\n\t\tType.Integer({\n\t\t\tdescription: \"Timeout in milliseconds (max 600000)\",\n\t\t\tminimum: 1,\n\t\t\tmaximum: 600000,\n\t\t}),\n\t),\n\tdescription: Type.Optional(\n\t\tType.String({\n\t\t\tdescription: \"Clear description of what this command does (5-10 words)\",\n\t\t}),\n\t),\n\trunInBackground: Type.Optional(\n\t\tType.Boolean({\n\t\t\tdescription: \"Run command in background\",\n\t\t\tdefault: false,\n\t\t}),\n\t),\n});\n\nexport type BashInput = Static<typeof BashInputSchema>;\n\n// ============================================================================\n// Search (Grep) Tool\n// ============================================================================\n\nexport const SearchInputSchema = Type.Object({\n\tpattern: Type.String({\n\t\tdescription: \"Regular expression pattern to search for\",\n\t\tminLength: 1,\n\t}),\n\tpath: Type.Optional(\n\t\tType.String({\n\t\t\tdescription: \"File or directory to search in\",\n\t\t}),\n\t),\n\tglob: Type.Optional(\n\t\tType.String({\n\t\t\tdescription: 'Glob pattern to filter files (e.g., \"*.js\", \"*.{ts,tsx}\")',\n\t\t}),\n\t),\n\toutputMode: Type.Optional(\n\t\tType.Union(\n\t\t\t[\n\t\t\t\tType.Literal(\"content\"),\n\t\t\t\tType.Literal(\"files_with_matches\"),\n\t\t\t\tType.Literal(\"count\"),\n\t\t\t],\n\t\t\t{\n\t\t\t\tdescription: \"Output mode\",\n\t\t\t\tdefault: \"files_with_matches\",\n\t\t\t},\n\t\t),\n\t),\n\tcontextBefore: Type.Optional(\n\t\tType.Integer({\n\t\t\tdescription: \"Lines of context before each match\",\n\t\t\tminimum: 0,\n\t\t}),\n\t),\n\tcontextAfter: Type.Optional(\n\t\tType.Integer({\n\t\t\tdescription: \"Lines of context after each match\",\n\t\t\tminimum: 0,\n\t\t}),\n\t),\n\tcaseInsensitive: Type.Optional(\n\t\tType.Boolean({\n\t\t\tdescription: \"Case insensitive search\",\n\t\t\tdefault: false,\n\t\t}),\n\t),\n\theadLimit: Type.Optional(\n\t\tType.Integer({\n\t\t\tdescription: \"Limit output to first N entries\",\n\t\t\tminimum: 1,\n\t\t}),\n\t),\n\tmultiline: Type.Optional(\n\t\tType.Boolean({\n\t\t\tdescription: \"Enable multiline mode\",\n\t\t\tdefault: false,\n\t\t}),\n\t),\n});\n\nexport type SearchInput = Static<typeof SearchInputSchema>;\n\n// ============================================================================\n// List (Glob) Tool\n// ============================================================================\n\nexport const ListInputSchema = Type.Object({\n\tpattern: Type.String({\n\t\tdescription: 'Glob pattern to match files (e.g., \"**/*.ts\")',\n\t\tminLength: 1,\n\t}),\n\tpath: Type.Optional(\n\t\tType.String({\n\t\t\tdescription: \"Directory to search in\",\n\t\t}),\n\t),\n});\n\nexport type ListInput = Static<typeof ListInputSchema>;\n\n// ============================================================================\n// Notebook Edit Tool\n// ============================================================================\n\nexport const NotebookEditInputSchema = Type.Object({\n\tpath: Type.String({\n\t\tdescription: \"Path to the Jupyter notebook file (.ipynb)\",\n\t\tminLength: 1,\n\t}),\n\tcellId: Type.Optional(\n\t\tType.String({\n\t\t\tdescription: \"Cell ID to edit\",\n\t\t}),\n\t),\n\tcellIndex: Type.Optional(\n\t\tType.Integer({\n\t\t\tdescription: \"Cell index (0-based) to edit\",\n\t\t\tminimum: 0,\n\t\t}),\n\t),\n\tnewSource: Type.String({\n\t\tdescription: \"New source content for the cell\",\n\t}),\n\tcellType: Type.Optional(\n\t\tType.Union([Type.Literal(\"code\"), Type.Literal(\"markdown\")], {\n\t\t\tdescription: \"Cell type\",\n\t\t}),\n\t),\n\teditMode: Type.Optional(\n\t\tType.Union(\n\t\t\t[Type.Literal(\"replace\"), Type.Literal(\"insert\"), Type.Literal(\"delete\")],\n\t\t\t{\n\t\t\t\tdescription: \"Edit mode\",\n\t\t\t\tdefault: \"replace\",\n\t\t\t},\n\t\t),\n\t),\n});\n\nexport type NotebookEditInput = Static<typeof NotebookEditInputSchema>;\n\n// ============================================================================\n// Todo Tool\n// ============================================================================\n\nexport const TodoItemSchema = Type.Object({\n\tcontent: Type.String({\n\t\tdescription: \"The task description\",\n\t\tminLength: 1,\n\t}),\n\tstatus: Type.Union(\n\t\t[\n\t\t\tType.Literal(\"pending\"),\n\t\t\tType.Literal(\"in_progress\"),\n\t\t\tType.Literal(\"completed\"),\n\t\t],\n\t\t{\n\t\t\tdescription: \"Task status\",\n\t\t},\n\t),\n\tactiveForm: Type.String({\n\t\tdescription:\n\t\t\t'Present continuous form shown during execution (e.g., \"Running tests\")',\n\t\tminLength: 1,\n\t}),\n});\n\nexport const TodoInputSchema = Type.Object({\n\ttodos: Type.Array(TodoItemSchema, {\n\t\tdescription: \"The updated todo list\",\n\t}),\n});\n\nexport type TodoItem = Static<typeof TodoItemSchema>;\nexport type TodoInput = Static<typeof TodoInputSchema>;\n\n// ============================================================================\n// Ask User Tool\n// ============================================================================\n\nexport const QuestionOptionSchema = Type.Object({\n\tlabel: Type.String({\n\t\tdescription: \"Display text for this option (1-5 words)\",\n\t\tminLength: 1,\n\t\tmaxLength: 50,\n\t}),\n\tdescription: Type.String({\n\t\tdescription: \"Explanation of what this option means\",\n\t\tminLength: 1,\n\t\tmaxLength: 200,\n\t}),\n});\n\nexport const QuestionSchema = Type.Object({\n\tquestion: Type.String({\n\t\tdescription: \"The complete question to ask\",\n\t\tminLength: 5,\n\t\tmaxLength: 500,\n\t}),\n\theader: Type.String({\n\t\tdescription: \"Short label (max 12 chars)\",\n\t\tminLength: 1,\n\t\tmaxLength: 12,\n\t}),\n\toptions: Type.Array(QuestionOptionSchema, {\n\t\tdescription: \"Available choices (2-4 options)\",\n\t\tminItems: 2,\n\t\tmaxItems: 4,\n\t}),\n\tmultiSelect: Type.Optional(\n\t\tType.Boolean({\n\t\t\tdescription: \"Allow selecting multiple options\",\n\t\t\tdefault: false,\n\t\t}),\n\t),\n});\n\nexport const AskUserInputSchema = Type.Object({\n\tquestions: Type.Array(QuestionSchema, {\n\t\tdescription: \"Questions to ask (1-4)\",\n\t\tminItems: 1,\n\t\tmaxItems: 4,\n\t}),\n});\n\nexport type AskUserQuestionOption = Static<typeof QuestionOptionSchema>;\nexport type AskUserQuestion = Static<typeof QuestionSchema>;\nexport type AskUserInput = Static<typeof AskUserInputSchema>;\n\n// ============================================================================\n// Web Search Tool\n// ============================================================================\n\nexport const WebSearchInputSchema = Type.Object({\n\tquery: Type.String({\n\t\tdescription: \"The search query\",\n\t\tminLength: 2,\n\t}),\n\tallowedDomains: Type.Optional(\n\t\tType.Array(Type.String(), {\n\t\t\tdescription: \"Only include results from these domains\",\n\t\t}),\n\t),\n\tblockedDomains: Type.Optional(\n\t\tType.Array(Type.String(), {\n\t\t\tdescription: \"Exclude results from these domains\",\n\t\t}),\n\t),\n});\n\nexport type WebSearchInput = Static<typeof WebSearchInputSchema>;\n\n// ============================================================================\n// Web Fetch Tool\n// ============================================================================\n\nexport const WebFetchInputSchema = Type.Object({\n\turl: Type.String({\n\t\tdescription: \"The URL to fetch content from\",\n\t\tformat: \"uri\",\n\t}),\n\tprompt: Type.String({\n\t\tdescription: \"Prompt to run on the fetched content\",\n\t}),\n});\n\nexport type WebFetchInput = Static<typeof WebFetchInputSchema>;\n\n// ============================================================================\n// Agent/Task Tool\n// ============================================================================\n\nexport const AgentInputSchema = Type.Object({\n\tdescription: Type.String({\n\t\tdescription: \"Short (3-5 word) description of the task\",\n\t\tminLength: 1,\n\t}),\n\tprompt: Type.String({\n\t\tdescription: \"The task for the agent to perform\",\n\t\tminLength: 1,\n\t}),\n\tsubagentType: Type.String({\n\t\tdescription:\n\t\t\t\"The type of specialized agent to use (e.g., 'explore', 'plan', 'review')\",\n\t}),\n\tmodel: Type.Optional(\n\t\tType.Union(\n\t\t\t[Type.Literal(\"sonnet\"), Type.Literal(\"opus\"), Type.Literal(\"haiku\")],\n\t\t\t{\n\t\t\t\tdescription:\n\t\t\t\t\t\"Model to use for this agent. Prefer 'haiku' for quick, straightforward tasks.\",\n\t\t\t},\n\t\t),\n\t),\n\tresume: Type.Optional(\n\t\tType.String({\n\t\t\tdescription:\n\t\t\t\t\"Agent transcript ID to resume from. If provided, the agent will continue from the previous execution, building on prior context and analysis.\",\n\t\t}),\n\t),\n});\n\nexport type AgentInput = Static<typeof AgentInputSchema>;\n\n// ============================================================================\n// All Tool Input Types Union\n// ============================================================================\n\nexport type ToolInputSchemas =\n\t| ReadInput\n\t| EditInput\n\t| WriteInput\n\t| BashInput\n\t| SearchInput\n\t| ListInput\n\t| NotebookEditInput\n\t| TodoInput\n\t| AskUserInput\n\t| WebSearchInput\n\t| WebFetchInput\n\t| AgentInput;\n\n// ============================================================================\n// Schema Registry\n// ============================================================================\n\nexport const toolSchemas: Record<string, TSchema> = {\n\tread: ReadInputSchema,\n\tedit: EditInputSchema,\n\twrite: WriteInputSchema,\n\tbash: BashInputSchema,\n\tsearch: SearchInputSchema,\n\tlist: ListInputSchema,\n\tnotebook_edit: NotebookEditInputSchema,\n\ttodo: TodoInputSchema,\n\task_user: AskUserInputSchema,\n\twebsearch: WebSearchInputSchema,\n\twebfetch: WebFetchInputSchema,\n\tagent: AgentInputSchema,\n};\n\n/**\n * Get the TypeBox schema for a tool by name.\n */\nexport function getToolSchema(toolName: string): TSchema | undefined {\n\treturn toolSchemas[toolName];\n}\n"]}
+{"version":3,"file":"sdk-tools.js","sourceRoot":"","sources":["../src/sdk-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAA6B,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEpE,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QACjB,WAAW,EAAE,iDAAiD;QAC9D,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,+CAA+C;QAC5D,OAAO,EAAE,CAAC;KACV,CAAC,CACF;IACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,iCAAiC;QAC9C,OAAO,EAAE,CAAC;KACV,CAAC,CACF;IACD,IAAI,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,KAAK,CACT,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EACpE;QACC,WAAW,EAAE,2CAA2C;QACxD,OAAO,EAAE,QAAQ;KACjB,CACD,CACD;IACD,QAAQ,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,KAAK,CACT;QACC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QACrB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;KACrB,EACD;QACC,WAAW,EAAE,4BAA4B;QACzC,OAAO,EAAE,OAAO;KAChB,CACD,CACD;CACD,CAAC,CAAC;AAIH,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9C,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC;QACpB,WAAW,EAAE,gCAAgC;QAC7C,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,EAAE;KACX,CAAC,CACF;CACD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QACjB,WAAW,EAAE,0BAA0B;QACvC,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EAAE,gCAAgC;QAC7C,SAAS,EAAE,CAAC;KACZ,CAAC,CACF;IACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EAAE,uCAAuC;QACpD,OAAO,EAAE,EAAE;KACX,CAAC,CACF;IACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE;QAC/B,WAAW,EAAE,sCAAsC;QACnD,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,EAAE;KACZ,CAAC,CACF;IACD,UAAU,EAAE,IAAI,CAAC,QAAQ,CACxB,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,yBAAyB;QACtC,OAAO,EAAE,KAAK;KACd,CAAC,CACF;IACD,UAAU,EAAE,IAAI,CAAC,QAAQ,CACxB,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,uCAAuC;QACpD,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;KACV,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,iCAAiC;QAC9C,OAAO,EAAE,KAAK;KACd,CAAC,CACF;CACD,CAAC,CAAC;AAIH,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QACjB,WAAW,EAAE,2BAA2B;QACxC,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC;QACpB,WAAW,EAAE,8BAA8B;KAC3C,CAAC;CACF,CAAC,CAAC;AAIH,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC;QACpB,WAAW,EAAE,wBAAwB;QACrC,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,sCAAsC;QACnD,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,MAAM;KACf,CAAC,CACF;IACD,WAAW,EAAE,IAAI,CAAC,QAAQ,CACzB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EAAE,0DAA0D;KACvE,CAAC,CACF;IACD,eAAe,EAAE,IAAI,CAAC,QAAQ,CAC7B,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,2BAA2B;QACxC,OAAO,EAAE,KAAK;KACd,CAAC,CACF;CACD,CAAC,CAAC;AAIH,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC;QACpB,WAAW,EAAE,0CAA0C;QACvD,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,IAAI,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EAAE,gCAAgC;KAC7C,CAAC,CACF;IACD,IAAI,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EAAE,2DAA2D;KACxE,CAAC,CACF;IACD,UAAU,EAAE,IAAI,CAAC,QAAQ,CACxB,IAAI,CAAC,KAAK,CACT;QACC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;KACrB,EACD;QACC,WAAW,EAAE,aAAa;QAC1B,OAAO,EAAE,oBAAoB;KAC7B,CACD,CACD;IACD,aAAa,EAAE,IAAI,CAAC,QAAQ,CAC3B,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,CAAC;KACV,CAAC,CACF;IACD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAC1B,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,mCAAmC;QAChD,OAAO,EAAE,CAAC;KACV,CAAC,CACF;IACD,eAAe,EAAE,IAAI,CAAC,QAAQ,CAC7B,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,yBAAyB;QACtC,OAAO,EAAE,KAAK;KACd,CAAC,CACF;IACD,SAAS,EAAE,IAAI,CAAC,QAAQ,CACvB,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,iCAAiC;QAC9C,OAAO,EAAE,CAAC;KACV,CAAC,CACF;IACD,SAAS,EAAE,IAAI,CAAC,QAAQ,CACvB,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,uBAAuB;QACpC,OAAO,EAAE,KAAK;KACd,CAAC,CACF;CACD,CAAC,CAAC;AAIH,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC;QACpB,WAAW,EAAE,+CAA+C;QAC5D,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,IAAI,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EAAE,wBAAwB;KACrC,CAAC,CACF;CACD,CAAC,CAAC;AAIH,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC,MAAM,CAAC;IAClD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QACjB,WAAW,EAAE,4CAA4C;QACzD,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EAAE,iBAAiB;KAC9B,CAAC,CACF;IACD,SAAS,EAAE,IAAI,CAAC,QAAQ,CACvB,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,8BAA8B;QAC3C,OAAO,EAAE,CAAC;KACV,CAAC,CACF;IACD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC;QACtB,WAAW,EAAE,iCAAiC;KAC9C,CAAC;IACF,QAAQ,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE;QAC5D,WAAW,EAAE,WAAW;KACxB,CAAC,CACF;IACD,QAAQ,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,KAAK,CACT,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EACzE;QACC,WAAW,EAAE,WAAW;QACxB,OAAO,EAAE,SAAS;KAClB,CACD,CACD;CACD,CAAC,CAAC;AAIH,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;IACzC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC;QACpB,WAAW,EAAE,sBAAsB;QACnC,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,MAAM,EAAE,IAAI,CAAC,KAAK,CACjB;QACC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;KACzB,EACD;QACC,WAAW,EAAE,aAAa;KAC1B,CACD;IACD,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;QACvB,WAAW,EACV,wEAAwE;QACzE,SAAS,EAAE,CAAC;KACZ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE;QACjC,WAAW,EAAE,uBAAuB;KACpC,CAAC;CACF,CAAC,CAAC;AAKH,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC,MAAM,CAAC;IACrD,IAAI,EAAE,IAAI,CAAC,KAAK,CACf,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EACtE;QACC,WAAW,EACV,qFAAqF;KACtF,CACD;IACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EAAE,+BAA+B;QAC5C,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,EAAE;KACb,CAAC,CACF;IACD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QACjB,WAAW,EAAE,wCAAwC;QACrD,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,MAAM;KACjB,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;QAClB,WAAW,EAAE,0CAA0C;QACvD,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,EAAE;KACb,CAAC;IACF,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC;QACxB,WAAW,EAAE,uCAAuC;QACpD,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,GAAG;KACd,CAAC;IACF,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC;CAClD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC;QACrB,WAAW,EAAE,8BAA8B;QAC3C,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,GAAG;KACd,CAAC;IACF,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,4BAA4B;QACzC,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,EAAE;KACb,CAAC;IACF,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE;QACzC,WAAW,EAAE,iCAAiC;QAC9C,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,CAAC;KACX,CAAC;IACF,WAAW,EAAE,IAAI,CAAC,QAAQ,CACzB,IAAI,CAAC,OAAO,CAAC;QACZ,WAAW,EAAE,kCAAkC;QAC/C,OAAO,EAAE,KAAK;KACd,CAAC,CACF;CACD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC7C,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE;QACrC,WAAW,EAAE,wBAAwB;QACrC,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,CAAC;KACX,CAAC;CACF,CAAC,CAAC;AAOH,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;QAClB,WAAW,EAAE,kBAAkB;QAC/B,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,cAAc,EAAE,IAAI,CAAC,QAAQ,CAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE;QACzB,WAAW,EAAE,yCAAyC;KACtD,CAAC,CACF;IACD,cAAc,EAAE,IAAI,CAAC,QAAQ,CAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE;QACzB,WAAW,EAAE,oCAAoC;KACjD,CAAC,CACF;CACD,CAAC,CAAC;AAIH,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC;QAChB,WAAW,EAAE,+BAA+B;QAC5C,MAAM,EAAE,KAAK;KACb,CAAC;IACF,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,sCAAsC;KACnD,CAAC;CACF,CAAC,CAAC;AAIH,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3C,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC;QACxB,WAAW,EAAE,0CAA0C;QACvD,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,mCAAmC;QAChD,SAAS,EAAE,CAAC;KACZ,CAAC;IACF,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC;QACzB,WAAW,EACV,0EAA0E;KAC3E,CAAC;IACF,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,KAAK,CACT,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EACrE;QACC,WAAW,EACV,+EAA+E;KAChF,CACD,CACD;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EACV,+IAA+I;KAChJ,CAAC,CACF;CACD,CAAC,CAAC;AAsBH,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,WAAW,GAA4B;IACnD,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,gBAAgB;IACvB,IAAI,EAAE,eAAe;IACrB,MAAM,EAAE,iBAAiB;IACzB,IAAI,EAAE,eAAe;IACrB,aAAa,EAAE,uBAAuB;IACtC,IAAI,EAAE,eAAe;IACrB,QAAQ,EAAE,kBAAkB;IAC5B,SAAS,EAAE,oBAAoB;IAC/B,QAAQ,EAAE,mBAAmB;IAC7B,KAAK,EAAE,gBAAgB;CACvB,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC7C,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC","sourcesContent":["/**\n * SDK Tool Types Export\n *\n * This file exports TypeBox schemas and TypeScript types for all built-in tools,\n * enabling type-safe tool integration for SDK consumers.\n *\n * @example\n * ```typescript\n * import type { ReadInput, EditInput, BashInput } from '@evalops/composer/sdk-tools';\n *\n * const readParams: ReadInput = {\n *   path: '/path/to/file',\n *   offset: 1,\n *   limit: 100\n * };\n * ```\n */\n\nimport { type Static, type TSchema, Type } from \"@sinclair/typebox\";\n\n// ============================================================================\n// Read Tool\n// ============================================================================\n\nexport const ReadInputSchema = Type.Object({\n\tpath: Type.String({\n\t\tdescription: \"Path to the file to read (relative or absolute)\",\n\t\tminLength: 1,\n\t}),\n\toffset: Type.Optional(\n\t\tType.Integer({\n\t\t\tdescription: \"Line number to start reading from (1-indexed)\",\n\t\t\tminimum: 1,\n\t\t}),\n\t),\n\tlimit: Type.Optional(\n\t\tType.Integer({\n\t\t\tdescription: \"Maximum number of lines to read\",\n\t\t\tminimum: 1,\n\t\t}),\n\t),\n\tmode: Type.Optional(\n\t\tType.Union(\n\t\t\t[Type.Literal(\"normal\"), Type.Literal(\"head\"), Type.Literal(\"tail\")],\n\t\t\t{\n\t\t\t\tdescription: 'Reading mode: \"normal\", \"head\", or \"tail\"',\n\t\t\t\tdefault: \"normal\",\n\t\t\t},\n\t\t),\n\t),\n\tencoding: Type.Optional(\n\t\tType.Union(\n\t\t\t[\n\t\t\t\tType.Literal(\"utf-8\"),\n\t\t\t\tType.Literal(\"utf-16le\"),\n\t\t\t\tType.Literal(\"latin1\"),\n\t\t\t\tType.Literal(\"ascii\"),\n\t\t\t],\n\t\t\t{\n\t\t\t\tdescription: \"Text encoding for the file\",\n\t\t\t\tdefault: \"utf-8\",\n\t\t\t},\n\t\t),\n\t),\n});\n\nexport type ReadInput = Static<typeof ReadInputSchema>;\n\n// ============================================================================\n// Edit Tool\n// ============================================================================\n\nexport const EditOperationSchema = Type.Object({\n\toldText: Type.String({\n\t\tdescription: \"Exact text to find and replace\",\n\t\tminLength: 1,\n\t}),\n\tnewText: Type.Optional(\n\t\tType.String({\n\t\t\tdescription: \"Replacement text (omit or empty string to delete)\",\n\t\t\tdefault: \"\",\n\t\t}),\n\t),\n});\n\nexport const EditInputSchema = Type.Object({\n\tpath: Type.String({\n\t\tdescription: \"Path to the file to edit\",\n\t\tminLength: 1,\n\t}),\n\toldText: Type.Optional(\n\t\tType.String({\n\t\t\tdescription: \"Exact text to find and replace\",\n\t\t\tminLength: 1,\n\t\t}),\n\t),\n\tnewText: Type.Optional(\n\t\tType.String({\n\t\t\tdescription: \"New text to replace the old text with\",\n\t\t\tdefault: \"\",\n\t\t}),\n\t),\n\tedits: Type.Optional(\n\t\tType.Array(EditOperationSchema, {\n\t\t\tdescription: \"Multiple edits to apply sequentially\",\n\t\t\tminItems: 1,\n\t\t\tmaxItems: 50,\n\t\t}),\n\t),\n\treplaceAll: Type.Optional(\n\t\tType.Boolean({\n\t\t\tdescription: \"Replace all occurrences\",\n\t\t\tdefault: false,\n\t\t}),\n\t),\n\toccurrence: Type.Optional(\n\t\tType.Integer({\n\t\t\tdescription: \"Which occurrence to replace (1-based)\",\n\t\t\tminimum: 1,\n\t\t\tdefault: 1,\n\t\t}),\n\t),\n\tdryRun: Type.Optional(\n\t\tType.Boolean({\n\t\t\tdescription: \"Preview without writing changes\",\n\t\t\tdefault: false,\n\t\t}),\n\t),\n});\n\nexport type EditInput = Static<typeof EditInputSchema>;\n\n// ============================================================================\n// Write Tool\n// ============================================================================\n\nexport const WriteInputSchema = Type.Object({\n\tpath: Type.String({\n\t\tdescription: \"Path to the file to write\",\n\t\tminLength: 1,\n\t}),\n\tcontent: Type.String({\n\t\tdescription: \"Content to write to the file\",\n\t}),\n});\n\nexport type WriteInput = Static<typeof WriteInputSchema>;\n\n// ============================================================================\n// Bash Tool\n// ============================================================================\n\nexport const BashInputSchema = Type.Object({\n\tcommand: Type.String({\n\t\tdescription: \"The command to execute\",\n\t\tminLength: 1,\n\t}),\n\ttimeout: Type.Optional(\n\t\tType.Integer({\n\t\t\tdescription: \"Timeout in milliseconds (max 600000)\",\n\t\t\tminimum: 1,\n\t\t\tmaximum: 600000,\n\t\t}),\n\t),\n\tdescription: Type.Optional(\n\t\tType.String({\n\t\t\tdescription: \"Clear description of what this command does (5-10 words)\",\n\t\t}),\n\t),\n\trunInBackground: Type.Optional(\n\t\tType.Boolean({\n\t\t\tdescription: \"Run command in background\",\n\t\t\tdefault: false,\n\t\t}),\n\t),\n});\n\nexport type BashInput = Static<typeof BashInputSchema>;\n\n// ============================================================================\n// Search (Grep) Tool\n// ============================================================================\n\nexport const SearchInputSchema = Type.Object({\n\tpattern: Type.String({\n\t\tdescription: \"Regular expression pattern to search for\",\n\t\tminLength: 1,\n\t}),\n\tpath: Type.Optional(\n\t\tType.String({\n\t\t\tdescription: \"File or directory to search in\",\n\t\t}),\n\t),\n\tglob: Type.Optional(\n\t\tType.String({\n\t\t\tdescription: 'Glob pattern to filter files (e.g., \"*.js\", \"*.{ts,tsx}\")',\n\t\t}),\n\t),\n\toutputMode: Type.Optional(\n\t\tType.Union(\n\t\t\t[\n\t\t\t\tType.Literal(\"content\"),\n\t\t\t\tType.Literal(\"files_with_matches\"),\n\t\t\t\tType.Literal(\"count\"),\n\t\t\t],\n\t\t\t{\n\t\t\t\tdescription: \"Output mode\",\n\t\t\t\tdefault: \"files_with_matches\",\n\t\t\t},\n\t\t),\n\t),\n\tcontextBefore: Type.Optional(\n\t\tType.Integer({\n\t\t\tdescription: \"Lines of context before each match\",\n\t\t\tminimum: 0,\n\t\t}),\n\t),\n\tcontextAfter: Type.Optional(\n\t\tType.Integer({\n\t\t\tdescription: \"Lines of context after each match\",\n\t\t\tminimum: 0,\n\t\t}),\n\t),\n\tcaseInsensitive: Type.Optional(\n\t\tType.Boolean({\n\t\t\tdescription: \"Case insensitive search\",\n\t\t\tdefault: false,\n\t\t}),\n\t),\n\theadLimit: Type.Optional(\n\t\tType.Integer({\n\t\t\tdescription: \"Limit output to first N entries\",\n\t\t\tminimum: 1,\n\t\t}),\n\t),\n\tmultiline: Type.Optional(\n\t\tType.Boolean({\n\t\t\tdescription: \"Enable multiline mode\",\n\t\t\tdefault: false,\n\t\t}),\n\t),\n});\n\nexport type SearchInput = Static<typeof SearchInputSchema>;\n\n// ============================================================================\n// List (Glob) Tool\n// ============================================================================\n\nexport const ListInputSchema = Type.Object({\n\tpattern: Type.String({\n\t\tdescription: 'Glob pattern to match files (e.g., \"**/*.ts\")',\n\t\tminLength: 1,\n\t}),\n\tpath: Type.Optional(\n\t\tType.String({\n\t\t\tdescription: \"Directory to search in\",\n\t\t}),\n\t),\n});\n\nexport type ListInput = Static<typeof ListInputSchema>;\n\n// ============================================================================\n// Notebook Edit Tool\n// ============================================================================\n\nexport const NotebookEditInputSchema = Type.Object({\n\tpath: Type.String({\n\t\tdescription: \"Path to the Jupyter notebook file (.ipynb)\",\n\t\tminLength: 1,\n\t}),\n\tcellId: Type.Optional(\n\t\tType.String({\n\t\t\tdescription: \"Cell ID to edit\",\n\t\t}),\n\t),\n\tcellIndex: Type.Optional(\n\t\tType.Integer({\n\t\t\tdescription: \"Cell index (0-based) to edit\",\n\t\t\tminimum: 0,\n\t\t}),\n\t),\n\tnewSource: Type.String({\n\t\tdescription: \"New source content for the cell\",\n\t}),\n\tcellType: Type.Optional(\n\t\tType.Union([Type.Literal(\"code\"), Type.Literal(\"markdown\")], {\n\t\t\tdescription: \"Cell type\",\n\t\t}),\n\t),\n\teditMode: Type.Optional(\n\t\tType.Union(\n\t\t\t[Type.Literal(\"replace\"), Type.Literal(\"insert\"), Type.Literal(\"delete\")],\n\t\t\t{\n\t\t\t\tdescription: \"Edit mode\",\n\t\t\t\tdefault: \"replace\",\n\t\t\t},\n\t\t),\n\t),\n});\n\nexport type NotebookEditInput = Static<typeof NotebookEditInputSchema>;\n\n// ============================================================================\n// Todo Tool\n// ============================================================================\n\nexport const TodoItemSchema = Type.Object({\n\tcontent: Type.String({\n\t\tdescription: \"The task description\",\n\t\tminLength: 1,\n\t}),\n\tstatus: Type.Union(\n\t\t[\n\t\t\tType.Literal(\"pending\"),\n\t\t\tType.Literal(\"in_progress\"),\n\t\t\tType.Literal(\"completed\"),\n\t\t],\n\t\t{\n\t\t\tdescription: \"Task status\",\n\t\t},\n\t),\n\tactiveForm: Type.String({\n\t\tdescription:\n\t\t\t'Present continuous form shown during execution (e.g., \"Running tests\")',\n\t\tminLength: 1,\n\t}),\n});\n\nexport const TodoInputSchema = Type.Object({\n\ttodos: Type.Array(TodoItemSchema, {\n\t\tdescription: \"The updated todo list\",\n\t}),\n});\n\nexport type TodoItem = Static<typeof TodoItemSchema>;\nexport type TodoInput = Static<typeof TodoInputSchema>;\n\n// ============================================================================\n// Ask User Tool\n// ============================================================================\n\nexport const AskUserOptionPreviewSchema = Type.Object({\n\tkind: Type.Union(\n\t\t[Type.Literal(\"markdown\"), Type.Literal(\"text\"), Type.Literal(\"diff\")],\n\t\t{\n\t\t\tdescription:\n\t\t\t\t\"Preview format. Raw HTML is intentionally unsupported; use markdown, text, or diff.\",\n\t\t},\n\t),\n\ttitle: Type.Optional(\n\t\tType.String({\n\t\t\tdescription: \"Optional short preview title.\",\n\t\t\tminLength: 1,\n\t\t\tmaxLength: 80,\n\t\t}),\n\t),\n\tbody: Type.String({\n\t\tdescription: \"Preview content shown with the option.\",\n\t\tminLength: 1,\n\t\tmaxLength: 12_000,\n\t}),\n});\n\nexport const QuestionOptionSchema = Type.Object({\n\tlabel: Type.String({\n\t\tdescription: \"Display text for this option (1-5 words)\",\n\t\tminLength: 1,\n\t\tmaxLength: 50,\n\t}),\n\tdescription: Type.String({\n\t\tdescription: \"Explanation of what this option means\",\n\t\tminLength: 1,\n\t\tmaxLength: 200,\n\t}),\n\tpreview: Type.Optional(AskUserOptionPreviewSchema),\n});\n\nexport const QuestionSchema = Type.Object({\n\tquestion: Type.String({\n\t\tdescription: \"The complete question to ask\",\n\t\tminLength: 5,\n\t\tmaxLength: 500,\n\t}),\n\theader: Type.String({\n\t\tdescription: \"Short label (max 12 chars)\",\n\t\tminLength: 1,\n\t\tmaxLength: 12,\n\t}),\n\toptions: Type.Array(QuestionOptionSchema, {\n\t\tdescription: \"Available choices (2-4 options)\",\n\t\tminItems: 2,\n\t\tmaxItems: 4,\n\t}),\n\tmultiSelect: Type.Optional(\n\t\tType.Boolean({\n\t\t\tdescription: \"Allow selecting multiple options\",\n\t\t\tdefault: false,\n\t\t}),\n\t),\n});\n\nexport const AskUserInputSchema = Type.Object({\n\tquestions: Type.Array(QuestionSchema, {\n\t\tdescription: \"Questions to ask (1-4)\",\n\t\tminItems: 1,\n\t\tmaxItems: 4,\n\t}),\n});\n\nexport type AskUserQuestionOption = Static<typeof QuestionOptionSchema>;\nexport type AskUserOptionPreview = Static<typeof AskUserOptionPreviewSchema>;\nexport type AskUserQuestion = Static<typeof QuestionSchema>;\nexport type AskUserInput = Static<typeof AskUserInputSchema>;\n\n// ============================================================================\n// Web Search Tool\n// ============================================================================\n\nexport const WebSearchInputSchema = Type.Object({\n\tquery: Type.String({\n\t\tdescription: \"The search query\",\n\t\tminLength: 2,\n\t}),\n\tallowedDomains: Type.Optional(\n\t\tType.Array(Type.String(), {\n\t\t\tdescription: \"Only include results from these domains\",\n\t\t}),\n\t),\n\tblockedDomains: Type.Optional(\n\t\tType.Array(Type.String(), {\n\t\t\tdescription: \"Exclude results from these domains\",\n\t\t}),\n\t),\n});\n\nexport type WebSearchInput = Static<typeof WebSearchInputSchema>;\n\n// ============================================================================\n// Web Fetch Tool\n// ============================================================================\n\nexport const WebFetchInputSchema = Type.Object({\n\turl: Type.String({\n\t\tdescription: \"The URL to fetch content from\",\n\t\tformat: \"uri\",\n\t}),\n\tprompt: Type.String({\n\t\tdescription: \"Prompt to run on the fetched content\",\n\t}),\n});\n\nexport type WebFetchInput = Static<typeof WebFetchInputSchema>;\n\n// ============================================================================\n// Agent/Task Tool\n// ============================================================================\n\nexport const AgentInputSchema = Type.Object({\n\tdescription: Type.String({\n\t\tdescription: \"Short (3-5 word) description of the task\",\n\t\tminLength: 1,\n\t}),\n\tprompt: Type.String({\n\t\tdescription: \"The task for the agent to perform\",\n\t\tminLength: 1,\n\t}),\n\tsubagentType: Type.String({\n\t\tdescription:\n\t\t\t\"The type of specialized agent to use (e.g., 'explore', 'plan', 'review')\",\n\t}),\n\tmodel: Type.Optional(\n\t\tType.Union(\n\t\t\t[Type.Literal(\"sonnet\"), Type.Literal(\"opus\"), Type.Literal(\"haiku\")],\n\t\t\t{\n\t\t\t\tdescription:\n\t\t\t\t\t\"Model to use for this agent. Prefer 'haiku' for quick, straightforward tasks.\",\n\t\t\t},\n\t\t),\n\t),\n\tresume: Type.Optional(\n\t\tType.String({\n\t\t\tdescription:\n\t\t\t\t\"Agent transcript ID to resume from. If provided, the agent will continue from the previous execution, building on prior context and analysis.\",\n\t\t}),\n\t),\n});\n\nexport type AgentInput = Static<typeof AgentInputSchema>;\n\n// ============================================================================\n// All Tool Input Types Union\n// ============================================================================\n\nexport type ToolInputSchemas =\n\t| ReadInput\n\t| EditInput\n\t| WriteInput\n\t| BashInput\n\t| SearchInput\n\t| ListInput\n\t| NotebookEditInput\n\t| TodoInput\n\t| AskUserInput\n\t| WebSearchInput\n\t| WebFetchInput\n\t| AgentInput;\n\n// ============================================================================\n// Schema Registry\n// ============================================================================\n\nexport const toolSchemas: Record<string, TSchema> = {\n\tread: ReadInputSchema,\n\tedit: EditInputSchema,\n\twrite: WriteInputSchema,\n\tbash: BashInputSchema,\n\tsearch: SearchInputSchema,\n\tlist: ListInputSchema,\n\tnotebook_edit: NotebookEditInputSchema,\n\ttodo: TodoInputSchema,\n\task_user: AskUserInputSchema,\n\twebsearch: WebSearchInputSchema,\n\twebfetch: WebFetchInputSchema,\n\tagent: AgentInputSchema,\n};\n\n/**\n * Get the TypeBox schema for a tool by name.\n */\nexport function getToolSchema(toolName: string): TSchema | undefined {\n\treturn toolSchemas[toolName];\n}\n"]}

package/dist/server/app-context.d.ts

@@ -12,9 +12,33 @@ export interface WebServerConfig {
     defaultApprovalMode: ApprovalMode;
     defaultProvider: string;
     defaultModelId: string;
+    hostedRunner?: HostedRunnerContext;
+}
+export interface HostedRunnerContext {
+    enabled: true;
+    runnerSessionId: string;
+    ownerInstanceId?: string;
+    workspaceRoot: string;
+    snapshotRoot?: string;
+    listenHost?: string;
+    listenPort?: number;
+    workspaceId?: string;
+    agentRunId?: string;
+    attachAudience?: string;
+    configuredMaestroSessionId?: string;
+    activeMaestroSessionId?: string;
+    draining?: boolean;
+    lastDrain?: {
+        status: string;
+        manifestPath: string;
+        drainedAt: string;
+        reason?: string;
+        requestedBy?: string;
+    };
 }
 export interface WebServerServices {
     createAgent: (model: RegisteredModel, thinking: ThinkingLevel, approval: ApprovalMode, options?: {
+        cwd?: string;
         enableClientTools?: boolean;
         useClientAskUser?: boolean;
         includeVscodeTools?: boolean;
@@ -25,6 +49,7 @@ export interface WebServerServices {
         toolRetryService?: ToolRetryService;
     }) => Promise<Agent>;
     createBackgroundAgent: (model: RegisteredModel, options?: {
+        cwd?: string;
         systemPrompt?: string;
     }) => Promise<Agent>;
     getRegisteredModel: (input: string | null | undefined) => Promise<RegisteredModel>;

package/dist/server/app-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-context.d.ts","sourceRoot":"","sources":["../../src/server/app-context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,qBAAqB,EACrB,YAAY,EACZ,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAE5E,MAAM,WAAW,eAAe;IAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,YAAY,CAAC;IAClC,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IACjC,WAAW,EAAE,CACZ,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,YAAY,EACtB,OAAO,CAAC,EAAE;QACT,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,eAAe,CAAC,EAAE,qBAAqB,CAAC;QACxC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;QAC/C,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;KACpC,KACG,OAAO,CAAC,KAAK,CAAC,CAAC;IACpB,qBAAqB,EAAE,CACtB,KAAK,EAAE,eAAe,EACtB,OAAO,CAAC,EAAE;QACT,YAAY,CAAC,EAAE,MAAM,CAAC;KACtB,KACG,OAAO,CAAC,KAAK,CAAC,CAAC;IACpB,kBAAkB,EAAE,CACnB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,KAC5B,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9B,mBAAmB,EAAE,MAAM;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,gBAAgB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAChE,iBAAiB,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IACpD,UAAU,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC3C,sBAAsB,EAAE,sBAAsB,CAAC;CAC/C;AAED,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,iBAAiB,CAAC"}
+{"version":3,"file":"app-context.d.ts","sourceRoot":"","sources":["../../src/server/app-context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,qBAAqB,EACrB,YAAY,EACZ,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAE5E,MAAM,WAAW,eAAe;IAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,YAAY,CAAC;IAClC,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACnC;AAED,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE,IAAI,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE;QACX,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACF;AAED,MAAM,WAAW,iBAAiB;IACjC,WAAW,EAAE,CACZ,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,YAAY,EACtB,OAAO,CAAC,EAAE;QACT,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,eAAe,CAAC,EAAE,qBAAqB,CAAC;QACxC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;QAC/C,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;KACpC,KACG,OAAO,CAAC,KAAK,CAAC,CAAC;IACpB,qBAAqB,EAAE,CACtB,KAAK,EAAE,eAAe,EACtB,OAAO,CAAC,EAAE;QACT,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,YAAY,CAAC,EAAE,MAAM,CAAC;KACtB,KACG,OAAO,CAAC,KAAK,CAAC,CAAC;IACpB,kBAAkB,EAAE,CACnB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,KAC5B,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9B,mBAAmB,EAAE,MAAM;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,gBAAgB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAChE,iBAAiB,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IACpD,UAAU,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC3C,sBAAsB,EAAE,sBAAsB,CAAC;CAC/C;AAED,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,iBAAiB,CAAC"}

package/dist/server/app-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-context.js","sourceRoot":"","sources":["../../src/server/app-context.ts"],"names":[],"mappings":"","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type {\n\tActionApprovalService,\n\tApprovalMode,\n} from \"../agent/action-approval.js\";\nimport type { Agent } from \"../agent/index.js\";\nimport type { ToolRetryService } from \"../agent/tool-retry.js\";\nimport type { ClientToolExecutionService } from \"../agent/transport.js\";\nimport type { ThinkingLevel } from \"../agent/types.js\";\nimport type { RegisteredModel } from \"../models/registry.js\";\nimport type { AuthCredential } from \"../providers/auth.js\";\nimport type { HeadlessRuntimeService } from \"./headless-runtime-service.js\";\n\nexport interface WebServerConfig {\n\tcorsHeaders: Record<string, string>;\n\tstaticMaxAge: number;\n\tdefaultApprovalMode: ApprovalMode;\n\tdefaultProvider: string;\n\tdefaultModelId: string;\n}\n\nexport interface WebServerServices {\n\tcreateAgent: (\n\t\tmodel: RegisteredModel,\n\t\tthinking: ThinkingLevel,\n\t\tapproval: ApprovalMode,\n\t\toptions?: {\n\t\t\tenableClientTools?: boolean;\n\t\t\tuseClientAskUser?: boolean;\n\t\t\tincludeVscodeTools?: boolean;\n\t\t\tincludeJetBrainsTools?: boolean;\n\t\t\tincludeConductorTools?: boolean;\n\t\t\tapprovalService?: ActionApprovalService;\n\t\t\tclientToolService?: ClientToolExecutionService;\n\t\t\ttoolRetryService?: ToolRetryService;\n\t\t},\n\t) => Promise<Agent>;\n\tcreateBackgroundAgent: (\n\t\tmodel: RegisteredModel,\n\t\toptions?: {\n\t\t\tsystemPrompt?: string;\n\t\t},\n\t) => Promise<Agent>;\n\tgetRegisteredModel: (\n\t\tinput: string | null | undefined,\n\t) => Promise<RegisteredModel>;\n\tgetCurrentSelection: () => { provider: string; modelId: string };\n\tensureCredential: (provider: string) => Promise<AuthCredential>;\n\tsetModelSelection: (model: RegisteredModel) => void;\n\tacquireSse: () => symbol | null;\n\treleaseSse: (token: symbol | null) => void;\n\theadlessRuntimeService: HeadlessRuntimeService;\n}\n\nexport type WebServerContext = WebServerConfig & WebServerServices;\n"]}
+{"version":3,"file":"app-context.js","sourceRoot":"","sources":["../../src/server/app-context.ts"],"names":[],"mappings":"","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type {\n\tActionApprovalService,\n\tApprovalMode,\n} from \"../agent/action-approval.js\";\nimport type { Agent } from \"../agent/index.js\";\nimport type { ToolRetryService } from \"../agent/tool-retry.js\";\nimport type { ClientToolExecutionService } from \"../agent/transport.js\";\nimport type { ThinkingLevel } from \"../agent/types.js\";\nimport type { RegisteredModel } from \"../models/registry.js\";\nimport type { AuthCredential } from \"../providers/auth.js\";\nimport type { HeadlessRuntimeService } from \"./headless-runtime-service.js\";\n\nexport interface WebServerConfig {\n\tcorsHeaders: Record<string, string>;\n\tstaticMaxAge: number;\n\tdefaultApprovalMode: ApprovalMode;\n\tdefaultProvider: string;\n\tdefaultModelId: string;\n\thostedRunner?: HostedRunnerContext;\n}\n\nexport interface HostedRunnerContext {\n\tenabled: true;\n\trunnerSessionId: string;\n\townerInstanceId?: string;\n\tworkspaceRoot: string;\n\tsnapshotRoot?: string;\n\tlistenHost?: string;\n\tlistenPort?: number;\n\tworkspaceId?: string;\n\tagentRunId?: string;\n\tattachAudience?: string;\n\tconfiguredMaestroSessionId?: string;\n\tactiveMaestroSessionId?: string;\n\tdraining?: boolean;\n\tlastDrain?: {\n\t\tstatus: string;\n\t\tmanifestPath: string;\n\t\tdrainedAt: string;\n\t\treason?: string;\n\t\trequestedBy?: string;\n\t};\n}\n\nexport interface WebServerServices {\n\tcreateAgent: (\n\t\tmodel: RegisteredModel,\n\t\tthinking: ThinkingLevel,\n\t\tapproval: ApprovalMode,\n\t\toptions?: {\n\t\t\tcwd?: string;\n\t\t\tenableClientTools?: boolean;\n\t\t\tuseClientAskUser?: boolean;\n\t\t\tincludeVscodeTools?: boolean;\n\t\t\tincludeJetBrainsTools?: boolean;\n\t\t\tincludeConductorTools?: boolean;\n\t\t\tapprovalService?: ActionApprovalService;\n\t\t\tclientToolService?: ClientToolExecutionService;\n\t\t\ttoolRetryService?: ToolRetryService;\n\t\t},\n\t) => Promise<Agent>;\n\tcreateBackgroundAgent: (\n\t\tmodel: RegisteredModel,\n\t\toptions?: {\n\t\t\tcwd?: string;\n\t\t\tsystemPrompt?: string;\n\t\t},\n\t) => Promise<Agent>;\n\tgetRegisteredModel: (\n\t\tinput: string | null | undefined,\n\t) => Promise<RegisteredModel>;\n\tgetCurrentSelection: () => { provider: string; modelId: string };\n\tensureCredential: (provider: string) => Promise<AuthCredential>;\n\tsetModelSelection: (model: RegisteredModel) => void;\n\tacquireSse: () => symbol | null;\n\treleaseSse: (token: symbol | null) => void;\n\theadlessRuntimeService: HeadlessRuntimeService;\n}\n\nexport type WebServerContext = WebServerConfig & WebServerServices;\n"]}

package/dist/server/approval-service.d.ts

@@ -1,12 +1,11 @@
-import { type ActionApprovalDecision, type ActionApprovalRequest, ActionApprovalService } from "../agent/action-approval.js";
-type SessionIdProvider = string | (() => string | undefined);
-export declare class ServerRequestActionApprovalService extends ActionApprovalService {
-    private readonly sessionIdProvider?;
-    constructor(mode?: ConstructorParameters<typeof ActionApprovalService>[0], sessionIdProvider?: SessionIdProvider | undefined);
-    requestApproval(request: ActionApprovalRequest, signal?: AbortSignal): Promise<ActionApprovalDecision>;
-    private getSessionId;
+import type { ActionApprovalRequest, ApprovalMode } from "../agent/action-approval.js";
+import { PlatformBackedActionApprovalService, type SessionIdProvider } from "../approvals/platform-action-approval.js";
+import type { ApprovalsServiceConfig } from "../approvals/service-client.js";
+export declare class ServerRequestActionApprovalService extends PlatformBackedActionApprovalService {
+    constructor(mode?: ApprovalMode, sessionIdProvider?: SessionIdProvider, approvalsServiceConfig?: ApprovalsServiceConfig | false);
+    protected onPendingApprovalRegistered(sessionId: string | undefined, request: ActionApprovalRequest): void;
+    protected onPendingApprovalSettled(request: ActionApprovalRequest): void;
 }
 export declare class WebActionApprovalService extends ServerRequestActionApprovalService {
 }
-export {};
 //# sourceMappingURL=approval-service.d.ts.map

package/dist/server/approval-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval-service.d.ts","sourceRoot":"","sources":["../../src/server/approval-service.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,MAAM,6BAA6B,CAAC;AAGrC,KAAK,iBAAiB,GAAG,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;AAE7D,qBAAa,kCAAmC,SAAQ,qBAAqB;IAG3E,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBADnC,IAAI,CAAC,EAAE,qBAAqB,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAC5C,iBAAiB,CAAC,EAAE,iBAAiB,YAAA;IAKxC,eAAe,CAC7B,OAAO,EAAE,qBAAqB,EAC9B,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,sBAAsB,CAAC;IAelC,OAAO,CAAC,YAAY;CAMpB;AAED,qBAAa,wBAAyB,SAAQ,kCAAkC;CAAG"}
+{"version":3,"file":"approval-service.d.ts","sourceRoot":"","sources":["../../src/server/approval-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,qBAAqB,EACrB,YAAY,EACZ,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACN,mCAAmC,EACnC,KAAK,iBAAiB,EACtB,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAG7E,qBAAa,kCAAmC,SAAQ,mCAAmC;gBAEzF,IAAI,CAAC,EAAE,YAAY,EACnB,iBAAiB,CAAC,EAAE,iBAAiB,EACrC,sBAAsB,CAAC,EAAE,sBAAsB,GAAG,KAAK;cAKrC,2BAA2B,CAC7C,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,EAAE,qBAAqB,GAC5B,IAAI;cAQY,wBAAwB,CAC1C,OAAO,EAAE,qBAAqB,GAC5B,IAAI;CAGP;AAED,qBAAa,wBAAyB,SAAQ,kCAAkC;CAAG"}

package/dist/server/approval-service.js

@@ -1,30 +1,18 @@
-import { ActionApprovalService, } from "../agent/action-approval.js";
+import { PlatformBackedActionApprovalService, } from "../approvals/platform-action-approval.js";
 import { serverRequestManager } from "./server-request-manager.js";
-export class ServerRequestActionApprovalService extends ActionApprovalService {
-    constructor(mode, sessionIdProvider) {
-        super(mode);
-        this.sessionIdProvider = sessionIdProvider;
+export class ServerRequestActionApprovalService extends PlatformBackedActionApprovalService {
+    constructor(mode, sessionIdProvider, approvalsServiceConfig) {
+        super(mode, { sessionIdProvider, approvalsServiceConfig });
     }
-    async requestApproval(request, signal) {
-        if (this.requiresUserInteraction()) {
-            serverRequestManager.registerApproval({
-                sessionId: this.getSessionId(),
-                request,
-                service: this,
-            });
-        }
-        try {
-            return await super.requestApproval(request, signal);
-        }
-        finally {
-            serverRequestManager.unregister(request.id);
-        }
+    onPendingApprovalRegistered(sessionId, request) {
+        serverRequestManager.registerApproval({
+            sessionId,
+            request,
+            service: this,
+        });
     }
-    getSessionId() {
-        if (typeof this.sessionIdProvider === "function") {
-            return this.sessionIdProvider();
-        }
-        return this.sessionIdProvider;
+    onPendingApprovalSettled(request) {
+        serverRequestManager.unregister(request.id);
     }
 }
 export class WebActionApprovalService extends ServerRequestActionApprovalService {