@executor-js/sdk 0.0.1 → 0.0.2

package/dist/plugin.d.ts

@@ -1,35 +1,269 @@
 import type { Effect } from "effect";
-import type { ToolRegistry } from "./tools";
-import type { SecretStore } from "./secrets";
-import type { PolicyEngine } from "./policies";
-import type { SourceRegistry } from "./sources";
+import type { DBAdapter, DBSchema, StorageFailure, TypedAdapter } from "@executor-js/storage-core";
+import type { PluginBlobStore } from "./blob";
+import type { ConnectionProvider, ConnectionRef, ConnectionRefreshError, CreateConnectionInput, UpdateConnectionTokensInput } from "./connections";
+import type { DefinitionsInput, SourceInput, ToolAnnotations, ToolRow } from "./core-schema";
+import type { SourceDetectionResult } from "./types";
+import type { ElicitationDeclinedError, ElicitationHandler, ElicitationRequest, ElicitationResponse } from "./elicitation";
+import type { ConnectionNotFoundError, ConnectionProviderNotRegisteredError, ConnectionReauthRequiredError, ConnectionRefreshNotSupportedError, SecretOwnedByConnectionError } from "./errors";
+import type { OAuthService } from "./oauth";
 import type { Scope } from "./scope";
-export interface PluginContext {
-    readonly scope: Scope;
-    readonly tools: Context.Tag.Service<typeof ToolRegistry>;
-    readonly sources: Context.Tag.Service<typeof SourceRegistry>;
-    readonly secrets: Context.Tag.Service<typeof SecretStore>;
-    readonly policies: Context.Tag.Service<typeof PolicyEngine>;
-}
-export interface ExecutorPlugin<TKey extends string = string, TExtension extends object = object> {
-    /** Unique plugin key — becomes a property on the Executor type */
-    readonly key: TKey;
+import type { SecretProvider, SecretRef, SetSecretInput } from "./secrets";
+export interface StorageDeps<TSchema extends DBSchema | undefined = undefined> {
     /**
-     * Called when the executor starts. The plugin should register its tools
-     * and return any cleanup logic + its public extension API.
+     * Precedence-ordered scope stack visible to this executor. Innermost
+     * first. Reads on scoped tables walk every scope; writes require the
+     * plugin to name a target scope explicitly (via `scope_id` on the
+     * adapter payload, via `options.scope` on the blob store).
      */
-    readonly init: (ctx: PluginContext) => Effect.Effect<PluginHandle<TExtension>, Error>;
+    readonly scopes: readonly Scope[];
+    /**
+     * Plugin-facing typed adapter. Failures surface as raw `StorageFailure`
+     * (`StorageError` | `UniqueViolationError`). Plugins can
+     * `catchTag("UniqueViolationError", …)` to translate to their own
+     * user-facing errors. `StorageError` bubbles up; the HTTP edge (see
+     * `@executor-js/api` `withCapture`) is the one place that
+     * translates it to the opaque `InternalError({ traceId })`.
+     */
+    readonly adapter: TSchema extends DBSchema ? TypedAdapter<TSchema, StorageFailure> : DBAdapter;
+    readonly blobs: PluginBlobStore;
+}
+export declare const defineSchema: <const S extends DBSchema>(schema: S) => S;
+export type Elicit = (request: ElicitationRequest) => Effect.Effect<ElicitationResponse, ElicitationDeclinedError>;
+export interface PluginCtx<TStore = unknown> {
+    /**
+     * Precedence-ordered scope stack visible to this executor. Innermost
+     * first. Plugins that write scoped rows must pick an element of
+     * `scopes` as the `scope`/`scope_id` they stamp; reads through the
+     * adapter or `ctx.secrets` automatically fall through the stack.
+     */
+    readonly scopes: readonly Scope[];
+    readonly storage: TStore;
+    readonly core: {
+        readonly sources: {
+            readonly register: (input: SourceInput) => Effect.Effect<void, StorageFailure>;
+            readonly unregister: (sourceId: string) => Effect.Effect<void, StorageFailure>;
+            readonly update: (input: {
+                readonly id: string;
+                readonly scope: string;
+                readonly name?: string;
+                readonly url?: string | null;
+            }) => Effect.Effect<void, StorageFailure>;
+        };
+        /** Register shared JSON-schema `$defs` for a source. Tool
+         *  input/output schemas registered via `sources.register` can carry
+         *  `$ref: "#/$defs/X"` pointers; `executor.tools.schema(toolId)`
+         *  attaches matching defs to the returned schema. Call inside the
+         *  same `ctx.transaction` as `sources.register` for atomicity.
+         *  Replaces any existing defs for the given sourceId. */
+        readonly definitions: {
+            readonly register: (input: DefinitionsInput) => Effect.Effect<void, StorageFailure>;
+        };
+    };
+    readonly secrets: {
+        readonly get: (id: string) => Effect.Effect<string | null, SecretOwnedByConnectionError | StorageFailure>;
+        /** List user-visible secrets. Connection-owned secrets (rows with
+         *  `owned_by_connection_id` set) are filtered out so they don't
+         *  clutter the UI — users see the Connection instead. */
+        readonly list: () => Effect.Effect<readonly {
+            readonly id: string;
+            readonly name: string;
+            readonly provider: string;
+        }[], StorageFailure>;
+        /** Write a secret value through a provider. Used by plugins that
+         *  mint secrets on behalf of the user (OAuth2 token storage,
+         *  interactive onboarding flows). Normally writes go through
+         *  `executor.secrets.set` on the host surface, but OAuth2 refresh
+         *  and one-shot token capture from plugin-owned flows need it here
+         *  too. Same routing rules as the host-level setter. */
+        readonly set: (input: SetSecretInput) => Effect.Effect<SecretRef, StorageFailure>;
+        /** Delete a secret from its pinned provider and the core table.
+         *  Rejects with `SecretOwnedByConnectionError` if the row is owned
+         *  by a connection — callers must go through `connections.remove`
+         *  to drop the whole sign-in. */
+        readonly remove: (id: string) => Effect.Effect<void, SecretOwnedByConnectionError | StorageFailure>;
+    };
+    /** Connections — product-level sign-in state. Owns backing secret
+     *  rows via `secret.owned_by_connection_id`. Plugins call
+     *  `connections.accessToken(id)` at invoke time to get a guaranteed-
+     *  fresh token (the SDK handles refresh via the registered provider
+     *  keyed by `connection.provider`). */
+    readonly connections: {
+        readonly get: (id: string) => Effect.Effect<ConnectionRef | null, StorageFailure>;
+        readonly list: () => Effect.Effect<readonly ConnectionRef[], StorageFailure>;
+        readonly create: (input: CreateConnectionInput) => Effect.Effect<ConnectionRef, ConnectionProviderNotRegisteredError | StorageFailure>;
+        readonly updateTokens: (input: UpdateConnectionTokensInput) => Effect.Effect<ConnectionRef, ConnectionNotFoundError | StorageFailure>;
+        readonly setIdentityLabel: (id: string, label: string | null) => Effect.Effect<void, ConnectionNotFoundError | StorageFailure>;
+        /** Get a guaranteed-fresh access token. Calls the provider's
+         *  `refresh` handler if `expires_at` is in the past / within the
+         *  refresh skew window. */
+        readonly accessToken: (id: string) => Effect.Effect<string, ConnectionNotFoundError | ConnectionProviderNotRegisteredError | ConnectionRefreshNotSupportedError | ConnectionReauthRequiredError | ConnectionRefreshError | StorageFailure>;
+        readonly remove: (id: string) => Effect.Effect<void, StorageFailure>;
+    };
+    /** Shared OAuth service. Plugins use this to probe/start/complete OAuth
+     *  flows; invocation should still resolve tokens via `connections.accessToken`. */
+    readonly oauth: OAuthService;
+    /** Run `effect` inside a database transaction. Wraps the underlying
+     *  adapter's transaction method. Use this in extension methods that
+     *  need atomicity across plugin storage writes AND core source/tool
+     *  registration. */
+    readonly transaction: <A, E>(effect: Effect.Effect<A, E>) => Effect.Effect<A, E | StorageFailure>;
+}
+export interface StaticToolHandlerInput<TStore = unknown> {
+    readonly ctx: PluginCtx<TStore>;
+    readonly args: unknown;
+    /** Suspend the fiber to request user input. The handler passed to
+     *  `createExecutor({ onElicitation })` is called. */
+    readonly elicit: Elicit;
+}
+export interface StaticToolDecl<TStore = unknown> {
+    readonly name: string;
+    readonly description: string;
+    readonly inputSchema?: unknown;
+    readonly outputSchema?: unknown;
+    /** Default-policy annotations — `requiresApproval`, `approvalDescription`,
+     *  `mayElicit`. Enforced by the executor before the handler runs.
+     *  Inline because static tools have no plugin storage to resolve from;
+     *  the plugin author literally writes this at definition time. */
+    readonly annotations?: ToolAnnotations;
+    readonly handler: (input: StaticToolHandlerInput<TStore>) => Effect.Effect<unknown, unknown>;
 }
-export interface PluginHandle<TExtension extends object = object> {
-    /** Plugin's public API — exposed on the executor as `executor[plugin.key]` */
-    readonly extension: TExtension;
-    /** Called when the executor shuts down */
-    readonly close?: () => Effect.Effect<void>;
+export interface StaticSourceDecl<TStore = unknown> {
+    readonly id: string;
+    readonly kind: string;
+    readonly name: string;
+    readonly url?: string;
+    /** Static sources default to `canRemove: false` — they represent
+     *  plugin-provided control surfaces and shouldn't be user-removable.
+     *  Override only if you really want that. */
+    readonly canRemove?: boolean;
+    readonly canRefresh?: boolean;
+    readonly canEdit?: boolean;
+    readonly tools: readonly StaticToolDecl<TStore>[];
 }
-/** Maps a tuple of plugins to their extensions keyed by plugin key */
-export type PluginExtensions<TPlugins extends readonly ExecutorPlugin<string, object>[]> = {
-    readonly [P in TPlugins[number] as P["key"]]: P extends ExecutorPlugin<string, infer TExt> ? TExt : never;
+export interface InvokeToolInput<TStore = unknown> {
+    readonly ctx: PluginCtx<TStore>;
+    /** Already-loaded tool row. Plugin doesn't need to re-fetch or parse
+     *  the tool id. Carries source_id, name, input/output schemas,
+     *  annotations. */
+    readonly toolRow: ToolRow;
+    readonly args: unknown;
+    /** Elicitation handle for plugins that need mid-invocation user input
+     *  (onepassword auth prompt, interactive MCP tools, etc.). */
+    readonly elicit: Elicit;
+}
+export interface SourceLifecycleInput<TStore = unknown> {
+    readonly ctx: PluginCtx<TStore>;
+    readonly sourceId: string;
+    /**
+     * Scope of the source row being removed/refreshed — resolved by the
+     * SDK's `sources.remove` / `sources.refresh` via innermost-wins lookup
+     * across the executor's scope stack. Plugins that own a side table
+     * keyed by (id, scope_id) must pin their own cleanup to this scope;
+     * relying on the scoped adapter's `scope_id IN (stack)` fall-through
+     * would widen the mutation across the whole stack and wipe a
+     * shadowed outer-scope row.
+     */
+    readonly scope: string;
+}
+export interface PluginSpec<TId extends string = string, TExtension extends object = Record<string, never>, TStore = unknown, TSchema extends DBSchema | undefined = DBSchema | undefined> {
+    readonly id: TId;
+    /** Plugin-declared schema. Merged with coreSchema and other plugins'
+     *  schemas at executor startup via `collectSchemas`. The type flows
+     *  into the `storage` factory's `deps.adapter` as a `TypedAdapter<TSchema>`
+     *  so plugins get narrowed model names + typed rows for free. */
+    readonly schema?: TSchema;
+    /** Build the plugin's typed store from backing. `deps.adapter` is
+     *  already narrowed to this plugin's schema; `deps.blobs` is already
+     *  scoped to the plugin id so key collisions across plugins are
+     *  structurally impossible. */
+    readonly storage: (deps: StorageDeps<TSchema>) => TStore;
+    /** Build the plugin's extension API. The returned object becomes
+     *  `executor[plugin.id]` and is also the `self` passed to
+     *  `staticSources`. Field order matters: `extension` MUST appear
+     *  before `staticSources` so TS infers TExtension from this
+     *  factory's return BEFORE type-checking `self: NoInfer<TExtension>`. */
+    readonly extension?: (ctx: PluginCtx<TStore>) => TExtension;
+    /** Static sources contributed by this plugin with inline tool
+     *  handlers. Lives entirely in memory — no DB writes at startup.
+     *  Handlers close over `self` via the closure, so a control tool
+     *  that delegates to the plugin's real API is a one-liner:
+     *  `({ args }) => self.addSpec(args)`. */
+    readonly staticSources?: (self: NoInfer<TExtension>) => readonly StaticSourceDecl<TStore>[];
+    /** Invoke a dynamic tool. Called when the executor's static-handler
+     *  map doesn't have the toolId. The plugin reads its own enrichment
+     *  via `ctx.storage` and returns the result. Optional — plugins with
+     *  only static tools can omit it. */
+    readonly invokeTool?: (input: InvokeToolInput<TStore>) => Effect.Effect<unknown, unknown>;
+    /** Bulk resolve annotations (requiresApproval, approvalDescription,
+     *  mayElicit) for a set of tool rows under a single source. Called
+     *  by the executor:
+     *    - at invoke time with a single-element `toolRows` array, to
+     *      enforce approval on the about-to-run tool
+     *    - at list time with every dynamic tool row under each source,
+     *      grouped by source_id, to populate `Tool.annotations` for UI
+     *
+     *  The expected implementation for most plugins is: read plugin
+     *  storage once for the given source/rows, derive annotations from
+     *  the same data that was used to build the tool (HTTP method +
+     *  path for openapi, introspection kind for graphql, etc.), return
+     *  a map keyed by tool id.
+     *
+     *  Omit if the plugin has no annotations to contribute — executor
+     *  treats tools from that plugin as auto-approved with no
+     *  elicitation. */
+    readonly resolveAnnotations?: (input: {
+        readonly ctx: PluginCtx<TStore>;
+        readonly sourceId: string;
+        readonly toolRows: readonly ToolRow[];
+    }) => Effect.Effect<Record<string, ToolAnnotations>, unknown>;
+    /** Called when `executor.sources.remove(id)` targets a source owned
+     *  by this plugin. Plugin-side cleanup only; the executor deletes
+     *  the core source/tool rows after this callback returns, inside
+     *  the same transaction. */
+    readonly removeSource?: (input: SourceLifecycleInput<TStore>) => Effect.Effect<void, unknown>;
+    readonly refreshSource?: (input: SourceLifecycleInput<TStore>) => Effect.Effect<void, unknown>;
+    /** URL autodetection hook. When the user pastes a URL in the
+     *  onboarding UI, `executor.sources.detect(url)` fans out to every
+     *  plugin's `detect`. Return a `SourceDetectionResult` if you
+     *  recognize the URL, `null` otherwise. Implementations should be
+     *  defensive — swallow fetch errors and return null rather than
+     *  throwing. First high-confidence match wins. */
+    readonly detect?: (input: {
+        readonly ctx: PluginCtx<TStore>;
+        readonly url: string;
+    }) => Effect.Effect<SourceDetectionResult | null, unknown>;
+    /** Secret providers contributed by this plugin. Either a static
+     *  array, a function of ctx (for providers that need per-instance
+     *  state like the keychain's scope-derived service name), or a
+     *  function returning an Effect so plugins can probe for backend
+     *  availability at startup and register conditionally. Called once
+     *  at executor startup after `storage` and `extension` have been
+     *  built. */
+    readonly secretProviders?: readonly SecretProvider[] | ((ctx: PluginCtx<TStore>) => readonly SecretProvider[]) | ((ctx: PluginCtx<TStore>) => Effect.Effect<readonly SecretProvider[]>);
+    /** Connection providers contributed by this plugin. Same registration
+     *  shape as `secretProviders`. Each provider's `key` is what
+     *  `connection.provider` references in the core table; the `refresh`
+     *  handler is the SDK's single entry point for token lifecycle —
+     *  plugins don't run their own refresh loops anymore. */
+    readonly connectionProviders?: readonly ConnectionProvider[] | ((ctx: PluginCtx<TStore>) => readonly ConnectionProvider[]) | ((ctx: PluginCtx<TStore>) => Effect.Effect<readonly ConnectionProvider[]>);
+    readonly close?: () => Effect.Effect<void, unknown>;
+}
+export interface Plugin<TId extends string = string, TExtension extends object = Record<string, never>, TStore = unknown, TSchema extends DBSchema | undefined = DBSchema | undefined> extends PluginSpec<TId, TExtension, TStore, TSchema> {
+}
+export type ConfiguredPlugin<TId extends string, TExtension extends object, TStore, TOptions extends object, TSchema extends DBSchema | undefined> = (options?: TOptions & {
+    readonly storage?: (deps: StorageDeps<TSchema>) => TStore;
+}) => Plugin<TId, TExtension, TStore, TSchema>;
+export declare function definePlugin<TId extends string, TExtension extends object, TStore, TSchema extends DBSchema | undefined = undefined, TOptions extends object = {}>(authorFactory: (options?: TOptions) => PluginSpec<TId, TExtension, TStore, TSchema>): ConfiguredPlugin<TId, TExtension, TStore, TOptions, TSchema>;
+export type AnyPlugin = Plugin<string, any, any, any>;
+export type PluginExtensions<TPlugins extends readonly AnyPlugin[]> = {
+    readonly [P in TPlugins[number] as P["id"]]: P extends Plugin<string, infer TExt, any, any> ? TExt : never;
 };
-import type { Context } from "effect";
-export declare const definePlugin: <const TKey extends string, TExtension extends object>(plugin: ExecutorPlugin<TKey, TExtension>) => ExecutorPlugin<TKey, TExtension>;
+/** Lightweight projection of a secret entry as returned by `ctx.secrets.list`. */
+export interface SecretListEntry {
+    readonly id: string;
+    readonly name: string;
+    readonly provider: string;
+}
+export type { ElicitationHandler };
 //# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAMrC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,YAAY,CAAC,CAAC;IACzD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,cAAc,CAAC,CAAC;IAC7D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,WAAW,CAAC,CAAC;IAC1D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,YAAY,CAAC,CAAC;CAC7D;AAMD,MAAM,WAAW,cAAc,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM,EAAE,UAAU,SAAS,MAAM,GAAG,MAAM;IAC9F,kEAAkE;IAClE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IAEnB;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;CACvF;AAED,MAAM,WAAW,YAAY,CAAC,UAAU,SAAS,MAAM,GAAG,MAAM;IAC9D,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,0CAA0C;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAC5C;AAMD,sEAAsE;AACtE,MAAM,MAAM,gBAAgB,CAAC,QAAQ,SAAS,SAAS,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI;IACzF,QAAQ,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,cAAc,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,GACtF,IAAI,GACJ,KAAK;CACV,CAAC;AAGF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAMtC,eAAO,MAAM,YAAY,GAAI,KAAK,CAAC,IAAI,SAAS,MAAM,EAAE,UAAU,SAAS,MAAM,EAC/E,QAAQ,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,KACvC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAW,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EACV,SAAS,EACT,QAAQ,EACR,cAAc,EACd,YAAY,EACb,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,EACV,kBAAkB,EAClB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,OAAO,EACR,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,KAAK,EACV,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,uBAAuB,EACvB,oCAAoC,EACpC,6BAA6B,EAC7B,kCAAkC,EAClC,4BAA4B,EAC7B,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAc3E,MAAM,WAAW,WAAW,CAAC,OAAO,SAAS,QAAQ,GAAG,SAAS,GAAG,SAAS;IAC3E;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,SAAS,QAAQ,GACtC,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC,GACrC,SAAS,CAAC;IACd,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;CACjC;AASD,eAAO,MAAM,YAAY,GAAI,KAAK,CAAC,CAAC,SAAS,QAAQ,EAAE,QAAQ,CAAC,KAAG,CAAW,CAAC;AAS/E,MAAM,MAAM,MAAM,GAAG,CACnB,OAAO,EAAE,kBAAkB,KACxB,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,CAAC;AAQlE,MAAM,WAAW,SAAS,CAAC,MAAM,GAAG,OAAO;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,OAAO,EAAE;YAChB,QAAQ,CAAC,QAAQ,EAAE,CACjB,KAAK,EAAE,WAAW,KACf,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACzC,QAAQ,CAAC,UAAU,EAAE,CACnB,QAAQ,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACzC,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;gBACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;gBACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;gBACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;aAC9B,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;SAC3C,CAAC;QACF;;;;;iEAKyD;QACzD,QAAQ,CAAC,WAAW,EAAE;YACpB,QAAQ,CAAC,QAAQ,EAAE,CACjB,KAAK,EAAE,gBAAgB,KACpB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;SAC1C,CAAC;KACH,CAAC;IAEF,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,GAAG,EAAE,CACZ,EAAE,EAAE,MAAM,KACP,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,4BAA4B,GAAG,cAAc,CAAC,CAAC;QACjF;;iEAEyD;QACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,MAAM,CAAC,MAAM,CAChC,SAAS;YAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,EAAE,EACpF,cAAc,CACf,CAAC;QACF;;;;;gEAKwD;QACxD,QAAQ,CAAC,GAAG,EAAE,CACZ,KAAK,EAAE,cAAc,KAClB,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAC9C;;;yCAGiC;QACjC,QAAQ,CAAC,MAAM,EAAE,CACf,EAAE,EAAE,MAAM,KACP,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,4BAA4B,GAAG,cAAc,CAAC,CAAC;KACzE,CAAC;IAEF;;;;2CAIuC;IACvC,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,GAAG,EAAE,CACZ,EAAE,EAAE,MAAM,KACP,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,EAAE,cAAc,CAAC,CAAC;QACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,aAAa,EAAE,EAAE,cAAc,CAAC,CAAC;QAC7E,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,qBAAqB,KACzB,MAAM,CAAC,MAAM,CAChB,aAAa,EACb,oCAAoC,GAAG,cAAc,CACtD,CAAC;QACF,QAAQ,CAAC,YAAY,EAAE,CACrB,KAAK,EAAE,2BAA2B,KAC/B,MAAM,CAAC,MAAM,CAChB,aAAa,EACb,uBAAuB,GAAG,cAAc,CACzC,CAAC;QACF,QAAQ,CAAC,gBAAgB,EAAE,CACzB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,GAAG,IAAI,KACjB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,cAAc,CAAC,CAAC;QACnE;;mCAE2B;QAC3B,QAAQ,CAAC,WAAW,EAAE,CACpB,EAAE,EAAE,MAAM,KACP,MAAM,CAAC,MAAM,CAChB,MAAM,EACJ,uBAAuB,GACvB,oCAAoC,GACpC,kCAAkC,GAClC,6BAA6B,GAC7B,sBAAsB,GACtB,cAAc,CACjB,CAAC;QACF,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;KACtE,CAAC;IAEF;uFACmF;IACnF,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAE7B;;;wBAGoB;IACpB,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,EACzB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,KACxB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC;CAC3C;AAcD,MAAM,WAAW,sBAAsB,CAAC,MAAM,GAAG,OAAO;IACtD,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB;yDACqD;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc,CAAC,MAAM,GAAG,OAAO;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC;;;sEAGkE;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,CAChB,KAAK,EAAE,sBAAsB,CAAC,MAAM,CAAC,KAClC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB,CAAC,MAAM,GAAG,OAAO;IAChD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;iDAE6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;CACnD;AAMD,MAAM,WAAW,eAAe,CAAC,MAAM,GAAG,OAAO;IAC/C,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC;;uBAEmB;IACnB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB;kEAC8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB,CAAC,MAAM,GAAG,OAAO;IACpD,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAMD,MAAM,WAAW,UAAU,CACzB,GAAG,SAAS,MAAM,GAAG,MAAM,EAC3B,UAAU,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EACjD,MAAM,GAAG,OAAO,EAChB,OAAO,SAAS,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS;IAE3D,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC;IACjB;;;qEAGiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B;;;mCAG+B;IAC/B,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC;IAEzD;;;;6EAIyE;IACzE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC;IAE5D;;;;8CAI0C;IAC1C,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,KACtB,SAAS,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;IAEzC;;;yCAGqC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,CACpB,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAErC;;;;;;;;;;;;;;;;uBAgBmB;IACnB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE;QACpC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;KACvC,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,OAAO,CAAC,CAAC;IAE9D;;;gCAG4B;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,CACtB,KAAK,EAAE,oBAAoB,CAAC,MAAM,CAAC,KAChC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAElC,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,KAAK,EAAE,oBAAoB,CAAC,MAAM,CAAC,KAChC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAElC;;;;;sDAKkD;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE;QACxB,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,KAAK,MAAM,CAAC,MAAM,CAAC,qBAAqB,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAE3D;;;;;;iBAMa;IACb,QAAQ,CAAC,eAAe,CAAC,EACrB,SAAS,cAAc,EAAE,GACzB,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,SAAS,cAAc,EAAE,CAAC,GACvD,CAAC,CACC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,KACnB,MAAM,CAAC,MAAM,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC,CAAC;IAEnD;;;;6DAIyD;IACzD,QAAQ,CAAC,mBAAmB,CAAC,EACzB,SAAS,kBAAkB,EAAE,GAC7B,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,SAAS,kBAAkB,EAAE,CAAC,GAC3D,CAAC,CACC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,KACnB,MAAM,CAAC,MAAM,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAEvD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,MAAM,CACrB,GAAG,SAAS,MAAM,GAAG,MAAM,EAC3B,UAAU,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EACjD,MAAM,GAAG,OAAO,EAChB,OAAO,SAAS,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAC3D,SAAQ,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;CAAG;AAQzD,MAAM,MAAM,gBAAgB,CAC1B,GAAG,SAAS,MAAM,EAClB,UAAU,SAAS,MAAM,EACzB,MAAM,EACN,QAAQ,SAAS,MAAM,EACvB,OAAO,SAAS,QAAQ,GAAG,SAAS,IAClC,CACF,OAAO,CAAC,EAAE,QAAQ,GAAG;IACnB,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC;CAC3D,KACE,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAG9C,wBAAgB,YAAY,CAC1B,GAAG,SAAS,MAAM,EAClB,UAAU,SAAS,MAAM,EACzB,MAAM,EACN,OAAO,SAAS,QAAQ,GAAG,SAAS,GAAG,SAAS,EAChD,QAAQ,SAAS,MAAM,GAAG,EAAE,EAE5B,aAAa,EAAE,CACb,OAAO,CAAC,EAAE,QAAQ,KACf,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,GAChD,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAoB9D;AAOD,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAEtD,MAAM,MAAM,gBAAgB,CAAC,QAAQ,SAAS,SAAS,SAAS,EAAE,IAAI;IACpE,QAAQ,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,MAAM,CAC3D,MAAM,EACN,MAAM,IAAI,EAEV,GAAG,EAEH,GAAG,CACJ,GACG,IAAI,GACJ,KAAK;CACV,CAAC;AAEF,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAGD,YAAY,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/policies.d.ts

@@ -1,70 +1,62 @@
-import { Context, Effect, Schema } from "effect";
+import { Schema } from "effect";
+import type { ToolPolicyAction, ToolPolicyRow } from "./core-schema";
 import { PolicyId, ScopeId } from "./ids";
-import { PolicyDeniedError } from "./errors";
-export declare const PolicyAction: Schema.Literal<["allow", "deny", "require_approval"]>;
-export type PolicyAction = typeof PolicyAction.Type;
-declare const Policy_base: Schema.Class<Policy, {
-    id: Schema.brand<typeof Schema.String, "PolicyId">;
-    scopeId: Schema.brand<typeof Schema.String, "ScopeId">;
-    name: typeof Schema.String;
-    action: Schema.Literal<["allow", "deny", "require_approval"]>;
-    match: Schema.Struct<{
-        toolPattern: Schema.optional<typeof Schema.String>;
-        sourceId: Schema.optional<typeof Schema.String>;
-    }>;
-    priority: typeof Schema.Number;
-    createdAt: typeof Schema.DateFromNumber;
-}, Schema.Struct.Encoded<{
-    id: Schema.brand<typeof Schema.String, "PolicyId">;
-    scopeId: Schema.brand<typeof Schema.String, "ScopeId">;
-    name: typeof Schema.String;
-    action: Schema.Literal<["allow", "deny", "require_approval"]>;
-    match: Schema.Struct<{
-        toolPattern: Schema.optional<typeof Schema.String>;
-        sourceId: Schema.optional<typeof Schema.String>;
-    }>;
-    priority: typeof Schema.Number;
-    createdAt: typeof Schema.DateFromNumber;
-}>, never, {
-    readonly action: "allow" | "deny" | "require_approval";
-} & {
-    readonly id: string & import("effect/Brand").Brand<"PolicyId">;
-} & {
-    readonly scopeId: string & import("effect/Brand").Brand<"ScopeId">;
-} & {
-    readonly name: string;
-} & {
+export interface ToolPolicy {
+    readonly id: PolicyId;
+    readonly scopeId: ScopeId;
+    readonly pattern: string;
+    readonly action: ToolPolicyAction;
+    /** Fractional-indexing key. Lower lex order = higher precedence.
+     *  Use `generateKeyBetween(a, b)` from the `fractional-indexing`
+     *  package to produce a key that sits between two existing rows. */
+    readonly position: string;
     readonly createdAt: Date;
-} & {
-    readonly priority: number;
-} & {
-    readonly match: {
-        readonly sourceId?: string | undefined;
-        readonly toolPattern?: string | undefined;
-    };
-}, {}, {}>;
-export declare class Policy extends Policy_base {
+    readonly updatedAt: Date;
 }
-declare const PolicyCheckInput_base: Schema.Class<PolicyCheckInput, {
-    scopeId: Schema.brand<typeof Schema.String, "ScopeId">;
-    toolId: Schema.brand<typeof Schema.String, "ToolId">;
-}, Schema.Struct.Encoded<{
-    scopeId: Schema.brand<typeof Schema.String, "ScopeId">;
-    toolId: Schema.brand<typeof Schema.String, "ToolId">;
-}>, never, {
-    readonly toolId: string & import("effect/Brand").Brand<"ToolId">;
-} & {
-    readonly scopeId: string & import("effect/Brand").Brand<"ScopeId">;
-}, {}, {}>;
-export declare class PolicyCheckInput extends PolicyCheckInput_base {
+export interface CreateToolPolicyInput {
+    readonly scope: string;
+    readonly pattern: string;
+    readonly action: ToolPolicyAction;
+    /** Optional explicit position. Defaults to a key above the current
+     *  minimum (top of the scope's list; highest precedence). */
+    readonly position?: string;
 }
-declare const PolicyEngine_base: Context.TagClass<PolicyEngine, "@executor-js/sdk/PolicyEngine", {
-    readonly list: (scopeId: ScopeId) => Effect.Effect<readonly Policy[]>;
-    readonly check: (input: PolicyCheckInput) => Effect.Effect<void, PolicyDeniedError>;
-    readonly add: (policy: Omit<Policy, "id" | "createdAt">) => Effect.Effect<Policy>;
-    readonly remove: (policyId: PolicyId) => Effect.Effect<boolean>;
-}>;
-export declare class PolicyEngine extends PolicyEngine_base {
+export interface UpdateToolPolicyInput {
+    readonly id: string;
+    readonly pattern?: string;
+    readonly action?: ToolPolicyAction;
+    readonly position?: string;
 }
-export {};
+export interface PolicyMatch {
+    readonly action: ToolPolicyAction;
+    readonly pattern: string;
+    readonly policyId: string;
+}
+export type PolicySource = "user" | "plugin-default";
+export interface EffectivePolicy {
+    readonly action: ToolPolicyAction;
+    readonly source: PolicySource;
+    /** Matched pattern; populated only when `source === "user"`. */
+    readonly pattern?: string;
+    /** Policy row id; populated only when `source === "user"`. */
+    readonly policyId?: string;
+}
+export declare const matchPattern: (pattern: string, toolId: string) => boolean;
+export declare const isValidPattern: (pattern: string) => boolean;
+export declare const comparePolicyRow: (a: {
+    position: unknown;
+    id: unknown;
+}, b: {
+    position: unknown;
+    id: unknown;
+}) => number;
+export declare const resolveToolPolicy: (toolId: string, policies: readonly ToolPolicyRow[], scopeRank: (row: {
+    scope_id: unknown;
+}) => number) => PolicyMatch | undefined;
+export declare const resolveEffectivePolicy: (toolId: string, policies: readonly ToolPolicyRow[], scopeRank: (row: {
+    scope_id: unknown;
+}) => number, defaultRequiresApproval?: boolean) => EffectivePolicy;
+export declare const effectivePolicyFromSorted: (toolId: string, sortedPolicies: readonly Pick<ToolPolicy, "pattern" | "action" | "id">[], defaultRequiresApproval?: boolean) => EffectivePolicy;
+export declare const rowToToolPolicy: (row: ToolPolicyRow) => ToolPolicy;
+export declare const ToolPolicyActionSchema: Schema.Literals<readonly ["approve", "require_approval", "block"]>;
 //# sourceMappingURL=policies.d.ts.map

package/dist/policies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policies.d.ts","sourceRoot":"","sources":["../src/policies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEjD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAU,MAAM,OAAO,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C,eAAO,MAAM,YAAY,uDAAsD,CAAC;AAChF,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEpD,qBAAa,MAAO,SAAQ,WAW1B;CAAG;;;;;;;;;;;;AAEL,qBAAa,gBAAiB,SAAQ,qBAGpC;CAAG;;mBAKc,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,MAAM,EAAE,CAAC;oBACrD,CAAC,KAAK,EAAE,gBAAgB,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,iBAAiB,CAAC;kBACrE,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,WAAW,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;qBAChE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;;AANnE,qBAAa,YAAa,SAAQ,iBAQ/B;CAAG"}
+{"version":3,"file":"policies.d.ts","sourceRoot":"","sources":["../src/policies.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAQ1C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC;;wEAEoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC;iEAC6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAQD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAaD,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,gBAAgB,CAAC;AAErD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAYD,eAAO,MAAM,YAAY,GAAI,SAAS,MAAM,EAAE,QAAQ,MAAM,KAAG,OAS9D,CAAC;AAOF,eAAO,MAAM,cAAc,GAAI,SAAS,MAAM,KAAG,OAehD,CAAC;AAcF,eAAO,MAAM,gBAAgB,GAC3B,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,OAAO,CAAA;CAAE,EACrC,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,OAAO,CAAA;CAAE,KACpC,MAQF,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAC5B,QAAQ,MAAM,EACd,UAAU,SAAS,aAAa,EAAE,EAClC,WAAW,CAAC,GAAG,EAAE;IAAE,QAAQ,EAAE,OAAO,CAAA;CAAE,KAAK,MAAM,KAChD,WAAW,GAAG,SAkBhB,CAAC;AA8BF,eAAO,MAAM,sBAAsB,GACjC,QAAQ,MAAM,EACd,UAAU,SAAS,aAAa,EAAE,EAClC,WAAW,CAAC,GAAG,EAAE;IAAE,QAAQ,EAAE,OAAO,CAAA;CAAE,KAAK,MAAM,EACjD,0BAA0B,OAAO,KAChC,eAGF,CAAC;AAEF,eAAO,MAAM,yBAAyB,GACpC,QAAQ,MAAM,EACd,gBAAgB,SAAS,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,EAAE,EACxE,0BAA0B,OAAO,KAChC,eAYF,CAAC;AAMF,eAAO,MAAM,eAAe,GAAI,KAAK,aAAa,KAAG,UAQnD,CAAC;AAOH,eAAO,MAAM,sBAAsB,oEAIjC,CAAC"}

package/dist/policies.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=policies.test.d.ts.map

package/dist/policies.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.test.d.ts","sourceRoot":"","sources":["../src/policies.test.ts"],"names":[],"mappings":""}