@guilz-dev/belay 0.6.0 → 0.8.0

package/dist/core/capability/boundary-session.js

@@ -51,6 +51,9 @@ export function hostIntegrationBoundaryContext(repoRoot) {
             egressProxyActive: false,
             proxyEnv: {},
         },
+        attestationPath: '',
+        attestation: null,
+        attestationFresh: false,
     };
 }
 export async function resolveBoundaryDriverContext(params) {
@@ -74,6 +77,8 @@ export async function resolveBoundaryDriverContext(params) {
         egressProxyEnv: proxyEnv,
         repoRoot: params.repoRoot,
     });
+    const attestationPath = boundaryAttestationPath(params.repoRoot, params.config);
+    const attestation = await loadBoundaryAttestation(attestationPath, params.repoRoot, configuredControlPlaneDir(params.config));
     return {
         driver,
         driverId,
@@ -84,6 +89,9 @@ export async function resolveBoundaryDriverContext(params) {
             egressProxyActive: proxyActive,
             proxyEnv,
         },
+        attestationPath,
+        attestation,
+        attestationFresh: attestation ? isAttestationFresh(attestation) : false,
     };
 }
 export async function runWithBoundaryDriver(params) {
@@ -124,6 +132,7 @@ export async function runBoundaryAgentCommand(params) {
         command: params.command,
         cwd: params.cwd ?? params.repoRoot,
         timeoutMs: params.timeoutMs ?? 30 * 60_000,
+        runOptions: params.runOptions,
     });
 }
 export { dockerNetworkArgs };

package/dist/core/capability/boundary-workspace-mount.d.ts

@@ -0,0 +1,5 @@
+import type { BoundaryWorkspaceMount } from './boundary-run.js';
+export declare function validateWorkspaceMount(mount: BoundaryWorkspaceMount): void;
+export declare function resolveGuestWorkdir(mount: BoundaryWorkspaceMount): string;
+export declare function buildWorkspaceMountSpec(mount: BoundaryWorkspaceMount): string;
+export declare function workspaceMountEnvArgs(mount: BoundaryWorkspaceMount): string[];

package/dist/core/capability/boundary-workspace-mount.js

@@ -0,0 +1,68 @@
+import path from 'node:path';
+import { canonicalPath, pathWithinRoot } from '../path-utils.js';
+const HOST_PATH_ENV_VARS = [
+    'BELAY_EGRESS_REPO_ROOT',
+    'BELAY_JUDGE_BROKER_REPO_ROOT',
+    'BELAY_JUDGE_BROKER_STATE_DIR',
+    'BELAY_REPO_ROOT',
+];
+export function validateWorkspaceMount(mount) {
+    const hostSourceRoot = canonicalPath(mount.hostSourceRoot);
+    const guestTargetRoot = canonicalPath(mount.guestTargetRoot);
+    if (!hostSourceRoot || !guestTargetRoot) {
+        throw new Error('boundary_workspace_mount_invalid_root');
+    }
+    if (hostSourceRoot.includes(',') || guestTargetRoot.includes(',')) {
+        throw new Error('boundary_workspace_mount_invalid_root');
+    }
+    if (hostSourceRoot === guestTargetRoot) {
+        throw new Error('boundary_workspace_mount_source_equals_target');
+    }
+    if (pathWithinRoot(hostSourceRoot, guestTargetRoot)) {
+        throw new Error('boundary_workspace_mount_source_contains_target');
+    }
+    if (mount.cwdRelative.includes('\0')) {
+        throw new Error('boundary_workspace_mount_invalid_cwd');
+    }
+    const normalizedRelative = path.posix.normalize(mount.cwdRelative.replace(/\\/g, '/'));
+    if (normalizedRelative === '..' || normalizedRelative.startsWith('../')) {
+        throw new Error('boundary_workspace_mount_invalid_cwd');
+    }
+    if (path.posix.isAbsolute(normalizedRelative)) {
+        throw new Error('boundary_workspace_mount_invalid_cwd');
+    }
+}
+export function resolveGuestWorkdir(mount) {
+    validateWorkspaceMount(mount);
+    const guestTargetRoot = canonicalPath(mount.guestTargetRoot);
+    const normalizedRelative = path.posix.normalize(mount.cwdRelative.replace(/\\/g, '/'));
+    if (normalizedRelative === '.' || normalizedRelative === '') {
+        return guestTargetRoot;
+    }
+    const segments = normalizedRelative.split('/').filter(Boolean);
+    return path.posix.join(guestTargetRoot, ...segments);
+}
+export function buildWorkspaceMountSpec(mount) {
+    validateWorkspaceMount(mount);
+    const hostSourceRoot = canonicalPath(mount.hostSourceRoot);
+    const guestTargetRoot = canonicalPath(mount.guestTargetRoot);
+    const readonly = mount.writable ? '' : ',readonly';
+    return `type=bind,src=${hostSourceRoot},dst=${guestTargetRoot}${readonly}`;
+}
+export function workspaceMountEnvArgs(mount) {
+    const workdir = resolveGuestWorkdir(mount);
+    if (!mount.hideHostSourcePath) {
+        return ['-e', `PWD=${workdir}`];
+    }
+    const guestTargetRoot = canonicalPath(mount.guestTargetRoot);
+    const hostSourceRoot = canonicalPath(mount.hostSourceRoot);
+    const args = [];
+    for (const key of HOST_PATH_ENV_VARS) {
+        args.push('-e', `${key}=`);
+    }
+    args.push('-e', `PWD=${workdir}`, '-e', `OLDPWD=${workdir}`, '-e', `BELAY_REPO_ROOT=${guestTargetRoot}`);
+    if (hostSourceRoot !== guestTargetRoot) {
+        args.push('-e', `BELAY_EGRESS_REPO_ROOT=${guestTargetRoot}`);
+    }
+    return args;
+}

package/dist/core/capability/gate-policy-shadow.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { belayStateDir } from '../config.js';
+import { effectPlanAuditFields } from '../effect-ir/audit.js';
 import { buildTier1Prompt } from '../verdict/judge.js';
 import { normalizeJudgeRuntimeConfig } from '../verdict/judge-runtime-config.js';
 import { judgeShadowAuditFields, recordShadowComparison, shouldRunShadowComparison, triggerJudgeSessionKillSwitch, } from '../verdict/judge-shadow.js';
@@ -7,7 +8,16 @@ import { evaluateWithJudgeTransport } from '../verdict/judge-transport.js';
 import { recordPolicyJudgeComparison } from './gate-shadow-ratchet.js';
 export { recordGateApprovalAsk } from './gate-shadow-ratchet.js';
 export function capabilityDecisionAuditFields(result) {
-    const fields = {};
+    const fields = {
+        ...effectPlanAuditFields(result.effectPlan, {
+            capabilityRequests: result.capabilityRequests,
+            decisions: result.effectPlanPolicyDecisions,
+            authorizationDecision: result.authorizationDecision,
+        }),
+        executionRoute: 'downstream_host',
+        enforcementStatus: 'prediction_only',
+        boundaryEnforcement: 'prediction_only',
+    };
     if (result.capabilityRequests?.length) {
         fields.capabilityRequestCount = result.capabilityRequests.length;
         fields.capabilityActions = result.capabilityRequests.map((request) => request.action);
@@ -19,6 +29,18 @@ export function capabilityDecisionAuditFields(result) {
             fields.policyMatchedRule = result.authorizationDecision.matchedRule;
         }
     }
+    const decisions = result.effectPlanPolicyDecisions ?? [];
+    if (decisions.length > 0 &&
+        decisions.every((decision) => decision.matchedRule === 'boundary.verified')) {
+        fields.authorizationMode = 'boundary_policy';
+    }
+    else if (decisions.length > 0 &&
+        decisions.every((decision) => decision.matchedRule === 'grant.exact')) {
+        fields.authorizationMode = 'exact_grant';
+    }
+    else {
+        fields.authorizationMode = result.authorizationDecision ? 'policy_decision' : 'none';
+    }
     if (result.boundaryProfile) {
         fields.boundaryProfile = result.boundaryProfile;
     }

package/dist/core/capability/grant-consumption.d.ts

@@ -0,0 +1,4 @@
+import type { ClassifyResult } from '../types.js';
+export declare function capabilityGrantLeaseRequired(result: Pick<ClassifyResult, 'reason' | 'authorizationDecision'>): boolean;
+/** Fail closed when a grant lease is required but capability requests are missing. */
+export declare function canConsumeCapabilityGrantLease(result: ClassifyResult): boolean;

package/dist/core/capability/grant-consumption.js

@@ -0,0 +1,11 @@
+export function capabilityGrantLeaseRequired(result) {
+    return (result.reason === 'capability_grant' ||
+        result.authorizationDecision?.matchedRule === 'grant.exact');
+}
+/** Fail closed when a grant lease is required but capability requests are missing. */
+export function canConsumeCapabilityGrantLease(result) {
+    if (!capabilityGrantLeaseRequired(result)) {
+        return true;
+    }
+    return (result.capabilityRequests?.length ?? 0) > 0;
+}

package/dist/core/capability/grant-lease.d.ts

@@ -1,9 +1,44 @@
-import type { ApprovalStateFile } from '../types.js';
+import type { ApprovalRecord, ApprovalStateFile } from '../types.js';
 import type { CapabilityGrantV1 } from './grant.js';
 import type { CapabilityRequestV1 } from './request.js';
+export type GrantBundleValidationFailureReason = 'legacy_record' | 'empty_requests' | 'cardinality_mismatch' | 'grant_scope_too_broad' | 'grant_inactive' | 'grant_mismatch';
+export type GrantBundleValidationResult = {
+    ok: true;
+    approval: ApprovalRecord;
+} | {
+    ok: false;
+    reason: GrantBundleValidationFailureReason;
+};
+export declare function grantsFromApproval(approval: {
+    grant?: CapabilityGrantV1;
+    grants?: CapabilityGrantV1[];
+}): CapabilityGrantV1[];
+export declare function approvalGrantBundleExhausted(approval: {
+    grant?: CapabilityGrantV1;
+    grants?: CapabilityGrantV1[];
+}): boolean;
+export declare function consumeApprovalGrantBundle(approval: ApprovalRecord, requests: readonly CapabilityRequestV1[]): {
+    approval: ApprovalRecord;
+    consumed: boolean;
+};
+/** Validate and consume a marked exact bundle without mutating on any failure. */
+export declare function validateAndConsumeGrantBundle(approval: ApprovalRecord, requests: readonly CapabilityRequestV1[], now?: number): GrantBundleValidationResult;
+/** Revalidate a marked bundle during an active replay lease without consuming it twice. */
+export declare function validateGrantBundleForLeaseReuse(approval: ApprovalRecord, requests: readonly CapabilityRequestV1[], now?: number): GrantBundleValidationResult;
+/** Consume every grant in an approved record after fingerprint/hash replay validation. */
+export declare function consumeApprovedRecordGrantBundle(approval: ApprovalRecord): {
+    approval: ApprovalRecord;
+    consumed: boolean;
+};
+export declare function decrementApprovalLegacyGrant(approval: ApprovalRecord): ApprovalRecord;
 export declare function grantsFromApprovedState(state: ApprovalStateFile, repoRoot: string): CapabilityGrantV1[];
 export declare function consumeGrantLease(state: ApprovalStateFile, grantId: string): {
     state: ApprovalStateFile;
     consumed: boolean;
 };
+/** Consume one lease for each request; all must succeed (atomic bundle consumption). */
+export declare function consumeGrantLeasesForRequests(state: ApprovalStateFile, requests: CapabilityRequestV1[]): {
+    state: ApprovalStateFile;
+    consumed: boolean;
+};
 export declare function findMatchingGrant(grants: CapabilityGrantV1[] | undefined, request: CapabilityRequestV1): CapabilityGrantV1 | undefined;

package/dist/core/capability/grant-lease.js

@@ -1,36 +1,212 @@
+import { canonicalStringify } from '../fingerprint.js';
 import { isGrantScopeTooBroad } from './grant.js';
 import { grantMatchesRequest } from './grant-match.js';
-export function grantsFromApprovedState(state, repoRoot) {
+function isActiveGrant(grant, now) {
+    if (isGrantScopeTooBroad(grant)) {
+        return false;
+    }
+    const expires = Date.parse(grant.expiresAt);
+    return Number.isFinite(expires) && expires > now && grant.usesRemaining > 0;
+}
+export function grantsFromApproval(approval) {
+    if (approval.grants?.length) {
+        return approval.grants;
+    }
+    if (approval.grant) {
+        return [approval.grant];
+    }
+    return [];
+}
+export function approvalGrantBundleExhausted(approval) {
+    const bundle = grantsFromApproval(approval);
+    if (!bundle.length) {
+        return false;
+    }
+    return bundle.every((grant) => grant.usesRemaining <= 0);
+}
+export function consumeApprovalGrantBundle(approval, requests) {
+    const bundle = grantsFromApproval(approval);
+    if (!bundle.length || !requests.length) {
+        return { approval, consumed: false };
+    }
+    const grants = [...bundle];
     const now = Date.now();
-    return state.approvals
-        .filter((approval) => approval.repoRoot === repoRoot)
-        .map((approval) => approval.grant)
-        .filter((grant) => {
+    for (const request of requests) {
+        const index = grants.findIndex((grant) => {
+            return isActiveGrant(grant, now) && grantMatchesRequest(grant, request);
+        });
+        if (index === -1) {
+            return { approval, consumed: false };
+        }
+        const grant = grants[index];
         if (!grant) {
-            return false;
+            return { approval, consumed: false };
         }
-        if (isGrantScopeTooBroad(grant)) {
+        grants[index] = decrementGrant(grant);
+    }
+    return {
+        approval: {
+            ...approval,
+            grants,
+            grant: grants[0],
+        },
+        consumed: true,
+    };
+}
+function exactGrantMatchesRequest(grant, request) {
+    return (persistedCanonicalStringify(grant.principal) ===
+        persistedCanonicalStringify(request.principal) &&
+        grant.action === request.action &&
+        persistedCanonicalStringify(grant.resource) === persistedCanonicalStringify(request.resource) &&
+        grant.inputFingerprint === request.context.inputFingerprint);
+}
+function validateExactGrantBundle(approval, requests, now, usage) {
+    if (approval.grantBundleVersion !== 1) {
+        return { ok: false, reason: 'legacy_record' };
+    }
+    if (!requests.length) {
+        return { ok: false, reason: 'empty_requests' };
+    }
+    const bundle = grantsFromApproval(approval);
+    if (bundle.length !== requests.length) {
+        return { ok: false, reason: 'cardinality_mismatch' };
+    }
+    if (bundle.some((grant) => isGrantScopeTooBroad(grant))) {
+        return { ok: false, reason: 'grant_scope_too_broad' };
+    }
+    const usageIsValid = bundle.every((grant) => {
+        const expires = Date.parse(grant.expiresAt);
+        if (!Number.isFinite(expires) || expires <= now) {
             return false;
         }
-        const expires = Date.parse(grant.expiresAt);
-        return Number.isFinite(expires) && expires > now && grant.usesRemaining > 0;
+        return usage === 'available'
+            ? grant.usesRemaining > 0
+            : grant.usesRemaining >= 0 && grant.usesRemaining < grant.maxUses;
     });
+    if (!usageIsValid) {
+        return { ok: false, reason: 'grant_inactive' };
+    }
+    const unmatched = [...bundle];
+    for (const request of requests) {
+        const index = unmatched.findIndex((grant) => exactGrantMatchesRequest(grant, request));
+        if (index === -1) {
+            return { ok: false, reason: 'grant_mismatch' };
+        }
+        unmatched.splice(index, 1);
+    }
+    if (unmatched.length > 0) {
+        return { ok: false, reason: 'grant_mismatch' };
+    }
+    return { ok: true, approval };
+}
+function persistedCanonicalStringify(value) {
+    return canonicalStringify(omitUndefined(value));
+}
+function omitUndefined(value) {
+    if (Array.isArray(value)) {
+        return value.map((entry) => omitUndefined(entry));
+    }
+    if (!value || typeof value !== 'object') {
+        return value;
+    }
+    return Object.fromEntries(Object.entries(value)
+        .filter(([, entry]) => entry !== undefined)
+        .map(([key, entry]) => [key, omitUndefined(entry)]));
+}
+/** Validate and consume a marked exact bundle without mutating on any failure. */
+export function validateAndConsumeGrantBundle(approval, requests, now = Date.now()) {
+    const validated = validateExactGrantBundle(approval, requests, now, 'available');
+    if (!validated.ok) {
+        return validated;
+    }
+    const grants = grantsFromApproval(approval).map((grant) => decrementGrant(grant));
+    return {
+        ok: true,
+        approval: {
+            ...approval,
+            grants,
+            grant: grants[0],
+        },
+    };
+}
+/** Revalidate a marked bundle during an active replay lease without consuming it twice. */
+export function validateGrantBundleForLeaseReuse(approval, requests, now = Date.now()) {
+    return validateExactGrantBundle(approval, requests, now, 'previously_consumed');
+}
+/** Consume every grant in an approved record after fingerprint/hash replay validation. */
+export function consumeApprovedRecordGrantBundle(approval) {
+    const bundle = grantsFromApproval(approval);
+    const now = Date.now();
+    if (!bundle.length ||
+        bundle.some((grant) => {
+            const expires = Date.parse(grant.expiresAt);
+            return !Number.isFinite(expires) || expires <= now || grant.usesRemaining <= 0;
+        })) {
+        return { approval, consumed: false };
+    }
+    const grants = bundle.map((grant) => decrementGrant(grant));
+    return {
+        approval: {
+            ...approval,
+            grants,
+            grant: grants[0],
+        },
+        consumed: true,
+    };
+}
+export function decrementApprovalLegacyGrant(approval) {
+    const bundle = grantsFromApproval(approval);
+    if (!bundle.length) {
+        return approval;
+    }
+    const grants = bundle.map((grant, index) => (index === 0 ? decrementGrant(grant) : grant));
+    return {
+        ...approval,
+        grants,
+        grant: grants[0],
+    };
+}
+export function grantsFromApprovedState(state, repoRoot) {
+    const now = Date.now();
+    const collected = [];
+    for (const approval of state.approvals) {
+        if (approval.repoRoot !== repoRoot) {
+            continue;
+        }
+        for (const grant of grantsFromApproval(approval)) {
+            if (isActiveGrant(grant, now)) {
+                collected.push(grant);
+            }
+        }
+    }
+    return collected;
+}
+function decrementGrant(grant) {
+    return {
+        ...grant,
+        usesRemaining: grant.usesRemaining - 1,
+    };
 }
 export function consumeGrantLease(state, grantId) {
     let consumed = false;
     const approvals = state.approvals.map((approval) => {
-        const grant = approval.grant;
-        if (!grant || grant.grantId !== grantId || grant.usesRemaining <= 0) {
+        const bundle = grantsFromApproval(approval);
+        const index = bundle.findIndex((g) => g.grantId === grantId);
+        if (index === -1) {
+            return approval;
+        }
+        const grant = bundle[index];
+        if (!grant || grant.usesRemaining <= 0) {
             return approval;
         }
         consumed = true;
-        const usesRemaining = grant.usesRemaining - 1;
+        const updated = decrementGrant(grant);
+        const grants = [...bundle];
+        grants[index] = updated;
         return {
             ...approval,
-            grant: {
-                ...grant,
-                usesRemaining,
-            },
+            grants,
+            grant: grants[0],
         };
     });
     return {
@@ -38,6 +214,27 @@ export function consumeGrantLease(state, grantId) {
         consumed,
     };
 }
+/** Consume one lease for each request; all must succeed (atomic bundle consumption). */
+export function consumeGrantLeasesForRequests(state, requests) {
+    const repoRoot = requests[0]?.principal.repoRoot;
+    if (!repoRoot || requests.some((request) => request.principal.repoRoot !== repoRoot)) {
+        return { state, consumed: false };
+    }
+    for (let index = 0; index < state.approvals.length; index += 1) {
+        const approval = state.approvals[index];
+        if (!approval || approval.repoRoot !== repoRoot) {
+            continue;
+        }
+        const consumed = consumeApprovalGrantBundle(approval, requests);
+        if (!consumed.consumed) {
+            continue;
+        }
+        const approvals = [...state.approvals];
+        approvals[index] = consumed.approval;
+        return { state: { ...state, approvals }, consumed: true };
+    }
+    return { state, consumed: false };
+}
 export function findMatchingGrant(grants, request) {
     if (!grants?.length) {
         return undefined;

package/dist/core/capability/grant-match.js

@@ -53,6 +53,9 @@ function grantTargetsResource(grant, request) {
     if (grant.resource.kind === 'executable' && request.resource.kind === 'executable') {
         return grant.resource.command === request.resource.command;
     }
+    if (grant.resource.kind === 'package-cache' && request.resource.kind === 'package-cache') {
+        return grant.resource.manager === request.resource.manager;
+    }
     if (grant.resource.kind === 'git-ref' && request.resource.kind === 'git-ref') {
         return grant.resource.ref === request.resource.ref;
     }

package/dist/core/capability/index.d.ts

@@ -1,5 +1,5 @@
 export { addPathToAllowlist, allPathsAllowlisted, fsScopeAllowlistPath, isPathAllowlisted, loadFsScopeAllowlist, loadFsScopeAllowlistSync, saveFsScopeAllowlist, } from './allowlist.js';
-export { BOUNDARY_ATTESTATION_VERSION, type BoundaryAttestation, type BoundaryDriverId, isAttestationFresh, } from './attestation.js';
+export { attestsWorkspaceMountIsolation, BOUNDARY_ATTESTATION_VERSION, type BoundaryAttestation, type BoundaryDriverId, isAttestationFresh, } from './attestation.js';
 export { BOUNDARY_PROFILE_L1_ATTESTED, BOUNDARY_PROFILE_L3_L4_ONLY, BOUNDARY_PROFILE_L3_POLICY, boundaryVerifiedAllowEnabled, isAttestedBoundary, resolveBoundaryProfile, } from './boundary-profile.js';
 export { evaluateL1FullStatus, hasSandboxRuntime, isCapabilityBrokerDemotionActive, isSandboxBrokerEnabled, } from './broker.js';
 export { CAPABILITY_GRANT_VERSION, type CapabilityGrantV1, isGrantScopeTooBroad, } from './grant.js';
@@ -9,6 +9,6 @@ export { type CapabilityAuthorizationMetadata, type PolicyLegacyReasonHints, pol
 export { buildFileMutationCapabilityRequest, buildShellCapabilityRequest, createTypeScriptPolicyEngine, evaluateFileMutationPolicy, evaluateShellPolicy, evaluateSubagentPolicy, type FileMutationCapabilityAnalysis, getDefaultPolicyEngine, policyDecisionRequiresAsk, type ShellCapabilityAnalysis, type SubagentCapabilityAnalysis, } from './policy-engine.js';
 export type { AuthorizationContext, PolicyDecision, PolicyEngine, PolicyOutcome, } from './policy-types.js';
 export { FS_SCOPE_REASONS, shouldSkipBrokerApprovedOnce, shouldSkipBrokerApprovedRecord, } from './reasons.js';
-export { CAPABILITY_REQUEST_VERSION, type CapabilityAction, type CapabilityEvidence, type CapabilityEvidenceLevel, type CapabilityHookKind, type CapabilityPrincipal, type CapabilityRequestContext, type CapabilityRequestV1, type CapabilityResource, } from './request.js';
+export { CAPABILITY_REQUEST_VERSION, type CapabilityAction, type CapabilityEvidence, type CapabilityEvidenceLevel, type CapabilityHookKind, type CapabilityPrincipal, type CapabilityRequestContext, type CapabilityRequestV1, type CapabilityResource, type GitRefScope, type NetworkMode, type NetworkPayload, type ProcessOperation, } from './request.js';
 export { addTrustedWorkspaceRoot, isBroadTrustedWorkspaceRoot, isHighStakesTrustedWorkspaceRoot, isPathWithinTrustedWorkspaceRoots, loadTrustedWorkspaceRoots, loadTrustedWorkspaceRootsSync, normalizeTrustedWorkspaceRootPath, saveTrustedWorkspaceRoots, trustedWorkspaceRootsPath, validateTrustedWorkspaceRootCandidate, } from './trusted-workspace-roots.js';
 export type { CapabilityApprovalScope, FsScopeAllowlistEntry, FsScopeAllowlistFile, TrustedWorkspaceRootEntry, TrustedWorkspaceRootsFile, } from './types.js';

package/dist/core/capability/index.js

@@ -1,5 +1,5 @@
 export { addPathToAllowlist, allPathsAllowlisted, fsScopeAllowlistPath, isPathAllowlisted, loadFsScopeAllowlist, loadFsScopeAllowlistSync, saveFsScopeAllowlist, } from './allowlist.js';
-export { BOUNDARY_ATTESTATION_VERSION, isAttestationFresh, } from './attestation.js';
+export { attestsWorkspaceMountIsolation, BOUNDARY_ATTESTATION_VERSION, isAttestationFresh, } from './attestation.js';
 export { BOUNDARY_PROFILE_L1_ATTESTED, BOUNDARY_PROFILE_L3_L4_ONLY, BOUNDARY_PROFILE_L3_POLICY, boundaryVerifiedAllowEnabled, isAttestedBoundary, resolveBoundaryProfile, } from './boundary-profile.js';
 export { evaluateL1FullStatus, hasSandboxRuntime, isCapabilityBrokerDemotionActive, isSandboxBrokerEnabled, } from './broker.js';
 export { CAPABILITY_GRANT_VERSION, isGrantScopeTooBroad, } from './grant.js';

package/dist/core/capability/policy-engine.d.ts

@@ -1,11 +1,41 @@
 import type { BelayConfigV4 } from '../config.js';
 import type { VerdictEffect, VerdictLocation, VerdictOpacity } from '../verdict/types.js';
+import type { CapabilityGrantV1 } from './grant.js';
 import type { AuthorizationContext, PolicyDecision, PolicyEngine } from './policy-types.js';
-import { type CapabilityHookKind, type CapabilityRequestV1 } from './request.js';
+import { type CapabilityAction, type CapabilityEvidenceLevel, type CapabilityHookKind, type CapabilityRequestV1, type CapabilityResource } from './request.js';
 export type PolicyAuthExtras = Pick<AuthorizationContext, 'grants' | 'attestation'> & {
     egressProxyActive?: boolean;
     sensitivePaths?: string[];
 };
+export type EffectPolicyDisposition = 'allow' | 'allow_flagged' | 'ask';
+export interface EffectRequirementPolicyInput {
+    tag: string;
+    action: CapabilityAction;
+    resource: CapabilityResource;
+    evidence: {
+        level: CapabilityEvidenceLevel;
+        signals: readonly string[];
+        basis: readonly string[];
+    };
+    provenance?: unknown;
+}
+export interface EffectRequirementPolicyContext {
+    cwd: string;
+    repoRoot: string;
+    trustedWorkspaceRoots?: readonly string[];
+    sensitivePaths?: readonly string[];
+    protectedArtifactRoots?: readonly string[];
+    grants?: readonly CapabilityGrantV1[];
+    capabilityRequest?: CapabilityRequestV1;
+}
+export interface EffectRequirementPolicyDecision extends PolicyDecision {
+    effectDisposition: EffectPolicyDisposition;
+}
+/**
+ * Policy for a lowered shell effect. It intentionally ignores executable
+ * command names, segment heads, command text, and config allowlists.
+ */
+export declare function evaluateEffectRequirementPolicy(requirement: EffectRequirementPolicyInput, context: EffectRequirementPolicyContext): EffectRequirementPolicyDecision;
 export interface ShellCapabilityAnalysis {
     command: string;
     hookKind: CapabilityHookKind;
@@ -56,12 +86,19 @@ export declare function evaluateSubagentPolicy(analysis: SubagentCapabilityAnaly
     decision: PolicyDecision;
 };
 export declare function buildShellCapabilityRequest(analysis: ShellCapabilityAnalysis): CapabilityRequestV1;
+export declare function buildShellCapabilityRequests(analysis: ShellCapabilityAnalysis): CapabilityRequestV1[];
 export declare function buildFileMutationCapabilityRequest(analysis: FileMutationCapabilityAnalysis): CapabilityRequestV1;
 export declare function createTypeScriptPolicyEngine(): PolicyEngine;
 export declare function getDefaultPolicyEngine(): PolicyEngine;
 export declare function policyDecisionRequiresAsk(decision: PolicyDecision): boolean;
+export declare function combinePolicyDecisions(decisions: readonly PolicyDecision[]): PolicyDecision;
+export declare function evaluateCapabilityRequestsPolicy(requests: readonly CapabilityRequestV1[], config: BelayConfigV4, auth?: PolicyAuthExtras, trustedWorkspaceRoots?: string[]): {
+    decisions: PolicyDecision[];
+    decision: PolicyDecision;
+};
 export declare function evaluateShellPolicy(analysis: ShellCapabilityAnalysis, config: BelayConfigV4, auth?: PolicyAuthExtras): {
     request: CapabilityRequestV1;
+    requests: CapabilityRequestV1[];
     decision: PolicyDecision;
 };
 export declare function evaluateFileMutationPolicy(analysis: FileMutationCapabilityAnalysis, config: BelayConfigV4, auth?: PolicyAuthExtras): {