@inhuman.tools/policy 0.0.0-stage → 0.1.0

package/authorize.scm

@@ -0,0 +1,4 @@
+;; Dist authorization. The document is the command or the path.
+;; allow runs. #f and deny do not.
+(decide/choose "Is this call authorized?"
+  (list (list "allow" "authorized") (list "deny" "not authorized")))

package/dist/acknowledge.d.ts

@@ -0,0 +1,70 @@
+import { type ClassId } from "./classes.js";
+import { type FloorVerdict } from "./types.js";
+export type AckMatch = {
+    readonly class: ClassId;
+} | {
+    readonly mcp: string;
+    readonly account?: string;
+    readonly tool?: string;
+} | {
+    readonly tool: string;
+} | {
+    readonly command: readonly string[];
+};
+export type AckFlag = {
+    readonly match: AckMatch;
+    readonly why?: string;
+    readonly modes?: readonly ("manual" | "auto" | "yolo")[];
+};
+/** Throws a readable error for an invalid block; `undefined` is no flags. */
+export declare function parseAcknowledge(value: unknown): readonly AckFlag[];
+/** A config file's text: a JSON array of flags, or an object with an `acknowledge` array. Empty text is none. */
+export declare function parseAcknowledgeText(text: string | undefined): readonly AckFlag[];
+/** Layer rule: the union. Project can add; nothing in it removes a user flag. */
+export declare function mergeAcknowledge(...layers: readonly (readonly AckFlag[] | undefined)[]): readonly AckFlag[];
+/** `mcp__server__tool` is the common MCP tool-name shape; hosts that spell it differently pass `mcp` themselves. */
+export declare function mcpOf(toolName: string): {
+    readonly server: string;
+    readonly tool: string;
+} | undefined;
+export type AckSubject = {
+    readonly tool?: string;
+    readonly mcp?: {
+        readonly server: string;
+        readonly account?: string;
+        readonly tool?: string;
+    };
+    readonly verdict?: FloorVerdict;
+};
+export type AckRequirement = {
+    readonly labels: readonly string[];
+    readonly why: readonly string[];
+};
+export declare function labelOf(match: AckMatch): string;
+/** Null when no flag matches. */
+export declare function acknowledgeRequirement(flags: readonly AckFlag[], subject: AckSubject): AckRequirement | null;
+/** Strictest floor verdict for a call, with the host path preparation the adapters use. */
+export declare function floorVerdictOf(call: {
+    readonly kind: "bash";
+    readonly command: string;
+    readonly cwd?: string;
+} | {
+    readonly kind: "read" | "write";
+    readonly path: string;
+    readonly cwd?: string;
+}): FloorVerdict;
+export declare function blockReason(requirement: AckRequirement): string;
+export type AckRequest = {
+    readonly summary: string;
+    readonly detail: string;
+    readonly why?: string;
+};
+export type Acknowledger = (request: AckRequest) => Promise<boolean>;
+/** `text` is what the agent wrote (a command, a path, arguments). It is JSON-encoded and truncated. */
+export declare function acknowledgeRequest(requirement: AckRequirement, tool: string, text: string): AckRequest;
+/**
+ * Ask the host. Undefined means acknowledged and the call may run; a string is the denial reason.
+ * No `acknowledger` is the degraded path: the reason is `needs acknowledgement: <label>`.
+ */
+export declare function requestAcknowledgement(requirement: AckRequirement, tool: string, text: string, acknowledger: Acknowledger | undefined): Promise<string | undefined>;
+//# sourceMappingURL=acknowledge.d.ts.map

package/dist/acknowledge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acknowledge.d.ts","sourceRoot":"","sources":["../src/acknowledge.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAa,KAAK,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvD,OAAO,EAAa,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAkB1D,MAAM,MAAM,QAAQ,GAChB;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3E;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAE5C,MAAM,MAAM,OAAO,GAAG;IACpB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;CAC1D,CAAC;AAEF,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,OAAO,EAAE,CAUnE;AAED,iHAAiH;AACjH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,OAAO,EAAE,CAYjF;AAED,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,GAAG,MAAM,EAAE,SAAS,CAAC,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,OAAO,EAAE,CAI3G;AAED,oHAAoH;AACpH,wBAAgB,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAGtG;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9F,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,CAAC;AAEF,wBAAgB,OAAO,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,CAO/C;AAuBD,iCAAiC;AACjC,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,EAAE,OAAO,EAAE,UAAU,GAAG,cAAc,GAAG,IAAI,CAU5G;AAED,2FAA2F;AAC3F,wBAAgB,cAAc,CAC5B,IAAI,EACA;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1E;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,GACJ,YAAY,CAQd;AAED,wBAAgB,WAAW,CAAC,WAAW,EAAE,cAAc,GAAG,MAAM,CAE/D;AAED,MAAM,MAAM,UAAU,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACtG,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAIrE,uGAAuG;AACvG,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,CAStG;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,cAAc,EAC3B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,YAAY,GAAG,SAAS,GACrC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQ7B"}

package/dist/acknowledge.js

@@ -0,0 +1,162 @@
+/**
+ * `needsAcknowledgement` for the adapters. One place for the flag schema, the matcher and the texts;
+ * an adapter only asks "does this call need an acknowledgement" and translates the answer into its
+ * host's confirmation mechanism.
+ *
+ * A flag forces a request for a call that would otherwise run (floor approve, judge allow, any
+ * resolution to allow). It never turns a block or a denial into anything. Flags only tighten:
+ * the effective set is the union of the user and project layers, so a project file can add and
+ * can never remove a user flag. The dist ships none.
+ *
+ * Adapters have no `modes` of their own, so `modes` is accepted (the schema is the daemon's) and
+ * ignored: a flag applies in every adapter.
+ *
+ * `class` matches the classes of the floor votes (`classesOf`). An approve has no classes, so a
+ * class flag only matches a call whose floor tier is ask or deny. `command` matches a prefix of
+ * `[argv0, ...spine, ...familyArgs]` of any shell unit in `verdict.seen`, so approved calls match.
+ */
+import { z } from "zod";
+import { defaultPolicy } from "./bind.js";
+import { CLASS_IDS } from "./classes.js";
+import { lattice } from "./lift.js";
+import { normalizeToolPath } from "./tool-path.js";
+import { classesOf } from "./types.js";
+import { join } from "./verdict.js";
+const classIdSchema = z.enum(CLASS_IDS);
+const matchSchema = z.union([
+    z.strictObject({ class: classIdSchema }),
+    z.strictObject({ mcp: z.string().min(1), account: z.string().min(1).optional(), tool: z.string().min(1).optional() }),
+    z.strictObject({ tool: z.string().min(1) }),
+    z.strictObject({ command: z.array(z.string().min(1)).min(1) }),
+]);
+const flagSchema = z.strictObject({
+    match: matchSchema,
+    why: z.string().max(200).optional(),
+    modes: z.array(z.enum(["manual", "auto", "yolo"])).optional(),
+});
+/** Throws a readable error for an invalid block; `undefined` is no flags. */
+export function parseAcknowledge(value) {
+    if (value === undefined)
+        return [];
+    const parsed = z.array(flagSchema).safeParse(value);
+    if (!parsed.success) {
+        const issue = parsed.error.issues[0];
+        throw new Error(`invalid acknowledge config: ${issue === undefined ? "bad shape" : `${issue.path.join(".") || "(root)"}: ${issue.message}`}`);
+    }
+    return parsed.data;
+}
+/** A config file's text: a JSON array of flags, or an object with an `acknowledge` array. Empty text is none. */
+export function parseAcknowledgeText(text) {
+    if (text === undefined || text.trim() === "")
+        return [];
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        throw new Error("invalid acknowledge config: not json");
+    }
+    if (typeof raw === "object" && raw !== null && !Array.isArray(raw)) {
+        return parseAcknowledge(raw.acknowledge);
+    }
+    return parseAcknowledge(raw);
+}
+/** Layer rule: the union. Project can add; nothing in it removes a user flag. */
+export function mergeAcknowledge(...layers) {
+    const out = new Map();
+    for (const layer of layers)
+        for (const flag of layer ?? [])
+            out.set(JSON.stringify([flag.match, flag.why]), flag);
+    return [...out.values()];
+}
+/** `mcp__server__tool` is the common MCP tool-name shape; hosts that spell it differently pass `mcp` themselves. */
+export function mcpOf(toolName) {
+    const found = /^mcp__(.+?)__(.+)$/.exec(toolName);
+    return found?.[1] === undefined || found[2] === undefined ? undefined : { server: found[1], tool: found[2] };
+}
+export function labelOf(match) {
+    if ("class" in match)
+        return `class ${match.class}`;
+    if ("command" in match)
+        return `command ${match.command.join(" ")}`;
+    if ("mcp" in match) {
+        return `mcp ${[match.mcp, match.tool].filter((part) => part !== undefined).join("/")}`;
+    }
+    return `tool ${match.tool}`;
+}
+function matches(match, subject) {
+    if ("class" in match)
+        return subject.verdict !== undefined && classesOf(subject.verdict).includes(match.class);
+    if ("command" in match) {
+        const units = subject.verdict?.seen ?? [];
+        return units.some((unit) => {
+            const identity = [unit.argv0, ...unit.spine, ...unit.familyArgs];
+            return match.command.length <= identity.length && match.command.every((word, i) => identity[i] === word);
+        });
+    }
+    const mcp = subject.mcp ?? (subject.tool === undefined ? undefined : mcpOf(subject.tool));
+    if ("mcp" in match) {
+        return (mcp !== undefined &&
+            mcp.server === match.mcp &&
+            (match.tool === undefined || mcp.tool === match.tool) &&
+            (match.account === undefined || ("account" in mcp && mcp.account === match.account)));
+    }
+    return subject.tool === match.tool || (mcp !== undefined && mcp.tool === match.tool);
+}
+/** Null when no flag matches. */
+export function acknowledgeRequirement(flags, subject) {
+    const labels = [];
+    const why = [];
+    for (const flag of flags) {
+        if (!matches(flag.match, subject))
+            continue;
+        const label = labelOf(flag.match);
+        if (!labels.includes(label))
+            labels.push(label);
+        if (flag.why !== undefined && !why.includes(flag.why))
+            why.push(flag.why);
+    }
+    return labels.length === 0 ? null : { labels, why };
+}
+/** Strictest floor verdict for a call, with the host path preparation the adapters use. */
+export function floorVerdictOf(call) {
+    if (call.kind === "bash")
+        return defaultPolicy.explainBash(call.command, undefined);
+    const prepared = normalizeToolPath(call.path, call.cwd);
+    const explain = call.kind === "read" ? defaultPolicy.explainRead : defaultPolicy.explainWrite;
+    const first = explain(prepared);
+    const second = explain(prepared.toLowerCase());
+    const top = lattice([first.disposition, second.disposition]);
+    return join([first, second].filter((verdict) => verdict.disposition === top));
+}
+export function blockReason(requirement) {
+    return `needs acknowledgement: ${requirement.labels.join(", ")}`;
+}
+const DETAIL_LIMIT = 500;
+/** `text` is what the agent wrote (a command, a path, arguments). It is JSON-encoded and truncated. */
+export function acknowledgeRequest(requirement, tool, text) {
+    const encoded = JSON.stringify(text);
+    const detail = encoded.length > DETAIL_LIMIT ? `${encoded.slice(0, DETAIL_LIMIT)}...` : encoded;
+    const why = requirement.why.length === 0 ? undefined : requirement.why.join("; ");
+    return {
+        summary: `Acknowledge ${tool}: ${requirement.labels.join(", ")}`,
+        detail,
+        ...(why === undefined ? {} : { why }),
+    };
+}
+/**
+ * Ask the host. Undefined means acknowledged and the call may run; a string is the denial reason.
+ * No `acknowledger` is the degraded path: the reason is `needs acknowledgement: <label>`.
+ */
+export async function requestAcknowledgement(requirement, tool, text, acknowledger) {
+    if (acknowledger === undefined)
+        return blockReason(requirement);
+    try {
+        const accepted = await acknowledger(acknowledgeRequest(requirement, tool, text));
+        return accepted ? undefined : `acknowledgement declined: ${requirement.labels.join(", ")}`;
+    }
+    catch {
+        return `acknowledgement failed: ${requirement.labels.join(", ")}`;
+    }
+}
+//# sourceMappingURL=acknowledge.js.map

package/dist/acknowledge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acknowledge.js","sourceRoot":"","sources":["../src/acknowledge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAgB,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAqB,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEpC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAExC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC;IAC1B,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IACxC,CAAC,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IACrH,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;CAC/D,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC;IAChC,KAAK,EAAE,WAAW;IAClB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9D,CAAC,CAAC;AAcH,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,EAAE,CAC7H,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAA0B,CAAC;AAC3C,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,oBAAoB,CAAC,IAAwB;IAC3D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IACxD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO,gBAAgB,CAAE,GAA+B,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,GAAG,MAAmD;IACrF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmB,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAClH,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,KAAK,CAAC,QAAgB;IACpC,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/G,CAAC;AAaD,MAAM,UAAU,OAAO,CAAC,KAAe;IACrC,IAAI,OAAO,IAAI,KAAK;QAAE,OAAO,SAAS,KAAK,CAAC,KAAK,EAAE,CAAC;IACpD,IAAI,SAAS,IAAI,KAAK;QAAE,OAAO,WAAW,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpE,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACzF,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,OAAO,CAAC,KAAe,EAAE,OAAmB;IACnD,IAAI,OAAO,IAAI,KAAK;QAAE,OAAO,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/G,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACzB,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;YACjE,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAC3G,CAAC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1F,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;QACnB,OAAO,CACL,GAAG,KAAK,SAAS;YACjB,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,GAAG;YACxB,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC;YACrD,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,SAAS,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC;AACvF,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,sBAAsB,CAAC,KAAyB,EAAE,OAAmB;IACnF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC;YAAE,SAAS;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACtD,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,cAAc,CAC5B,IAMK;IAEL,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC;IAC9F,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,WAA2B;IACrD,OAAO,0BAA0B,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACnE,CAAC;AAKD,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB,uGAAuG;AACvG,MAAM,UAAU,kBAAkB,CAAC,WAA2B,EAAE,IAAY,EAAE,IAAY;IACxF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;IAChG,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClF,OAAO;QACL,OAAO,EAAE,eAAe,IAAI,KAAK,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAChE,MAAM;QACN,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,WAA2B,EAC3B,IAAY,EACZ,IAAY,EACZ,YAAsC;IAEtC,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,kBAAkB,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACjF,OAAO,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,6BAA6B,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,2BAA2B,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACpE,CAAC;AACH,CAAC"}

package/dist/authorize.d.ts

@@ -0,0 +1,8 @@
+import { ErrorWithInvariant } from "@inhuman.tools/error-with-invariant";
+export declare class DecideError extends ErrorWithInvariant {
+    readonly name = "DecideError";
+}
+export declare function authorizationProgram(): string;
+/** A set `POLICY_AUTHORIZE` that cannot be read is an error, not the dist script. */
+export declare function authorizationSource(override?: string, env?: NodeJS.ProcessEnv): string;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../src/authorize.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEzE,qBAAa,WAAY,SAAQ,kBAAkB;IACjD,SAAkB,IAAI,iBAAiB;CACxC;AAMD,wBAAgB,oBAAoB,IAAI,MAAM,CAI7C;AAED,qFAAqF;AACrF,wBAAgB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAgBtF"}

package/dist/authorize.js

@@ -0,0 +1,39 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { ErrorWithInvariant } from "@inhuman.tools/error-with-invariant";
+export class DecideError extends ErrorWithInvariant {
+    name = "DecideError";
+}
+const programPath = path.join(path.dirname(fileURLToPath(import.meta.url)), "../authorize.scm");
+let cached;
+export function authorizationProgram() {
+    if (cached !== undefined)
+        return cached;
+    cached = readFileSync(programPath, "utf8");
+    return cached;
+}
+/** A set `POLICY_AUTHORIZE` that cannot be read is an error, not the dist script. */
+export function authorizationSource(override, env) {
+    const inline = override?.trim();
+    if (inline)
+        return inline;
+    const file = env?.POLICY_AUTHORIZE?.trim();
+    if (file === undefined || file === "")
+        return authorizationProgram();
+    let text;
+    try {
+        text = readFileSync(file, "utf8");
+    }
+    catch (error) {
+        const code = typeof error === "object" && error !== null && "code" in error ? error.code : undefined;
+        if (code === "ENOENT")
+            throw new DecideError(`authorization program not found: ${file}`);
+        throw error;
+    }
+    const source = text.trim();
+    if (source === "")
+        throw new DecideError("authorization program is empty");
+    return text;
+}
+//# sourceMappingURL=authorize.js.map

package/dist/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../src/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEzE,MAAM,OAAO,WAAY,SAAQ,kBAAkB;IAC/B,IAAI,GAAG,aAAa,CAAC;CACxC;AAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAEhG,IAAI,MAA0B,CAAC;AAE/B,MAAM,UAAU,oBAAoB;IAClC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mBAAmB,CAAC,QAAiB,EAAE,GAAuB;IAC5E,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;IAChC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,IAAI,GAAG,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,oBAAoB,EAAE,CAAC;IACrE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACrG,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,WAAW,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAC;QACzF,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,WAAW,CAAC,gCAAgC,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/bind.d.ts

@@ -0,0 +1,6 @@
+import type { Which } from "./identity.js";
+import { type Policy } from "./types.js";
+export declare function bindPolicy(document: unknown, which?: Which): Policy;
+/** Dist floor. A path-form argv0 stays a path: this binding has no `which`. */
+export declare const defaultPolicy: Policy;
+//# sourceMappingURL=bind.d.ts.map

package/dist/bind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bind.d.ts","sourceRoot":"","sources":["../src/bind.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAG3C,OAAO,EAAgC,KAAK,MAAM,EAAE,MAAM,YAAY,CAAC;AAKvE,wBAAgB,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,GAAE,KAAkB,GAAG,MAAM,CA4C/E;AAED,+EAA+E;AAC/E,eAAO,MAAM,aAAa,EAAE,MAAuC,CAAC"}

package/dist/bind.js

@@ -0,0 +1,45 @@
+import { explainBash } from "./check.js";
+import { compilePolicy, PolicyAssumeError } from "./compile.js";
+import { explainPath, writeRemainderKind } from "./path-policy.js";
+import { reasonableDefaults } from "./reasonable-defaults.js";
+import { classesOf } from "./types.js";
+import { cast } from "./verdict.js";
+const unresolved = () => undefined;
+export function bindPolicy(document, which = unresolved) {
+    const compiled = compilePolicy(document);
+    const clusters = { read: compiled.read, write: compiled.write };
+    const bash = (command, cwd) => compiled.bash === undefined
+        ? cast("ask", "unmodelled", "bash:no-policy")
+        : explainBash(compiled.bash, command, clusters, which, cwd);
+    for (const smoke of compiled.assume) {
+        const verdict = bash(smoke.command);
+        const actual = verdict.disposition;
+        PolicyAssumeError.invariant(actual === smoke.expect, `assume: expected ${smoke.expect}, got ${actual}: ${smoke.command}`, {
+            expected: smoke.expect,
+            actual,
+            command: smoke.command,
+        });
+        if (smoke.expectClass !== undefined) {
+            const classes = classesOf(verdict);
+            PolicyAssumeError.invariant(classes.includes(smoke.expectClass), `assume: expected class ${smoke.expectClass}, got ${classes.join(",") || "none"}: ${smoke.command}`, { expected: smoke.expect, actual, command: smoke.command });
+        }
+    }
+    const path = (cluster) => {
+        const term = cluster === "read" ? compiled.read : compiled.write;
+        return (raw) => term === undefined ? cast("ask", "unmodelled", `${cluster}:no-policy`) : explainPath(term, raw);
+    };
+    const explainRead = path("read");
+    const explainWrite = path("write");
+    return {
+        bash: (command, cwd) => bash(command, cwd).disposition,
+        explainBash: bash,
+        read: (raw) => explainRead(raw).disposition,
+        explainRead,
+        write: (raw) => explainWrite(raw).disposition,
+        explainWrite,
+        writeKind: (raw) => (compiled.write === undefined ? null : writeRemainderKind(compiled.write, raw)),
+    };
+}
+/** Dist floor. A path-form argv0 stays a path: this binding has no `which`. */
+export const defaultPolicy = bindPolicy(reasonableDefaults);
+//# sourceMappingURL=bind.js.map

package/dist/bind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bind.js","sourceRoot":"","sources":["../src/bind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAkC,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEpC,MAAM,UAAU,GAAU,GAAG,EAAE,CAAC,SAAS,CAAC;AAE1C,MAAM,UAAU,UAAU,CAAC,QAAiB,EAAE,QAAe,UAAU;IACrE,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;IAChE,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,GAAY,EAAgB,EAAE,CAC3D,QAAQ,CAAC,IAAI,KAAK,SAAS;QACzB,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,gBAAgB,CAAC;QAC7C,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAChE,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;QACnC,iBAAiB,CAAC,SAAS,CACzB,MAAM,KAAK,KAAK,CAAC,MAAM,EACvB,oBAAoB,KAAK,CAAC,MAAM,SAAS,MAAM,KAAK,KAAK,CAAC,OAAO,EAAE,EACnE;YACE,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,MAAM;YACN,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CACF,CAAC;QACF,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;YACnC,iBAAiB,CAAC,SAAS,CACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EACnC,0BAA0B,KAAK,CAAC,WAAW,SAAS,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,KAAK,KAAK,CAAC,OAAO,EAAE,EACnG,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAC3D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,OAAyB,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACjE,OAAO,CAAC,GAAW,EAAgB,EAAE,CACnC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpG,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO;QACL,IAAI,EAAE,CAAC,OAAe,EAAE,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,WAAW;QACvE,WAAW,EAAE,IAAI;QACjB,IAAI,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW;QACnD,WAAW;QACX,KAAK,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW;QACrD,YAAY;QACZ,SAAS,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;KAC5G,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,aAAa,GAAW,UAAU,CAAC,kBAAkB,CAAC,CAAC"}

package/dist/check.d.ts

@@ -0,0 +1,30 @@
+/**
+ * String processors over a compiled YAML term. Prep, unparsed→ask, empty I→ask,
+ * and the pipeline lattice live here — not on the host.
+ *
+ * Shape (policy / matcher / subcommands) is one vote. File effects from
+ * arg_types / arg_rest_type join on their own lattice — they cannot lift ask.
+ * `"--"` present: suffix is re-parsed with that body's flag vocabulary
+ * (undeclared dash tokens stay positionals). `"--"` absent: cutoff, consume
+ * the delimiter, leftovers are positionals.
+ *
+ * Every vote carries the class of the rule that cast it (see classes.ts). The verdict of a call
+ * is the strictest disposition plus the votes at exactly that disposition (verdict.ts `join`).
+ */
+import { type Which } from "./identity.js";
+import { type PathTerm } from "./path-policy.js";
+import type { CommandNode, Disposition, FloorVerdict } from "./types.js";
+type PathClusters = {
+    readonly read?: PathTerm;
+    readonly write?: PathTerm;
+    /** Workspace-relative (or extra-root absolute) directory the shell runs in. Relative path tokens re-base on it. */
+    readonly cwd?: string;
+    /** The shell would expand this question's words (an argument is not literal). */
+    readonly expand?: boolean;
+    /** `dotglob` is mentioned in the command: `*` may match a leading dot. */
+    readonly dotglob?: boolean;
+};
+export declare function checkBash(term: CommandNode, command: string, clusters?: PathClusters, which?: Which, cwd?: string): Disposition;
+export declare function explainBash(term: CommandNode, command: string, clusters?: PathClusters, which?: Which, cwd?: string): FloorVerdict;
+export { explainPath } from "./path-policy.js";
+//# sourceMappingURL=check.d.ts.map

package/dist/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../src/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAQH,OAAO,EAAgB,KAAK,KAAK,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAEV,WAAW,EACX,WAAW,EAEX,YAAY,EAIb,MAAM,YAAY,CAAC;AAGpB,KAAK,YAAY,GAAG;IAClB,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B,mHAAmH;IACnH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AA+CF,wBAAgB,SAAS,CACvB,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,YAAiB,EAC3B,KAAK,CAAC,EAAE,KAAK,EACb,GAAG,CAAC,EAAE,MAAM,GACX,WAAW,CAEb;AAED,wBAAgB,WAAW,CACzB,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,YAAiB,EAC3B,KAAK,CAAC,EAAE,KAAK,EACb,GAAG,CAAC,EAAE,MAAM,GACX,YAAY,CAmDd;AA0YD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC"}