@inhuman.tools/policy 0.0.0-stage → 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+/** Plugin door: the dist floor and the authorization program. */
+export { authorizationProgram } from "./authorize.js";
+export { authorize } from "./run-authorization.js";
+export { defaultPolicy } from "./bind.js";
+export { JUDGE_DEADLINE_MS, withDeadline } from "./deadline.js";
+export { checkToolPath, normalizeToolPath } from "./tool-path.js";
+export { acknowledgeRequest, acknowledgeRequirement, blockReason, floorVerdictOf, labelOf, mcpOf, mergeAcknowledge, parseAcknowledge, parseAcknowledgeText, requestAcknowledgement, type AckFlag, type AckMatch, type AckRequest, type AckRequirement, type AckSubject, type Acknowledger, } from "./acknowledge.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,WAAW,EACX,cAAc,EACd,OAAO,EACP,KAAK,EACL,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,KAAK,OAAO,EACZ,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,YAAY,GAClB,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,8 @@
+/** Plugin door: the dist floor and the authorization program. */
+export { authorizationProgram } from "./authorize.js";
+export { authorize } from "./run-authorization.js";
+export { defaultPolicy } from "./bind.js";
+export { JUDGE_DEADLINE_MS, withDeadline } from "./deadline.js";
+export { checkToolPath, normalizeToolPath } from "./tool-path.js";
+export { acknowledgeRequest, acknowledgeRequirement, blockReason, floorVerdictOf, labelOf, mcpOf, mergeAcknowledge, parseAcknowledge, parseAcknowledgeText, requestAcknowledgement, } from "./acknowledge.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,WAAW,EACX,cAAc,EACd,OAAO,EACP,KAAK,EACL,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,GAOvB,MAAM,kBAAkB,CAAC"}

package/dist/license-law.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Pure license decisions. One `LicenseFacts` bag — no jobs.
+ * Short-circuit order is the law. Do not reorder.
+ * Job readers stay in harness-model.
+ */
+export type LicenseFacts = {
+    readonly humanApprove: boolean | null;
+    readonly completed: boolean;
+    readonly cancelled: boolean;
+    readonly commFirst: boolean;
+    readonly fileReadGrant: boolean;
+    readonly policy: "manual" | "auto" | "yolo";
+    readonly policyResult: "policyApprove" | "deny" | "ask" | "block" | null;
+    readonly classifierResult: "allow" | "deny" | null;
+    readonly classifierAbstain: string | null;
+    readonly hatch: boolean;
+    readonly clusterGranted: boolean;
+    readonly writeClassifierOff: boolean;
+    readonly unattended: boolean;
+    readonly coverDeny: boolean;
+};
+/** Stored `allow` and `approve` are the previous positive spellings. */
+export declare function asPolicyResult(value: unknown): LicenseFacts["policyResult"];
+/** Floor `ask` and `deny` share remainder `"ask"`. Ignores hatch. `block` is not remainder. */
+export declare function autoRemainderOf(facts: LicenseFacts): "ask" | null;
+/** Auto floor `ask` that allow-sides: not hatch, cluster already granted. */
+export declare function autoAllowSkip(facts: LicenseFacts): boolean;
+/** Floor ask/deny except auto allow-skip. Floor allow is not remainder. */
+export declare function autoRemainder(facts: LicenseFacts): "ask" | null;
+/**
+ * Remainder classifier intern. Not the cover. Ungranted write never
+ * classifies, including after a fail message. Deny classifies when
+ * unattended, when cover is off, or when the cluster is granted.
+ */
+export declare function autoClassifierPending(facts: LicenseFacts): boolean;
+/** Cover predicate. Not a license bit. */
+export declare function needsHuman(facts: LicenseFacts): boolean;
+/** `true` allow / `false` deny / `null` still waiting. Human first, then the floor. */
+export declare function licenseDecision(facts: LicenseFacts): boolean | null;
+export declare function licenseAllows(facts: LicenseFacts): boolean;
+/** Known-safe leaves. Approved and any judge vote stay visible. */
+export declare function tapeFuse(facts: LicenseFacts): boolean;
+//# sourceMappingURL=license-law.d.ts.map

package/dist/license-law.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-law.d.ts","sourceRoot":"","sources":["../src/license-law.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,eAAe,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,IAAI,CAAC;IACzE,QAAQ,CAAC,gBAAgB,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC;IACnD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAAC,cAAc,CAAC,CAI3E;AAED,+FAA+F;AAC/F,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,GAAG,KAAK,GAAG,IAAI,CAQjE;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAS1D;AAED,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,KAAK,GAAG,IAAI,CAO/D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAYlE;AAED,0CAA0C;AAC1C,wBAAgB,UAAU,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAgBvD;AAED,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,GAAG,IAAI,CA2BnE;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAE1D;AAED,mEAAmE;AACnE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAerD"}

package/dist/license-law.js

@@ -0,0 +1,129 @@
+/**
+ * Pure license decisions. One `LicenseFacts` bag — no jobs.
+ * Short-circuit order is the law. Do not reorder.
+ * Job readers stay in harness-model.
+ */
+/** Stored `allow` and `approve` are the previous positive spellings. */
+export function asPolicyResult(value) {
+    if (value === "policyApprove" || value === "allow" || value === "approve")
+        return "policyApprove";
+    if (value === "deny" || value === "ask" || value === "block")
+        return value;
+    return null;
+}
+/** Floor `ask` and `deny` share remainder `"ask"`. Ignores hatch. `block` is not remainder. */
+export function autoRemainderOf(facts) {
+    switch (true) {
+        case facts.policyResult === "ask":
+        case facts.policyResult === "deny":
+            return "ask";
+        default:
+            return null;
+    }
+}
+/** Auto floor `ask` that allow-sides: not hatch, cluster already granted. */
+export function autoAllowSkip(facts) {
+    switch (true) {
+        case facts.policy !== "auto":
+        case facts.policyResult !== "ask":
+        case facts.hatch:
+            return false;
+        default:
+            return facts.clusterGranted;
+    }
+}
+/** Floor ask/deny except auto allow-skip. Floor allow is not remainder. */
+export function autoRemainder(facts) {
+    switch (true) {
+        case autoAllowSkip(facts):
+            return null;
+        default:
+            return autoRemainderOf(facts);
+    }
+}
+/**
+ * Remainder classifier intern. Not the cover. Ungranted write never
+ * classifies, including after a fail message. Deny classifies when
+ * unattended, when cover is off, or when the cluster is granted.
+ */
+export function autoClassifierPending(facts) {
+    switch (true) {
+        case facts.policy !== "auto":
+        case autoRemainder(facts) === null || facts.classifierResult !== null:
+        case facts.writeClassifierOff:
+            return false;
+        case facts.classifierAbstain !== null:
+        case facts.unattended || facts.policyResult === "ask":
+            return true;
+        default:
+            return facts.policyResult === "deny" && (!facts.coverDeny || facts.clusterGranted);
+    }
+}
+/** Cover predicate. Not a license bit. */
+export function needsHuman(facts) {
+    switch (true) {
+        case facts.completed || facts.cancelled || facts.humanApprove !== null:
+        case facts.commFirst:
+        case facts.fileReadGrant:
+            return false;
+        case facts.policy === "manual" && (facts.policyResult === "ask" || facts.policyResult === "deny"):
+            return true;
+        case facts.policy !== "auto":
+        case autoRemainder(facts) === null || facts.classifierResult !== null:
+            return false;
+        case autoClassifierPending(facts):
+            return facts.classifierAbstain !== null;
+        default:
+            return true;
+    }
+}
+/** `true` allow / `false` deny / `null` still waiting. Human first, then the floor. */
+export function licenseDecision(facts) {
+    switch (true) {
+        case facts.humanApprove === true:
+            return true;
+        case facts.humanApprove === false:
+            return false;
+        case facts.commFirst:
+            return true;
+        case facts.policyResult === "block":
+            return false;
+        case facts.fileReadGrant:
+        case facts.policyResult === "policyApprove":
+        case facts.policy === "yolo" && (facts.policyResult === "ask" || facts.policyResult === "deny"):
+        case autoAllowSkip(facts):
+            return true;
+        case facts.policy === "auto" && autoRemainderOf(facts) !== null:
+            switch (facts.classifierResult) {
+                case "allow":
+                    return true;
+                case "deny":
+                    return false;
+                default:
+                    return null;
+            }
+        default:
+            return null;
+    }
+}
+export function licenseAllows(facts) {
+    return licenseDecision(facts) === true;
+}
+/** Known-safe leaves. Approved and any judge vote stay visible. */
+export function tapeFuse(facts) {
+    switch (true) {
+        case facts.humanApprove !== null:
+        case facts.classifierResult !== null:
+            return false;
+        case facts.commFirst:
+        case autoAllowSkip(facts):
+            return true;
+        case facts.policyResult === "ask":
+        case facts.policyResult === "deny":
+        case facts.policyResult === "block":
+            return false;
+        default:
+            return true;
+    }
+}
+//# sourceMappingURL=license-law.js.map

package/dist/license-law.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-law.js","sourceRoot":"","sources":["../src/license-law.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAmBH,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,KAAK,KAAK,eAAe,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IAClG,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,eAAe,CAAC,KAAmB;IACjD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC;QAClC,KAAK,KAAK,CAAC,YAAY,KAAK,MAAM;YAChC,OAAO,KAAK,CAAC;QACf;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;QAC7B,KAAK,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC;QAClC,KAAK,KAAK,CAAC,KAAK;YACd,OAAO,KAAK,CAAC;QACf;YACE,OAAO,KAAK,CAAC,cAAc,CAAC;IAChC,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,aAAa,CAAC,KAAK,CAAC;YACvB,OAAO,IAAI,CAAC;QACd;YACE,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAmB;IACvD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;QAC7B,KAAK,aAAa,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,CAAC;QACtE,KAAK,KAAK,CAAC,kBAAkB;YAC3B,OAAO,KAAK,CAAC;QACf,KAAK,KAAK,CAAC,iBAAiB,KAAK,IAAI,CAAC;QACtC,KAAK,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK;YACnD,OAAO,IAAI,CAAC;QACd;YACE,OAAO,KAAK,CAAC,YAAY,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,UAAU,CAAC,KAAmB;IAC5C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC;QACvE,KAAK,KAAK,CAAC,SAAS,CAAC;QACrB,KAAK,KAAK,CAAC,aAAa;YACtB,OAAO,KAAK,CAAC;QACf,KAAK,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,KAAK,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC;YAC/F,OAAO,IAAI,CAAC;QACd,KAAK,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;QAC7B,KAAK,aAAa,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI;YACnE,OAAO,KAAK,CAAC;QACf,KAAK,qBAAqB,CAAC,KAAK,CAAC;YAC/B,OAAO,KAAK,CAAC,iBAAiB,KAAK,IAAI,CAAC;QAC1C;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,KAAmB;IACjD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,KAAK,CAAC,YAAY,KAAK,IAAI;YAC9B,OAAO,IAAI,CAAC;QACd,KAAK,KAAK,CAAC,YAAY,KAAK,KAAK;YAC/B,OAAO,KAAK,CAAC;QACf,KAAK,KAAK,CAAC,SAAS;YAClB,OAAO,IAAI,CAAC;QACd,KAAK,KAAK,CAAC,YAAY,KAAK,OAAO;YACjC,OAAO,KAAK,CAAC;QACf,KAAK,KAAK,CAAC,aAAa,CAAC;QACzB,KAAK,KAAK,CAAC,YAAY,KAAK,eAAe,CAAC;QAC5C,KAAK,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,KAAK,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,CAAC;QAChG,KAAK,aAAa,CAAC,KAAK,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,KAAK,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,eAAe,CAAC,KAAK,CAAC,KAAK,IAAI;YAC7D,QAAQ,KAAK,CAAC,gBAAgB,EAAE,CAAC;gBAC/B,KAAK,OAAO;oBACV,OAAO,IAAI,CAAC;gBACd,KAAK,MAAM;oBACT,OAAO,KAAK,CAAC;gBACf;oBACE,OAAO,IAAI,CAAC;YAChB,CAAC;QACH;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,OAAO,eAAe,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AACzC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,QAAQ,CAAC,KAAmB;IAC1C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC;QACjC,KAAK,KAAK,CAAC,gBAAgB,KAAK,IAAI;YAClC,OAAO,KAAK,CAAC;QACf,KAAK,KAAK,CAAC,SAAS,CAAC;QACrB,KAAK,aAAa,CAAC,KAAK,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,KAAK,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC;QAClC,KAAK,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC;QACnC,KAAK,KAAK,CAAC,YAAY,KAAK,OAAO;YACjC,OAAO,KAAK,CAAC;QACf;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/license.d.ts

@@ -0,0 +1,3 @@
+export { asPolicyResult, autoAllowSkip, autoClassifierPending, autoRemainder, autoRemainderOf, licenseAllows, licenseDecision, needsHuman, tapeFuse, } from "./license-law.js";
+export type { LicenseFacts } from "./license-law.js";
+//# sourceMappingURL=license.d.ts.map

package/dist/license.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../src/license.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,aAAa,EACb,qBAAqB,EACrB,aAAa,EACb,eAAe,EACf,aAAa,EACb,eAAe,EACf,UAAU,EACV,QAAQ,GACT,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/license.js

@@ -0,0 +1,2 @@
+export { asPolicyResult, autoAllowSkip, autoClassifierPending, autoRemainder, autoRemainderOf, licenseAllows, licenseDecision, needsHuman, tapeFuse, } from "./license-law.js";
+//# sourceMappingURL=license.js.map

package/dist/license.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"license.js","sourceRoot":"","sources":["../src/license.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,aAAa,EACb,qBAAqB,EACrB,aAAa,EACb,eAAe,EACf,aAAa,EACb,eAAe,EACf,UAAU,EACV,QAAQ,GACT,MAAM,kBAAkB,CAAC"}

package/dist/lift.d.ts

@@ -0,0 +1,4 @@
+import type { Disposition } from "./types.js";
+/** Match-all / pipeline lattice: any-block > any-deny > any-ask > all-approve. */
+export declare function lattice(hits: readonly Disposition[]): Disposition;
+//# sourceMappingURL=lift.d.ts.map

package/dist/lift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lift.d.ts","sourceRoot":"","sources":["../src/lift.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,kFAAkF;AAClF,wBAAgB,OAAO,CAAC,IAAI,EAAE,SAAS,WAAW,EAAE,GAAG,WAAW,CAWjE"}

package/dist/lift.js

@@ -0,0 +1,14 @@
+/** Match-all / pipeline lattice: any-block > any-deny > any-ask > all-approve. */
+export function lattice(hits) {
+    switch (true) {
+        case hits.includes("block"):
+            return "block";
+        case hits.includes("deny"):
+            return "deny";
+        case hits.includes("ask"):
+            return "ask";
+        default:
+            return "policyApprove";
+    }
+}
+//# sourceMappingURL=lift.js.map

package/dist/lift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lift.js","sourceRoot":"","sources":["../src/lift.ts"],"names":[],"mappings":"AAEA,kFAAkF;AAClF,MAAM,UAAU,OAAO,CAAC,IAA4B;IAClD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YACzB,OAAO,OAAO,CAAC;QACjB,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxB,OAAO,MAAM,CAAC;QAChB,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YACvB,OAAO,KAAK,CAAC;QACf;YACE,OAAO,eAAe,CAAC;IAC3B,CAAC;AACH,CAAC"}

package/dist/path-policy.d.ts

@@ -0,0 +1,53 @@
+/**
+ * File-access cluster: policy.json `read_file` / `write_file` enable lists
+ * and `read_block` / `write_block` hard-block lists.
+ * Enable `!` is deny (remainder carve-out). Block lists are unliftable.
+ * Suffix wildcard is implied — PAT matches itself and descendants.
+ * Miss is deny (closed). Unresolvable path is ask.
+ * Read enable is approve (silent in-tree). Write enable is ask: the list is
+ * what the agent may attempt, not a grant. Yolo rewrites that ask and deny.
+ * Realpath / cwd / ~ live on the host; this matcher sees the prepared string.
+ *
+ * Every rule carries a class (why it votes). Brace and glob words from the shell are expanded
+ * lexically against the block rules: if any expansion or match could hit one, the word is `block`.
+ */
+import type { ClassId } from "./classes.js";
+import type { Disposition, FloorVerdict, WriteRemainderKind } from "./types.js";
+type PathRule = {
+    readonly id: string;
+    readonly polarity: "policyApprove" | "ask" | "deny" | "block";
+    readonly stem: string;
+    readonly unanchored: boolean;
+    readonly class: ClassId;
+};
+export type PathTerm = {
+    readonly cluster: "read" | "write";
+    readonly rules: PathRule[];
+    /** Class of a miss (deny: outside the enable roots). */
+    readonly missClass: ClassId;
+};
+export declare function mergePathTerms(cluster: "read" | "write", missClass: ClassId, enable: readonly PathRule[] | undefined, block: readonly PathRule[] | undefined): PathTerm | undefined;
+export declare function checkPath(term: PathTerm, path: string): Disposition;
+/** The disposition of one path with the rules that decided it. */
+export declare function explainPath(term: PathTerm, path: string): FloorVerdict;
+/**
+ * Shell words may carry braces and globs. A word the shell would expand is judged as every
+ * word it could expand to; a glob is judged as everything it could match. The result is the
+ * strictest of those and the word itself, so this can only tighten. Only block rules can be
+ * hit by a pattern (an enable root never needs a glob to be understood: the word asks).
+ */
+export declare function explainShellPath(term: PathTerm, word: string, options?: {
+    readonly dotglob?: boolean;
+}): FloorVerdict;
+/**
+ * Write-deny remainder intern. Null when the floor is not deny.
+ * protected: enable `!` inside an enable root. outside: miss, left the
+ * enable set. risky: enable `!` and left the enable set. `write_block`
+ * never reaches this.
+ */
+export declare function writeRemainderKind(term: PathTerm, path: string): WriteRemainderKind | null;
+/** Undefined = unresolvable (ask). No `..`, `~`, `$`, glob, NUL. */
+export declare function normalizePath(raw: string): string | undefined;
+export { lattice } from "./lift.js";
+export { APPROVE } from "./verdict.js";
+//# sourceMappingURL=path-policy.d.ts.map

package/dist/path-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-policy.d.ts","sourceRoot":"","sources":["../src/path-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGhF,KAAK,QAAQ,GAAG;IACd,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,GAAG,OAAO,EACzB,SAAS,EAAE,OAAO,EAClB,MAAM,EAAE,SAAS,QAAQ,EAAE,GAAG,SAAS,EACvC,KAAK,EAAE,SAAS,QAAQ,EAAE,GAAG,SAAS,GACrC,QAAQ,GAAG,SAAS,CAGtB;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAEnE;AAED,kEAAkE;AAClE,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAStE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3C,YAAY,CAsBd;AAwED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAkB1F;AAkED,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAiB7D;AAED,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC"}

package/dist/path-policy.js

@@ -0,0 +1,248 @@
+/**
+ * File-access cluster: policy.json `read_file` / `write_file` enable lists
+ * and `read_block` / `write_block` hard-block lists.
+ * Enable `!` is deny (remainder carve-out). Block lists are unliftable.
+ * Suffix wildcard is implied — PAT matches itself and descendants.
+ * Miss is deny (closed). Unresolvable path is ask.
+ * Read enable is approve (silent in-tree). Write enable is ask: the list is
+ * what the agent may attempt, not a grant. Yolo rewrites that ask and deny.
+ * Realpath / cwd / ~ live on the host; this matcher sees the prepared string.
+ *
+ * Every rule carries a class (why it votes). Brace and glob words from the shell are expanded
+ * lexically against the block rules: if any expansion or match could hit one, the word is `block`.
+ */
+import { posix } from "node:path";
+import { minimatch } from "minimatch";
+import { expandBraces } from "./glob-expand.js";
+import { cast, join } from "./verdict.js";
+export function mergePathTerms(cluster, missClass, enable, block) {
+    if (enable === undefined && block === undefined)
+        return undefined;
+    return { cluster, missClass, rules: [...(enable ?? []), ...(block ?? [])] };
+}
+export function checkPath(term, path) {
+    return explainPath(term, path).disposition;
+}
+/** The disposition of one path with the rules that decided it. */
+export function explainPath(term, path) {
+    const resolved = normalizePath(path);
+    if (resolved === undefined) {
+        return cast("ask", "unmodelled", `${term.cluster}:unresolvable`, { path: { cluster: term.cluster, path } });
+    }
+    const hits = term.rules.filter((rule) => matchesRule(rule, resolved));
+    const where = { path: { cluster: term.cluster, path: resolved } };
+    if (hits.length === 0)
+        return cast("deny", term.missClass, `${term.cluster}:miss`, where);
+    return join(hits.map((rule) => cast(rule.polarity, rule.class, rule.id, where)));
+}
+/**
+ * Shell words may carry braces and globs. A word the shell would expand is judged as every
+ * word it could expand to; a glob is judged as everything it could match. The result is the
+ * strictest of those and the word itself, so this can only tighten. Only block rules can be
+ * hit by a pattern (an enable root never needs a glob to be understood: the word asks).
+ */
+export function explainShellPath(term, word, options = {}) {
+    const plain = explainPath(term, word);
+    if (!/[{*?[]/.test(word))
+        return plain;
+    const { words: expandedWords, overflow } = expandBraces(word);
+    // `a/../.e{nv,x}`: collapse `..` lexically so the block rule sees the name it will open.
+    const words = [...expandedWords, ...expandedWords.map(collapseDots).filter((w) => !expandedWords.includes(w))];
+    const verdicts = [plain];
+    for (const expanded of words) {
+        if (!/[*?[]/.test(expanded)) {
+            if (expanded !== word)
+                verdicts.push(explainPath(term, expanded));
+            continue;
+        }
+        const hit = globBlockHit(term, expanded, options.dotglob === true);
+        if (hit !== undefined)
+            verdicts.push(cast("block", hit.class, hit.id, { path: { cluster: term.cluster, path: word } }));
+    }
+    if (overflow) {
+        const hit = globBlockHit(term, wildcardBraces(word), options.dotglob === true);
+        if (hit !== undefined)
+            verdicts.push(cast("block", hit.class, hit.id, { path: { cluster: term.cluster, path: word } }));
+    }
+    return join(verdicts);
+}
+function collapseDots(word) {
+    return word.includes("..") ? posix.normalize(word) : word;
+}
+/** Every outermost `{...}` group becomes `*`: a superset of whatever the group could expand to. */
+function wildcardBraces(word) {
+    let depth = 0;
+    let out = "";
+    for (const ch of word) {
+        if (ch === "{") {
+            if (depth === 0)
+                out += "*";
+            depth += 1;
+        }
+        else if (ch === "}" && depth > 0) {
+            depth -= 1;
+        }
+        else if (depth === 0) {
+            out += ch;
+        }
+    }
+    return out;
+}
+/**
+ * Could a path matching glob `pattern` be blocked? Segment by segment: `*` and `?` do not cross `/`
+ * and (like bash without `dotglob`) do not match a leading dot. Case and Unicode form are folded the
+ * way the block rules fold them.
+ */
+function globBlockHit(term, pattern, dotglob) {
+    const slash = pattern.replaceAll("\\", "/").normalize("NFC").toLowerCase();
+    const absolute = slash.startsWith("/");
+    const segments = slash.split("/").filter((seg) => seg !== "" && seg !== ".");
+    for (const rule of term.rules) {
+        if (rule.polarity !== "block")
+            continue;
+        const stem = rule.stem.normalize("NFC").toLowerCase();
+        if (stem === ".")
+            continue;
+        const stemSegments = stem.split("/").filter((seg) => seg !== "");
+        if (rule.unanchored) {
+            const name = stemSegments[0];
+            const at = name === undefined ? -1 : segments.findIndex((seg) => segmentMatches(seg, name, dotglob));
+            // `.claude/worktrees` is not under the `.claude` block, glob or not.
+            if (at !== -1 && !(rule.stem === ".claude" && segments[at + 1] === "worktrees"))
+                return rule;
+            continue;
+        }
+        if (stem.startsWith("/") !== absolute)
+            continue;
+        if (prefixMatches(segments, stemSegments, dotglob))
+            return rule;
+    }
+    return undefined;
+}
+/** `**` stands for any number of segments (zsh and bash with globstar). */
+function prefixMatches(pattern, stem, dotglob) {
+    if (stem.length === 0)
+        return true;
+    const [head, ...rest] = pattern;
+    if (head === undefined)
+        return false;
+    if (head === "**") {
+        return prefixMatches(rest, stem, dotglob) || prefixMatches(pattern, stem.slice(1), dotglob);
+    }
+    const [name, ...more] = stem;
+    return segmentMatches(head, name, dotglob) && prefixMatches(rest, more, dotglob);
+}
+function segmentMatches(pattern, name, dotglob) {
+    if (pattern === name)
+        return true;
+    if (!/[*?[\]{}()!+@]/.test(pattern))
+        return false;
+    // A segment with nothing literal in it (`*`, `??`, `[ab]`) matches every file name; treating that as a hit
+    // would block `cat *`. It still reaches dot-files when `dotglob` is set.
+    const literal = pattern.replaceAll(/\[[^\]]*\]|[*?]/g, "");
+    if (literal === "" && !(dotglob && name.startsWith(".")))
+        return false;
+    return minimatch(name, pattern, { dot: dotglob, nocase: true, nocomment: true, nonegate: true, noglobstar: true });
+}
+/**
+ * Write-deny remainder intern. Null when the floor is not deny.
+ * protected: enable `!` inside an enable root. outside: miss, left the
+ * enable set. risky: enable `!` and left the enable set. `write_block`
+ * never reaches this.
+ */
+export function writeRemainderKind(term, path) {
+    const resolved = normalizePath(path);
+    switch (true) {
+        case resolved === undefined:
+        case checkPath(term, path) !== "deny":
+            return null;
+        case !term.rules.some((rule) => resolved !== undefined && rule.polarity === "deny" && matchesRule(rule, resolved)):
+            return "outside";
+        case term.rules.some((rule) => resolved !== undefined &&
+            (rule.polarity === "ask" || rule.polarity === "policyApprove") &&
+            matchesRule(rule, resolved)):
+            return "protected";
+        default:
+            return "risky";
+    }
+}
+/**
+ * Block / deny rules fold case and Unicode form: macOS (APFS) and Windows open `.ENV` and `.env`
+ * as one file, so a case variant must not walk past the rule. A false block is safe; a miss
+ * is not. Enable rules stay exact: folding them would approve paths the list never named.
+ */
+function fold(path) {
+    return path.normalize("NFC").toLowerCase();
+}
+function matchesRule(rule, exact) {
+    const folded = rule.polarity === "block" || rule.polarity === "deny";
+    const resolved = folded ? fold(exact) : exact;
+    const stem = folded ? fold(rule.stem) : rule.stem;
+    switch (true) {
+        case rule.stem === ".":
+            return isRelative(resolved);
+        case rule.unanchored && hasSegment(resolved, stem):
+        case !rule.unanchored && isPrefix(resolved, stem):
+            return !(rule.polarity === "block" && rule.stem === ".claude" && isClaudeWorktree(resolved));
+        default:
+            return false;
+    }
+}
+/** `.claude` write_block does not cover `.claude/worktrees` (any depth). */
+function isClaudeWorktree(path) {
+    switch (true) {
+        case path === ".claude/worktrees":
+        case path.startsWith(".claude/worktrees/"):
+        case path.includes("/.claude/worktrees/"):
+        case path.endsWith("/.claude/worktrees"):
+            return true;
+        default:
+            return false;
+    }
+}
+function isPrefix(path, stem) {
+    switch (true) {
+        case path === stem:
+            return true;
+        case stem === "/":
+            return path.startsWith("/");
+        default:
+            return path.startsWith(`${stem}/`);
+    }
+}
+function hasSegment(path, stem) {
+    switch (true) {
+        case path === stem:
+        case path.startsWith(`${stem}/`):
+        case path.includes(`/${stem}/`):
+        case path.endsWith(`/${stem}`):
+            return true;
+        default:
+            return false;
+    }
+}
+function isRelative(path) {
+    return path !== "/" && !path.startsWith("/");
+}
+/** Undefined = unresolvable (ask). No `..`, `~`, `$`, glob, NUL. */
+export function normalizePath(raw) {
+    const slash = raw.replaceAll("\\", "/");
+    const parts = slash.split("/").filter((seg) => seg !== "" && seg !== ".");
+    switch (true) {
+        case raw === "" || raw.includes("\0"):
+        case /[~$?*`\0]/.test(slash):
+        case parts.includes(".."):
+            return undefined;
+        case slash.startsWith("/") && parts.length === 0:
+            return "/";
+        case slash.startsWith("/"):
+            return `/${parts.join("/")}`;
+        case parts.length === 0:
+            return ".";
+        default:
+            return parts.join("/");
+    }
+}
+export { lattice } from "./lift.js";
+export { APPROVE } from "./verdict.js";
+//# sourceMappingURL=path-policy.js.map

package/dist/path-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-policy.js","sourceRoot":"","sources":["../src/path-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAiB1C,MAAM,UAAU,cAAc,CAC5B,OAAyB,EACzB,SAAkB,EAClB,MAAuC,EACvC,KAAsC;IAEtC,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAClE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAc,EAAE,IAAY;IACpD,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,WAAW,CAAC;AAC7C,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,WAAW,CAAC,IAAc,EAAE,IAAY;IACtD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,OAAO,eAAe,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAW,CAAC;IAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1F,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAc,EACd,IAAY,EACZ,UAA0C,EAAE;IAE5C,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,yFAAyF;IACzF,MAAM,KAAK,GAAG,CAAC,GAAG,aAAa,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/G,MAAM,QAAQ,GAAmB,CAAC,KAAK,CAAC,CAAC;IACzC,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,IAAI,QAAQ,KAAK,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;QACnE,IAAI,GAAG,KAAK,SAAS;YACnB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;QAC/E,IAAI,GAAG,KAAK,SAAS;YACnB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AAED,mGAAmG;AACnG,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,KAAK,KAAK,CAAC;gBAAE,GAAG,IAAI,GAAG,CAAC;YAC5B,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACnC,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACvB,GAAG,IAAI,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,IAAc,EAAE,OAAe,EAAE,OAAgB;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC;IAC7E,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;YAAE,SAAS;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACtD,IAAI,IAAI,KAAK,GAAG;YAAE,SAAS;QAC3B,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;QACjE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,EAAE,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YACrG,qEAAqE;YACrE,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,WAAW,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7F,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,SAAS;QAChD,IAAI,aAAa,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAClE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,2EAA2E;AAC3E,SAAS,aAAa,CAAC,OAA0B,EAAE,IAAuB,EAAE,OAAgB;IAC1F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;IAChC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,OAAO,cAAc,CAAC,IAAI,EAAE,IAAK,EAAE,OAAO,CAAC,IAAI,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,IAAY,EAAE,OAAgB;IACrE,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,2GAA2G;IAC3G,yEAAyE;IACzE,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,OAAO,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;AACrH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAc,EAAE,IAAY;IAC7D,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ,KAAK,SAAS,CAAC;QAC5B,KAAK,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,MAAM;YACnC,OAAO,IAAI,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAChH,OAAO,SAAS,CAAC;QACnB,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAClB,CAAC,IAAI,EAAE,EAAE,CACP,QAAQ,KAAK,SAAS;YACtB,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,eAAe,CAAC;YAC9D,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAC9B;YACC,OAAO,WAAW,CAAC;QACrB;YACE,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,IAAI,CAAC,IAAY;IACxB,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,WAAW,CAAC,IAAc,EAAE,KAAa;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC;IACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAClD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG;YACpB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC9B,KAAK,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;YAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/F;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,SAAS,gBAAgB,CAAC,IAAY;IACpC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,IAAI,KAAK,mBAAmB,CAAC;QAClC,KAAK,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;QAC3C,KAAK,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QAC1C,KAAK,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YACtC,OAAO,IAAI,CAAC;QACd;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY;IAC1C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,IAAI,KAAK,IAAI;YAChB,OAAO,IAAI,CAAC;QACd,KAAK,IAAI,KAAK,GAAG;YACf,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B;YACE,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY;IAC5C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,IAAI,KAAK,IAAI,CAAC;QACnB,KAAK,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;QACjC,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;QAChC,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC;IAC1E,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,KAAK,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,KAAK,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,KAAK,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAC9C,OAAO,GAAG,CAAC;QACb,KAAK,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YACxB,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,KAAK,CAAC,MAAM,KAAK,CAAC;YACrB,OAAO,GAAG,CAAC;QACb;YACE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC"}

package/dist/peel-cwd.d.ts

@@ -0,0 +1,8 @@
+export type PeeledCd = {
+    readonly cwd: string;
+    readonly command: string;
+};
+export declare function peelLeadingCd(source: string): PeeledCd | null;
+/** Keep an explicit `cwd` arg when it names the same leaf; never override a disagreement. */
+export declare function peelShellCwd(command: string, cwdArg?: string): PeeledCd | null;
+//# sourceMappingURL=peel-cwd.d.ts.map

package/dist/peel-cwd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"peel-cwd.d.ts","sourceRoot":"","sources":["../src/peel-cwd.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAIF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAyB7D;AAED,6FAA6F;AAC7F,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAU9E"}