@intentic/sandbox-contract 1.248.0 → 1.250.0

package/dist/{batch-runs.d.ts → policy/batch-runs.d.ts}

@@ -1,4 +1,4 @@
-import type { ModelRole } from "./model-roles.js";
+import type { ModelRole } from "../models/model-roles.js";
 export interface BatchRunKind {
     readonly runsDir: string;
     readonly prefix: string;
@@ -21,7 +21,11 @@ export declare const batchReportingClause: (params: {
 export interface BatchTurnPick {
     readonly provider: string;
     readonly model?: string | undefined;
+    readonly account?: string | undefined;
+    readonly harness?: string | undefined;
     readonly effort?: string | undefined;
+    readonly thinking?: boolean | undefined;
+    readonly fast?: boolean | undefined;
 }
 export declare const batchTurnBody: (params: {
     readonly prompt: string;

package/dist/policy/batch-runs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch-runs.d.ts","sourceRoot":"","sources":["../../src/policy/batch-runs.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAQ1D,MAAM,WAAW,YAAY;IAEzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC7B;AASD,eAAO,MAAM,YAAY,YAAa,MAAM,KAAG,MAA2F,CAAC;AAI3I,eAAO,MAAM,mBAAmB,SAAU,YAAY,SAAS,MAAM,SAAS,MAAM,KAAG,MACkC,CAAC;AAG1H,eAAO,MAAM,cAAc,SAAU,YAAY,KAAG,MAA2B,CAAC;AAGhF,eAAO,MAAM,YAAY,SAAU,YAAY,KAAG,MAAwC,CAAC;AAC3F,eAAO,MAAM,WAAW,SAAU,YAAY,SAAS,MAAM,KAAG,MAA0C,CAAC;AAC3G,eAAO,MAAM,oBAAoB,SAAU,YAAY,SAAS,MAAM,KAAG,MAAgD,CAAC;AAI1H,eAAO,MAAM,YAAY,SAAU,YAAY,SAAS,MAAM,SAAS,MAAM,KAAG,MACS,CAAC;AAC1F,eAAO,MAAM,eAAe,SAAU,YAAY,SAAS,MAAM,SAAS,MAAM,KAAG,MAA0D,CAAC;AAI9I,eAAO,MAAM,cAAc,GAAI,CAAC,QAAQ,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,KAAG,CAAC,GAAG,SAO9G,CAAC;AAiBF,eAAO,MAAM,oBAAoB,WAAY;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,KAAG,MAMxH,CAAC;AAmBnB,MAAM,WAAW,aAAa;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACvC;AAcD,eAAO,MAAM,aAAa,WAAY;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CAClE,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CASxB,CAAC"}

package/dist/{batch-runs.js → policy/batch-runs.js}

@@ -25,6 +25,15 @@ export const batchReportingClause = (params) => [
     ...(params.outcomes === undefined ? [] : [params.outcomes]),
     `Write that file even if you conclude there was nothing to do.`,
 ].join(`\n\n`);
+const runPickFields = (pick) => ({
+    agent: pick.provider,
+    ...(pick.model === undefined ? {} : { model: pick.model }),
+    ...(pick.account === undefined ? {} : { account: pick.account }),
+    ...(pick.harness === undefined ? {} : { harness: pick.harness }),
+    ...(pick.effort === undefined ? {} : { effort: pick.effort }),
+    ...(pick.thinking === undefined ? {} : { thinking: pick.thinking }),
+    ...(pick.fast === undefined ? {} : { fast: pick.fast }),
+});
 export const batchTurnBody = (params) => ({
     prompt: params.prompt,
     title: params.title.slice(0, 80),
@@ -32,13 +41,7 @@ export const batchTurnBody = (params) => ({
     isolated: true,
     unattended: true,
     runRole: params.role,
-    ...(params.pick === undefined
-        ? {}
-        : {
-            agent: params.pick.provider,
-            ...(params.pick.model === undefined ? {} : { model: params.pick.model }),
-            ...(params.pick.effort === undefined ? {} : { effort: params.pick.effort }),
-        }),
+    ...(params.pick === undefined ? {} : runPickFields(params.pick)),
     ...params.extra,
 });
 //# sourceMappingURL=batch-runs.js.map

package/dist/policy/batch-runs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch-runs.js","sourceRoot":"","sources":["../../src/policy/batch-runs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAmBhD,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAI/B,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,IAAI,QAAQ,GAAG,CAAC,CAAC;AACjB,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;AAI3I,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,IAAkB,EAAE,KAAa,EAAE,IAAa,EAAU,EAAE,CAC5F,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAG1H,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAkB,EAAU,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;AAGhF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAkB,EAAU,EAAE,CAAC,GAAG,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;AAC3F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAkB,EAAE,KAAa,EAAU,EAAE,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;AAC3G,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAkB,EAAE,KAAa,EAAU,EAAE,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC;AAI1H,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAkB,EAAE,KAAa,EAAE,IAAa,EAAU,EAAE,CACrF,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;AAC1F,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAkB,EAAE,KAAa,EAAE,IAAa,EAAU,EAAE,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC;AAI9I,MAAM,CAAC,MAAM,cAAc,GAAG,CAAI,IAAY,EAAE,KAAwD,EAAiB,EAAE;IACvH,IAAI,CAAC;QACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAiC,CAAC,CAAC;IAChH,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC,CAAC;AAiBF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAkG,EAAU,EAAE,CAC/I;IACI,mDAAmD,MAAM,CAAC,IAAI,WAAW;IACzE,MAAM,CAAC,MAAM;IACb,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3D,+DAA+D;CAClE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AA+BnB,MAAM,aAAa,GAAG,CAAC,IAAmB,EAA2B,EAAE,CAAC,CAAC;IACrE,KAAK,EAAE,IAAI,CAAC,QAAQ;IACpB,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAC1D,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAChE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAChE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC7D,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IACnE,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;CAC1D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAQ7B,EAA2B,EAAE,CAAC,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;IAChC,cAAc,EAAE,MAAM,CAAC,cAAc;IACrC,QAAQ,EAAE,IAAI;IACd,UAAU,EAAE,IAAI;IAChB,OAAO,EAAE,MAAM,CAAC,IAAI;IACpB,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChE,GAAG,MAAM,CAAC,KAAK;CAClB,CAAC,CAAC"}

package/dist/policy/capability-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-env.d.ts","sourceRoot":"","sources":["../../src/policy/capability-env.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,SAAS,OAAQ,MAAM,KAAG,MAA+C,CAAC"}

package/dist/policy/capability-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-env.js","sourceRoot":"","sources":["../../src/policy/capability-env.ts"],"names":[],"mappings":"AASA,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC"}

package/dist/policy/capability-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-secrets.d.ts","sourceRoot":"","sources":["../../src/policy/capability-secrets.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,OAAO,yBAAyB,CAAC;AAG9C,eAAO,MAAM,SAAS,UAAW,OAAO,KAAG,OAA4B,CAAC"}

package/dist/policy/capability-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-secrets.js","sourceRoot":"","sources":["../../src/policy/capability-secrets.ts"],"names":[],"mappings":"AACA,MAAM,CAAC,MAAM,OAAO,GAAG,sBAAsB,CAAC;AAG9C,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAc,EAAW,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC"}

package/dist/{card-status.d.ts → policy/card-status.d.ts}

@@ -1,5 +1,5 @@
-import type { TranscriptCards } from "./events.js";
-import type { AgentReply } from "./schemas/plan-limits.js";
+import type { TranscriptCards } from "../events/transcript.js";
+import type { AgentReply } from "../schemas/plan-limits.js";
 export declare const settledCards: (cards: TranscriptCards, reply: AgentReply | undefined) => TranscriptCards;
 export declare const cancelledCards: (cards: TranscriptCards) => TranscriptCards;
 //# sourceMappingURL=card-status.d.ts.map

package/dist/policy/card-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"card-status.d.ts","sourceRoot":"","sources":["../../src/policy/card-status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAa,eAAe,EAAiB,MAAM,yBAAyB,CAAC;AACzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAO5D,eAAO,MAAM,YAAY,UAAW,eAAe,SAAS,UAAU,GAAG,SAAS,KAAG,eAoDpF,CAAC;AAIF,eAAO,MAAM,cAAc,UAAW,eAAe,KAAG,eAyBvD,CAAC"}

package/dist/{card-status.js → policy/card-status.js}

@@ -1,6 +1,6 @@
 export const settledCards = (cards, reply) => {
     const out = {};
-    const { plan, question, permission, browserHelp, terminalHelp, serviceOffer, capabilityOffer, paymentOffer, credentialOffer } = cards;
+    const { plan, question, permission, browserHelp, terminalHelp, capabilityOffer, paymentOffer, credentialOffer } = cards;
     if (plan !== undefined) {
         out.plan = { ...plan, status: reply?.kind !== "plan" ? "cancelled" : reply.approve ? "approved" : "rejected" };
     }
@@ -30,9 +30,6 @@ export const settledCards = (cards, reply) => {
     if (terminalHelp !== undefined) {
         out.terminalHelp = { ...terminalHelp, status: reply?.kind !== "terminal_help" ? "cancelled" : reply.helped ? "helped" : "declined" };
     }
-    if (serviceOffer !== undefined) {
-        out.serviceOffer = { ...serviceOffer, status: reply?.kind !== "service_offer" ? "cancelled" : reply.approve ? "approved" : "skipped" };
-    }
     if (capabilityOffer !== undefined) {
         out.capabilityOffer = {
             ...capabilityOffer,
@@ -59,7 +56,6 @@ export const cancelledCards = (cards) => {
         "permission",
         "browserHelp",
         "terminalHelp",
-        "serviceOffer",
         "capabilityOffer",
         "paymentOffer",
         "credentialOffer",

package/dist/policy/card-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"card-status.js","sourceRoot":"","sources":["../../src/policy/card-status.ts"],"names":[],"mappings":"AAQA,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAsB,EAAE,KAA6B,EAAmB,EAAE;IACnG,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IACxH,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACrB,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IACnH,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,GAAG,CAAC,QAAQ,GAAG;YACX,GAAG,QAAQ;YACX,MAAM,EAAE,KAAK,EAAE,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW;YACzF,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAChD,CAAC;IACN,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC3B,GAAG,CAAC,UAAU,GAAG;YACb,GAAG,UAAU;YACb,MAAM,EACF,KAAK,EAAE,IAAI,KAAK,YAAY;gBACxB,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM;oBACzB,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ;wBAC3B,CAAC,CAAC,QAAQ;wBACV,CAAC,CAAC,SAAS;SAC1B,CAAC;IACN,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC5B,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IACtI,CAAC;IACD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,YAAY,GAAG,EAAE,GAAG,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IACzI,CAAC;IAED,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAChC,GAAG,CAAC,eAAe,GAAG;YAClB,GAAG,eAAe;YAClB,MAAM,EAAE,KAAK,EAAE,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;SACtG,CAAC;IACN,CAAC;IAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,YAAY,GAAG,EAAE,GAAG,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC3I,CAAC;IAED,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAChC,GAAG,CAAC,eAAe,GAAG;YAClB,GAAG,eAAe;YAClB,MAAM,EAAE,KAAK,EAAE,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;SACpG,CAAC;IACN,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAsB,EAAmB,EAAE;IACtE,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,KAAK,IAAI;QAChB,MAAM;QACN,UAAU;QACV,YAAY;QACZ,aAAa;QACb,cAAc;QACd,iBAAiB;QACjB,cAAc;QACd,iBAAiB;KACX,EAAE,CAAC;QACT,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,SAAS;QACb,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,GAAG,IAAI,CAAC;YACd,GAAkC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAClF,CAAC;aAAM,CAAC;YACH,GAAkC,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QACtD,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AACjC,CAAC,CAAC"}

package/dist/{command-classes.d.ts → policy/command-classes.d.ts}

@@ -1,4 +1,4 @@
-import { type CommandClass, type CommandLocus } from "./schemas/agent.js";
+import { type CommandClass, type CommandLocus } from "../schemas/agent.js";
 export interface CommandSpan {
     readonly start: number;
     readonly end: number;
@@ -16,5 +16,9 @@ export declare const mergeSpans: (spans: readonly CommandSpan[]) => CommandSpan[
 export declare const matchCommand: (command: string, context: CommandContext) => CommandMatch[];
 export declare const classifyCommand: (command: string, context: CommandContext) => CommandClass[];
 export declare const COMMAND_CLASS_LABELS: Readonly<Record<CommandClass, string>>;
-export declare const COMMAND_CLASS_PATTERNS: Readonly<Record<CommandClass, readonly string[]>>;
+export interface CommandPattern {
+    readonly code: string;
+    readonly qualifier?: string;
+}
+export declare const COMMAND_CLASS_PATTERNS: Readonly<Record<CommandClass, readonly CommandPattern[]>>;
 //# sourceMappingURL=command-classes.d.ts.map

package/dist/policy/command-classes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-classes.d.ts","sourceRoot":"","sources":["../../src/policy/command-classes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,YAAY,EAAsB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAQ/F,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACxB;AAID,MAAM,WAAW,YAAY;IACzB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IAEvC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CAC1B;AAID,MAAM,WAAW,cAAc;IAE3B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAE7B,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,SAAS,CAAC;CAChE;AAaD,eAAO,MAAM,UAAU,UAAW,SAAS,WAAW,EAAE,KAAG,WAAW,EAWrE,CAAC;AAgQF,eAAO,MAAM,YAAY,YAAa,MAAM,WAAW,cAAc,KAAG,YAAY,EAMnF,CAAC;AAGF,eAAO,MAAM,eAAe,YAAa,MAAM,WAAW,cAAc,KAAG,YAAY,EAClB,CAAC;AAGtE,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAQvE,CAAC;AAIF,MAAM,WAAW,cAAc;IAE3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC/B;AAGD,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,cAAc,EAAE,CAAC,CAiD5F,CAAC"}

package/dist/{command-classes.js → policy/command-classes.js}

@@ -1,6 +1,6 @@
 import { HISTORY_ROOT, WORKSPACE_ROOT } from "@intentic/constants";
-import { CommandClassSchema } from "./schemas/agent.js";
-import { inertRegions, isLive } from "./shell-regions.js";
+import { CommandClassSchema } from "../schemas/agent.js";
+import { inertRegions, isLive } from "../text/shell-regions.js";
 const globally = (patterns) => patterns.map((pattern) => new RegExp(pattern.source, `${pattern.flags}g`));
 const spansOf = (patterns, command) => patterns.flatMap((pattern) => [...command.matchAll(pattern)].map((match) => ({ start: match.index, end: match.index + match[0].length })));
 export const mergeSpans = (spans) => {
@@ -206,16 +206,53 @@ export const COMMAND_CLASS_LABELS = {
     "network.outbound": "send a request out to the internet",
 };
 export const COMMAND_CLASS_PATTERNS = {
-    "git.destructive": ["git push --force / -f / --force-with-lease / --delete", "git reset --hard", "git clean -f", "git branch -D", "git filter-branch"],
-    "files.destructive": ["rm -rf <path>", "fs.rm / rmSync / rmdir with recursive: true", "rimraf(<path>)"],
+    "git.destructive": [
+        { code: "git push --force", qualifier: "also -f and --force-with-lease" },
+        { code: "git push --delete" },
+        { code: "git reset --hard" },
+        { code: "git clean -f" },
+        { code: "git branch -D" },
+        { code: "git filter-branch" },
+    ],
+    "files.destructive": [
+        { code: "rm -rf <path>" },
+        { code: "fs.rm(<path>, { recursive: true })", qualifier: "also rmSync, rmdir, rmdirSync" },
+        { code: "rimraf(<path>)" },
+    ],
     "system.destructive": [
-        "mkfs, wipefs, blkdiscard, sgdisk --zap-all",
-        "dd of=/dev/…, shred /dev/…, > /dev/sda",
-        "rm -rf aimed at a root directory",
+        { code: "mkfs" },
+        { code: "wipefs" },
+        { code: "blkdiscard" },
+        { code: "sgdisk --zap-all" },
+        { code: "dd of=/dev/…" },
+        { code: "shred /dev/…" },
+        { code: "> /dev/sda" },
+        { code: "rm -rf /", qualifier: "only when the target is a root, listed below" },
+    ],
+    "container.state": [
+        { code: "docker volume rm", qualifier: "also remove, prune, and podman for any of these" },
+        { code: "docker system prune" },
+        { code: "docker compose down -v" },
+    ],
+    "secrets.access": [
+        { code: "{{secret:NAME}}", qualifier: "a stored secret, used in the command itself" },
+        { code: ".env" },
+        { code: ".ssh/*" },
+        { code: "id_rsa" },
+        { code: ".aws/credentials" },
+        { code: ".npmrc" },
+        { code: ".git-credentials" },
+    ],
+    "package.publish": [
+        { code: "npm publish", qualifier: "also pnpm, yarn, bun" },
+        { code: "cargo publish" },
+        { code: "gh release create" },
+        { code: "docker push" },
+        { code: "twine upload" },
+    ],
+    "network.outbound": [
+        { code: "curl https://…", qualifier: "also wget; loopback does not count" },
+        { code: 'fetch("https://…")', qualifier: "in a script" },
     ],
-    "container.state": ["docker / podman volume rm, remove, prune", "docker / podman system prune", "docker compose down -v"],
-    "secrets.access": ["a {{secret:NAME}} reference in the command", ".env, .ssh/*, id_rsa, .aws/credentials, .npmrc, .git-credentials"],
-    "package.publish": ["npm / pnpm / yarn / bun publish", "cargo publish", "gh release create", "docker push", "twine upload"],
-    "network.outbound": ["curl / wget to a non-loopback https:// host", 'fetch("https://…") in a script'],
 };
 //# sourceMappingURL=command-classes.js.map

package/dist/policy/command-classes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-classes.js","sourceRoot":"","sources":["../../src/policy/command-classes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAqB,kBAAkB,EAAqB,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAgChE,MAAM,QAAQ,GAAG,CAAC,QAA2B,EAAqB,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AAIhJ,MAAM,OAAO,GAAG,CAAC,QAA2B,EAAE,OAAe,EAAiB,EAAE,CAC5E,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AAI/I,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAA6B,EAAiB,EAAE;IACvE,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpG,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9C,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACrF,SAAS;QACb,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG;IACpB,2EAA2E;IAC3E,kCAAkC;IAElC,0CAA0C;IAC1C,6EAA6E;IAC7E,yBAAyB;CAC5B,CAAC;AAGF,MAAM,iBAAiB,GAAG,CAAC,iCAAiC,CAAC,CAAC;AAI9D,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAA,gBAAgB,CAAC;AAEhD,MAAM,gBAAgB,GAAG;IAErB,iEAAiE;IAEjE,mHAAmH;IAEnH,6CAA6C;IAC7C,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,GAAG,YAAY,qBAAqB,CAAC;IAE1D,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,GAAG,YAAY,4CAA4C,CAAC;IACjF,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,GAAG,YAAY,qBAAqB,CAAC;IAC1D,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,GAAG,YAAY,uBAAuB,CAAC;CAC/D,CAAC;AAEF,MAAM,eAAe,GAAG;IACpB,qCAAqC;IACrC,qBAAqB;IACrB,2BAA2B;IAC3B,mBAAmB;IACnB,oBAAoB;CACvB,CAAC;AAGF,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAA,2EAA2E,CAAC;AAGvG,MAAM,gBAAgB,GAAG;IACrB,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,yCAAyC,QAAQ,GAAG,CAAC;IAE1E,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,mCAAmC,QAAQ,GAAG,CAAC;CACvE,CAAC;AAGF,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAW5C,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;AAE7E,MAAM,OAAO,GAAG,CAAC,OAAe,EAAkB,EAAE;IAChD,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACvD,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAK,UAAU,CAAC,CAAC,CAAY,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/D,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBACd,SAAS;YACb,CAAC;YAED,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,SAAS,KAAK,IAAI,KAAK,aAAa,CAAC;gBACrC,KAAK,KAAK,IAAI,KAAK,SAAS,CAAC;gBAC7B,SAAS;YACb,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,SAAS,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChC,KAAK,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC7B,SAAS;YACb,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3I,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAKF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;AAGlD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IACzB,EAAE;IACF,cAAc;IACd,YAAY;IACZ,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,eAAe;IACf,SAAS;IACT,UAAU;CACb,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,CAAC,KAAmB,EAAuB,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;AAEnH,MAAM,UAAU,GAAG,yCAAyC,CAAC;AAC7D,MAAM,aAAa,GAAG,aAAa,CAAC;AAGpC,MAAM,UAAU,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAExG,MAAM,YAAY,GAAG,CAAC,OAAe,EAAE,KAAmB,EAAW,EAAE;IACnE,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAEnC,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,KAAK,QAAQ,CAAC;IAC9B,CAAC;IAED,OAAO,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC5G,CAAC,CAAC;AAGF,MAAM,iBAAiB,GAAG,gEAAgE,CAAC;AAC3F,MAAM,sBAAsB,GAAG,sFAAsF,CAAC;AAEtH,MAAM,MAAM,GAAG,iDAAiD,CAAC;AACjE,MAAM,WAAW,GAAG,uEAAuE,CAAC;AAG5F,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAiB,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAIrH,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAA6D,EAAE,CACrG,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5F,MAAM,EAAE,KAAK,CAAC,CAAC,CAAW;IAC1B,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE;CACnE,CAAC,CAAC,CAAC;AAIR,MAAM,YAAY,GAAG;IACjB,oBAAoB;IACpB,YAAY;IACZ,gBAAgB;IAChB,uCAAuC;IACvC,4CAA4C;IAC5C,2BAA2B;IAE3B,mDAAmD;CACtD,CAAC;AAGF,MAAM,eAAe,GAAG;IACpB,sDAAsD;IACtD,wCAAwC;IACxC,2FAA2F;CAC9F,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAiB,EAAE,CACzD,OAAO,CAAC,OAAO,CAAC;KACX,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;KAChE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAI9C,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,KAAmB,EAAiB,EAAE,CAAC;IACzE,GAAG,OAAO,CAAC,OAAO,CAAC;SACd,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;SACvI,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;IACzC,GAAG,iBAAiB,CAAC,OAAO,CAAC;SACxB,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACtC,CAAC;AAGF,MAAM,iBAAiB,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;AACpD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,iBAAiB,CAAC,CAAC;AACxD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AACtD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;AACpD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AACtD,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;AAC9C,MAAM,iBAAiB,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;AAIpD,MAAM,SAAS,GAAG,cAAc,CAAC;AACjC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,IAAiB,EAAU,EAAE;IACjE,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAW,CAAC,EAAE,CAAC;QAChE,KAAK,IAAI,CAAC,CAAC;IACf,CAAC;IACD,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACnB,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAW,CAAC,EAAE,CAAC;QACrE,GAAG,IAAI,CAAC,CAAC;IACb,CAAC;IACD,OAAO,OAAO;SACT,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC;SACjB,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;SAC7B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC,CAAC;AAIF,MAAM,eAAe,GAAG,YAAY,CAAC;AACrC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAC1C,MAAM,WAAW,GAAG,MAAM,CAAC;AAC3B,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,aAAa,GAAG,CAAC,IAAY,EAAW,EAAE,CAC5C,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAIpH,MAAM,eAAe,GAAG,CAAC,OAAe,EAAE,OAAuB,EAAiB,EAAE,CAAC;IACjF,GAAG,OAAO,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACxC,GAAG,OAAO,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1C,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC;IACzE,CAAC,CAAC;CACL,CAAC;AAGF,MAAM,OAAO,GAAgG;IACzG,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACnE,mBAAmB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,GAAG,iBAAiB,CAAC,OAAO,CAAC,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC/F,oBAAoB,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACzH,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACnE,gBAAgB,EAAE,eAAe;IACjC,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACnE,kBAAkB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,OAAO,CAAC;CACxE,CAAC;AAIF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAE,OAAuB,EAAkB,EAAE;IACrF,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE;QACvD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAClE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAClH,CAAC,CAAC,CAAC;AACP,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAe,EAAE,OAAuB,EAAkB,EAAE,CACxF,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AAGtE,MAAM,CAAC,MAAM,oBAAoB,GAA2C;IACxE,iBAAiB,EAAE,gCAAgC;IACnD,mBAAmB,EAAE,0BAA0B;IAC/C,oBAAoB,EAAE,+CAA+C;IACrE,iBAAiB,EAAE,6CAA6C;IAChE,gBAAgB,EAAE,0BAA0B;IAC5C,iBAAiB,EAAE,8BAA8B;IACjD,kBAAkB,EAAE,oCAAoC;CAC3D,CAAC;AAYF,MAAM,CAAC,MAAM,sBAAsB,GAA8D;IAC7F,iBAAiB,EAAE;QACf,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,gCAAgC,EAAE;QACzE,EAAE,IAAI,EAAE,mBAAmB,EAAE;QAC7B,EAAE,IAAI,EAAE,kBAAkB,EAAE;QAC5B,EAAE,IAAI,EAAE,cAAc,EAAE;QACxB,EAAE,IAAI,EAAE,eAAe,EAAE;QACzB,EAAE,IAAI,EAAE,mBAAmB,EAAE;KAChC;IACD,mBAAmB,EAAE;QACjB,EAAE,IAAI,EAAE,eAAe,EAAE;QACzB,EAAE,IAAI,EAAE,oCAAoC,EAAE,SAAS,EAAE,+BAA+B,EAAE;QAC1F,EAAE,IAAI,EAAE,gBAAgB,EAAE;KAC7B;IACD,oBAAoB,EAAE;QAClB,EAAE,IAAI,EAAE,MAAM,EAAE;QAChB,EAAE,IAAI,EAAE,QAAQ,EAAE;QAClB,EAAE,IAAI,EAAE,YAAY,EAAE;QACtB,EAAE,IAAI,EAAE,kBAAkB,EAAE;QAC5B,EAAE,IAAI,EAAE,cAAc,EAAE;QACxB,EAAE,IAAI,EAAE,cAAc,EAAE;QACxB,EAAE,IAAI,EAAE,YAAY,EAAE;QACtB,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,8CAA8C,EAAE;KAClF;IACD,iBAAiB,EAAE;QACf,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,iDAAiD,EAAE;QAC1F,EAAE,IAAI,EAAE,qBAAqB,EAAE;QAC/B,EAAE,IAAI,EAAE,wBAAwB,EAAE;KACrC;IACD,gBAAgB,EAAE;QACd,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,6CAA6C,EAAE;QACrF,EAAE,IAAI,EAAE,MAAM,EAAE;QAChB,EAAE,IAAI,EAAE,QAAQ,EAAE;QAClB,EAAE,IAAI,EAAE,QAAQ,EAAE;QAClB,EAAE,IAAI,EAAE,kBAAkB,EAAE;QAC5B,EAAE,IAAI,EAAE,QAAQ,EAAE;QAClB,EAAE,IAAI,EAAE,kBAAkB,EAAE;KAC/B;IACD,iBAAiB,EAAE;QACf,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,sBAAsB,EAAE;QAC1D,EAAE,IAAI,EAAE,eAAe,EAAE;QACzB,EAAE,IAAI,EAAE,mBAAmB,EAAE;QAC7B,EAAE,IAAI,EAAE,aAAa,EAAE;QACvB,EAAE,IAAI,EAAE,cAAc,EAAE;KAC3B;IACD,kBAAkB,EAAE;QAChB,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,oCAAoC,EAAE;QAC3E,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,aAAa,EAAE;KAC3D;CACJ,CAAC"}

package/dist/{command-run.d.ts → policy/command-run.d.ts}

@@ -1,4 +1,4 @@
-import type { CommandRun } from "./schemas/ci.js";
+import type { CommandRun } from "../schemas/ci.js";
 export interface FollowRunOptions<R extends CommandRun> {
     readonly intervalMs: number;
     readonly signal?: AbortSignal | undefined;

package/dist/policy/command-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-run.d.ts","sourceRoot":"","sources":["../../src/policy/command-run.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAInD,MAAM,WAAW,gBAAgB,CAAC,CAAC,SAAS,UAAU;IAElD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAE1C,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAElD,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC7D;AAeD,eAAO,MAAM,gBAAgB,GAAU,CAAC,SAAS,UAAU,QAAQ,MAAM,OAAO,CAAC,CAAC,CAAC,WAAW,gBAAgB,CAAC,CAAC,CAAC,KAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAiBxI,CAAC;AAEF,eAAO,MAAM,iBAAiB,QAAS,IAAI,CAAC,UAAU,EAAE,QAAQ,GAAG,UAAU,CAAC,WAAW,MAAM,KAAG,MAiBjG,CAAC"}

package/dist/policy/command-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-run.js","sourceRoot":"","sources":["../../src/policy/command-run.ts"],"names":[],"mappings":"AAeA,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,MAA+B,EAAiB,EAAE,CACzE,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACpB,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnC,SAAS,IAAI;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3C,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AAIP,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAwB,IAAsB,EAAE,OAA4B,EAA0B,EAAE;IACzI,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACzD,SAAS,CAAC;QACN,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;YACf,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO,GAAG,CAAC;YACf,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAA4C,EAAE,OAAe,EAAU,EAAE;IACvG,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,GAAG,OAAO,YAAY,CAAC;IAClC,CAAC;IACD,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,OAAO;YACR,OAAO,GAAG,OAAO,eAAe,CAAC;QACrC,KAAK,WAAW;YACZ,OAAO,GAAG,OAAO,UAAU,CAAC;QAChC,KAAK,QAAQ;YACT,OAAO,GAAG,OAAO,SAAS,CAAC;QAC/B,KAAK,QAAQ;YACT,OAAO,GAAG,OAAO,SAAS,CAAC;QAC/B;YAEI,OAAO,GAAG,OAAO,aAAa,CAAC;IACvC,CAAC;AACL,CAAC,CAAC"}

package/dist/policy/control-scopes.d.ts

@@ -0,0 +1,16 @@
+import { z } from "zod";
+export declare const CONTROL_SCOPES: readonly ["editor", "read", "drive", "land"];
+export type ControlScope = (typeof CONTROL_SCOPES)[number];
+export declare const ControlScopeSchema: z.ZodEnum<{
+    drive: "drive";
+    editor: "editor";
+    land: "land";
+    read: "read";
+}>;
+export interface ControlScopeReach {
+    readonly scope: ControlScope;
+    readonly reach: string;
+    readonly note: string;
+}
+export declare const CONTROL_SCOPE_REACH: readonly ControlScopeReach[];
+//# sourceMappingURL=control-scopes.d.ts.map

package/dist/policy/control-scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-scopes.d.ts","sourceRoot":"","sources":["../../src/policy/control-scopes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,cAAc,YAAI,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAC3E,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3D,eAAO,MAAM,kBAAkB;;;;;EAAyB,CAAC;AAEzD,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAE7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACzB;AAGD,eAAO,MAAM,mBAAmB,EAAE,SAAS,iBAAiB,EAqB3D,CAAC"}

package/dist/policy/control-scopes.js

@@ -0,0 +1,26 @@
+import { z } from "zod";
+export const CONTROL_SCOPES = ["editor", "read", "drive", "land"];
+export const ControlScopeSchema = z.enum(CONTROL_SCOPES);
+export const CONTROL_SCOPE_REACH = [
+    {
+        scope: "editor",
+        reach: "One conversation: run a turn, answer a card it parked on, read transcripts, search the tree.",
+        note: "What an editor bridge holds. It cannot see the fleet and it cannot land work.",
+    },
+    {
+        scope: "read",
+        reach: "Everything a viewer sees: the fleet, transcripts, files, git state, CI runs, listening ports. Changes nothing.",
+        note: "The one genuinely narrow rung, which is why it exists separately rather than as a politeness.",
+    },
+    {
+        scope: "drive",
+        reach: "Everything read sees, plus what a collaborator does: start, answer, steer and stop turns, rename and archive agents.",
+        note: "Stops short of anything that moves code into the main tree. A stolen token at this rung is the agent's reach.",
+    },
+    {
+        scope: "land",
+        reach: "Everything drive does, plus merging a conversation's worktree into the main tree, and discarding or purging one.",
+        note: "Separate because the usual arrangement is a program that works and a person who decides.",
+    },
+];
+//# sourceMappingURL=control-scopes.js.map

package/dist/policy/control-scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-scopes.js","sourceRoot":"","sources":["../../src/policy/control-scopes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAE3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAWzD,MAAM,CAAC,MAAM,mBAAmB,GAAiC;IAC7D;QACI,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,8FAA8F;QACrG,IAAI,EAAE,+EAA+E;KACxF;IACD;QACI,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,gHAAgH;QACvH,IAAI,EAAE,+FAA+F;KACxG;IACD;QACI,KAAK,EAAE,OAAO;QACd,KAAK,EAAE,sHAAsH;QAC7H,IAAI,EAAE,+GAA+G;KACxH;IACD;QACI,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,kHAAkH;QACzH,IAAI,EAAE,0FAA0F;KACnG;CACJ,CAAC"}

package/dist/policy/credential-material.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-material.d.ts","sourceRoot":"","sources":["../../src/policy/credential-material.ts"],"names":[],"mappings":"AA+CA,eAAO,MAAM,uBAAuB,SAAU,MAAM,KAAG,OAYtD,CAAC;AAiBF,eAAO,MAAM,sBAAsB,SAAU,MAAM,KAAG,MAc5C,CAAC"}

package/dist/policy/credential-material.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-material.js","sourceRoot":"","sources":["../../src/policy/credential-material.ts"],"names":[],"mappings":"AAKA,MAAM,qBAAqB,GACvB,2PAA2P,CAAC;AAGhQ,MAAM,WAAW,GACb,yRAAyR,CAAC;AAG9R,MAAM,SAAS,GAAG,CAAC,CAAC;AAGpB,MAAM,iBAAiB,GAAG;IACtB,4CAA4C;IAC5C,wBAAwB;IAExB,yDAAyD;CAC5D,CAAC;AAEF,MAAM,aAAa,GAAG;IAClB,wBAAwB;IACxB,4CAA4C;IAC5C,gCAAgC;IAChC,4BAA4B;IAC5B,gCAAgC;IAChC,yBAAyB;IACzB,mCAAmC;IACnC,sBAAsB;IACtB,sBAAsB;IACtB,2BAA2B;IAC3B,uBAAuB;IACvB,wBAAwB;IAExB,gDAAgD;CACnD,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,GAAG,iBAAiB,EAAE,GAAG,aAAa,CAAC,CAAC;AAG9D,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAIxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,IAAY,EAAW,EAAE;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAGF,MAAM,IAAI,GAAG,KAAK,CAAC;AAGnB,MAAM,QAAQ,GAAG,CAAC,QAA2B,EAAqB,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AAChJ,MAAM,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;AAChD,MAAM,uBAAuB,GAAG,IAAI,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC;AAGtG,MAAM,iBAAiB,GAAG,sFAAsF,CAAC;AACjH,MAAM,YAAY,GAAG,4DAA4D,CAAC;AAGlF,MAAM,eAAe,GAAG,cAAc,CAAC;AAEvC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,IAAY,EAAU,EAAE,CAC3D,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;KACvE,OAAO,CAAC,iBAAiB,EAAE,OAAO,IAAI,MAAM,CAAC;KAC7C,OAAO,CAAC,YAAY,EAAE,KAAK,IAAI,GAAG,CAAC;KAEnC,OAAO,CAAC,uBAAuB,EAAE,CAAC,KAAK,EAAE,GAAG,MAAiB,EAAE,EAAE;IAC9D,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAW,CAAC;IACpE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3F,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;AAC3E,CAAC,CAAC,CAAC"}

package/dist/policy/needs-action.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"needs-action.d.ts","sourceRoot":"","sources":["../../src/policy/needs-action.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;iBAAwD,CAAC;AACvF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/policy/needs-action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"needs-action.js","sourceRoot":"","sources":["../../src/policy/needs-action.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC"}

package/dist/policy/output-fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-fields.d.ts","sourceRoot":"","sources":["../../src/policy/output-fields.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,eAAO,MAAM,iBAAiB;;;;;;;;;;iBAO5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAG5D,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAIpC,eAAO,MAAM,yBAAyB,WAAY,SAAS,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAG,MAAM,EAU9F,CAAC;AAEF,eAAO,MAAM,kBAAkB;;;;;;;;;;kBAQzB,CAAC;AAiBP,eAAO,MAAM,eAAe,WAAY,SAAS,WAAW,EAAE,KAAG,CAAC,CAAC,OAC8E,CAAC;AAIlJ,eAAO,MAAM,aAAa,WAAY,SAAS,WAAW,EAAE,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAehF,CAAC;AAGN,eAAO,MAAM,cAAc,WAAY,SAAS,WAAW,EAAE,KAAG,MACgF,CAAC"}

package/dist/policy/output-fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-fields.js","sourceRoot":"","sources":["../../src/policy/output-fields.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,MAAM,UAAU,GAAG,+BAA+B,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAEzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAIpC,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,MAA4C,EAAY,EAAE;IAChG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;AACzB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAC9B,KAAK,CAAC,iBAAiB,CAAC;KACxB,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,iBAAiB,CAAC;KACtB,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IAC7B,KAAK,MAAM,IAAI,IAAI,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,uCAAuC,IAAI,gBAAgB,EAAE,CAAC,CAAC;IAC/G,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,MAAM,YAAY,GAAG,CAAC,KAAkB,EAAa,EAAE;IACnD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;AACtB,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAA8B,EAAa,EAAE,CACzE,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAIlJ,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAA8B,EAA2B,EAAE,CACrF,MAAM,CAAC,WAAW,CACd,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;IACjB,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,wCAAwC,EAAE,CAAC;IACrG,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC9B,CAAC,CAAC,CACL,CAAC;AAGN,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAA8B,EAAU,EAAE,CACrE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC"}

package/dist/policy/overlay-lint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"overlay-lint.d.ts","sourceRoot":"","sources":["../../src/policy/overlay-lint.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,sBAAsB,QAAS,MAAM,KAAG,OAA2C,CAAC;AAyBjG,eAAO,MAAM,wBAAwB,YAAa,MAAM,KAAG,MAAM,GAAG,SAUnE,CAAC;AAGF,eAAO,MAAM,WAAW,YAAa,MAAM,KAAG,MAAM,GAAG,SAGtD,CAAC;AAGF,eAAO,MAAM,eAAe,YAAa,MAAM,KAAG,OAGjD,CAAC;AAIF,eAAO,MAAM,WAAW,YAAa,MAAM,KAAG,MAAM,GAAG,SAoBtD,CAAC;AAIF,eAAO,MAAM,kBAAkB,YAAa,MAAM,QAAQ,MAAM,KAAG,MAWlE,CAAC"}

package/dist/policy/overlay-lint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"overlay-lint.js","sourceRoot":"","sources":["../../src/policy/overlay-lint.ts"],"names":[],"mappings":"AAQA,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAE7C,MAAM,sBAAsB,GAAG,mCAAmC,CAAC;AAGnE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AASjG,MAAM,YAAY,GAAG,CAAC,OAAe,EAAiB,EAAE;IACpD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,YAAY,GAAG,SAAS,CAAC;QAC/B,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;QAC9G,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;AACP,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG,gBAAgB,CAAC;AAC9B,MAAM,UAAU,GAAG,eAAe,CAAC;AAInC,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,OAAe,EAAsB,EAAE;IAC5E,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,IAAI,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAClC,OAAO,GAAG,CAAC;QACf,CAAC;QACD,IAAI,IAAI,KAAK,aAAa,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACzD,OAAO,GAAG,CAAC;QACf,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAe,EAAsB,EAAE;IAC/D,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;IAChF,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAe,EAAW,EAAE;IACxD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,IAAI,KAAK,SAAS,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC;AAC9D,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAe,EAAsB,EAAE;IAC/D,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YACzB,SAAS;QACb,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,KAAK,EAAE,CAAC;YACR,KAAK,GAAG,KAAK,CAAC;YACd,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtD,OAAO,GAAG,CAAC;YACf,CAAC;YACD,SAAS;QACb,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO,GAAG,CAAC;QACf,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAClC,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAE,IAAY,EAAU,EAAE;IACxE,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,OAAO,YAAY,CAAC,OAAO,CAAC;SACvB,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;QACnB,IAAI,IAAI,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YACjC,OAAO,GAAG,CAAC;QACf,CAAC;QACD,IAAI,GAAG,IAAI,CAAC;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3E,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC,CAAC"}

package/dist/policy/owner-ticket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-ticket.d.ts","sourceRoot":"","sources":["../../src/policy/owner-ticket.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,mBAAmB,QAAa,CAAC;AAG9C,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAK7D,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC9B;AAED,eAAO,MAAM,aAAa,WAAY,MAAM,KAAG,OAAiD,CAAC;AAEjG,eAAO,MAAM,eAAe,kBACT,MAAM,SACd;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KACpH,MAYF,CAAC;AAIF,eAAO,MAAM,iBAAiB,iBAAkB,MAAM,SAAS,MAAM,SAAS,MAAM,KAAG,WAAW,GAAG,SA6BpG,CAAC;AAGF,eAAO,MAAM,cAAc,kBAAmB,MAAM,KAAG,MAC+C,CAAC"}

package/dist/{owner-ticket.js → policy/owner-ticket.js}

@@ -1,9 +1,9 @@
 import { createPrivateKey, createPublicKey, sign as edSign, verify as edVerify } from "node:crypto";
+import { SANDBOX_ID } from "../ids/tunnel-ids.js";
 const TICKET_PREFIX = "ot1";
 export const OWNER_TICKET_TTL_MS = 5 * 60_000;
 export const ENV_PLATFORM_PUBLIC_KEY = "PLATFORM_PUBLIC_KEY";
 const base64url = (bytes) => bytes.toString("base64url");
-const SANDBOX_ID = /^[0-9a-f]{12}$/;
 export const isOwnerTicket = (bearer) => bearer.startsWith(`${TICKET_PREFIX}.`);
 export const mintOwnerTicket = (privateKeyPem, claim) => {
     if (!SANDBOX_ID.test(claim.sandboxId)) {

package/dist/policy/owner-ticket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-ticket.js","sourceRoot":"","sources":["../../src/policy/owner-ticket.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,IAAI,QAAQ,EAAE,MAAM,aAAa,CAAC;AACpG,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAMlD,MAAM,aAAa,GAAG,KAAK,CAAC;AAG5B,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,MAAM,CAAC;AAG9C,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAUzE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAc,EAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,aAAa,GAAG,CAAC,CAAC;AAEjG,MAAM,CAAC,MAAM,eAAe,GAAG,CAC3B,aAAqB,EACrB,KAAmH,EAC7G,EAAE;IACR,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,mDAAmD,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,mBAAmB,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAC1H,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;IACzE,OAAO,GAAG,aAAa,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;AAC5E,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,YAAoB,EAAE,KAAa,EAAE,KAAa,EAA2B,EAAE;IAC7G,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;QACnD,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAW,EAAE,WAAW,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAW,EAAE,WAAW,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;YACrE,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAqE,CAAC;QACxH,IACI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC9B,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YAC5B,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAChC,MAAM,CAAC,KAAK,KAAK,EAAE;YACnB,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC9B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAChC,CAAC;YACC,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IACvG,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,aAAqB,EAAU,EAAE,CAC5D,eAAe,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC"}

package/dist/{safety-policy.d.ts → policy/safety-policy.d.ts}

@@ -1,15 +1,16 @@
 import { z } from "zod";
-import { type CommandClass, type CommandLocus } from "./schemas/agent.js";
+import { type CommandPattern } from "./command-classes.js";
+import { type CommandClass, type CommandLocus } from "../schemas/agent.js";
 export declare const hardRuleClasses: (locus: CommandLocus) => ReadonlySet<CommandClass>;
 export type CommandRuleTier = "hard" | "judged";
 export interface CommandRule {
     readonly commandClass: CommandClass;
     readonly label: string;
-    readonly patterns: readonly string[];
-    readonly tier: CommandRuleTier;
-    readonly note?: string;
+    readonly patterns: readonly CommandPattern[];
+    readonly tiers: Readonly<Record<CommandLocus, CommandRuleTier>>;
+    readonly notes?: Readonly<Record<CommandLocus, string>>;
 }
-export declare const COMMAND_RULE_CATALOG: Readonly<Record<CommandLocus, readonly CommandRule[]>>;
+export declare const COMMAND_RULE_CATALOG: readonly CommandRule[];
 export declare const CommandJudgeModeSchema: z.ZodEnum<{
     off: "off";
     on: "on";

package/dist/policy/safety-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safety-policy.d.ts","sourceRoot":"","sources":["../../src/policy/safety-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAgD,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACzG,OAAO,EAAE,KAAK,YAAY,EAAsB,KAAK,YAAY,EAAsB,MAAM,qBAAqB,CAAC;AAanH,eAAO,MAAM,eAAe,UAAW,YAAY,KAAG,WAAW,CAAC,YAAY,CAChB,CAAC;AAI/D,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEhD,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IAEpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;IAE7C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC;IAEhE,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3D;AAgBD,eAAO,MAAM,oBAAoB,EAAE,SAAS,WAAW,EAQa,CAAC;AAOrE,eAAO,MAAM,sBAAsB;;;;EAAiC,CAAC;AACrE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE,eAAO,MAAM,oBAAoB;;;;EAAqC,CAAC;AACvE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,mBAAmB;;;;;;;;iBAS9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAIhE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;iBAY/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,kBAAkB;;;iBAI7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAG9D,eAAO,MAAM,qBAAqB,+qFA+BjC,CAAC"}

package/dist/{safety-policy.js → policy/safety-policy.js}

@@ -1,24 +1,24 @@
 import { z } from "zod";
 import { COMMAND_CLASS_LABELS, COMMAND_CLASS_PATTERNS } from "./command-classes.js";
-import { CommandClassSchema } from "./schemas/agent.js";
+import { CommandClassSchema, CommandLocusSchema } from "../schemas/agent.js";
 const SANDBOX_HARD_RULE = new Set(["system.destructive"]);
 const DEVICE_HARD_RULE = new Set(["system.destructive", "container.state", "files.destructive"]);
 export const hardRuleClasses = (locus) => locus === "sandbox" ? SANDBOX_HARD_RULE : DEVICE_HARD_RULE;
-const ROOT_NOTE = {
-    sandbox: `Roots here are / and /history. /work, /usr and /etc are not: the worktree's changes are uncommitted work and the container comes back from its image.`,
-    device: `Roots here are /, a home directory, a Windows drive, and the top-level directories an OS keeps.`,
+const ROOT_NOTES = {
+    sandbox: `/ and /history. Not /work, /usr or /etc: the worktree's changes are uncommitted work, and the container comes back from its image.`,
+    device: `/, a home directory, a Windows drive, and the top-level directories an OS keeps.`,
 };
-const rulesFor = (locus) => CommandClassSchema.options.map((commandClass) => ({
+const tiersFor = (commandClass) => Object.fromEntries(CommandLocusSchema.options.map((locus) => [locus, hardRuleClasses(locus).has(commandClass) ? "hard" : "judged"]));
+const unwaivableAt = (rule) => CommandLocusSchema.options.filter((locus) => rule.tiers[locus] === "hard").length;
+export const COMMAND_RULE_CATALOG = CommandClassSchema.options
+    .map((commandClass) => ({
     commandClass,
     label: COMMAND_CLASS_LABELS[commandClass],
     patterns: COMMAND_CLASS_PATTERNS[commandClass],
-    tier: hardRuleClasses(locus).has(commandClass) ? "hard" : "judged",
-    ...(commandClass === "system.destructive" ? { note: ROOT_NOTE[locus] } : {}),
-}));
-export const COMMAND_RULE_CATALOG = {
-    sandbox: rulesFor("sandbox"),
-    device: rulesFor("device"),
-};
+    tiers: tiersFor(commandClass),
+    ...(commandClass === "system.destructive" ? { notes: ROOT_NOTES } : {}),
+}))
+    .sort((left, right) => unwaivableAt(right) - unwaivableAt(left));
 export const CommandJudgeModeSchema = z.enum(["off", "watch", "on"]);
 export const SafetyDecisionSchema = z.enum(["allow", "ask", "refuse"]);
 export const SafetyVerdictSchema = z.object({

package/dist/policy/safety-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safety-policy.js","sourceRoot":"","sources":["../../src/policy/safety-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAuB,MAAM,sBAAsB,CAAC;AACzG,OAAO,EAAqB,kBAAkB,EAAqB,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAUnH,MAAM,iBAAiB,GAA8B,IAAI,GAAG,CAAe,CAAC,oBAAoB,CAAC,CAAC,CAAC;AACnG,MAAM,gBAAgB,GAA8B,IAAI,GAAG,CAAe,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE1I,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAmB,EAA6B,EAAE,CAC9E,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAC;AAkB/D,MAAM,UAAU,GAA2C;IACvD,OAAO,EAAE,oIAAoI;IAC7I,MAAM,EAAE,kFAAkF;CAC7F,CAAC;AAEF,MAAM,QAAQ,GAAG,CAAC,YAA0B,EAAyC,EAAE,CACnF,MAAM,CAAC,WAAW,CACd,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAC1E,CAAC;AAG/C,MAAM,YAAY,GAAG,CAAC,IAAiB,EAAU,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;AAGtI,MAAM,CAAC,MAAM,oBAAoB,GAA2B,kBAAkB,CAAC,OAAO;KACjF,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACpB,YAAY;IACZ,KAAK,EAAE,oBAAoB,CAAC,YAAY,CAAC;IACzC,QAAQ,EAAE,sBAAsB,CAAC,YAAY,CAAC;IAC9C,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC;IAC7B,GAAG,CAAC,YAAY,KAAK,oBAAoB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAC1E,CAAC,CAAC;KACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;AAOrE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAOrE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGvE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IAE/E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wFAAwF,CAAC;IAEvH,UAAU,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,gHAAgH,CAAC;CAClI,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IACxE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IAEjE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,uEAAuE,CAAC;IAC9G,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IAClE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAEtD,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;IAC1F,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;IAE1H,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;CACrH,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAE/D,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,0EAA0E,CAAC;CAC3G,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BpC,CAAC"}

package/dist/policy/search-globs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-globs.d.ts","sourceRoot":"","sources":["../../src/policy/search-globs.ts"],"names":[],"mappings":"AA6CA,MAAM,WAAW,YAAY;IAEzB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAElC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED,eAAO,MAAM,YAAY,YAAa,MAAM,GAAG,SAAS,KAAG,YAO1D,CAAC"}

package/dist/policy/search-globs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-globs.js","sourceRoot":"","sources":["../../src/policy/search-globs.ts"],"names":[],"mappings":"AASA,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,SAAiB,EAAY,EAAE;IACnE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;YACjD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,GAAG,EAAE,CAAC;YACb,SAAS;QACb,CAAC;QACD,QAAQ,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjE,UAAU,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;QACrE,OAAO,IAAI,IAAI,CAAC;IACpB,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;AACzF,CAAC,CAAC;AAIF,MAAM,MAAM,GAAG,CAAC,OAAe,EAAY,EAAE;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,QAAQ,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,KAAK,IAAI,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAClE,OAAO,CAAC,MAAM,OAAO,EAAE,EAAE,MAAM,OAAO,KAAK,CAAC,CAAC;AACjD,CAAC,CAAC;AASF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAA2B,EAAgB,EAAE;IACtE,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IACnD,OAAO;QACH,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QAE7E,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;KACjH,CAAC;AACN,CAAC,CAAC"}

package/dist/protocol/container-requirements.d.ts

@@ -0,0 +1,20 @@
+export interface ContainerRequirement {
+    readonly key: string;
+    readonly requires: readonly string[];
+    readonly given: readonly string[];
+    readonly unless?: readonly string[];
+    readonly enables: string;
+    readonly lost: string;
+    readonly repair: string;
+}
+export type ContainerEnv = Readonly<Record<string, string | undefined>>;
+export declare const CONTAINER_REQUIREMENTS: readonly ContainerRequirement[];
+export interface ContainerGap {
+    readonly key: string;
+    readonly missing: readonly string[];
+    readonly enables: string;
+    readonly lost: string;
+    readonly repair: string;
+}
+export declare const containerDrift: (env: ContainerEnv) => readonly ContainerGap[];
+//# sourceMappingURL=container-requirements.d.ts.map

package/dist/protocol/container-requirements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-requirements.d.ts","sourceRoot":"","sources":["../../src/protocol/container-requirements.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAErC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAElC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CAC3B;AAGD,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAIxE,eAAO,MAAM,sBAAsB,EAAE,SAAS,oBAAoB,EAcjE,CAAC;AAEF,MAAM,WAAW,YAAY;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CAC3B;AAGD,eAAO,MAAM,cAAc,QAAS,YAAY,KAAG,SAAS,YAAY,EAWxB,CAAC"}

package/dist/protocol/container-requirements.js

@@ -0,0 +1,23 @@
+const present = (env, name) => (env[name] ?? "").trim() !== "";
+export const CONTAINER_REQUIREMENTS = [
+    {
+        key: "reachability",
+        requires: ["SANDBOX_GRANT", "INGRESS_URL"],
+        given: ["SANDBOX_PUBLIC_URL"],
+        unless: ["SANDBOX_VM"],
+        enables: "reaching this sandbox at its public address, from anywhere",
+        lost: "Its public address answers 502 to everyone, including this browser when it is not on the same machine as the sandbox. " +
+            "On that machine the workspace still works, over a direct connection that never leaves it — which is why this can go unnoticed for a long time.",
+        repair: "Re-run this sandbox's setup command. It carries a freshly signed grant, and it keeps the workspace, its history and its Docker engine.",
+    },
+];
+export const containerDrift = (env) => CONTAINER_REQUIREMENTS.filter((requirement) => requirement.given.every((name) => present(env, name)) && !(requirement.unless ?? []).some((name) => present(env, name)))
+    .map((requirement) => ({
+    key: requirement.key,
+    missing: requirement.requires.filter((name) => !present(env, name)),
+    enables: requirement.enables,
+    lost: requirement.lost,
+    repair: requirement.repair,
+}))
+    .filter((gap) => gap.missing.length > 0);
+//# sourceMappingURL=container-requirements.js.map

package/dist/protocol/container-requirements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-requirements.js","sourceRoot":"","sources":["../../src/protocol/container-requirements.ts"],"names":[],"mappings":"AAmBA,MAAM,OAAO,GAAG,CAAC,GAAiB,EAAE,IAAY,EAAW,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AAE9F,MAAM,CAAC,MAAM,sBAAsB,GAAoC;IAEnE;QACI,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,CAAC,eAAe,EAAE,aAAa,CAAC;QAC1C,KAAK,EAAE,CAAC,oBAAoB,CAAC;QAE7B,MAAM,EAAE,CAAC,YAAY,CAAC;QACtB,OAAO,EAAE,4DAA4D;QACrE,IAAI,EACA,wHAAwH;YACxH,gJAAgJ;QACpJ,MAAM,EAAE,wIAAwI;KACnJ;CACJ,CAAC;AAWF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAiB,EAA2B,EAAE,CACzE,sBAAsB,CAAC,MAAM,CACzB,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAC3I;KACI,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACnB,GAAG,EAAE,WAAW,CAAC,GAAG;IACpB,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnE,OAAO,EAAE,WAAW,CAAC,OAAO;IAC5B,IAAI,EAAE,WAAW,CAAC,IAAI;IACtB,MAAM,EAAE,WAAW,CAAC,MAAM;CAC7B,CAAC,CAAC;KACF,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC"}

package/dist/{host-protocol.d.ts → protocol/host-protocol.d.ts}

@@ -1,5 +1,6 @@
 import { z } from "zod";
 export declare const MCP_PROTOCOL_VERSION = "2025-06-18";
+export declare const HOST_HEARTBEAT_MS = 30000;
 export declare const HostHelloSchema: z.ZodObject<{
     type: z.ZodLiteral<"hello">;
     token: z.ZodString;

package/dist/protocol/host-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-protocol.d.ts","sourceRoot":"","sources":["../../src/protocol/host-protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAQjD,eAAO,MAAM,iBAAiB,QAAS,CAAC;AAExC,eAAO,MAAM,eAAe;;;;iBAM1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAIxD,eAAO,MAAM,cAAc,eAAgB,MAAM,KAAG,MAAwF,CAAC"}

package/dist/{host-protocol.js → protocol/host-protocol.js}

@@ -1,5 +1,6 @@
 import { z } from "zod";
 export const MCP_PROTOCOL_VERSION = "2025-06-18";
+export const HOST_HEARTBEAT_MS = 30_000;
 export const HostHelloSchema = z.object({
     type: z.literal("hello"),
     token: z.string(),

package/dist/protocol/host-protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-protocol.js","sourceRoot":"","sources":["../../src/protocol/host-protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAQjD,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAExC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAExB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IAEjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,UAAkB,EAAU,EAAE,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC"}

package/dist/protocol/ingress-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingress-contract.d.ts","sourceRoot":"","sources":["../../src/protocol/ingress-contract.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC7B;AAGD,eAAO,MAAM,qBAAqB,kBAAmB,MAAM,aAAa,MAAM,cAAc,MAAM,KAAG,MAOpG,CAAC;AAGF,eAAO,MAAM,uBAAuB,iBAAkB,MAAM,SAAS,MAAM,KAAG,iBAAiB,GAAG,SAmBjG,CAAC;AAMF,eAAO,MAAM,WAAW,SAAU,MAAM,KAAG,MAAM,GAAG,SAInD,CAAC;AAKF,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAGhD,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAGvD,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAC7C,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAMjD,MAAM,WAAW,oBAAoB;IAEjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CAC5D;AAED,MAAM,WAAW,mBAAmB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpC,QAAQ,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC;CACrC;AAED,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,oBAAoB,KAAK,mBAAmB,CAAC"}

package/dist/{ingress-contract.js → protocol/ingress-contract.js}

@@ -1,7 +1,7 @@
 import { createPrivateKey, createPublicKey, sign as edSign, verify as edVerify } from "node:crypto";
+import { SANDBOX_ID } from "../ids/tunnel-ids.js";
 const GRANT_PREFIX = "ig1";
 const base64url = (bytes) => bytes.toString("base64url");
-const SANDBOX_ID = /^[0-9a-f]{12}$/;
 export const mintReachabilityGrant = (privateKeyPem, sandboxId, issuedAtMs) => {
     if (!SANDBOX_ID.test(sandboxId)) {
         throw new Error(`a reachability grant names a 12-hex sandbox id, got "${sandboxId}"`);

package/dist/protocol/ingress-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingress-contract.js","sourceRoot":"","sources":["../../src/protocol/ingress-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,IAAI,QAAQ,EAAE,MAAM,aAAa,CAAC;AACpG,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AASlD,MAAM,YAAY,GAAG,KAAK,CAAC;AAE3B,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAUzE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,aAAqB,EAAE,SAAiB,EAAE,UAAkB,EAAU,EAAE;IAC1G,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wDAAwD,SAAS,GAAG,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5G,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;IACzE,OAAO,GAAG,YAAY,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;AAC3E,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,YAAoB,EAAE,KAAa,EAAiC,EAAE;IAC1G,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;QAClD,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAW,EAAE,WAAW,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAW,EAAE,WAAW,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;YACrE,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAqC,CAAC;QACxF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACnG,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC,CAAC;AAMF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAsB,EAAE;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC,CAAC;AAKF,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAGhD,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAGvD,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAC7C,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC"}