@intentic/sandbox-contract 1.331.0 → 1.333.0

package/dist/policy/device-programs.js

@@ -0,0 +1,79 @@
+import { z } from "zod";
+export const ProgramArgumentsSchema = z.looseObject({
+    command: z.string().optional().catch(undefined),
+    serial: z.string().optional().catch(undefined),
+    program: z.string().optional().catch(undefined),
+    args: z.array(z.string()).optional().catch(undefined),
+    target: z.string().optional().catch(undefined),
+    action: z.string().optional().catch(undefined),
+    text: z.string().optional().catch(undefined),
+    value: z.string().optional().catch(undefined),
+});
+const present = (value) => (value === undefined || value.trim() === "" ? undefined : value);
+const programName = (program) => (program.split(/[/\\]/).at(-1) ?? program).replace(/\.exe$/i, "");
+export const commandLineOf = (program, args) => [
+    programName(program),
+    ...args.map((arg) => (arg === "" || /[\s'"|;&<>()$`\\]/.test(arg) ? (arg.includes("'") ? `"${arg}"` : `'${arg}'`) : arg)),
+].join(" ");
+const ADB_SERIAL = /^[\w.:-]+$/;
+const URL_TARGET = /^(?:[a-z][a-z0-9+.-]*:\/\/|www\.|mailto:)/i;
+const typedBy = (tool, action, field) => ({
+    tool,
+    carries: `${field}, when action is ${action}`,
+    read: (args) => {
+        const typed = args.action === action ? present(args[field]) : undefined;
+        return typed === undefined ? undefined : { kind: "typed", commandLine: typed };
+    },
+});
+export const DEVICE_PROGRAM_TOOLS = [
+    {
+        tool: "run_command",
+        carries: "command",
+        read: ({ command }) => {
+            const line = present(command);
+            return line === undefined ? undefined : { kind: "command", commandLine: line };
+        },
+    },
+    {
+        tool: "android_shell",
+        carries: "command, run as `adb [-s serial] shell <command>`",
+        read: ({ command, serial }) => {
+            const line = present(command);
+            if (line === undefined) {
+                return undefined;
+            }
+            return { kind: "phone-command", commandLine: `adb ${serial !== undefined && ADB_SERIAL.test(serial) ? `-s ${serial} ` : ""}shell ${line}` };
+        },
+    },
+    {
+        tool: "app_start",
+        carries: "program and args",
+        read: ({ program, args }) => {
+            const started = present(program);
+            if (started === undefined) {
+                return undefined;
+            }
+            return { kind: args === undefined || args.length === 0 ? "app-launch" : "command", commandLine: commandLineOf(started, args ?? []) };
+        },
+    },
+    {
+        tool: "open",
+        carries: "target",
+        read: ({ target }) => {
+            const opened = present(target);
+            if (opened === undefined) {
+                return undefined;
+            }
+            return { kind: URL_TARGET.test(opened) || !/\s/.test(opened.trim()) ? "app-launch" : "command", commandLine: opened };
+        },
+    },
+    typedBy("device", "type", "text"),
+    typedBy("android_act", "type", "text"),
+    typedBy("clipboard", "write", "text"),
+    typedBy("ui_act", "set_value", "value"),
+];
+export const programInCall = (tool, args) => {
+    const read = DEVICE_PROGRAM_TOOLS.find((carrier) => carrier.tool === tool)?.read(args);
+    return read === undefined ? undefined : { tool, ...read };
+};
+//# sourceMappingURL=device-programs.js.map

package/dist/policy/device-programs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-programs.js","sourceRoot":"","sources":["../../src/policy/device-programs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA6BxB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,WAAW,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAC9C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CAChD,CAAC,CAAC;AAUH,MAAM,OAAO,GAAG,CAAC,KAAyB,EAAsB,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAGpI,MAAM,WAAW,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAMnH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,IAAuB,EAAU,EAAE,CAC9E;IACI,WAAW,CAAC,OAAO,CAAC;IACpB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,EAAE,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;CAC5H,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAIhB,MAAM,UAAU,GAAG,YAAY,CAAC;AAGhC,MAAM,UAAU,GAAG,4CAA4C,CAAC;AAEhE,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,KAAuB,EAAkB,EAAE,CAAC,CAAC;IACxF,IAAI;IACJ,OAAO,EAAE,GAAG,KAAK,oBAAoB,MAAM,EAAE;IAC7C,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QACX,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACnF,CAAC;CACJ,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAA8B;IAC3D;QACI,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,SAAS;QAClB,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;YAClB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9B,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACnF,CAAC;KACJ;IACD;QACI,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,mDAAmD;QAC5D,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;YAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAC;YACrB,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,OAAO,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;QAChJ,CAAC;KACJ;IACD;QACI,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,kBAAkB;QAC3B,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;YACxB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,SAAS,CAAC;YACrB,CAAC;YAGD,OAAO,EAAE,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QACzI,CAAC;KACJ;IACD;QACI,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,QAAQ;QACjB,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;YACjB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,SAAS,CAAC;YACrB,CAAC;YAGD,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;QAC1H,CAAC;KACJ;IACD,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;IACjC,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC;IACtC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC;IACrC,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC;CAC1C,CAAC;AAGF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,IAAsB,EAA8B,EAAE;IAC9F,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACvF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;AAC9D,CAAC,CAAC"}

package/dist/policy/identity-assertion.d.ts

@@ -0,0 +1,27 @@
+import { z } from "zod";
+export declare const IDENTITY_ASSERTION_TTL_MS: number;
+export declare const IDENTITY_ASSERTION_MAX_TTL_MS: number;
+export declare const ENV_PLATFORM_IDENTITY_KEY = "PLATFORM_IDENTITY_KEY";
+export declare const IdentityAssertionMethodSchema: z.ZodEnum<{
+    email: "email";
+    google: "google";
+}>;
+export type IdentityAssertionMethod = z.infer<typeof IdentityAssertionMethodSchema>;
+export interface IdentityAssertion {
+    readonly sandboxId: string;
+    readonly email: string;
+    readonly method: IdentityAssertionMethod;
+    readonly issuedAt: number;
+    readonly expiresAt: number;
+    readonly nonce: string;
+}
+export declare const isIdentityAssertion: (bearer: string) => boolean;
+export declare const mintIdentityAssertion: (privateKeyPem: string, claim: {
+    readonly sandboxId: string;
+    readonly email: string;
+    readonly method: IdentityAssertionMethod;
+    readonly issuedAtMs: number;
+    readonly ttlMs?: number;
+}) => string;
+export declare const verifyIdentityAssertion: (publicKeyPem: string, token: string, nowMs: number) => IdentityAssertion | undefined;
+//# sourceMappingURL=identity-assertion.d.ts.map

package/dist/policy/identity-assertion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-assertion.d.ts","sourceRoot":"","sources":["../../src/policy/identity-assertion.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB,eAAO,MAAM,yBAAyB,QAAa,CAAC;AAGpD,eAAO,MAAM,6BAA6B,QAAa,CAAC;AAIxD,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAGjE,eAAO,MAAM,6BAA6B;;;EAA8B,CAAC;AACzE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAGpF,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CAC1B;AAQD,eAAO,MAAM,mBAAmB,WAAY,MAAM,KAAG,OAAoD,CAAC;AAE1G,eAAO,MAAM,qBAAqB,kBACf,MAAM,SACd;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CAC3B,KACF,MA2BF,CAAC;AAyBF,eAAO,MAAM,uBAAuB,iBAAkB,MAAM,SAAS,MAAM,SAAS,MAAM,KAAG,iBAAiB,GAAG,SAuBhH,CAAC"}

package/dist/policy/identity-assertion.js

@@ -0,0 +1,77 @@
+import { createPrivateKey, createPublicKey, randomBytes, sign as edSign, verify as edVerify } from "node:crypto";
+import { z } from "zod";
+import { SANDBOX_ID } from "../ids/tunnel-ids.js";
+const ASSERTION_PREFIX = "pa1";
+export const IDENTITY_ASSERTION_TTL_MS = 2 * 60_000;
+export const IDENTITY_ASSERTION_MAX_TTL_MS = 5 * 60_000;
+export const ENV_PLATFORM_IDENTITY_KEY = "PLATFORM_IDENTITY_KEY";
+export const IdentityAssertionMethodSchema = z.enum(["email", "google"]);
+const base64url = (bytes) => bytes.toString("base64url");
+const signedBytes = (payload) => Buffer.concat([Buffer.from(`${ASSERTION_PREFIX}.`, "utf8"), payload]);
+export const isIdentityAssertion = (bearer) => bearer.startsWith(`${ASSERTION_PREFIX}.`);
+export const mintIdentityAssertion = (privateKeyPem, claim) => {
+    if (!SANDBOX_ID.test(claim.sandboxId)) {
+        throw new Error(`an identity assertion names a 12-hex sandbox id, got "${claim.sandboxId}"`);
+    }
+    if (claim.email.trim() === "") {
+        throw new Error("an identity assertion names an address");
+    }
+    const ttlMs = claim.ttlMs ?? IDENTITY_ASSERTION_TTL_MS;
+    if (ttlMs <= 0 || ttlMs > IDENTITY_ASSERTION_MAX_TTL_MS) {
+        throw new Error(`an identity assertion lives at most ${IDENTITY_ASSERTION_MAX_TTL_MS} ms`);
+    }
+    const iat = Math.floor(claim.issuedAtMs / 1000);
+    const exp = Math.floor((claim.issuedAtMs + ttlMs) / 1000);
+    const payload = Buffer.from(JSON.stringify({
+        v: 1,
+        sub: claim.sandboxId,
+        email: claim.email.trim().toLowerCase(),
+        amr: claim.method,
+        iat,
+        exp,
+        jti: base64url(randomBytes(16)),
+    }), "utf8");
+    const signature = edSign(null, signedBytes(payload), createPrivateKey(privateKeyPem));
+    return `${ASSERTION_PREFIX}.${base64url(payload)}.${base64url(signature)}`;
+};
+const AssertionPayloadSchema = z.object({
+    v: z.literal(1),
+    sub: z.string().regex(SANDBOX_ID),
+    email: z.string().min(1),
+    amr: IdentityAssertionMethodSchema,
+    iat: z.number(),
+    exp: z.number(),
+    jti: z.string().min(16),
+});
+const parsePayload = (payload) => {
+    try {
+        return AssertionPayloadSchema.safeParse(JSON.parse(payload.toString("utf8"))).data;
+    }
+    catch {
+        return undefined;
+    }
+};
+export const verifyIdentityAssertion = (publicKeyPem, token, nowMs) => {
+    const [prefix, encodedPayload, encodedSignature, ...rest] = token.split(".");
+    if (prefix !== ASSERTION_PREFIX || encodedPayload === undefined || encodedSignature === undefined || rest.length > 0) {
+        return undefined;
+    }
+    const payload = Buffer.from(encodedPayload, "base64url");
+    try {
+        if (!edVerify(null, signedBytes(payload), createPublicKey(publicKeyPem), Buffer.from(encodedSignature, "base64url"))) {
+            return undefined;
+        }
+    }
+    catch {
+        return undefined;
+    }
+    const claim = parsePayload(payload);
+    if (claim === undefined) {
+        return undefined;
+    }
+    if (claim.exp * 1000 <= nowMs || claim.iat * 1000 > nowMs + 60_000 || (claim.exp - claim.iat) * 1000 > IDENTITY_ASSERTION_MAX_TTL_MS) {
+        return undefined;
+    }
+    return { sandboxId: claim.sub, email: claim.email, method: claim.amr, issuedAt: claim.iat, expiresAt: claim.exp, nonce: claim.jti };
+};
+//# sourceMappingURL=identity-assertion.js.map

package/dist/policy/identity-assertion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-assertion.js","sourceRoot":"","sources":["../../src/policy/identity-assertion.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,IAAI,QAAQ,EAAE,MAAM,aAAa,CAAC;AACjH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AASlD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAG/B,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAG,MAAM,CAAC;AAGpD,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,GAAG,MAAM,CAAC;AAIxD,MAAM,CAAC,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAGjE,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAazE,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAIzE,MAAM,WAAW,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,gBAAgB,GAAG,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;AAEvH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAAc,EAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,gBAAgB,GAAG,CAAC,CAAC;AAE1G,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACjC,aAAqB,EACrB,KAMC,EACK,EAAE;IACR,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,yDAAyD,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,yBAAyB,CAAC;IACvD,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG,6BAA6B,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,uCAAuC,6BAA6B,KAAK,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CACvB,IAAI,CAAC,SAAS,CAAC;QACX,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,KAAK,CAAC,SAAS;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QACvC,GAAG,EAAE,KAAK,CAAC,MAAM;QACjB,GAAG;QACH,GAAG;QACH,GAAG,EAAE,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;KAClC,CAAC,EACF,MAAM,CACT,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;IACtF,OAAO,GAAG,gBAAgB,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;AAC/E,CAAC,CAAC;AAGF,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,GAAG,EAAE,6BAA6B;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;CAC1B,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,OAAe,EAAsD,EAAE;IACzF,IAAI,CAAC;QACD,OAAO,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QAEL,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC,CAAC;AAKF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,YAAoB,EAAE,KAAa,EAAE,KAAa,EAAiC,EAAE;IACzH,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7E,IAAI,MAAM,KAAK,gBAAgB,IAAI,cAAc,KAAK,SAAS,IAAI,gBAAgB,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnH,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACzD,IAAI,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;YACnH,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QAEL,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,6BAA6B,EAAE,CAAC;QACnI,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;AACxI,CAAC,CAAC"}

package/dist/policy/sandbox-power.d.ts

@@ -0,0 +1,34 @@
+import type { CommandSpan } from "./command-classes.js";
+export type SandboxPowerOp = "start" | "stop" | "restart" | "sleep" | "remove" | "update" | "prepare" | "rebuild" | "rollback" | "dev" | "resize" | "restore" | "connect";
+export declare const SANDBOX_POWER_DOING: {
+    readonly start: "Start";
+    readonly stop: "Stop";
+    readonly restart: "Restart";
+    readonly sleep: "Stop";
+    readonly remove: "Remove";
+    readonly update: "Update";
+    readonly prepare: "Prepare an update for";
+    readonly rebuild: "Rebuild";
+    readonly rollback: "Roll back";
+    readonly dev: "Update";
+    readonly resize: "Restart with new resources";
+    readonly restore: "Restore a backup over";
+    readonly connect: "Reinstall";
+};
+export interface SandboxPowerCommand {
+    readonly via: "ic" | "docker";
+    readonly op: SandboxPowerOp;
+    readonly stops: boolean;
+    readonly targets: readonly string[];
+    readonly unnamed: boolean;
+    readonly span: CommandSpan;
+    readonly live: boolean;
+}
+export declare const sandboxPowerCommands: (command: string) => SandboxPowerCommand[];
+export interface OwnSandbox {
+    readonly slug: string;
+    readonly container: string;
+}
+export declare const mayReachSandbox: (hit: SandboxPowerCommand, own: OwnSandbox) => boolean;
+export declare const managesSandbox: (hit: SandboxPowerCommand, containerPrefix: string) => boolean;
+//# sourceMappingURL=sandbox-power.d.ts.map

package/dist/policy/sandbox-power.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-power.d.ts","sourceRoot":"","sources":["../../src/policy/sandbox-power.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAWxD,MAAM,MAAM,cAAc,GACpB,OAAO,GACP,MAAM,GACN,SAAS,GACT,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,SAAS,GACT,UAAU,GACV,KAAK,GACL,QAAQ,GACR,SAAS,GACT,SAAS,CAAC;AAGhB,eAAO,MAAM,mBAAmB;oBACrB,OAAO;mBACR,MAAM;sBACH,SAAS;oBACX,MAAM;qBACL,QAAQ;qBACR,QAAQ;sBACP,uBAAuB;sBACvB,SAAS;uBACR,WAAW;kBAChB,QAAQ;qBACL,4BAA4B;sBAC3B,uBAAuB;sBACvB,WAAW;CAC2B,CAAC;AAGpD,MAAM,WAAW,mBAAmB;IAChC,QAAQ,CAAC,GAAG,EAAE,IAAI,GAAG,QAAQ,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC;IAE5B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAExB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAEpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAE3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CAC1B;AA+ID,eAAO,MAAM,oBAAoB,YAAa,MAAM,KAAG,mBAAmB,EAoBzE,CAAC;AAMF,MAAM,WAAW,UAAU;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC9B;AAOD,eAAO,MAAM,eAAe,QAAS,mBAAmB,OAAO,UAAU,KAAG,OAC2C,CAAC;AAOxH,eAAO,MAAM,cAAc,QAAS,mBAAmB,mBAAmB,MAAM,KAAG,OACK,CAAC"}

package/dist/policy/sandbox-power.js

@@ -0,0 +1,146 @@
+import { inertRegions, isLive } from "../text/shell-regions.js";
+export const SANDBOX_POWER_DOING = {
+    start: "Start",
+    stop: "Stop",
+    restart: "Restart",
+    sleep: "Stop",
+    remove: "Remove",
+    update: "Update",
+    prepare: "Prepare an update for",
+    rebuild: "Rebuild",
+    rollback: "Roll back",
+    dev: "Update",
+    resize: "Restart with new resources",
+    restore: "Restore a backup over",
+    connect: "Reinstall",
+};
+const IC_INVOCATION = /(?<![\w.$-])ic(?:\.exe)?["']?\s+sandbox\s+([a-z][a-z-]*)(?![\w-])/gi;
+const DOCKER_INVOCATION = /(?<![\w.$-])(?:docker|podman)(?:\.exe)?["']?\s+(?:container\s+)?(stop|restart|rm|remove|kill)(?![\w-])/gi;
+const IC_VERBS = new Map([
+    ["start", "start"],
+    ["stop", "stop"],
+    ["restart", "restart"],
+    ["sleep", "sleep"],
+    ["remove", "remove"],
+    ["rm", "remove"],
+    ["update", "update"],
+    ["prepare", "prepare"],
+    ["rebuild", "rebuild"],
+    ["rollback", "rollback"],
+    ["dev", "dev"],
+    ["reshape", "resize"],
+    ["shape", "resize"],
+    ["backup-restore", "restore"],
+    ["connect", "connect"],
+]);
+const DOCKER_VERBS = new Map([
+    ["stop", "stop"],
+    ["kill", "stop"],
+    ["restart", "restart"],
+    ["rm", "remove"],
+    ["remove", "remove"],
+]);
+const IC_VALUE_FLAGS = new Set([
+    "--channel",
+    "--to",
+    "--set",
+    "--when",
+    "--memory",
+    "--cpus",
+    "--privileged",
+    "--gpus",
+    "--idle",
+    "--source",
+    "--code",
+    "--snapshot",
+    "--into",
+    "--confirm",
+    "--accept",
+    "--tail",
+]);
+const DOCKER_VALUE_FLAGS = new Set(["-t", "--time", "-s", "--signal"]);
+const SIMPLE_COMMAND = /^(?:[^|;&\n\r"']|(?<=[<>])&|"[^"]*"?|'[^']*'?)*/;
+const WORD = /(?:[^\s"']|"[^"]*"?|'[^']*'?)+/g;
+const REDIRECTION = /^\d*(?:>>?|<)/;
+const BARE_REDIRECTION = /^\d*(?:>>?|<)$/;
+const wordsOf = (text) => [...(SIMPLE_COMMAND.exec(text)?.[0] ?? "").matchAll(WORD)].map((word) => word[0].replace(/["']/g, ""));
+const withoutRedirections = (words) => {
+    const kept = [];
+    let skipNext = false;
+    for (const word of words) {
+        if (skipNext) {
+            skipNext = false;
+        }
+        else if (BARE_REDIRECTION.test(word)) {
+            skipNext = true;
+        }
+        else if (!REDIRECTION.test(word)) {
+            kept.push(word);
+        }
+    }
+    return kept;
+};
+const operandsOf = (words, valueFlags) => {
+    const positionals = [];
+    const flags = new Map();
+    const list = withoutRedirections(words);
+    for (const [index, word] of list.entries()) {
+        const equals = word.indexOf("=");
+        if (!word.startsWith("-") || word === "-") {
+            if (!valueFlags.has(list[index - 1] ?? "")) {
+                positionals.push(word);
+            }
+        }
+        else if (word.startsWith("--") && equals !== -1) {
+            flags.set(word.slice(0, equals), word.slice(equals + 1));
+        }
+        else {
+            flags.set(word, valueFlags.has(word) ? list[index + 1] : undefined);
+        }
+    }
+    return { positionals, flags };
+};
+const icAim = (op, { positionals, flags }) => {
+    const all = flags.has("--all") || flags.has("-a");
+    if (op === "start" || op === "prepare") {
+        return { stops: false, targets: positionals, all };
+    }
+    if (op === "resize") {
+        const when = flags.get("--when");
+        const saves = flags.has("--later") || flags.has("--forget") || (when !== undefined && when !== "now");
+        return { stops: !saves, targets: positionals, all };
+    }
+    if (op === "restore") {
+        const into = flags.get("--into");
+        return into === undefined ? { stops: false, targets: [], all: false } : { stops: true, targets: [into], all: false };
+    }
+    if (op === "connect") {
+        return { stops: flags.has("--replace"), targets: [], all: false };
+    }
+    return { stops: true, targets: positionals, all };
+};
+export const sandboxPowerCommands = (command) => {
+    const regions = inertRegions(command);
+    const found = [];
+    for (const invocation of command.matchAll(IC_INVOCATION)) {
+        const op = IC_VERBS.get((invocation[1] ?? "").toLowerCase());
+        if (op !== undefined) {
+            const span = { start: invocation.index, end: invocation.index + invocation[0].length };
+            const aim = icAim(op, operandsOf(wordsOf(command.slice(span.end)), IC_VALUE_FLAGS));
+            found.push({ via: "ic", op, stops: aim.stops, targets: aim.targets, unnamed: aim.targets.length === 0 || aim.all, span, live: isLive(span, regions) });
+        }
+    }
+    for (const invocation of command.matchAll(DOCKER_INVOCATION)) {
+        const op = DOCKER_VERBS.get((invocation[1] ?? "").toLowerCase());
+        if (op !== undefined) {
+            const span = { start: invocation.index, end: invocation.index + invocation[0].length };
+            const { positionals } = operandsOf(wordsOf(command.slice(span.end)), DOCKER_VALUE_FLAGS);
+            found.push({ via: "docker", op, stops: true, targets: positionals, unnamed: positionals.length === 0, span, live: isLive(span, regions) });
+        }
+    }
+    return found.toSorted((left, right) => left.span.start - right.span.start);
+};
+const isExpansion = (word) => /[$`*?%]|^\(/.test(word);
+export const mayReachSandbox = (hit, own) => hit.unnamed || hit.targets.some((target) => target === own.slug || target === own.container || isExpansion(target));
+export const managesSandbox = (hit, containerPrefix) => hit.via === "ic" || hit.targets.some((target) => target.startsWith(containerPrefix));
+//# sourceMappingURL=sandbox-power.js.map

package/dist/policy/sandbox-power.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-power.js","sourceRoot":"","sources":["../../src/policy/sandbox-power.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AA4BhE,MAAM,CAAC,MAAM,mBAAmB,GAAG;IAC/B,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,MAAM;IACb,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,uBAAuB;IAChC,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,WAAW;IACrB,GAAG,EAAE,QAAQ;IACb,MAAM,EAAE,4BAA4B;IACpC,OAAO,EAAE,uBAAuB;IAChC,OAAO,EAAE,WAAW;CAC2B,CAAC;AAmBpD,MAAM,aAAa,GAAG,qEAAqE,CAAC;AAG5F,MAAM,iBAAiB,GAAG,0GAA0G,CAAC;AAErI,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAyB;IAC7C,CAAC,OAAO,EAAE,OAAO,CAAC;IAClB,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,OAAO,EAAE,OAAO,CAAC;IAClB,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,IAAI,EAAE,QAAQ,CAAC;IAChB,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,UAAU,EAAE,UAAU,CAAC;IACxB,CAAC,KAAK,EAAE,KAAK,CAAC;IACd,CAAC,SAAS,EAAE,QAAQ,CAAC;IACrB,CAAC,OAAO,EAAE,QAAQ,CAAC;IACnB,CAAC,gBAAgB,EAAE,SAAS,CAAC;IAC7B,CAAC,SAAS,EAAE,SAAS,CAAC;CACzB,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAyB;IACjD,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,IAAI,EAAE,QAAQ,CAAC;IAChB,CAAC,QAAQ,EAAE,QAAQ,CAAC;CACvB,CAAC,CAAC;AAGH,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAChD,WAAW;IACX,MAAM;IACN,OAAO;IACP,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,cAAc;IACd,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,WAAW;IACX,UAAU;IACV,QAAQ;CACX,CAAC,CAAC;AACH,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;AAI5F,MAAM,cAAc,GAAG,iDAAiD,CAAC;AAGzE,MAAM,IAAI,GAAG,iCAAiC,CAAC;AAC/C,MAAM,WAAW,GAAG,eAAe,CAAC;AACpC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAE1C,MAAM,OAAO,GAAG,CAAC,IAAY,EAAY,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAGnJ,MAAM,mBAAmB,GAAG,CAAC,KAAwB,EAAY,EAAE;IAC/D,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,QAAQ,EAAE,CAAC;YACX,QAAQ,GAAG,KAAK,CAAC;QACrB,CAAC;aAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,QAAQ,GAAG,IAAI,CAAC;QACpB,CAAC;aAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC,CAAC;AAQF,MAAM,UAAU,GAAG,CAAC,KAAwB,EAAE,UAA+B,EAAY,EAAE;IACvF,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IACpD,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACxC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAExC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACzC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;QACL,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAChD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACJ,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACxE,CAAC;IACL,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC,CAAC;AAUF,MAAM,KAAK,GAAG,CAAC,EAAkB,EAAE,EAAE,WAAW,EAAE,KAAK,EAAY,EAAO,EAAE;IACxE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,EAAE,KAAK,OAAO,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QAElB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK,CAAC,CAAC;QACtG,OAAO,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QAEnB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACzH,CAAC;IACD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACnB,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;AACtD,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAe,EAAyB,EAAE;IAC3E,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,KAAK,GAA0B,EAAE,CAAC;IACxC,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACvD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7D,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YACvF,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;YACpF,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3J,CAAC;IACL,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC3D,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACjE,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YACvF,MAAM,EAAE,WAAW,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;YACzF,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/I,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/E,CAAC,CAAC;AAGF,MAAM,WAAW,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAaxE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAwB,EAAE,GAAe,EAAW,EAAE,CAClF,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,MAAM,KAAK,GAAG,CAAC,SAAS,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AAOxH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAwB,EAAE,eAAuB,EAAW,EAAE,CACzF,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC"}

package/dist/policy/search-globs.d.ts

@@ -3,4 +3,7 @@ export interface IncludeGlobs {
     readonly notGlobs: readonly string[];
 }
 export declare const includeGlobs: (include: string | undefined) => IncludeGlobs;
+export declare const globRegExp: (glob: string) => RegExp;
+export declare const globMatcher: (glob: string) => ((path: string) => boolean);
+export declare const includeMatcher: (include: string | undefined) => ((path: string) => boolean);
 //# sourceMappingURL=search-globs.d.ts.map

package/dist/policy/search-globs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search-globs.d.ts","sourceRoot":"","sources":["../../src/policy/search-globs.ts"],"names":[],"mappings":"AA6CA,MAAM,WAAW,YAAY;IAEzB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAElC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED,eAAO,MAAM,YAAY,YAAa,MAAM,GAAG,SAAS,KAAG,YAO1D,CAAC"}
+{"version":3,"file":"search-globs.d.ts","sourceRoot":"","sources":["../../src/policy/search-globs.ts"],"names":[],"mappings":"AA6CA,MAAM,WAAW,YAAY;IAEzB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAElC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED,eAAO,MAAM,YAAY,YAAa,MAAM,GAAG,SAAS,KAAG,YAO1D,CAAC;AAuHF,eAAO,MAAM,UAAU,SAAU,MAAM,KAAG,MAAoD,CAAC;AAG/F,eAAO,MAAM,WAAW,SAAU,MAAM,KAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAGpE,CAAC;AAIF,eAAO,MAAM,cAAc,YAAa,MAAM,GAAG,SAAS,KAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAMtF,CAAC"}

package/dist/policy/search-globs.js

@@ -36,4 +36,122 @@ export const includeGlobs = (include) => {
         notGlobs: segments.filter((segment) => segment.startsWith(`!`)).flatMap((segment) => expand(segment.slice(1))),
     };
 };
+const REGEXP_SPECIAL = /[.*+?^${}()|[\]\\/]/;
+const literal = (char) => (REGEXP_SPECIAL.test(char) ? `\\${char}` : char);
+const setEnd = (glob, open) => {
+    let index = open + 1;
+    if (glob[index] === `!` || glob[index] === `^`) {
+        index += 1;
+    }
+    if (glob[index] === `]`) {
+        index += 1;
+    }
+    for (; index < glob.length; index += 1) {
+        if (glob[index] === `\\`) {
+            index += 1;
+        }
+        else if (glob[index] === `]`) {
+            return index;
+        }
+    }
+    return -1;
+};
+const setSource = (body) => {
+    const negated = body.startsWith(`!`) || body.startsWith(`^`);
+    const members = (negated ? body.slice(1) : body).replaceAll(/\\(.)/g, `$1`).replaceAll(/[\\\]^[]/g, (char) => `\\${char}`);
+    return `[${negated ? `^` : ``}${members}]`;
+};
+const groupOf = (glob, open) => {
+    const commas = [];
+    let depth = 0;
+    for (let index = open; index < glob.length; index += 1) {
+        const char = glob[index];
+        if (char === `\\`) {
+            index += 1;
+        }
+        else if (char === `[`) {
+            const end = setEnd(glob, index);
+            index = end === -1 ? index : end;
+        }
+        else if (char === `{`) {
+            depth += 1;
+        }
+        else if (char === `}`) {
+            depth -= 1;
+            if (depth === 0) {
+                return { end: index, commas };
+            }
+        }
+        else if (char === `,` && depth === 1) {
+            commas.push(index);
+        }
+    }
+    return undefined;
+};
+const globstar = (glob, index, segmentStart) => {
+    if (!segmentStart || glob[index + 1] !== `*`) {
+        return undefined;
+    }
+    const after = glob[index + 2];
+    if (after === `/`) {
+        return { source: `(?:[^/]*/)*`, length: 3 };
+    }
+    return after === undefined ? { source: `.*`, length: 2 } : undefined;
+};
+const compileGlob = (glob, segmentStart) => {
+    let source = ``;
+    let atStart = segmentStart;
+    for (let index = 0; index < glob.length; index += 1) {
+        const char = glob[index];
+        const star = char === `*` ? globstar(glob, index, atStart) : undefined;
+        if (star !== undefined) {
+            source += star.source;
+            index += star.length - 1;
+            atStart = true;
+            continue;
+        }
+        if (char === `*`) {
+            while (glob[index + 1] === `*`) {
+                index += 1;
+            }
+            source += `[^/]*`;
+        }
+        else if (char === `?`) {
+            source += `[^/]`;
+        }
+        else if (char === `\\` && index + 1 < glob.length) {
+            index += 1;
+            source += literal(glob[index]);
+        }
+        else if (char === `[` && setEnd(glob, index) !== -1) {
+            const end = setEnd(glob, index);
+            source += setSource(glob.slice(index + 1, end));
+            index = end;
+        }
+        else if (char === `{` && groupOf(glob, index) !== undefined) {
+            const group = groupOf(glob, index);
+            const bounds = [index, ...group.commas, group.end];
+            const alternatives = bounds.slice(1).map((end, at) => compileGlob(glob.slice(bounds[at] + 1, end), atStart));
+            source += `(?:${alternatives.join(`|`)})`;
+            index = group.end;
+        }
+        else {
+            source += literal(char);
+        }
+        atStart = char === `/`;
+    }
+    return source;
+};
+export const globRegExp = (glob) => new RegExp(`^${compileGlob(glob, true)}$`);
+export const globMatcher = (glob) => {
+    const pattern = globRegExp(glob);
+    return (path) => pattern.test(path);
+};
+export const includeMatcher = (include) => {
+    const { globs, notGlobs } = includeGlobs(include);
+    const rooted = (glob) => glob.replace(/^\.\//, ``);
+    const admits = globs.map((glob) => globMatcher(rooted(glob)));
+    const refuses = notGlobs.map((glob) => globMatcher(rooted(glob)));
+    return (path) => (admits.length === 0 || admits.some((test) => test(path))) && !refuses.some((test) => test(path));
+};
 //# sourceMappingURL=search-globs.js.map

package/dist/policy/search-globs.js.map

@@ -1 +1 @@
-{"version":3,"file":"search-globs.js","sourceRoot":"","sources":["../../src/policy/search-globs.ts"],"names":[],"mappings":"AASA,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,SAAiB,EAAY,EAAE;IACnE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;YACjD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,GAAG,EAAE,CAAC;YACb,SAAS;QACb,CAAC;QACD,QAAQ,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjE,UAAU,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;QACrE,OAAO,IAAI,IAAI,CAAC;IACpB,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;AACzF,CAAC,CAAC;AAIF,MAAM,MAAM,GAAG,CAAC,OAAe,EAAY,EAAE;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,QAAQ,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,KAAK,IAAI,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAClE,OAAO,CAAC,MAAM,OAAO,EAAE,EAAE,MAAM,OAAO,KAAK,CAAC,CAAC;AACjD,CAAC,CAAC;AASF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAA2B,EAAgB,EAAE;IACtE,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IACnD,OAAO;QACH,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QAE7E,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;KACjH,CAAC;AACN,CAAC,CAAC"}
+{"version":3,"file":"search-globs.js","sourceRoot":"","sources":["../../src/policy/search-globs.ts"],"names":[],"mappings":"AASA,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,SAAiB,EAAY,EAAE;IACnE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;YACjD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,GAAG,EAAE,CAAC;YACb,SAAS;QACb,CAAC;QACD,QAAQ,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjE,UAAU,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;QACrE,OAAO,IAAI,IAAI,CAAC;IACpB,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;AACzF,CAAC,CAAC;AAIF,MAAM,MAAM,GAAG,CAAC,OAAe,EAAY,EAAE;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,QAAQ,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,KAAK,IAAI,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAClE,OAAO,CAAC,MAAM,OAAO,EAAE,EAAE,MAAM,OAAO,KAAK,CAAC,CAAC;AACjD,CAAC,CAAC;AASF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAA2B,EAAgB,EAAE;IACtE,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IACnD,OAAO;QACH,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QAE7E,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;KACjH,CAAC;AACN,CAAC,CAAC;AAUF,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAE7C,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAG3F,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,IAAY,EAAU,EAAE;IAClD,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC;IACrB,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;QAC7C,KAAK,IAAI,CAAC,CAAC;IACf,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;QACtB,KAAK,IAAI,CAAC,CAAC;IACf,CAAC;IACD,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YACvB,KAAK,IAAI,CAAC,CAAC;QACf,CAAC;aAAM,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,IAAY,EAAU,EAAE;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC3H,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,GAAG,CAAC;AAC/C,CAAC,CAAC;AAGF,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,IAAY,EAA4E,EAAE;IACrH,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAChB,KAAK,IAAI,CAAC,CAAC;QACf,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAChC,KAAK,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;QACrC,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,IAAI,CAAC,CAAC;QACf,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBACd,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAClC,CAAC;QACL,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC,CAAC;AAGF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,YAAqB,EAAoE,EAAE;IACtI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,YAAqB,EAAU,EAAE;IAChE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,OAAO,GAAG,YAAY,CAAC;IAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;YACtB,KAAK,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;YACzB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACb,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAEf,OAAO,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC7B,KAAK,IAAI,CAAC,CAAC;YACf,CAAC;YACD,MAAM,IAAI,OAAO,CAAC;QACtB,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,MAAM,CAAC;QACrB,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAClD,KAAK,IAAI,CAAC,CAAC;YACX,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAE,CAAC,CAAC;QACpC,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACpD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAChC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAChD,KAAK,GAAG,GAAG,CAAC;QAChB,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,CAAE,CAAC;YACpC,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YACnD,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAE,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9G,MAAM,IAAI,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAC1C,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC;QACtB,CAAC;aAAM,CAAC;YACJ,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,GAAG,IAAI,KAAK,GAAG,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;AAG/F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAA+B,EAAE;IACrE,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAA2B,EAA+B,EAAE;IACvF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACvH,CAAC,CAAC"}

package/dist/policy/secret-hosts.d.ts

@@ -4,6 +4,7 @@ export declare const SECRET_HOSTS_MAX = 64;
 export declare const normalizeHostPattern: (raw: string) => string | undefined;
 export declare const normalizeHost: (raw: string) => string | undefined;
 export declare const hostMatches: (pattern: string, host: string) => boolean;
+export declare const hostCovers: (entry: string, host: string) => boolean;
 export declare const hostAllowed: (patterns: readonly string[], host: string) => boolean;
 export interface HostGuardSetting {
     readonly guard: boolean;

package/dist/policy/secret-hosts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-hosts.d.ts","sourceRoot":"","sources":["../../src/policy/secret-hosts.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,sBAAsB,QAAoF,CAAC;AACxH,eAAO,MAAM,eAAe,MAAM,CAAC;AAEnC,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAMnC,eAAO,MAAM,oBAAoB,QAAS,MAAM,KAAG,MAAM,GAAG,SAY3D,CAAC;AAIF,eAAO,MAAM,aAAa,QAAS,MAAM,KAAG,MAAM,GAAG,SAGpD,CAAC;AAIF,eAAO,MAAM,WAAW,YAAa,MAAM,QAAQ,MAAM,KAAG,OACyB,CAAC;AAEtF,eAAO,MAAM,WAAW,aAAc,SAAS,MAAM,EAAE,QAAQ,MAAM,KAAG,OAAiE,CAAC;AAa1I,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAKD,eAAO,MAAM,iBAAiB,YAAa,gBAAgB,GAAG,SAAS,QAAQ,gBAAgB,KAAG,OAQjG,CAAC"}
+{"version":3,"file":"secret-hosts.d.ts","sourceRoot":"","sources":["../../src/policy/secret-hosts.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,sBAAsB,QAAoF,CAAC;AACxH,eAAO,MAAM,eAAe,MAAM,CAAC;AAEnC,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAMnC,eAAO,MAAM,oBAAoB,QAAS,MAAM,KAAG,MAAM,GAAG,SAY3D,CAAC;AAIF,eAAO,MAAM,aAAa,QAAS,MAAM,KAAG,MAAM,GAAG,SAGpD,CAAC;AAIF,eAAO,MAAM,WAAW,YAAa,MAAM,QAAQ,MAAM,KAAG,OACyB,CAAC;AAMtF,eAAO,MAAM,UAAU,UAAW,MAAM,QAAQ,MAAM,KAAG,OAC+C,CAAC;AAEzG,eAAO,MAAM,WAAW,aAAc,SAAS,MAAM,EAAE,QAAQ,MAAM,KAAG,OAAiE,CAAC;AAa1I,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAKD,eAAO,MAAM,iBAAiB,YAAa,gBAAgB,GAAG,SAAS,QAAQ,gBAAgB,KAAG,OAQjG,CAAC"}

package/dist/policy/secret-hosts.js

@@ -21,6 +21,7 @@ export const normalizeHost = (raw) => {
     return host.length <= SECRET_HOST_MAX && !host.startsWith(WILDCARD) && SECRET_HOST_PATTERN_RE.test(host) ? host : undefined;
 };
 export const hostMatches = (pattern, host) => pattern.startsWith(WILDCARD) ? host.endsWith(pattern.slice(1)) : host === pattern;
+export const hostCovers = (entry, host) => entry.startsWith(WILDCARD) ? hostMatches(entry, host) : host === entry || host.endsWith(`.${entry}`);
 export const hostAllowed = (patterns, host) => patterns.some((pattern) => hostMatches(pattern, host));
 const covered = (patterns, pattern) => {
     if (!pattern.startsWith(WILDCARD)) {

package/dist/policy/secret-hosts.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-hosts.js","sourceRoot":"","sources":["../../src/policy/secret-hosts.ts"],"names":[],"mappings":"AAKA,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAA,sCAAsC,CAAC;AAI/D,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,WAAW,KAAK,QAAQ,KAAK,MAAM,KAAK,QAAQ,KAAK,MAAM,CAAC,CAAC;AACxH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AAEnC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC,MAAM,QAAQ,GAAG,IAAI,CAAC;AAItB,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAW,EAAsB,EAAE;IACpE,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC;YACD,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QAElC,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC,MAAM,IAAI,eAAe,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAClG,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAW,EAAsB,EAAE;IAC7D,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,MAAM,IAAI,eAAe,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAChI,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,IAAY,EAAW,EAAE,CAClE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC;AAEtF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAA2B,EAAE,IAAY,EAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAI1I,MAAM,OAAO,GAAG,CAAC,QAA2B,EAAE,OAAe,EAAW,EAAE;IACtE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC,CAAC;AAWF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAAqC,EAAE,IAAsB,EAAW,EAAE;IACxG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAC1E,CAAC,CAAC"}
+{"version":3,"file":"secret-hosts.js","sourceRoot":"","sources":["../../src/policy/secret-hosts.ts"],"names":[],"mappings":"AAKA,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAA,sCAAsC,CAAC;AAI/D,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,WAAW,KAAK,QAAQ,KAAK,MAAM,KAAK,QAAQ,KAAK,MAAM,CAAC,CAAC;AACxH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AAEnC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC,MAAM,QAAQ,GAAG,IAAI,CAAC;AAItB,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAW,EAAsB,EAAE;IACpE,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC;YACD,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QAElC,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC,MAAM,IAAI,eAAe,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAClG,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAW,EAAsB,EAAE;IAC7D,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,MAAM,IAAI,eAAe,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAChI,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,IAAY,EAAW,EAAE,CAClE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC;AAMtF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,IAAY,EAAW,EAAE,CAC/D,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;AAEzG,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAA2B,EAAE,IAAY,EAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAI1I,MAAM,OAAO,GAAG,CAAC,QAA2B,EAAE,OAAe,EAAW,EAAE;IACtE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC,CAAC;AAWF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAAqC,EAAE,IAAsB,EAAW,EAAE;IACxG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAC1E,CAAC,CAAC"}

package/dist/policy/turned-away.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"turned-away.d.ts","sourceRoot":"","sources":["../../src/policy/turned-away.ts"],"names":[],"mappings":"AA4BA,eAAO,MAAM,cAAc,SAAU,MAAM,GAAG,SAAS,KAAG,OAAsD,CAAC"}
+{"version":3,"file":"turned-away.d.ts","sourceRoot":"","sources":["../../src/policy/turned-away.ts"],"names":[],"mappings":"AA8BA,eAAO,MAAM,cAAc,SAAU,MAAM,GAAG,SAAS,KAAG,OAAsD,CAAC"}

package/dist/policy/turned-away.js

@@ -5,6 +5,7 @@ const TURNED_AWAY = new Set([
     "context-window-too-small",
     "model-helper-only",
     "privacy-unshielded",
+    "tools-unenforced",
     "agent-domain-refused",
     "privacy-instructions",
     "sandbox-memory-low",

package/dist/policy/turned-away.js.map

@@ -1 +1 @@
-{"version":3,"file":"turned-away.js","sourceRoot":"","sources":["../../src/policy/turned-away.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC;IAC7C,eAAe;IAGf,qBAAqB;IACrB,iBAAiB;IACjB,0BAA0B;IAC1B,mBAAmB;IAEnB,oBAAoB;IAEpB,sBAAsB;IAEtB,sBAAsB;IACtB,oBAAoB;IACpB,mBAAmB;IACnB,yBAAyB;IACzB,iBAAiB;IACjB,mBAAmB;IACnB,sBAAsB;CACzB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAwB,EAAW,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC"}
+{"version":3,"file":"turned-away.js","sourceRoot":"","sources":["../../src/policy/turned-away.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC;IAC7C,eAAe;IAGf,qBAAqB;IACrB,iBAAiB;IACjB,0BAA0B;IAC1B,mBAAmB;IAEnB,oBAAoB;IAEpB,kBAAkB;IAElB,sBAAsB;IAEtB,sBAAsB;IACtB,oBAAoB;IACpB,mBAAmB;IACnB,yBAAyB;IACzB,iBAAiB;IACjB,mBAAmB;IACnB,sBAAsB;CACzB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAwB,EAAW,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC"}