@iowarp/clio-coder 0.4.6 → 0.4.8

package/dist/chunk-2ZWLMA3T.js

@@ -0,0 +1,658 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  describeValidationContract,
+  loadValidationContract
+} from "./chunk-RFULVPBX.js";
+import {
+  CONFIRMED_SCOPE,
+  READONLY_SCOPE,
+  WORKSPACE_SCOPE,
+  createLoopState,
+  isSubset,
+  observe
+} from "./chunk-MUXNDNMZ.js";
+import {
+  createSafetyPolicyEngine
+} from "./chunk-RAUOKUZV.js";
+import {
+  BusChannels,
+  isRunAbortedPayload
+} from "./chunk-W5RM7YAH.js";
+import {
+  classify
+} from "./chunk-YXFKLMX2.js";
+import {
+  clioStateDir,
+  stateRootRemoved
+} from "./chunk-CTTI7G3T.js";
+import {
+  init_esm_shims
+} from "./chunk-ECBHH7LU.js";
+
+// src/domains/safety/rigor.ts
+init_esm_shims();
+function rigorResolution(options) {
+  if (options.override === "high" || options.override === "normal") {
+    return { rigor: options.override, source: "override" };
+  }
+  const cwd = options.cwd ?? process.cwd();
+  const loaded = loadValidationContract(cwd);
+  if (!loaded.ok) {
+    const resolution = { rigor: "normal", source: "invalid-contract", contractPath: loaded.path };
+    const diagnostic = describeValidationContract(loaded);
+    if (diagnostic !== null) resolution.diagnostic = diagnostic;
+    return resolution;
+  }
+  if (loaded.contract !== null) {
+    return { rigor: "high", source: "validation-contract", contractPath: loaded.path };
+  }
+  if ("advisory" in loaded) {
+    const resolution = { rigor: "normal", source: "markdown-advisory", contractPath: loaded.path };
+    const diagnostic = describeValidationContract(loaded);
+    if (diagnostic !== null) resolution.diagnostic = diagnostic;
+    return resolution;
+  }
+  return { rigor: "normal", source: "none" };
+}
+function resolveRigor(options) {
+  return rigorResolution(options).rigor;
+}
+function parseRigorOverride(value) {
+  if (typeof value !== "string") return null;
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "high") return "high";
+  if (normalized === "normal") return "normal";
+  return null;
+}
+
+// src/domains/safety/index.ts
+init_esm_shims();
+
+// src/domains/safety/extension.ts
+init_esm_shims();
+
+// src/domains/safety/audit.ts
+init_esm_shims();
+import { randomBytes } from "node:crypto";
+import { closeSync, fsyncSync, mkdirSync, openSync, writeSync } from "node:fs";
+import { join } from "node:path";
+var REDACT_KEY_RE = /(password|token|secret|key|auth|credential)/i;
+var MAX_STRING_LEN = 200;
+var DATE_OPTIONS = { year: "numeric", month: "2-digit", day: "2-digit" };
+var dateFormatterZone = process.env.TZ;
+var dateFormatter = new Intl.DateTimeFormat("en-CA", DATE_OPTIONS);
+function localDateString(d) {
+  if (process.env.TZ !== dateFormatterZone) {
+    dateFormatterZone = process.env.TZ;
+    const zone = dateFormatterZone === void 0 ? void 0 : { timeZone: dateFormatterZone };
+    dateFormatter = new Intl.DateTimeFormat("en-CA", { ...DATE_OPTIONS, ...zone });
+  }
+  return dateFormatter.format(d);
+}
+function newCorrelationId() {
+  const n = BigInt(`0x${randomBytes(8).toString("hex")}`);
+  const raw = n.toString(36);
+  if (raw.length >= 12) return raw.slice(0, 12);
+  return raw.padStart(12, "0");
+}
+function redactString(s) {
+  if (s.length <= MAX_STRING_LEN) return s;
+  const truncated = s.length - MAX_STRING_LEN;
+  return `${s.slice(0, MAX_STRING_LEN)}\u2026 [truncated ${truncated} chars]`;
+}
+function redactArgs(value, depth = 0) {
+  if (depth > 8) return "[redacted:depth]";
+  if (value == null) return value;
+  if (typeof value === "string") return redactString(value);
+  if (typeof value === "number" || typeof value === "boolean") return value;
+  if (Array.isArray(value)) return value.map((item) => redactArgs(item, depth + 1));
+  if (typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      if (REDACT_KEY_RE.test(k)) {
+        out[k] = "[redacted]";
+        continue;
+      }
+      out[k] = redactArgs(v, depth + 1);
+    }
+    return out;
+  }
+  return String(value);
+}
+function buildAuditRecord(input) {
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  const record = {
+    kind: "tool_call",
+    ts: now.toISOString(),
+    correlationId: newCorrelationId(),
+    tool: input.tool,
+    actionClass: input.classification.actionClass,
+    decision: input.decision,
+    reasons: input.reasons ?? input.policy?.reasons ?? input.classification.reasons
+  };
+  if (input.requestId !== void 0) record.requestId = input.requestId;
+  if (input.posture !== void 0) record.posture = input.posture;
+  if (input.policy?.ruleId !== void 0) record.ruleId = input.policy.ruleId;
+  const reasonCode = input.reasonCode ?? input.policy?.reasonCode;
+  if (reasonCode !== void 0) record.reasonCode = reasonCode;
+  if (input.policy?.policySource !== void 0) record.policySource = input.policy.policySource;
+  if (input.policy?.policyHash !== void 0) record.policyHash = input.policy.policyHash;
+  if (input.policy?.command !== void 0) record.command = redactString(input.policy.command);
+  if (input.policy?.cwd !== void 0) record.cwd = input.policy.cwd;
+  if (input.args !== void 0) record.args = redactArgs(input.args);
+  return record;
+}
+function buildAbortAuditRecord(input) {
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  const record = {
+    kind: "abort",
+    ts: now.toISOString(),
+    correlationId: newCorrelationId(),
+    source: input.source,
+    runId: input.runId,
+    startedAt: input.startedAt,
+    elapsedMs: input.elapsedMs
+  };
+  if (input.reason !== void 0) record.reason = input.reason;
+  return record;
+}
+function buildSessionParkAuditRecord(input) {
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  return {
+    kind: "session_park",
+    ts: now.toISOString(),
+    correlationId: newCorrelationId(),
+    sessionId: input.sessionId,
+    reason: input.reason
+  };
+}
+function buildSessionResumeAuditRecord(input) {
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  return {
+    kind: "session_resume",
+    ts: now.toISOString(),
+    correlationId: newCorrelationId(),
+    sessionId: input.sessionId,
+    via: input.via
+  };
+}
+function buildPermissionAuditRecord(input) {
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  const record = {
+    kind: "permission",
+    ts: now.toISOString(),
+    correlationId: newCorrelationId(),
+    status: input.status
+  };
+  if (input.tool !== void 0) record.tool = input.tool;
+  if (input.requestId !== void 0) record.requestId = input.requestId;
+  if (input.origin !== void 0) record.origin = input.origin;
+  if (input.decidedBy !== void 0) record.decidedBy = input.decidedBy;
+  if (input.actionClass !== void 0) record.actionClass = input.actionClass;
+  if (input.reason !== void 0) record.reason = input.reason;
+  if (input.requestedBy !== void 0) record.requestedBy = input.requestedBy;
+  return record;
+}
+function buildAgentStatusChangeAuditRecord(input) {
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  const record = {
+    kind: "agent_status_change",
+    ts: now.toISOString(),
+    correlationId: newCorrelationId(),
+    runId: input.runId,
+    phase: input.phase,
+    prevPhase: input.prevPhase,
+    elapsedFromStart: Math.max(0, Math.floor(input.elapsedFromStart)),
+    watchdogTier: Math.max(0, Math.floor(input.watchdogTier))
+  };
+  if (input.metadata !== void 0) record.metadata = redactArgs(input.metadata);
+  return record;
+}
+function buildCompletionContractAuditRecord(input) {
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  const record = {
+    kind: "completion_contract",
+    ts: now.toISOString(),
+    correlationId: newCorrelationId(),
+    turnId: input.turnId,
+    decision: input.decision,
+    reason: input.reason,
+    rigor: input.rigor,
+    mutatedPaths: input.mutatedPaths.map((path) => redactString(path)),
+    evidenceKinds: [...input.evidenceKinds]
+  };
+  if (input.runId !== void 0) record.runId = input.runId;
+  if (input.sessionId !== void 0) record.sessionId = input.sessionId;
+  return record;
+}
+function logAuditError(err, path) {
+  const msg = err instanceof Error ? err.message : String(err);
+  const where = path ? ` (${path})` : "";
+  process.stderr.write(`[clio-coder:audit] ${msg}${where}
+`);
+}
+var AUDIT_FLUSH_INTERVAL_MS = 5e3;
+function openAuditWriter(opts) {
+  const dateFn = opts?.dateFn ?? (() => /* @__PURE__ */ new Date());
+  let current = null;
+  let closed = false;
+  let dirty = false;
+  function flushCurrent() {
+    if (current === null || !dirty) return;
+    try {
+      fsyncSync(current.fd);
+      dirty = false;
+    } catch (err) {
+      logAuditError(err, current.path);
+    }
+  }
+  const flushTimer = setInterval(flushCurrent, AUDIT_FLUSH_INTERVAL_MS);
+  flushTimer.unref();
+  function closeCurrent() {
+    if (current === null) return;
+    flushCurrent();
+    try {
+      closeSync(current.fd);
+    } catch (err) {
+      logAuditError(err, current.path);
+    }
+    current = null;
+    dirty = false;
+  }
+  function ensureFor(date) {
+    if (current !== null && current.date === date) return current;
+    if (current !== null) closeCurrent();
+    if (stateRootRemoved()) return null;
+    try {
+      const dir = join(clioStateDir(), "audit");
+      mkdirSync(dir, { recursive: true });
+      const filePath = join(dir, `${date}.jsonl`);
+      const fd = openSync(filePath, "a");
+      current = { fd, date, path: filePath };
+      return current;
+    } catch (err) {
+      logAuditError(err);
+      return null;
+    }
+  }
+  return {
+    write(record) {
+      if (closed) return;
+      try {
+        const date = localDateString(dateFn());
+        const handle = ensureFor(date);
+        if (handle === null) return;
+        const line = `${JSON.stringify(record)}
+`;
+        writeSync(handle.fd, line);
+        dirty = true;
+      } catch (err) {
+        logAuditError(err, current?.path);
+      }
+    },
+    flush() {
+      flushCurrent();
+    },
+    async close() {
+      if (closed) return;
+      closed = true;
+      clearInterval(flushTimer);
+      closeCurrent();
+    }
+  };
+}
+
+// src/domains/safety/extension.ts
+function isPermissionResolvedPayload(value) {
+  if (!value || typeof value !== "object") return false;
+  const p = value;
+  if (p.status !== "granted" && p.status !== "denied" && p.status !== "expired") return false;
+  if (p.tool !== void 0 && typeof p.tool !== "string") return false;
+  if (p.actionClass !== void 0 && typeof p.actionClass !== "string") return false;
+  if (p.reason !== void 0 && typeof p.reason !== "string") return false;
+  if (p.requestedBy !== void 0 && typeof p.requestedBy !== "string") return false;
+  if (p.requestId !== void 0 && typeof p.requestId !== "string") return false;
+  if (p.origin !== void 0 && typeof p.origin !== "string") return false;
+  if (p.decidedBy !== void 0 && typeof p.decidedBy !== "string") return false;
+  return true;
+}
+function isPermissionRequestedPayload(value) {
+  if (!value || typeof value !== "object") return false;
+  const p = value;
+  if (typeof p.tool !== "string" || p.tool.length === 0) return false;
+  if (typeof p.actionClass !== "string" || p.actionClass.length === 0) return false;
+  if (p.origin !== void 0 && typeof p.origin !== "string") return false;
+  if (p.requestId !== void 0 && typeof p.requestId !== "string") return false;
+  if (p.requestedBy !== void 0 && typeof p.requestedBy !== "string") return false;
+  if (p.summary !== void 0 && typeof p.summary !== "string") return false;
+  if (p.rejection !== void 0) {
+    const rejection = p.rejection;
+    if (!rejection || typeof rejection !== "object" || Array.isArray(rejection)) return false;
+    if (typeof rejection.short !== "string") return false;
+  }
+  return true;
+}
+var PARK_REASONS = /* @__PURE__ */ new Set([
+  "create_new",
+  "resume_other",
+  "fork",
+  "switch_branch",
+  "close",
+  "shutdown"
+]);
+var RESUME_VIAS = /* @__PURE__ */ new Set(["resume", "switch_branch"]);
+var MAX_REQUESTED_PERMISSION_AUDIT_IDS = 4096;
+function isSessionParkedPayload(value) {
+  if (!value || typeof value !== "object") return false;
+  const p = value;
+  if (typeof p.sessionId !== "string") return false;
+  if (typeof p.reason !== "string" || !PARK_REASONS.has(p.reason)) return false;
+  return true;
+}
+function isSessionResumedPayload(value) {
+  if (!value || typeof value !== "object") return false;
+  const p = value;
+  if (typeof p.sessionId !== "string") return false;
+  if (typeof p.via !== "string" || !RESUME_VIAS.has(p.via)) return false;
+  return true;
+}
+function isAgentStatusChangedPayload(value) {
+  if (!value || typeof value !== "object") return false;
+  const p = value;
+  if (p.runId !== null && typeof p.runId !== "string") return false;
+  if (typeof p.phase !== "string" || typeof p.prevPhase !== "string") return false;
+  if (typeof p.elapsedFromStart !== "number" || !Number.isFinite(p.elapsedFromStart)) return false;
+  if (typeof p.watchdogTier !== "number" || !Number.isFinite(p.watchdogTier)) return false;
+  if (p.metadata !== void 0 && (!p.metadata || typeof p.metadata !== "object" || Array.isArray(p.metadata)))
+    return false;
+  return true;
+}
+function isAlarmableStatus(payload) {
+  if (payload.phase === "stuck" || payload.phase === "tool_blocked" || payload.phase === "retrying") return true;
+  return payload.phase === "ended" && payload.metadata?.reason === "cancelled";
+}
+function createSafetyBundle(context) {
+  let writer = null;
+  let policyEngine = null;
+  let loopState = createLoopState();
+  let recordCount = 0;
+  let unsubscribePermissionRequested = null;
+  let unsubscribePermissionResolved = null;
+  let unsubscribeRunAborted = null;
+  let unsubscribeSessionParked = null;
+  let unsubscribeSessionResumed = null;
+  let unsubscribeAgentStatusChanged = null;
+  let unsubscribeDispatchCompleted = null;
+  let unsubscribeDispatchFailed = null;
+  const recordedRequestedPermissionIds = /* @__PURE__ */ new Set();
+  function activePolicyEngine() {
+    policyEngine ??= createSafetyPolicyEngine();
+    return policyEngine;
+  }
+  function writeAudit(rec) {
+    if (writer === null) return;
+    writer.write(rec);
+    recordCount += 1;
+  }
+  function recordToolCallAudit(input) {
+    writeAudit(buildAuditRecord(input));
+  }
+  function recordCompletionContractAudit(input) {
+    writeAudit(buildCompletionContractAuditRecord(input));
+  }
+  const extension = {
+    async start() {
+      policyEngine = createSafetyPolicyEngine();
+      writer = openAuditWriter();
+      unsubscribePermissionRequested = context.bus.on(BusChannels.PermissionRequested, (payload) => {
+        if (!isPermissionRequestedPayload(payload)) return;
+        if (payload.origin === void 0 || payload.origin === "main") return;
+        if (payload.requestId === void 0) return;
+        if (recordedRequestedPermissionIds.has(payload.requestId)) return;
+        recordedRequestedPermissionIds.add(payload.requestId);
+        if (recordedRequestedPermissionIds.size > MAX_REQUESTED_PERMISSION_AUDIT_IDS) {
+          const oldest = recordedRequestedPermissionIds.values().next().value;
+          if (oldest !== void 0) recordedRequestedPermissionIds.delete(oldest);
+        }
+        const reason = payload.rejection?.short ?? payload.summary;
+        writeAudit(
+          buildPermissionAuditRecord({
+            status: "requested",
+            requestId: payload.requestId,
+            origin: payload.origin,
+            tool: payload.tool,
+            actionClass: payload.actionClass,
+            ...reason !== void 0 ? { reason } : {},
+            ...payload.requestedBy !== void 0 ? { requestedBy: payload.requestedBy } : {}
+          })
+        );
+      });
+      unsubscribePermissionResolved = context.bus.on(BusChannels.PermissionResolved, (payload) => {
+        if (!isPermissionResolvedPayload(payload)) return;
+        writeAudit(
+          buildPermissionAuditRecord({
+            status: payload.status,
+            ...payload.requestId !== void 0 ? { requestId: payload.requestId } : {},
+            ...payload.origin !== void 0 ? { origin: payload.origin } : {},
+            ...payload.decidedBy !== void 0 ? { decidedBy: payload.decidedBy } : {},
+            ...payload.tool !== void 0 ? { tool: payload.tool } : {},
+            ...payload.actionClass !== void 0 ? { actionClass: payload.actionClass } : {},
+            ...payload.reason !== void 0 ? { reason: payload.reason } : {},
+            ...payload.requestedBy !== void 0 ? { requestedBy: payload.requestedBy } : {}
+          })
+        );
+      });
+      unsubscribeRunAborted = context.bus.on(BusChannels.RunAborted, (payload) => {
+        if (!isRunAbortedPayload(payload)) return;
+        const recordInput = {
+          source: payload.source,
+          runId: payload.runId,
+          startedAt: payload.startedAt,
+          elapsedMs: payload.elapsedMs
+        };
+        if (payload.reason !== void 0) recordInput.reason = payload.reason;
+        writeAudit(buildAbortAuditRecord(recordInput));
+      });
+      unsubscribeSessionParked = context.bus.on(BusChannels.SessionParked, (payload) => {
+        if (!isSessionParkedPayload(payload)) return;
+        writeAudit(buildSessionParkAuditRecord({ sessionId: payload.sessionId, reason: payload.reason }));
+      });
+      unsubscribeSessionResumed = context.bus.on(BusChannels.SessionResumed, (payload) => {
+        if (!isSessionResumedPayload(payload)) return;
+        writeAudit(buildSessionResumeAuditRecord({ sessionId: payload.sessionId, via: payload.via }));
+      });
+      unsubscribeAgentStatusChanged = context.bus.on(BusChannels.AgentStatusChanged, (payload) => {
+        if (!isAgentStatusChangedPayload(payload) || !isAlarmableStatus(payload)) return;
+        writeAudit(
+          buildAgentStatusChangeAuditRecord({
+            runId: payload.runId,
+            phase: payload.phase,
+            prevPhase: payload.prevPhase,
+            elapsedFromStart: payload.elapsedFromStart,
+            watchdogTier: payload.watchdogTier,
+            ...payload.metadata ? { metadata: payload.metadata } : {}
+          })
+        );
+      });
+      const auditDispatchTerminal = (raw) => {
+        if (!raw || typeof raw !== "object") return;
+        const payload = raw;
+        if (typeof payload.runId !== "string" || typeof payload.outcome !== "string") return;
+        const lineage = payload.lineage && typeof payload.lineage === "object" && !Array.isArray(payload.lineage) ? payload.lineage : null;
+        const durationMs = typeof payload.durationMs === "number" ? payload.durationMs : 0;
+        writeAudit(
+          buildAgentStatusChangeAuditRecord({
+            runId: payload.runId,
+            phase: payload.outcome,
+            prevPhase: "running",
+            elapsedFromStart: durationMs,
+            watchdogTier: 0,
+            metadata: {
+              outcome: payload.outcome,
+              ...payload.outcomeDetail !== void 0 && payload.outcomeDetail !== null ? { outcomeDetail: payload.outcomeDetail } : {},
+              ...typeof payload.agentId === "string" ? { agentId: payload.agentId } : {},
+              ...lineage !== null ? {
+                parentRunId: lineage.parentRunId ?? null,
+                rootRunId: lineage.rootRunId ?? null,
+                attempt: lineage.attempt ?? 0,
+                depth: lineage.depth ?? 0
+              } : {}
+            }
+          })
+        );
+      };
+      unsubscribeDispatchCompleted = context.bus.on(BusChannels.DispatchCompleted, auditDispatchTerminal);
+      unsubscribeDispatchFailed = context.bus.on(BusChannels.DispatchFailed, auditDispatchTerminal);
+    },
+    async stop() {
+      unsubscribePermissionRequested?.();
+      unsubscribePermissionRequested = null;
+      unsubscribePermissionResolved?.();
+      unsubscribePermissionResolved = null;
+      unsubscribeRunAborted?.();
+      unsubscribeRunAborted = null;
+      unsubscribeSessionParked?.();
+      unsubscribeSessionParked = null;
+      unsubscribeSessionResumed?.();
+      unsubscribeSessionResumed = null;
+      unsubscribeAgentStatusChanged?.();
+      unsubscribeAgentStatusChanged = null;
+      unsubscribeDispatchCompleted?.();
+      unsubscribeDispatchCompleted = null;
+      unsubscribeDispatchFailed?.();
+      unsubscribeDispatchFailed = null;
+      recordedRequestedPermissionIds.clear();
+      await writer?.close();
+      writer = null;
+    }
+  };
+  const contract = {
+    classify(call) {
+      return classify(call);
+    },
+    evaluate(call, posture) {
+      const policy = activePolicyEngine().evaluate(call, posture);
+      const classification = policy.classification;
+      context.bus.emit(BusChannels.SafetyClassified, {
+        tool: call.tool,
+        actionClass: classification.actionClass,
+        reasons: classification.reasons,
+        ruleId: policy.ruleId,
+        posture,
+        policySource: policy.policySource,
+        reasonCode: policy.reasonCode
+      });
+      if (policy.kind === "block") {
+        const auditInput2 = {
+          tool: call.tool,
+          classification,
+          decision: "blocked",
+          args: call.args,
+          policy
+        };
+        if (posture !== void 0) auditInput2.posture = posture;
+        recordToolCallAudit(auditInput2);
+        context.bus.emit(BusChannels.SafetyBlocked, {
+          tool: call.tool,
+          actionClass: classification.actionClass,
+          ruleId: policy.ruleId,
+          posture,
+          rejection: policy.rejection,
+          policySource: policy.policySource,
+          reasonCode: policy.reasonCode
+        });
+        const decision = {
+          kind: "block",
+          classification,
+          rejection: policy.rejection ?? fallbackRejection(policy),
+          policy
+        };
+        if (policy.match) decision.match = policy.match;
+        return decision;
+      }
+      if (policy.kind === "ask") {
+        const auditInput2 = {
+          tool: call.tool,
+          classification,
+          decision: "classified",
+          args: call.args,
+          policy
+        };
+        if (posture !== void 0) auditInput2.posture = posture;
+        recordToolCallAudit(auditInput2);
+        const decision = {
+          kind: "ask",
+          classification,
+          rejection: policy.rejection ?? fallbackRejection(policy),
+          policy
+        };
+        if (policy.match) decision.match = policy.match;
+        return decision;
+      }
+      const auditInput = {
+        tool: call.tool,
+        classification,
+        // Non-confirmed net passes are not final: registry admission still
+        // applies autonomy and writes the resolved allowed/park/denied row.
+        decision: posture === "confirmed" ? "allowed" : "classified",
+        args: call.args,
+        policy
+      };
+      if (posture !== void 0) auditInput.posture = posture;
+      recordToolCallAudit(auditInput);
+      context.bus.emit(BusChannels.SafetyAllowed, {
+        tool: call.tool,
+        actionClass: classification.actionClass,
+        posture,
+        ruleId: policy.ruleId,
+        policySource: policy.policySource,
+        reasonCode: policy.reasonCode
+      });
+      return { kind: "allow", classification, policy };
+    },
+    observeLoop(key, now) {
+      const [next, verdict] = observe(loopState, key, now ?? Date.now());
+      loopState = next;
+      return verdict;
+    },
+    scopes: { readonly: READONLY_SCOPE, workspace: WORKSPACE_SCOPE, confirmed: CONFIRMED_SCOPE },
+    isSubset,
+    policy: {
+      metadata: (posture) => activePolicyEngine().metadata(posture),
+      allowsObservationPath: (path) => activePolicyEngine().evaluate({ tool: "read", args: { path } }).reasonCode !== "path-policy:zeroAccessPaths"
+    },
+    audit: {
+      recordCount: () => recordCount,
+      recordToolCall: recordToolCallAudit,
+      recordCompletionContract: recordCompletionContractAudit
+    }
+  };
+  return { extension, contract };
+}
+function fallbackRejection(policy) {
+  return {
+    short: `${policy.tool} blocked: ${policy.actionClass}`,
+    detail: policy.reasons.join("\n"),
+    hints: []
+  };
+}
+
+// src/domains/safety/manifest.ts
+init_esm_shims();
+var SafetyManifest = {
+  name: "safety",
+  dependsOn: ["config"]
+};
+
+// src/domains/safety/index.ts
+var SafetyDomainModule = {
+  manifest: SafetyManifest,
+  createExtension: createSafetyBundle
+};
+
+export {
+  resolveRigor,
+  parseRigorOverride,
+  SafetyDomainModule
+};
+//# sourceMappingURL=chunk-2ZWLMA3T.js.map