@iowarp/clio-coder 0.4.9 → 0.5.0

package/dist/chunk-GREYLTZ5.js

@@ -1,658 +0,0 @@
-import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
-import {
-  describeValidationContract,
-  loadValidationContract
-} from "./chunk-PTFISXQO.js";
-import {
-  CONFIRMED_SCOPE,
-  READONLY_SCOPE,
-  WORKSPACE_SCOPE,
-  createLoopState,
-  isSubset,
-  observe
-} from "./chunk-AY4XE6GN.js";
-import {
-  BusChannels,
-  isRunAbortedPayload
-} from "./chunk-W5RM7YAH.js";
-import {
-  createSafetyPolicyEngine
-} from "./chunk-IC7JXLOM.js";
-import {
-  classify
-} from "./chunk-H2WSCZZT.js";
-import {
-  clioStateDir,
-  stateRootRemoved
-} from "./chunk-CTTI7G3T.js";
-import {
-  init_esm_shims
-} from "./chunk-ECBHH7LU.js";
-
-// src/domains/safety/rigor.ts
-init_esm_shims();
-function rigorResolution(options) {
-  if (options.override === "high" || options.override === "normal") {
-    return { rigor: options.override, source: "override" };
-  }
-  const cwd = options.cwd ?? process.cwd();
-  const loaded = loadValidationContract(cwd);
-  if (!loaded.ok) {
-    const resolution = { rigor: "normal", source: "invalid-contract", contractPath: loaded.path };
-    const diagnostic = describeValidationContract(loaded);
-    if (diagnostic !== null) resolution.diagnostic = diagnostic;
-    return resolution;
-  }
-  if (loaded.contract !== null) {
-    return { rigor: "high", source: "validation-contract", contractPath: loaded.path };
-  }
-  if ("advisory" in loaded) {
-    const resolution = { rigor: "normal", source: "markdown-advisory", contractPath: loaded.path };
-    const diagnostic = describeValidationContract(loaded);
-    if (diagnostic !== null) resolution.diagnostic = diagnostic;
-    return resolution;
-  }
-  return { rigor: "normal", source: "none" };
-}
-function resolveRigor(options) {
-  return rigorResolution(options).rigor;
-}
-function parseRigorOverride(value) {
-  if (typeof value !== "string") return null;
-  const normalized = value.trim().toLowerCase();
-  if (normalized === "high") return "high";
-  if (normalized === "normal") return "normal";
-  return null;
-}
-
-// src/domains/safety/index.ts
-init_esm_shims();
-
-// src/domains/safety/extension.ts
-init_esm_shims();
-
-// src/domains/safety/audit.ts
-init_esm_shims();
-import { randomBytes } from "node:crypto";
-import { closeSync, fsyncSync, mkdirSync, openSync, writeSync } from "node:fs";
-import { join } from "node:path";
-var REDACT_KEY_RE = /(password|token|secret|key|auth|credential)/i;
-var MAX_STRING_LEN = 200;
-var DATE_OPTIONS = { year: "numeric", month: "2-digit", day: "2-digit" };
-var dateFormatterZone = process.env.TZ;
-var dateFormatter = new Intl.DateTimeFormat("en-CA", DATE_OPTIONS);
-function localDateString(d) {
-  if (process.env.TZ !== dateFormatterZone) {
-    dateFormatterZone = process.env.TZ;
-    const zone = dateFormatterZone === void 0 ? void 0 : { timeZone: dateFormatterZone };
-    dateFormatter = new Intl.DateTimeFormat("en-CA", { ...DATE_OPTIONS, ...zone });
-  }
-  return dateFormatter.format(d);
-}
-function newCorrelationId() {
-  const n = BigInt(`0x${randomBytes(8).toString("hex")}`);
-  const raw = n.toString(36);
-  if (raw.length >= 12) return raw.slice(0, 12);
-  return raw.padStart(12, "0");
-}
-function redactString(s) {
-  if (s.length <= MAX_STRING_LEN) return s;
-  const truncated = s.length - MAX_STRING_LEN;
-  return `${s.slice(0, MAX_STRING_LEN)}\u2026 [truncated ${truncated} chars]`;
-}
-function redactArgs(value, depth = 0) {
-  if (depth > 8) return "[redacted:depth]";
-  if (value == null) return value;
-  if (typeof value === "string") return redactString(value);
-  if (typeof value === "number" || typeof value === "boolean") return value;
-  if (Array.isArray(value)) return value.map((item) => redactArgs(item, depth + 1));
-  if (typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      if (REDACT_KEY_RE.test(k)) {
-        out[k] = "[redacted]";
-        continue;
-      }
-      out[k] = redactArgs(v, depth + 1);
-    }
-    return out;
-  }
-  return String(value);
-}
-function buildAuditRecord(input) {
-  const now = input.now ?? /* @__PURE__ */ new Date();
-  const record = {
-    kind: "tool_call",
-    ts: now.toISOString(),
-    correlationId: newCorrelationId(),
-    tool: input.tool,
-    actionClass: input.classification.actionClass,
-    decision: input.decision,
-    reasons: input.reasons ?? input.policy?.reasons ?? input.classification.reasons
-  };
-  if (input.requestId !== void 0) record.requestId = input.requestId;
-  if (input.posture !== void 0) record.posture = input.posture;
-  if (input.policy?.ruleId !== void 0) record.ruleId = input.policy.ruleId;
-  const reasonCode = input.reasonCode ?? input.policy?.reasonCode;
-  if (reasonCode !== void 0) record.reasonCode = reasonCode;
-  if (input.policy?.policySource !== void 0) record.policySource = input.policy.policySource;
-  if (input.policy?.policyHash !== void 0) record.policyHash = input.policy.policyHash;
-  if (input.policy?.command !== void 0) record.command = redactString(input.policy.command);
-  if (input.policy?.cwd !== void 0) record.cwd = input.policy.cwd;
-  if (input.args !== void 0) record.args = redactArgs(input.args);
-  return record;
-}
-function buildAbortAuditRecord(input) {
-  const now = input.now ?? /* @__PURE__ */ new Date();
-  const record = {
-    kind: "abort",
-    ts: now.toISOString(),
-    correlationId: newCorrelationId(),
-    source: input.source,
-    runId: input.runId,
-    startedAt: input.startedAt,
-    elapsedMs: input.elapsedMs
-  };
-  if (input.reason !== void 0) record.reason = input.reason;
-  return record;
-}
-function buildSessionParkAuditRecord(input) {
-  const now = input.now ?? /* @__PURE__ */ new Date();
-  return {
-    kind: "session_park",
-    ts: now.toISOString(),
-    correlationId: newCorrelationId(),
-    sessionId: input.sessionId,
-    reason: input.reason
-  };
-}
-function buildSessionResumeAuditRecord(input) {
-  const now = input.now ?? /* @__PURE__ */ new Date();
-  return {
-    kind: "session_resume",
-    ts: now.toISOString(),
-    correlationId: newCorrelationId(),
-    sessionId: input.sessionId,
-    via: input.via
-  };
-}
-function buildPermissionAuditRecord(input) {
-  const now = input.now ?? /* @__PURE__ */ new Date();
-  const record = {
-    kind: "permission",
-    ts: now.toISOString(),
-    correlationId: newCorrelationId(),
-    status: input.status
-  };
-  if (input.tool !== void 0) record.tool = input.tool;
-  if (input.requestId !== void 0) record.requestId = input.requestId;
-  if (input.origin !== void 0) record.origin = input.origin;
-  if (input.decidedBy !== void 0) record.decidedBy = input.decidedBy;
-  if (input.actionClass !== void 0) record.actionClass = input.actionClass;
-  if (input.reason !== void 0) record.reason = input.reason;
-  if (input.requestedBy !== void 0) record.requestedBy = input.requestedBy;
-  return record;
-}
-function buildAgentStatusChangeAuditRecord(input) {
-  const now = input.now ?? /* @__PURE__ */ new Date();
-  const record = {
-    kind: "agent_status_change",
-    ts: now.toISOString(),
-    correlationId: newCorrelationId(),
-    runId: input.runId,
-    phase: input.phase,
-    prevPhase: input.prevPhase,
-    elapsedFromStart: Math.max(0, Math.floor(input.elapsedFromStart)),
-    watchdogTier: Math.max(0, Math.floor(input.watchdogTier))
-  };
-  if (input.metadata !== void 0) record.metadata = redactArgs(input.metadata);
-  return record;
-}
-function buildCompletionContractAuditRecord(input) {
-  const now = input.now ?? /* @__PURE__ */ new Date();
-  const record = {
-    kind: "completion_contract",
-    ts: now.toISOString(),
-    correlationId: newCorrelationId(),
-    turnId: input.turnId,
-    decision: input.decision,
-    reason: input.reason,
-    rigor: input.rigor,
-    mutatedPaths: input.mutatedPaths.map((path) => redactString(path)),
-    evidenceKinds: [...input.evidenceKinds]
-  };
-  if (input.runId !== void 0) record.runId = input.runId;
-  if (input.sessionId !== void 0) record.sessionId = input.sessionId;
-  return record;
-}
-function logAuditError(err, path) {
-  const msg = err instanceof Error ? err.message : String(err);
-  const where = path ? ` (${path})` : "";
-  process.stderr.write(`[clio-coder:audit] ${msg}${where}
-`);
-}
-var AUDIT_FLUSH_INTERVAL_MS = 5e3;
-function openAuditWriter(opts) {
-  const dateFn = opts?.dateFn ?? (() => /* @__PURE__ */ new Date());
-  let current = null;
-  let closed = false;
-  let dirty = false;
-  function flushCurrent() {
-    if (current === null || !dirty) return;
-    try {
-      fsyncSync(current.fd);
-      dirty = false;
-    } catch (err) {
-      logAuditError(err, current.path);
-    }
-  }
-  const flushTimer = setInterval(flushCurrent, AUDIT_FLUSH_INTERVAL_MS);
-  flushTimer.unref();
-  function closeCurrent() {
-    if (current === null) return;
-    flushCurrent();
-    try {
-      closeSync(current.fd);
-    } catch (err) {
-      logAuditError(err, current.path);
-    }
-    current = null;
-    dirty = false;
-  }
-  function ensureFor(date) {
-    if (current !== null && current.date === date) return current;
-    if (current !== null) closeCurrent();
-    if (stateRootRemoved()) return null;
-    try {
-      const dir = join(clioStateDir(), "audit");
-      mkdirSync(dir, { recursive: true });
-      const filePath = join(dir, `${date}.jsonl`);
-      const fd = openSync(filePath, "a");
-      current = { fd, date, path: filePath };
-      return current;
-    } catch (err) {
-      logAuditError(err);
-      return null;
-    }
-  }
-  return {
-    write(record) {
-      if (closed) return;
-      try {
-        const date = localDateString(dateFn());
-        const handle = ensureFor(date);
-        if (handle === null) return;
-        const line = `${JSON.stringify(record)}
-`;
-        writeSync(handle.fd, line);
-        dirty = true;
-      } catch (err) {
-        logAuditError(err, current?.path);
-      }
-    },
-    flush() {
-      flushCurrent();
-    },
-    async close() {
-      if (closed) return;
-      closed = true;
-      clearInterval(flushTimer);
-      closeCurrent();
-    }
-  };
-}
-
-// src/domains/safety/extension.ts
-function isPermissionResolvedPayload(value) {
-  if (!value || typeof value !== "object") return false;
-  const p = value;
-  if (p.status !== "granted" && p.status !== "denied" && p.status !== "expired") return false;
-  if (p.tool !== void 0 && typeof p.tool !== "string") return false;
-  if (p.actionClass !== void 0 && typeof p.actionClass !== "string") return false;
-  if (p.reason !== void 0 && typeof p.reason !== "string") return false;
-  if (p.requestedBy !== void 0 && typeof p.requestedBy !== "string") return false;
-  if (p.requestId !== void 0 && typeof p.requestId !== "string") return false;
-  if (p.origin !== void 0 && typeof p.origin !== "string") return false;
-  if (p.decidedBy !== void 0 && typeof p.decidedBy !== "string") return false;
-  return true;
-}
-function isPermissionRequestedPayload(value) {
-  if (!value || typeof value !== "object") return false;
-  const p = value;
-  if (typeof p.tool !== "string" || p.tool.length === 0) return false;
-  if (typeof p.actionClass !== "string" || p.actionClass.length === 0) return false;
-  if (p.origin !== void 0 && typeof p.origin !== "string") return false;
-  if (p.requestId !== void 0 && typeof p.requestId !== "string") return false;
-  if (p.requestedBy !== void 0 && typeof p.requestedBy !== "string") return false;
-  if (p.summary !== void 0 && typeof p.summary !== "string") return false;
-  if (p.rejection !== void 0) {
-    const rejection = p.rejection;
-    if (!rejection || typeof rejection !== "object" || Array.isArray(rejection)) return false;
-    if (typeof rejection.short !== "string") return false;
-  }
-  return true;
-}
-var PARK_REASONS = /* @__PURE__ */ new Set([
-  "create_new",
-  "resume_other",
-  "fork",
-  "switch_branch",
-  "close",
-  "shutdown"
-]);
-var RESUME_VIAS = /* @__PURE__ */ new Set(["resume", "switch_branch"]);
-var MAX_REQUESTED_PERMISSION_AUDIT_IDS = 4096;
-function isSessionParkedPayload(value) {
-  if (!value || typeof value !== "object") return false;
-  const p = value;
-  if (typeof p.sessionId !== "string") return false;
-  if (typeof p.reason !== "string" || !PARK_REASONS.has(p.reason)) return false;
-  return true;
-}
-function isSessionResumedPayload(value) {
-  if (!value || typeof value !== "object") return false;
-  const p = value;
-  if (typeof p.sessionId !== "string") return false;
-  if (typeof p.via !== "string" || !RESUME_VIAS.has(p.via)) return false;
-  return true;
-}
-function isAgentStatusChangedPayload(value) {
-  if (!value || typeof value !== "object") return false;
-  const p = value;
-  if (p.runId !== null && typeof p.runId !== "string") return false;
-  if (typeof p.phase !== "string" || typeof p.prevPhase !== "string") return false;
-  if (typeof p.elapsedFromStart !== "number" || !Number.isFinite(p.elapsedFromStart)) return false;
-  if (typeof p.watchdogTier !== "number" || !Number.isFinite(p.watchdogTier)) return false;
-  if (p.metadata !== void 0 && (!p.metadata || typeof p.metadata !== "object" || Array.isArray(p.metadata)))
-    return false;
-  return true;
-}
-function isAlarmableStatus(payload) {
-  if (payload.phase === "stuck" || payload.phase === "tool_blocked" || payload.phase === "retrying") return true;
-  return payload.phase === "ended" && payload.metadata?.reason === "cancelled";
-}
-function createSafetyBundle(context) {
-  let writer = null;
-  let policyEngine = null;
-  let loopState = createLoopState();
-  let recordCount = 0;
-  let unsubscribePermissionRequested = null;
-  let unsubscribePermissionResolved = null;
-  let unsubscribeRunAborted = null;
-  let unsubscribeSessionParked = null;
-  let unsubscribeSessionResumed = null;
-  let unsubscribeAgentStatusChanged = null;
-  let unsubscribeDispatchCompleted = null;
-  let unsubscribeDispatchFailed = null;
-  const recordedRequestedPermissionIds = /* @__PURE__ */ new Set();
-  function activePolicyEngine() {
-    policyEngine ??= createSafetyPolicyEngine();
-    return policyEngine;
-  }
-  function writeAudit(rec) {
-    if (writer === null) return;
-    writer.write(rec);
-    recordCount += 1;
-  }
-  function recordToolCallAudit(input) {
-    writeAudit(buildAuditRecord(input));
-  }
-  function recordCompletionContractAudit(input) {
-    writeAudit(buildCompletionContractAuditRecord(input));
-  }
-  const extension = {
-    async start() {
-      policyEngine = createSafetyPolicyEngine();
-      writer = openAuditWriter();
-      unsubscribePermissionRequested = context.bus.on(BusChannels.PermissionRequested, (payload) => {
-        if (!isPermissionRequestedPayload(payload)) return;
-        if (payload.origin === void 0 || payload.origin === "main") return;
-        if (payload.requestId === void 0) return;
-        if (recordedRequestedPermissionIds.has(payload.requestId)) return;
-        recordedRequestedPermissionIds.add(payload.requestId);
-        if (recordedRequestedPermissionIds.size > MAX_REQUESTED_PERMISSION_AUDIT_IDS) {
-          const oldest = recordedRequestedPermissionIds.values().next().value;
-          if (oldest !== void 0) recordedRequestedPermissionIds.delete(oldest);
-        }
-        const reason = payload.rejection?.short ?? payload.summary;
-        writeAudit(
-          buildPermissionAuditRecord({
-            status: "requested",
-            requestId: payload.requestId,
-            origin: payload.origin,
-            tool: payload.tool,
-            actionClass: payload.actionClass,
-            ...reason !== void 0 ? { reason } : {},
-            ...payload.requestedBy !== void 0 ? { requestedBy: payload.requestedBy } : {}
-          })
-        );
-      });
-      unsubscribePermissionResolved = context.bus.on(BusChannels.PermissionResolved, (payload) => {
-        if (!isPermissionResolvedPayload(payload)) return;
-        writeAudit(
-          buildPermissionAuditRecord({
-            status: payload.status,
-            ...payload.requestId !== void 0 ? { requestId: payload.requestId } : {},
-            ...payload.origin !== void 0 ? { origin: payload.origin } : {},
-            ...payload.decidedBy !== void 0 ? { decidedBy: payload.decidedBy } : {},
-            ...payload.tool !== void 0 ? { tool: payload.tool } : {},
-            ...payload.actionClass !== void 0 ? { actionClass: payload.actionClass } : {},
-            ...payload.reason !== void 0 ? { reason: payload.reason } : {},
-            ...payload.requestedBy !== void 0 ? { requestedBy: payload.requestedBy } : {}
-          })
-        );
-      });
-      unsubscribeRunAborted = context.bus.on(BusChannels.RunAborted, (payload) => {
-        if (!isRunAbortedPayload(payload)) return;
-        const recordInput = {
-          source: payload.source,
-          runId: payload.runId,
-          startedAt: payload.startedAt,
-          elapsedMs: payload.elapsedMs
-        };
-        if (payload.reason !== void 0) recordInput.reason = payload.reason;
-        writeAudit(buildAbortAuditRecord(recordInput));
-      });
-      unsubscribeSessionParked = context.bus.on(BusChannels.SessionParked, (payload) => {
-        if (!isSessionParkedPayload(payload)) return;
-        writeAudit(buildSessionParkAuditRecord({ sessionId: payload.sessionId, reason: payload.reason }));
-      });
-      unsubscribeSessionResumed = context.bus.on(BusChannels.SessionResumed, (payload) => {
-        if (!isSessionResumedPayload(payload)) return;
-        writeAudit(buildSessionResumeAuditRecord({ sessionId: payload.sessionId, via: payload.via }));
-      });
-      unsubscribeAgentStatusChanged = context.bus.on(BusChannels.AgentStatusChanged, (payload) => {
-        if (!isAgentStatusChangedPayload(payload) || !isAlarmableStatus(payload)) return;
-        writeAudit(
-          buildAgentStatusChangeAuditRecord({
-            runId: payload.runId,
-            phase: payload.phase,
-            prevPhase: payload.prevPhase,
-            elapsedFromStart: payload.elapsedFromStart,
-            watchdogTier: payload.watchdogTier,
-            ...payload.metadata ? { metadata: payload.metadata } : {}
-          })
-        );
-      });
-      const auditDispatchTerminal = (raw) => {
-        if (!raw || typeof raw !== "object") return;
-        const payload = raw;
-        if (typeof payload.runId !== "string" || typeof payload.outcome !== "string") return;
-        const lineage = payload.lineage && typeof payload.lineage === "object" && !Array.isArray(payload.lineage) ? payload.lineage : null;
-        const durationMs = typeof payload.durationMs === "number" ? payload.durationMs : 0;
-        writeAudit(
-          buildAgentStatusChangeAuditRecord({
-            runId: payload.runId,
-            phase: payload.outcome,
-            prevPhase: "running",
-            elapsedFromStart: durationMs,
-            watchdogTier: 0,
-            metadata: {
-              outcome: payload.outcome,
-              ...payload.outcomeDetail !== void 0 && payload.outcomeDetail !== null ? { outcomeDetail: payload.outcomeDetail } : {},
-              ...typeof payload.agentId === "string" ? { agentId: payload.agentId } : {},
-              ...lineage !== null ? {
-                parentRunId: lineage.parentRunId ?? null,
-                rootRunId: lineage.rootRunId ?? null,
-                attempt: lineage.attempt ?? 0,
-                depth: lineage.depth ?? 0
-              } : {}
-            }
-          })
-        );
-      };
-      unsubscribeDispatchCompleted = context.bus.on(BusChannels.DispatchCompleted, auditDispatchTerminal);
-      unsubscribeDispatchFailed = context.bus.on(BusChannels.DispatchFailed, auditDispatchTerminal);
-    },
-    async stop() {
-      unsubscribePermissionRequested?.();
-      unsubscribePermissionRequested = null;
-      unsubscribePermissionResolved?.();
-      unsubscribePermissionResolved = null;
-      unsubscribeRunAborted?.();
-      unsubscribeRunAborted = null;
-      unsubscribeSessionParked?.();
-      unsubscribeSessionParked = null;
-      unsubscribeSessionResumed?.();
-      unsubscribeSessionResumed = null;
-      unsubscribeAgentStatusChanged?.();
-      unsubscribeAgentStatusChanged = null;
-      unsubscribeDispatchCompleted?.();
-      unsubscribeDispatchCompleted = null;
-      unsubscribeDispatchFailed?.();
-      unsubscribeDispatchFailed = null;
-      recordedRequestedPermissionIds.clear();
-      await writer?.close();
-      writer = null;
-    }
-  };
-  const contract = {
-    classify(call) {
-      return classify(call);
-    },
-    evaluate(call, posture) {
-      const policy = activePolicyEngine().evaluate(call, posture);
-      const classification = policy.classification;
-      context.bus.emit(BusChannels.SafetyClassified, {
-        tool: call.tool,
-        actionClass: classification.actionClass,
-        reasons: classification.reasons,
-        ruleId: policy.ruleId,
-        posture,
-        policySource: policy.policySource,
-        reasonCode: policy.reasonCode
-      });
-      if (policy.kind === "block") {
-        const auditInput2 = {
-          tool: call.tool,
-          classification,
-          decision: "blocked",
-          args: call.args,
-          policy
-        };
-        if (posture !== void 0) auditInput2.posture = posture;
-        recordToolCallAudit(auditInput2);
-        context.bus.emit(BusChannels.SafetyBlocked, {
-          tool: call.tool,
-          actionClass: classification.actionClass,
-          ruleId: policy.ruleId,
-          posture,
-          rejection: policy.rejection,
-          policySource: policy.policySource,
-          reasonCode: policy.reasonCode
-        });
-        const decision = {
-          kind: "block",
-          classification,
-          rejection: policy.rejection ?? fallbackRejection(policy),
-          policy
-        };
-        if (policy.match) decision.match = policy.match;
-        return decision;
-      }
-      if (policy.kind === "ask") {
-        const auditInput2 = {
-          tool: call.tool,
-          classification,
-          decision: "classified",
-          args: call.args,
-          policy
-        };
-        if (posture !== void 0) auditInput2.posture = posture;
-        recordToolCallAudit(auditInput2);
-        const decision = {
-          kind: "ask",
-          classification,
-          rejection: policy.rejection ?? fallbackRejection(policy),
-          policy
-        };
-        if (policy.match) decision.match = policy.match;
-        return decision;
-      }
-      const auditInput = {
-        tool: call.tool,
-        classification,
-        // Non-confirmed net passes are not final: registry admission still
-        // applies autonomy and writes the resolved allowed/park/denied row.
-        decision: posture === "confirmed" ? "allowed" : "classified",
-        args: call.args,
-        policy
-      };
-      if (posture !== void 0) auditInput.posture = posture;
-      recordToolCallAudit(auditInput);
-      context.bus.emit(BusChannels.SafetyAllowed, {
-        tool: call.tool,
-        actionClass: classification.actionClass,
-        posture,
-        ruleId: policy.ruleId,
-        policySource: policy.policySource,
-        reasonCode: policy.reasonCode
-      });
-      return { kind: "allow", classification, policy };
-    },
-    observeLoop(key, now) {
-      const [next, verdict] = observe(loopState, key, now ?? Date.now());
-      loopState = next;
-      return verdict;
-    },
-    scopes: { readonly: READONLY_SCOPE, workspace: WORKSPACE_SCOPE, confirmed: CONFIRMED_SCOPE },
-    isSubset,
-    policy: {
-      metadata: (posture) => activePolicyEngine().metadata(posture),
-      allowsObservationPath: (path) => activePolicyEngine().evaluate({ tool: "read", args: { path } }).reasonCode !== "path-policy:zeroAccessPaths"
-    },
-    audit: {
-      recordCount: () => recordCount,
-      recordToolCall: recordToolCallAudit,
-      recordCompletionContract: recordCompletionContractAudit
-    }
-  };
-  return { extension, contract };
-}
-function fallbackRejection(policy) {
-  return {
-    short: `${policy.tool} blocked: ${policy.actionClass}`,
-    detail: policy.reasons.join("\n"),
-    hints: []
-  };
-}
-
-// src/domains/safety/manifest.ts
-init_esm_shims();
-var SafetyManifest = {
-  name: "safety",
-  dependsOn: ["config"]
-};
-
-// src/domains/safety/index.ts
-var SafetyDomainModule = {
-  manifest: SafetyManifest,
-  createExtension: createSafetyBundle
-};
-
-export {
-  resolveRigor,
-  parseRigorOverride,
-  SafetyDomainModule
-};
-//# sourceMappingURL=chunk-GREYLTZ5.js.map