@itphx/synth-core 0.2.0 → 0.3.0

package/dist/engine/security/protected-paths-store.js

@@ -0,0 +1,239 @@
+/**
+ * ProtectedPathsStore — редактируемый список защищённых путей.
+ *
+ * Схема «системный + override» (по аналогии с ContextConfig / SecretPatternStore):
+ * - системный дефолт — definitions/protected-paths.json;
+ * - пользовательский override — JSON-файл {dataDir}/security/protected-paths.json;
+ * - итоговая политика = системный base + `add` − `remove` (каскад, см. protected-paths.ts);
+ * - сброс = удаление override-файла → снова системный дефолт.
+ *
+ * Формат override-файла:
+ *   { version: 1, add: { deniedPaths, deniedPrefixes, approvalPaths, deniedCommandPrefixes },
+ *                    remove: { deniedPaths, deniedPrefixes, approvalPaths, deniedCommandPrefixes } }
+ *
+ * Миграция (однократно): если существует legacy {dataDir}/context/shell-policy.json и отсутствует
+ * override — его содержимое (полная политика) преобразуется в каскад add/remove и записывается
+ * в override-файл; legacy помечается полем "migrated": true.
+ */
+import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync, unlinkSync } from 'node:fs';
+import { writeFile, rename as renameAsync, mkdir } from 'node:fs/promises';
+import { join, dirname } from 'node:path';
+import { atomicWrite } from '@itphx/synth-shared';
+import { info, warning } from '../../logger.js';
+import { DEFAULT_POLICY, loadProtectedPaths, clearProtectedPathsCache, packageDirectoryForDefinitions, } from './protected-paths.js';
+const POLICY_KEYS = [
+    'deniedPaths',
+    'deniedPrefixes',
+    'approvalPaths',
+    'deniedCommandPrefixes',
+];
+function _isStringArray(v) {
+    return Array.isArray(v) && v.every((x) => typeof x === 'string');
+}
+export class ProtectedPathsStore {
+    overridePath;
+    _systemDir;
+    _legacyPath;
+    constructor(options) {
+        this.overridePath = options.overrideFile ?? join(options.dataDir, 'security', 'protected-paths.json');
+        this._systemDir = options.systemDir ?? packageDirectoryForDefinitions();
+        this._legacyPath = join(options.dataDir, 'context', 'shell-policy.json');
+        // Миграция legacy shell-policy → override (однократно).
+        this._migrateLegacy();
+    }
+    /** Существует ли пользовательский override-файл. */
+    hasOverride() {
+        return existsSync(this.overridePath);
+    }
+    /** Системный base (definitions/protected-paths.json), всегда свежая копия. */
+    getBase() {
+        try {
+            const raw = JSON.parse(readFileSync(join(this._systemDir, 'protected-paths.json'), 'utf-8'));
+            return {
+                deniedPaths: _isStringArray(raw.deniedPaths) ? raw.deniedPaths : [],
+                deniedPrefixes: _isStringArray(raw.deniedPrefixes) ? raw.deniedPrefixes : [],
+                approvalPaths: _isStringArray(raw.approvalPaths) ? raw.approvalPaths : [],
+                deniedCommandPrefixes: _isStringArray(raw.deniedCommandPrefixes) ? raw.deniedCommandPrefixes : [],
+            };
+        }
+        catch {
+            return { ...DEFAULT_POLICY, deniedPaths: [], deniedPrefixes: [], approvalPaths: [], deniedCommandPrefixes: [] };
+        }
+    }
+    /** Эффективная политика: base + add − remove (или base без override). */
+    getPolicy() {
+        return loadProtectedPaths({ systemDir: this._systemDir, overridePath: this.overridePath });
+    }
+    /** Алиас getPolicy для единообразия. */
+    getEffective() {
+        return this.getPolicy();
+    }
+    /** Полное состояние: признак override + эффективная и системная политики. */
+    getRaw() {
+        const base = this.getBase();
+        const isOverridden = this.hasOverride();
+        return {
+            isOverridden,
+            policy: this.getPolicy(),
+            base,
+            defaultBase: base,
+        };
+    }
+    /** Читает сырой override-файл (add/remove). */
+    getOverride() {
+        if (!this.hasOverride())
+            return null;
+        try {
+            const parsed = JSON.parse(readFileSync(this.overridePath, 'utf-8'));
+            const add = parsed.add ?? {};
+            const remove = parsed.remove ?? {};
+            const toArr = (v) => (_isStringArray(v) ? v : []);
+            return {
+                version: typeof parsed.version === 'number' ? parsed.version : 1,
+                add: {
+                    deniedPaths: toArr(add.deniedPaths),
+                    deniedPrefixes: toArr(add.deniedPrefixes),
+                    approvalPaths: toArr(add.approvalPaths),
+                    deniedCommandPrefixes: toArr(add.deniedCommandPrefixes),
+                },
+                remove: {
+                    deniedPaths: toArr(remove.deniedPaths),
+                    deniedPrefixes: toArr(remove.deniedPrefixes),
+                    approvalPaths: toArr(remove.approvalPaths),
+                    deniedCommandPrefixes: toArr(remove.deniedCommandPrefixes),
+                },
+            };
+        }
+        catch (e) {
+            warning('SECURITY', `Не удалось прочитать protected-paths override (${this.overridePath}): ${e}`);
+            return null;
+        }
+    }
+    /**
+     * Сохраняет эффективную политику (списки целиком). Относительно системного base
+     * вычисляется каскад: add = effective − base, remove = base − effective. Это
+     * приводит итоговую политику ровно к переданной effective. Атомарная запись.
+     */
+    async savePolicy(effective) {
+        if (!POLICY_KEYS.every((k) => _isStringArray(effective[k] ?? []))) {
+            warning('SECURITY', 'Отказ: невалидная политика защищённых путей (ожидаются строковые массивы)');
+            return false;
+        }
+        const base = this.getBase();
+        const override = { version: 1, add: {}, remove: {} };
+        for (const key of POLICY_KEYS) {
+            const baseArr = base[key] ?? [];
+            const effArr = effective[key] ?? [];
+            const effSet = new Set(effArr);
+            const baseSet = new Set(baseArr);
+            // add — то, что есть в effective, но нет в base
+            override.add[key] = effArr.filter((x) => !baseSet.has(x));
+            // remove — то, что есть в base, но нет в effective
+            override.remove[key] = baseArr.filter((x) => !effSet.has(x));
+        }
+        try {
+            await mkdir(dirname(this.overridePath), { recursive: true });
+            await atomicWrite((p, d) => writeFile(p, d, 'utf-8'), (o, n) => renameAsync(o, n), this.overridePath, JSON.stringify(override, null, 2));
+            clearProtectedPathsCache();
+            info('SECURITY', `Сохранена политика защищённых путей: ${this.overridePath}`);
+            return true;
+        }
+        catch (e) {
+            warning('SECURITY', `Не удалось сохранить политику защищённых путей: ${e}`);
+            return false;
+        }
+    }
+    /**
+     * Сохраняет сырой override (формат add/remove, version: 1) — без пересчёта.
+     * Используется при передаче add/remove напрямую (например из UI/API).
+     * Приводит к каноничному виду (все 4 ключа в add/remove), атомарная запись.
+     */
+    async saveRawOverride(raw) {
+        const toArr = (v) => (_isStringArray(v) ? v : []);
+        const add = raw.add ?? {};
+        const remove = raw.remove ?? {};
+        const override = {
+            version: typeof raw.version === 'number' ? raw.version : 1,
+            add: {
+                deniedPaths: toArr(add.deniedPaths),
+                deniedPrefixes: toArr(add.deniedPrefixes),
+                approvalPaths: toArr(add.approvalPaths),
+                deniedCommandPrefixes: toArr(add.deniedCommandPrefixes),
+            },
+            remove: {
+                deniedPaths: toArr(remove.deniedPaths),
+                deniedPrefixes: toArr(remove.deniedPrefixes),
+                approvalPaths: toArr(remove.approvalPaths),
+                deniedCommandPrefixes: toArr(remove.deniedCommandPrefixes),
+            },
+        };
+        try {
+            await mkdir(dirname(this.overridePath), { recursive: true });
+            await atomicWrite((p, d) => writeFile(p, d, 'utf-8'), (o, n) => renameAsync(o, n), this.overridePath, JSON.stringify(override, null, 2));
+            clearProtectedPathsCache();
+            info('SECURITY', `Сохранён override защищённых путей (add/remove): ${this.overridePath}`);
+            return true;
+        }
+        catch (e) {
+            warning('SECURITY', `Не удалось сохранить override защищённых путей: ${e}`);
+            return false;
+        }
+    }
+    /** Удаляет override-файл → снова системный дефолт. true — файл удалён. */
+    async reset() {
+        if (!this.hasOverride())
+            return false;
+        try {
+            unlinkSync(this.overridePath);
+            clearProtectedPathsCache();
+            info('SECURITY', 'Политика защищённых путей сброшена к системной');
+            return true;
+        }
+        catch (e) {
+            warning('SECURITY', `Не удалось сбросить политику защищённых путей: ${e}`);
+            return false;
+        }
+    }
+    /**
+     * Однократная миграция legacy {dataDir}/context/shell-policy.json (полная
+     * замена) → override add/remove. Выполняется в конструкторе при первом
+     * запуске. Старый файл помечается "migrated": true.
+     */
+    _migrateLegacy() {
+        try {
+            if (!existsSync(this._legacyPath) || existsSync(this.overridePath))
+                return;
+            const legacy = JSON.parse(readFileSync(this._legacyPath, 'utf-8'));
+            if (!legacy || typeof legacy !== 'object')
+                return;
+            const legacyPolicy = {
+                deniedPaths: _isStringArray(legacy.deniedPaths) ? legacy.deniedPaths : [],
+                deniedPrefixes: _isStringArray(legacy.deniedPrefixes) ? legacy.deniedPrefixes : [],
+                approvalPaths: _isStringArray(legacy.approvalPaths) ? legacy.approvalPaths : [],
+                deniedCommandPrefixes: _isStringArray(legacy.deniedCommandPrefixes) ? legacy.deniedCommandPrefixes : [],
+            };
+            const base = this.getBase();
+            const override = { version: 1, add: {}, remove: {} };
+            for (const key of POLICY_KEYS) {
+                const baseArr = base[key] ?? [];
+                const effArr = legacyPolicy[key] ?? [];
+                const effSet = new Set(effArr);
+                const baseSet = new Set(baseArr);
+                override.add[key] = effArr.filter((x) => !baseSet.has(x));
+                override.remove[key] = baseArr.filter((x) => !effSet.has(x));
+            }
+            mkdirSync(dirname(this.overridePath), { recursive: true });
+            const tmp = `${this.overridePath}.tmp.${process.pid}`;
+            writeFileSync(tmp, JSON.stringify(override, null, 2), 'utf-8');
+            renameSync(tmp, this.overridePath);
+            // Помечаем legacy как устаревший (migrated: true).
+            writeFileSync(this._legacyPath, JSON.stringify({ ...legacy, migrated: true }, null, 2), 'utf-8');
+            clearProtectedPathsCache();
+            info('SECURITY', 'Мигрирована legacy shell-policy.json → protected-paths.json');
+        }
+        catch (e) {
+            warning('SECURITY', `Не удалось выполнить миграцию shell-policy.json: ${e}`);
+        }
+    }
+}
+//# sourceMappingURL=protected-paths-store.js.map

package/dist/engine/security/protected-paths-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protected-paths-store.js","sourceRoot":"","sources":["../../../src/engine/security/protected-paths-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrG,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,WAAW,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,sBAAsB,CAAC;AAqB9B,MAAM,WAAW,GAAsC;IACrD,aAAa;IACb,gBAAgB;IAChB,eAAe;IACf,uBAAuB;CACxB,CAAC;AAEF,SAAS,cAAc,CAAC,CAAU;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,OAAO,mBAAmB;IACrB,YAAY,CAAS;IACb,UAAU,CAAS;IACnB,WAAW,CAAS;IAErC,YAAY,OAAmC;QAC7C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC;QACtG,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,IAAI,8BAA8B,EAAE,CAAC;QACxE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;QACzE,wDAAwD;QACxD,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;IAED,oDAAoD;IACpD,WAAW;QACT,OAAO,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvC,CAAC;IAED,8EAA8E;IAC9E,OAAO;QACL,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,sBAAsB,CAAC,EAAE,OAAO,CAAC,CAAkC,CAAC;YAC9H,OAAO;gBACL,WAAW,EAAE,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;gBACnE,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE;gBAC5E,aAAa,EAAE,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;gBACzE,qBAAqB,EAAE,cAAc,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE;aAClG,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,GAAG,cAAc,EAAE,WAAW,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAAC;QAClH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,SAAS;QACP,OAAO,kBAAkB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,wCAAwC;IACxC,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED,6EAA6E;IAC7E,MAAM;QACJ,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO;YACL,YAAY;YACZ,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE;YACxB,IAAI;YACJ,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,CAAC;IAED,+CAA+C;IAC/C,WAAW;QACT,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAoC,CAAC;YACvG,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,CAAC,CAAU,EAAY,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrE,OAAO;gBACL,OAAO,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAChE,GAAG,EAAE;oBACH,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;oBACnC,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;oBACzC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;oBACvC,qBAAqB,EAAE,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC;iBACxD;gBACD,MAAM,EAAE;oBACN,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;oBACtC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC;oBAC5C,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC;oBAC1C,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC;iBAC3D;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,UAAU,EAAE,kDAAkD,IAAI,CAAC,YAAY,MAAM,CAAC,EAAE,CAAC,CAAC;YAClG,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,SAA+B;QAC9C,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,CAAC,UAAU,EAAE,2EAA2E,CAAC,CAAC;YACjG,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAA2B,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC7E,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YACjC,gDAAgD;YAChD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1D,mDAAmD;YACnD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,MAAM,WAAW,CACf,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,EAClC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EAC3B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAClC,CAAC;YACF,wBAAwB,EAAE,CAAC;YAC3B,IAAI,CAAC,UAAU,EAAE,wCAAwC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,UAAU,EAAE,mDAAmD,CAAC,EAAE,CAAC,CAAC;YAC5E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,GAAoC;QACxD,MAAM,KAAK,GAAG,CAAC,CAAU,EAAY,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;QAChC,MAAM,QAAQ,GAA2B;YACvC,OAAO,EAAE,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1D,GAAG,EAAE;gBACH,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;gBACnC,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;gBACzC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;gBACvC,qBAAqB,EAAE,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC;aACxD;YACD,MAAM,EAAE;gBACN,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;gBACtC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC;gBAC5C,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC;gBAC1C,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC;aAC3D;SACF,CAAC;QACF,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,MAAM,WAAW,CACf,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,EAClC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EAC3B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAClC,CAAC;YACF,wBAAwB,EAAE,CAAC;YAC3B,IAAI,CAAC,UAAU,EAAE,oDAAoD,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;YAC1F,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,UAAU,EAAE,mDAAmD,CAAC,EAAE,CAAC,CAAC;YAC5E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC9B,wBAAwB,EAAE,CAAC;YAC3B,IAAI,CAAC,UAAU,EAAE,gDAAgD,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,UAAU,EAAE,kDAAkD,CAAC,EAAE,CAAC,CAAC;YAC3E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,cAAc;QACpB,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;gBAAE,OAAO;YAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAkC,CAAC;YACpG,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO;YAClD,MAAM,YAAY,GAAyB;gBACzC,WAAW,EAAE,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;gBACzE,cAAc,EAAE,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE;gBAClF,aAAa,EAAE,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;gBAC/E,qBAAqB,EAAE,cAAc,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE;aACxG,CAAC;YAEF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAA2B,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC7E,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;gBAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAChC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACvC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC/B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;gBACjC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1D,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/D,CAAC;YAED,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,YAAY,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;YACtD,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC/D,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAEnC,mDAAmD;YACnD,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACjG,wBAAwB,EAAE,CAAC;YAC3B,IAAI,CAAC,UAAU,EAAE,6DAA6D,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,UAAU,EAAE,oDAAoD,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;CACF"}

package/dist/engine/security/protected-paths.d.ts

@@ -0,0 +1,54 @@
+/** Политика защищённых путей (структурно совпадает с ShellPolicy). */
+export interface ProtectedPathsPolicy {
+    /** Точные запрещённые пути (резолвятся с `~`). */
+    deniedPaths: string[];
+    /** Запрещённые префиксы директорий. */
+    deniedPrefixes: string[];
+    /** Пути, требующие подтверждения (ask). */
+    approvalPaths: string[];
+    /** Префиксы команд, запрещённые целиком — только для shell-команд. */
+    deniedCommandPrefixes: string[];
+}
+/** Результат checkPath. */
+export interface ProtectedPathCheckResult {
+    action: 'allow' | 'deny' | 'ask';
+    /** Человекочитаемая причина (fallback, без локализации). */
+    reason?: string;
+    /** Идентификатор локализованного сообщения (deny-protected-path и т.д.). */
+    messageId?: string;
+    /** Параметры подстановки в сообщение ({{path}}, {{dir}}). */
+    params?: Record<string, string>;
+    matchedRule?: string;
+}
+/** Пустая политика — fallback, если файлы не найдены или невалидны. */
+export declare const DEFAULT_POLICY: ProtectedPathsPolicy;
+/** Override-файл: каскад add/remove поверх системного base. */
+export interface ProtectedPathsOverride {
+    version: number;
+    add: Partial<ProtectedPathsPolicy>;
+    remove: Partial<ProtectedPathsPolicy>;
+}
+export interface ProtectedPathsOptions {
+    /** Каталог системных definitions (по умолчанию резолвится от пакета). */
+    systemDir?: string;
+    /** Пользовательский override: {dataDir}/security/protected-paths.json. */
+    overridePath?: string;
+}
+/** Сброс кэша (для тестов и после save/reset override-файла). */
+export declare function clearProtectedPathsCache(): void;
+/**
+ * Загружает политику: системный дефолт definitions/protected-paths.json +
+ * override {dataDir}/security/protected-paths.json. Если override существует —
+ * применяется каскад add/remove. Некорректные файлы игнорируются; результат
+ * кэшируется по ключу «systemDir|overridePath».
+ */
+export declare function loadProtectedPaths(options?: ProtectedPathsOptions): ProtectedPathsPolicy;
+/**
+ * Проверяет один путь по политике. Резолвит `~`, `$HOME`, `$PWD`, относительные
+ * пути через общий `tryResolvePath`. Приоритет: deniedPaths (точное совпадение)
+ * → approvalPaths (ask) → deniedPrefixes (префикс директории).
+ */
+export declare function checkPath(path: string, cwd: string, policy: ProtectedPathsPolicy): ProtectedPathCheckResult;
+/** Вспомогательный экспорт для ProtectedPathsStore: каталог системных definitions. */
+export declare function packageDirectoryForDefinitions(): string;
+//# sourceMappingURL=protected-paths.d.ts.map

package/dist/engine/security/protected-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protected-paths.d.ts","sourceRoot":"","sources":["../../../src/engine/security/protected-paths.ts"],"names":[],"mappings":"AAwBA,sEAAsE;AACtE,MAAM,WAAW,oBAAoB;IACnC,kDAAkD;IAClD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,uCAAuC;IACvC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,2CAA2C;IAC3C,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,sEAAsE;IACtE,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,2BAA2B;AAC3B,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;IACjC,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,uEAAuE;AACvE,eAAO,MAAM,cAAc,EAAE,oBAK5B,CAAC;AAEF,+DAA+D;AAC/D,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnC,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAYD,iEAAiE;AACjE,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAgED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,qBAA0B,GAAG,oBAAoB,CAoB5F;AAUD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,wBAAwB,CAiD3G;AAED,sFAAsF;AACtF,wBAAgB,8BAA8B,IAAI,MAAM,CAEvD"}

package/dist/engine/security/protected-paths.js

@@ -0,0 +1,193 @@
+/**
+ * ProtectedPaths — единый слой защиты защищённых путей для монорепозитория.
+ *
+ * Заменяет точечный денлист shell-guard (только execute_shell) на сквозную
+ * проверку ВСЕХ тулов, чьи параметры содержат файловые пути (read_file,
+ * write_file, edit_file, delete_file, git_* и т.д.) через PermissionEvaluator.
+ *
+ * Политика: системный дефолт `definitions/protected-paths.json` (публикуется
+ * в npm, копируется в `dist/definitions/` при сборке) + пользовательский
+ * override `{dataDir}/security/protected-paths.json`, который НЕ заменяет
+ * системный полностью, а применяет каскад:
+ *   итог = системный base + `add` − `remove`.
+ *
+ * Резолв путей: `~`, `$HOME`, `$PWD`, относительные пути — переиспользует
+ * `tryResolvePath` из shell-guard (общая логика без дублирования).
+ * Пути с динамикой (`$()`, `${}`, glob) считаются не достоверными —
+ * не блокируются, но и не разрешаются с уверенностью.
+ */
+import { readFileSync, existsSync } from 'node:fs';
+import { join, normalize, sep } from 'node:path';
+import { tryResolvePath, resolveSystemDefinitionsDir } from './shell-guard.js';
+import { t as sm } from '../system-messages.js';
+/** Пустая политика — fallback, если файлы не найдены или невалидны. */
+export const DEFAULT_POLICY = {
+    deniedPaths: [],
+    deniedPrefixes: [],
+    approvalPaths: [],
+    deniedCommandPrefixes: [],
+};
+const POLICY_KEYS = [
+    'deniedPaths',
+    'deniedPrefixes',
+    'approvalPaths',
+    'deniedCommandPrefixes',
+];
+/** Кэш политик по ключу «systemDir|overridePath». */
+const policyCache = new Map();
+/** Сброс кэша (для тестов и после save/reset override-файла). */
+export function clearProtectedPathsCache() {
+    policyCache.clear();
+}
+function readBasePolicy(path) {
+    try {
+        if (!existsSync(path))
+            return null;
+        const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+        return {
+            deniedPaths: Array.isArray(parsed.deniedPaths) ? parsed.deniedPaths : [],
+            deniedPrefixes: Array.isArray(parsed.deniedPrefixes) ? parsed.deniedPrefixes : [],
+            approvalPaths: Array.isArray(parsed.approvalPaths) ? parsed.approvalPaths : [],
+            deniedCommandPrefixes: Array.isArray(parsed.deniedCommandPrefixes) ? parsed.deniedCommandPrefixes : [],
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function readOverride(path) {
+    try {
+        if (!existsSync(path))
+            return null;
+        const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+        const add = parsed.add ?? {};
+        const remove = parsed.remove ?? {};
+        const toArr = (v) => (Array.isArray(v) ? v.filter((x) => typeof x === 'string') : []);
+        return {
+            version: typeof parsed.version === 'number' ? parsed.version : 1,
+            add: {
+                deniedPaths: toArr(add.deniedPaths),
+                deniedPrefixes: toArr(add.deniedPrefixes),
+                approvalPaths: toArr(add.approvalPaths),
+                deniedCommandPrefixes: toArr(add.deniedCommandPrefixes),
+            },
+            remove: {
+                deniedPaths: toArr(remove.deniedPaths),
+                deniedPrefixes: toArr(remove.deniedPrefixes),
+                approvalPaths: toArr(remove.approvalPaths),
+                deniedCommandPrefixes: toArr(remove.deniedCommandPrefixes),
+            },
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/** Применяет каскад add/remove к одному списку: base + add − remove. */
+function applyCascade(baseArr, addArr, removeArr) {
+    const removed = new Set(removeArr);
+    const kept = baseArr.filter((x) => !removed.has(x));
+    const addedSet = new Set(kept);
+    for (const item of addArr) {
+        if (!addedSet.has(item))
+            kept.push(item);
+    }
+    return kept;
+}
+/** Применяет override к политике: итог = base + add − remove. */
+function applyOverride(base, override) {
+    const result = { ...DEFAULT_POLICY };
+    for (const key of POLICY_KEYS) {
+        result[key] = applyCascade(base[key] ?? [], override.add[key] ?? [], override.remove[key] ?? []);
+    }
+    return result;
+}
+/**
+ * Загружает политику: системный дефолт definitions/protected-paths.json +
+ * override {dataDir}/security/protected-paths.json. Если override существует —
+ * применяется каскад add/remove. Некорректные файлы игнорируются; результат
+ * кэшируется по ключу «systemDir|overridePath».
+ */
+export function loadProtectedPaths(options = {}) {
+    const systemDir = options.systemDir ?? resolveSystemDefinitionsDir();
+    const overridePath = options.overridePath ?? '';
+    const key = `${systemDir}|${overridePath}`;
+    const cached = policyCache.get(key);
+    if (cached)
+        return cached;
+    let base = DEFAULT_POLICY;
+    const systemPolicy = readBasePolicy(join(systemDir, 'protected-paths.json'));
+    if (systemPolicy)
+        base = systemPolicy;
+    let result = base;
+    if (overridePath) {
+        const override = readOverride(overridePath);
+        if (override)
+            result = applyOverride(base, override);
+    }
+    policyCache.set(key, result);
+    return result;
+}
+/** Резолвит запись политики (deniedPath/approvalPath/deniedPrefix) в абсолютный путь. */
+function resolvePolicyEntry(entry, cwd) {
+    const r = tryResolvePath(entry, cwd);
+    if (r && r.source === 'literal')
+        return normalize(r.path);
+    // Резолв не удался на 100% (динамика в записи политики) — используем сырое значение.
+    return normalize(entry);
+}
+/**
+ * Проверяет один путь по политике. Резолвит `~`, `$HOME`, `$PWD`, относительные
+ * пути через общий `tryResolvePath`. Приоритет: deniedPaths (точное совпадение)
+ * → approvalPaths (ask) → deniedPrefixes (префикс директории).
+ */
+export function checkPath(path, cwd, policy) {
+    const resolved = tryResolvePath(path, cwd);
+    if (!resolved) {
+        return { action: 'allow', reason: sm('protectedpaths.unresolvable') };
+    }
+    if (resolved.source !== 'literal') {
+        return { action: 'allow', reason: sm('protectedpaths.dynamic') };
+    }
+    const norm = normalize(resolved.path);
+    const deniedPaths = policy.deniedPaths.map((p) => resolvePolicyEntry(p, cwd));
+    const approvalPaths = policy.approvalPaths.map((p) => resolvePolicyEntry(p, cwd));
+    const deniedPrefixes = policy.deniedPrefixes.map((p) => resolvePolicyEntry(p, cwd));
+    for (const denied of deniedPaths) {
+        if (normalize(denied) === norm) {
+            return {
+                action: 'deny',
+                messageId: 'deny-protected-path',
+                params: { path: norm },
+                matchedRule: 'protected-paths.deny',
+            };
+        }
+    }
+    for (const approval of approvalPaths) {
+        if (normalize(approval) === norm) {
+            return {
+                action: 'ask',
+                messageId: 'ask-protected-path',
+                params: { path: norm },
+                matchedRule: 'protected-paths.ask',
+            };
+        }
+    }
+    for (const prefix of deniedPrefixes) {
+        const normalizedPrefix = normalize(prefix);
+        if (norm === normalizedPrefix || norm.startsWith(normalizedPrefix.endsWith(sep) ? normalizedPrefix : normalizedPrefix + sep)) {
+            return {
+                action: 'deny',
+                messageId: 'deny-protected-dir',
+                params: { path: norm, dir: normalizedPrefix },
+                matchedRule: 'protected-paths.deny',
+            };
+        }
+    }
+    return { action: 'allow', reason: sm('protectedpaths.allow_default') };
+}
+/** Вспомогательный экспорт для ProtectedPathsStore: каталог системных definitions. */
+export function packageDirectoryForDefinitions() {
+    return resolveSystemDefinitionsDir();
+}
+//# sourceMappingURL=protected-paths.js.map

package/dist/engine/security/protected-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protected-paths.js","sourceRoot":"","sources":["../../../src/engine/security/protected-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,MAAM,uBAAuB,CAAC;AA0BhD,uEAAuE;AACvE,MAAM,CAAC,MAAM,cAAc,GAAyB;IAClD,WAAW,EAAE,EAAE;IACf,cAAc,EAAE,EAAE;IAClB,aAAa,EAAE,EAAE;IACjB,qBAAqB,EAAE,EAAE;CAC1B,CAAC;AAgBF,MAAM,WAAW,GAAsC;IACrD,aAAa;IACb,gBAAgB;IAChB,eAAe;IACf,uBAAuB;CACxB,CAAC;AAEF,qDAAqD;AACrD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAgC,CAAC;AAE5D,iEAAiE;AACjE,MAAM,UAAU,wBAAwB;IACtC,WAAW,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAkC,CAAC;QACxF,OAAO;YACL,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;YACxE,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE;YACjF,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;YAC9E,qBAAqB,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE;SACvG,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAoC,CAAC;QAC1F,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,CAAC,CAAU,EAAY,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtH,OAAO;YACL,OAAO,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAChE,GAAG,EAAE;gBACH,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;gBACnC,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;gBACzC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;gBACvC,qBAAqB,EAAE,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC;aACxD;YACD,MAAM,EAAE;gBACN,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;gBACtC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC;gBAC5C,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC;gBAC1C,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC;aAC3D;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,SAAS,YAAY,CAAC,OAAiB,EAAE,MAAgB,EAAE,SAAmB;IAC5E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iEAAiE;AACjE,SAAS,aAAa,CAAC,IAA0B,EAAE,QAAgC;IACjF,MAAM,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;IACrC,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAiC,EAAE;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,2BAA2B,EAAE,CAAC;IACrE,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,YAAY,EAAE,CAAC;IAE3C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,IAAI,GAAG,cAAc,CAAC;IAC1B,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAC7E,IAAI,YAAY;QAAE,IAAI,GAAG,YAAY,CAAC;IAEtC,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,QAAQ;YAAE,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;IAED,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yFAAyF;AACzF,SAAS,kBAAkB,CAAC,KAAa,EAAE,GAAW;IACpD,MAAM,CAAC,GAAG,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1D,qFAAqF;IACrF,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,GAAW,EAAE,MAA4B;IAC/E,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,6BAA6B,CAAC,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9E,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAClF,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAEpF,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;QACjC,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,SAAS,EAAE,qBAAqB;gBAChC,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;gBACtB,WAAW,EAAE,sBAAsB;aACpC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;QACrC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;YACjC,OAAO;gBACL,MAAM,EAAE,KAAK;gBACb,SAAS,EAAE,oBAAoB;gBAC/B,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;gBACtB,WAAW,EAAE,qBAAqB;aACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,MAAM,gBAAgB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,GAAG,GAAG,CAAC,EAAE,CAAC;YAC7H,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,SAAS,EAAE,oBAAoB;gBAC/B,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,gBAAgB,EAAE;gBAC7C,WAAW,EAAE,sBAAsB;aACpC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,8BAA8B,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,8BAA8B;IAC5C,OAAO,2BAA2B,EAAE,CAAC;AACvC,CAAC"}

package/dist/engine/security/protected-paths.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=protected-paths.test.d.ts.map

package/dist/engine/security/protected-paths.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protected-paths.test.d.ts","sourceRoot":"","sources":["../../../src/engine/security/protected-paths.test.ts"],"names":[],"mappings":""}