@kb-labs/perm-presets 1.0.0

package/README.md

@@ -0,0 +1,78 @@
+# @kb-labs/perm-presets
+
+> Composable permission presets for KB Labs plugin manifests.
+
+## Installation
+
+```bash
+pnpm add @kb-labs/perm-presets
+```
+
+Or use via `@kb-labs/sdk` (already bundled):
+
+```typescript
+import { minimalPreset, combinePermissions } from '@kb-labs/sdk';
+```
+
+## Quick Start
+
+```typescript
+import { combine, minimal, llmAccess, gitWorkflow } from '@kb-labs/perm-presets';
+import { defineManifest } from '@kb-labs/sdk';
+
+export default defineManifest({
+  schema: 'kb.plugin/3',
+  id: 'my-plugin',
+  version: '1.0.0',
+  permissions: combine(minimal, llmAccess, gitWorkflow),
+});
+```
+
+## Available Presets
+
+| Preset | Description |
+|--------|-------------|
+| `minimal` | Minimal permissions (read-only workspace) |
+| `gitWorkflow` | Git read/write operations |
+| `npmPublish` | npm publish permissions |
+| `fullEnv` | Full environment variable access |
+| `kbPlatform` | KB Labs platform API access |
+| `llmAccess` | LLM API access |
+| `vectorStore` | Vector store access |
+| `ciEnvironment` | CI/CD environment permissions |
+
+## API
+
+### `combine(...presets)`
+
+Merge multiple presets into a single `PermissionSpec`:
+
+```typescript
+import { combine, minimal, llmAccess } from '@kb-labs/perm-presets';
+
+const permissions = combine(minimal, llmAccess);
+```
+
+### `combinePresets(presets[])`
+
+Same as `combine` but accepts an array:
+
+```typescript
+import { combinePresets, presets } from '@kb-labs/perm-presets';
+
+const permissions = combinePresets([presets.minimal, presets.llmAccess]);
+```
+
+### `presets` namespace
+
+All presets accessible as a namespace:
+
+```typescript
+import { presets, combine } from '@kb-labs/perm-presets';
+
+const permissions = combine(presets.minimal, presets.kbPlatform);
+```
+
+## License
+
+MIT

package/dist/index.d.ts

@@ -0,0 +1,299 @@
+/**
+ * Platform service permissions
+ */
+interface PlatformPermissions {
+    /** LLM access */
+    llm?: boolean | {
+        models?: string[];
+    };
+    /** Vector store access */
+    vectorStore?: boolean | {
+        collections?: string[];
+    };
+    /** Cache access */
+    cache?: boolean | string[];
+    /**
+     * Storage access (file/blob storage)
+     *
+     * **Formats:**
+     * - `true` - full access (all read/write)
+     * - `false` - no access
+     * - `string[]` - path prefixes (both read + write)
+     * - `{ read?: string[]; write?: string[] }` - granular read/write
+     *
+     * **Examples:**
+     * ```typescript
+     * storage: true  // Full access
+     * storage: ['.kb/artifacts/**']  // Read + write .kb/artifacts
+     * storage: { read: ['**'], write: ['.kb/artifacts/**'] }  // Read all, write only .kb/artifacts
+     * ```
+     */
+    storage?: boolean | string[] | {
+        read?: string[];
+        write?: string[];
+    };
+    /**
+     * Database access (SQL, Document, KV, TimeSeries)
+     *
+     * **Formats:**
+     * - `true` - full access to all databases
+     * - `false` - no access
+     * - Granular per database type:
+     *   - `sql?: { tables?: string[] }` - SQL table access
+     *   - `document?: { collections?: string[] }` - Document collection access
+     *   - `kv?: { prefixes?: string[] }` - KV key prefix access
+     *   - `timeseries?: { metrics?: string[] }` - TimeSeries metric access
+     *
+     * **Examples:**
+     * ```typescript
+     * database: true  // Full access to all databases
+     * database: {
+     *   sql: { tables: ['incidents', 'audit_log'] },
+     *   document: { collections: ['workflows'] }
+     * }
+     * ```
+     */
+    database?: boolean | {
+        sql?: boolean | {
+            tables?: string[];
+        };
+        document?: boolean | {
+            collections?: string[];
+        };
+        kv?: boolean | {
+            prefixes?: string[];
+        };
+        timeseries?: boolean | {
+            metrics?: string[];
+        };
+    };
+    /** Analytics access */
+    analytics?: boolean;
+    /** Embeddings access */
+    embeddings?: boolean;
+    /** Event bus access */
+    eventBus?: boolean | {
+        publish?: string[];
+        subscribe?: string[];
+    };
+}
+/**
+ * Permission specification for preset building (declarative format)
+ * This is the format used when defining presets and combining them.
+ *
+ * Design:
+ * - Presets declare what plugin WANTS (allow-list only)
+ * - No deny - platform enforces hardcoded security patterns
+ */
+interface PermissionSpec {
+    /** File system permissions */
+    fs?: {
+        mode?: 'read' | 'readWrite';
+        allow?: string[];
+    };
+    /** Environment variable permissions */
+    env?: {
+        read?: string[];
+    };
+    /** Network permissions */
+    network?: {
+        fetch?: string[];
+    };
+    /** Platform service permissions */
+    platform?: PlatformPermissions;
+    /** Shell execution permissions */
+    shell?: {
+        allow?: string[];
+    };
+    /** Resource quotas */
+    quotas?: {
+        timeoutMs?: number;
+        memoryMb?: number;
+        cpuMs?: number;
+    };
+}
+/**
+ * Runtime permission specification (explicit format)
+ * This is the format used by plugin-runtime fs-shim.
+ * Matches PermissionSpec from @kb-labs/plugin-contracts.
+ */
+interface RuntimePermissionSpec {
+    /** File system permissions - explicit read/write lists */
+    fs?: {
+        read?: string[];
+        write?: string[];
+    };
+    /** Environment variable permissions */
+    env?: {
+        read?: string[];
+    };
+    /** Network permissions */
+    network?: {
+        fetch?: string[];
+    };
+    /** Platform service permissions */
+    platform?: PlatformPermissions;
+    /** Shell execution permissions */
+    shell?: {
+        allow?: string[];
+    };
+    /** Resource quotas */
+    quotas?: {
+        timeoutMs?: number;
+        memoryMb?: number;
+        cpuMs?: number;
+    };
+}
+/**
+ * A preset is a named permission configuration
+ */
+interface PermissionPreset {
+    /** Unique preset identifier */
+    id: string;
+    /** Human-readable description */
+    description: string;
+    /** The permission spec this preset provides */
+    permissions: PermissionSpec;
+}
+/**
+ * Builder for combining multiple presets
+ */
+interface PresetBuilder {
+    /** Add a preset to the combination */
+    with(preset: PermissionPreset | PermissionSpec): PresetBuilder;
+    /** Add environment variables to read */
+    withEnv(vars: string[]): PresetBuilder;
+    /** Add file system permissions */
+    withFs(fs: PermissionSpec['fs']): PresetBuilder;
+    /** Add network permissions */
+    withNetwork(network: PermissionSpec['network']): PresetBuilder;
+    /** Add platform service permissions */
+    withPlatform(platform: PlatformPermissions): PresetBuilder;
+    /** Add shell execution permissions */
+    withShell(shell: PermissionSpec['shell']): PresetBuilder;
+    /** Add quotas */
+    withQuotas(quotas: PermissionSpec['quotas']): PresetBuilder;
+    /**
+     * Add storage permissions.
+     *
+     * @param storage - Storage permissions (true, string[], or { read, write })
+     * @returns Builder for chaining
+     *
+     * @example
+     * ```typescript
+     * .withStorage({ read: ['**'], write: ['.kb/artifacts/**'] })
+     * .withStorage(['.kb/data/**'])  // Both read + write
+     * ```
+     */
+    withStorage(storage: PlatformPermissions['storage']): PresetBuilder;
+    /**
+     * Add database permissions.
+     *
+     * @param database - Database permissions (true or granular per type)
+     * @returns Builder for chaining
+     *
+     * @example
+     * ```typescript
+     * .withDatabase({ sql: { tables: ['incidents'] } })
+     * .withDatabase(true)  // Full database access
+     * ```
+     */
+    withDatabase(database: PlatformPermissions['database']): PresetBuilder;
+    /** Build the final permission spec (converts to runtime format) */
+    build(): RuntimePermissionSpec;
+}
+
+/**
+ * Minimal preset - only basic Node.js environment
+ * Use when plugin doesn't need any external access
+ */
+declare const minimal: PermissionPreset;
+
+/**
+ * Git workflow preset - for plugins that use git (simple-git, etc.)
+ * Includes HOME for ~/.gitconfig, USER for author info
+ */
+declare const gitWorkflow: PermissionPreset;
+
+/**
+ * NPM publish preset - for plugins that publish to npm
+ * Includes HOME for ~/.npmrc, npm auth tokens
+ */
+declare const npmPublish: PermissionPreset;
+
+/**
+ * Full environment preset - access to all environment variables
+ * Use for trusted plugins that need full system access
+ * WARNING: This bypasses env filtering entirely
+ */
+declare const fullEnv: PermissionPreset;
+
+/**
+ * KB Platform preset - for KB Labs internal plugins
+ * Includes KB_* env vars and .kb/ directory access
+ */
+declare const kbPlatform: PermissionPreset;
+
+/**
+ * LLM Access preset - for plugins that use LLM APIs
+ * Includes OpenAI and Anthropic API keys and network access
+ */
+declare const llmAccess: PermissionPreset;
+
+/**
+ * Vector Store preset - for plugins that use vector databases
+ * Includes Qdrant, Pinecone, Weaviate access
+ */
+declare const vectorStore: PermissionPreset;
+
+/**
+ * CI Environment preset - for plugins running in CI/CD
+ * Includes GitHub Actions, GitLab CI, and common CI variables
+ */
+declare const ciEnvironment: PermissionPreset;
+
+declare const index_ciEnvironment: typeof ciEnvironment;
+declare const index_fullEnv: typeof fullEnv;
+declare const index_gitWorkflow: typeof gitWorkflow;
+declare const index_kbPlatform: typeof kbPlatform;
+declare const index_llmAccess: typeof llmAccess;
+declare const index_minimal: typeof minimal;
+declare const index_npmPublish: typeof npmPublish;
+declare const index_vectorStore: typeof vectorStore;
+declare namespace index {
+  export { index_ciEnvironment as ciEnvironment, index_fullEnv as fullEnv, index_gitWorkflow as gitWorkflow, index_kbPlatform as kbPlatform, index_llmAccess as llmAccess, index_minimal as minimal, index_npmPublish as npmPublish, index_vectorStore as vectorStore };
+}
+
+/**
+ * Convert declarative PermissionSpec to explicit RuntimePermissionSpec
+ *
+ * Transforms:
+ *   { mode: 'readWrite', allow: ['*.json'] }
+ * Into:
+ *   { read: ['*.json'], write: ['*.json'] }
+ */
+declare function toRuntimeFormat(spec: PermissionSpec): RuntimePermissionSpec;
+/**
+ * Create a builder for combining permission presets
+ *
+ * @example
+ * ```typescript
+ * const permissions = combine()
+ *   .with(presets.gitWorkflow)
+ *   .with(presets.npmPublish)
+ *   .withEnv(['MY_CUSTOM_VAR'])
+ *   .build();
+ * ```
+ */
+declare function combine(): PresetBuilder;
+/**
+ * Quickly combine multiple presets into a single permission spec
+ *
+ * @example
+ * ```typescript
+ * const permissions = combinePresets(presets.gitWorkflow, presets.npmPublish);
+ * ```
+ */
+declare function combinePresets(...presets: (PermissionPreset | PermissionSpec)[]): RuntimePermissionSpec;
+
+export { type PermissionPreset, type PermissionSpec, type PresetBuilder, type RuntimePermissionSpec, ciEnvironment, combine, combinePresets, fullEnv, gitWorkflow, kbPlatform, llmAccess, minimal, npmPublish, index as presets, toRuntimeFormat, vectorStore };

package/dist/index.js

@@ -0,0 +1,472 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/presets/minimal.ts
+var minimal = {
+  id: "minimal",
+  description: "Minimal permissions - basic Node.js environment only",
+  permissions: {
+    env: {
+      read: [
+        "NODE_ENV",
+        "PATH",
+        "LANG",
+        "LC_ALL",
+        "TZ"
+      ]
+    }
+  }
+};
+
+// src/presets/git-workflow.ts
+var gitWorkflow = {
+  id: "git-workflow",
+  description: "Git operations - includes HOME, USER, and git config access",
+  permissions: {
+    env: {
+      read: [
+        // System (required for git to find config)
+        "HOME",
+        "USER",
+        "PATH",
+        "SHELL",
+        "TERM",
+        "LANG",
+        "LC_ALL",
+        "TZ",
+        "TMPDIR",
+        // Git-specific
+        "GIT_*",
+        // All git env vars (GIT_AUTHOR_NAME, GIT_DIR, etc.)
+        "SSH_AUTH_SOCK",
+        // For SSH key auth
+        "SSH_AGENT_PID",
+        // Node
+        "NODE_ENV"
+      ]
+    },
+    fs: {
+      mode: "readWrite",
+      allow: [
+        "**/.git/**",
+        // Git directory
+        "**/.gitignore",
+        "**/.gitattributes"
+      ]
+    }
+  }
+};
+
+// src/presets/npm-publish.ts
+var npmPublish = {
+  id: "npm-publish",
+  description: "NPM operations - includes HOME, npm tokens, and registry access",
+  permissions: {
+    env: {
+      read: [
+        // System (required for npm to find config)
+        "HOME",
+        "USER",
+        "PATH",
+        "TMPDIR",
+        "LANG",
+        "LC_ALL",
+        "TZ",
+        // NPM-specific
+        "NPM_TOKEN",
+        "NPM_AUTH_TOKEN",
+        "NODE_AUTH_TOKEN",
+        "npm_*",
+        // All npm env vars
+        // Node
+        "NODE_ENV",
+        "NODE_OPTIONS"
+      ]
+    },
+    fs: {
+      mode: "readWrite",
+      allow: [
+        "**/package.json",
+        "**/package-lock.json",
+        "**/pnpm-lock.yaml",
+        "**/.npmrc",
+        "**/.npmignore"
+      ]
+    },
+    network: {
+      fetch: [
+        "registry.npmjs.org",
+        "npm.pkg.github.com"
+      ]
+    }
+  }
+};
+
+// src/presets/full-env.ts
+var fullEnv = {
+  id: "full-env",
+  description: "Full environment access - all env vars available (trusted plugins only)",
+  permissions: {
+    env: {
+      read: ["*"]
+      // Wildcard - all env vars
+    }
+  }
+};
+
+// src/presets/kb-platform.ts
+var kbPlatform = {
+  id: "kb-platform",
+  description: "KB Labs platform access - KB_* env vars and .kb/ directory",
+  permissions: {
+    env: {
+      read: [
+        // System basics
+        "HOME",
+        "USER",
+        "PATH",
+        "TMPDIR",
+        "NODE_ENV",
+        // KB Labs specific
+        "KB_*"
+        // All KB env vars
+      ]
+    },
+    fs: {
+      mode: "readWrite",
+      allow: [
+        ".kb/**"
+        // KB Labs config directory
+      ]
+    }
+  }
+};
+
+// src/presets/llm-access.ts
+var llmAccess = {
+  id: "llm-access",
+  description: "LLM API access - OpenAI, Anthropic keys and network",
+  permissions: {
+    env: {
+      read: [
+        "OPENAI_API_KEY",
+        "OPENAI_ORG_ID",
+        "OPENAI_BASE_URL",
+        "ANTHROPIC_API_KEY",
+        "AZURE_OPENAI_*",
+        // Azure OpenAI
+        "LLM_*"
+        // Generic LLM config
+      ]
+    },
+    network: {
+      fetch: [
+        "api.openai.com",
+        "api.anthropic.com",
+        "*.openai.azure.com"
+        // Azure OpenAI
+      ]
+    }
+  }
+};
+
+// src/presets/vector-store.ts
+var vectorStore = {
+  id: "vector-store",
+  description: "Vector database access - Qdrant, Pinecone, Weaviate",
+  permissions: {
+    env: {
+      read: [
+        // Qdrant
+        "QDRANT_URL",
+        "QDRANT_API_KEY",
+        "QDRANT_*",
+        // Pinecone
+        "PINECONE_API_KEY",
+        "PINECONE_ENVIRONMENT",
+        "PINECONE_*",
+        // Weaviate
+        "WEAVIATE_URL",
+        "WEAVIATE_API_KEY",
+        "WEAVIATE_*",
+        // Generic
+        "VECTOR_STORE_*",
+        "EMBEDDING_*"
+      ]
+    },
+    network: {
+      fetch: [
+        "localhost",
+        "127.0.0.1",
+        "*.qdrant.io",
+        "*.pinecone.io",
+        "*.weaviate.io"
+      ]
+    }
+  }
+};
+
+// src/presets/ci-environment.ts
+var ciEnvironment = {
+  id: "ci-environment",
+  description: "CI/CD environment - GitHub Actions, GitLab CI tokens and vars",
+  permissions: {
+    env: {
+      read: [
+        // Common CI
+        "CI",
+        "CI_*",
+        "CONTINUOUS_INTEGRATION",
+        // GitHub Actions
+        "GITHUB_TOKEN",
+        "GITHUB_*",
+        "GH_TOKEN",
+        // GitLab CI
+        "GITLAB_*",
+        "CI_JOB_TOKEN",
+        // Jenkins
+        "JENKINS_*",
+        "BUILD_*",
+        // Generic
+        "BRANCH_NAME",
+        "TAG_NAME",
+        "COMMIT_SHA"
+      ]
+    }
+  }
+};
+
+// src/presets/index.ts
+var presets_exports = {};
+__export(presets_exports, {
+  ciEnvironment: () => ciEnvironment,
+  fullEnv: () => fullEnv,
+  gitWorkflow: () => gitWorkflow,
+  kbPlatform: () => kbPlatform,
+  llmAccess: () => llmAccess,
+  minimal: () => minimal,
+  npmPublish: () => npmPublish,
+  vectorStore: () => vectorStore
+});
+
+// src/combine.ts
+function mergeArrays(a, b) {
+  if (!a && !b) {
+    return void 0;
+  }
+  const set = /* @__PURE__ */ new Set([...a ?? [], ...b ?? []]);
+  return set.size > 0 ? [...set] : void 0;
+}
+function mergePlatformPermissions(base, next) {
+  if (!base && !next) {
+    return void 0;
+  }
+  if (!base) {
+    return next;
+  }
+  if (!next) {
+    return base;
+  }
+  const result = {};
+  const keys = /* @__PURE__ */ new Set([...Object.keys(base), ...Object.keys(next)]);
+  for (const key of keys) {
+    const baseVal = base[key];
+    const nextVal = next[key];
+    if (nextVal === void 0) {
+      result[key] = baseVal;
+    } else if (Array.isArray(nextVal)) {
+      result[key] = mergeArrays(
+        Array.isArray(baseVal) ? baseVal : void 0,
+        nextVal
+      );
+    } else if (typeof nextVal === "object" && nextVal !== null) {
+      result[key] = { ...typeof baseVal === "object" ? baseVal : {}, ...nextVal };
+    } else {
+      result[key] = nextVal;
+    }
+  }
+  return Object.keys(result).length > 0 ? result : void 0;
+}
+function mergeSpecs(base, next) {
+  const result = {};
+  if (base.fs || next.fs) {
+    result.fs = {
+      // readWrite wins over read
+      mode: next.fs?.mode ?? base.fs?.mode,
+      allow: mergeArrays(base.fs?.allow, next.fs?.allow)
+    };
+    if (result.fs.mode === void 0) {
+      delete result.fs.mode;
+    }
+    if (result.fs.allow === void 0) {
+      delete result.fs.allow;
+    }
+    if (Object.keys(result.fs).length === 0) {
+      delete result.fs;
+    }
+  }
+  if (base.env || next.env) {
+    result.env = {
+      read: mergeArrays(base.env?.read, next.env?.read)
+    };
+    if (result.env.read === void 0) {
+      delete result.env.read;
+    }
+    if (Object.keys(result.env).length === 0) {
+      delete result.env;
+    }
+  }
+  if (base.network || next.network) {
+    result.network = {
+      fetch: mergeArrays(base.network?.fetch, next.network?.fetch)
+    };
+    if (result.network.fetch === void 0) {
+      delete result.network.fetch;
+    }
+    if (Object.keys(result.network).length === 0) {
+      delete result.network;
+    }
+  }
+  if (base.shell || next.shell) {
+    result.shell = {
+      allow: mergeArrays(base.shell?.allow, next.shell?.allow)
+    };
+    if (result.shell.allow === void 0) {
+      delete result.shell.allow;
+    }
+    if (Object.keys(result.shell).length === 0) {
+      delete result.shell;
+    }
+  }
+  result.platform = mergePlatformPermissions(base.platform, next.platform);
+  if (base.quotas || next.quotas) {
+    result.quotas = {
+      timeoutMs: next.quotas?.timeoutMs ?? base.quotas?.timeoutMs,
+      memoryMb: next.quotas?.memoryMb ?? base.quotas?.memoryMb,
+      cpuMs: next.quotas?.cpuMs ?? base.quotas?.cpuMs
+    };
+    if (result.quotas.timeoutMs === void 0) {
+      delete result.quotas.timeoutMs;
+    }
+    if (result.quotas.memoryMb === void 0) {
+      delete result.quotas.memoryMb;
+    }
+    if (result.quotas.cpuMs === void 0) {
+      delete result.quotas.cpuMs;
+    }
+    if (Object.keys(result.quotas).length === 0) {
+      delete result.quotas;
+    }
+  }
+  return result;
+}
+function toRuntimeFormat(spec) {
+  const result = {};
+  if (spec.fs) {
+    const { mode, allow } = spec.fs;
+    result.fs = {};
+    if (allow && allow.length > 0) {
+      result.fs.read = [...allow];
+      if (mode === "readWrite") {
+        result.fs.write = [...allow];
+      }
+    }
+    if (Object.keys(result.fs).length === 0) {
+      delete result.fs;
+    }
+  }
+  if (spec.env) {
+    result.env = { ...spec.env };
+  }
+  if (spec.network) {
+    result.network = { ...spec.network };
+  }
+  if (spec.shell) {
+    result.shell = { ...spec.shell };
+  }
+  if (spec.platform) {
+    result.platform = { ...spec.platform };
+  }
+  if (spec.quotas) {
+    result.quotas = { ...spec.quotas };
+  }
+  return result;
+}
+function combine() {
+  let accumulated = {};
+  const builder = {
+    with(preset) {
+      const spec = "permissions" in preset ? preset.permissions : preset;
+      accumulated = mergeSpecs(accumulated, spec);
+      return builder;
+    },
+    withEnv(vars) {
+      accumulated = mergeSpecs(accumulated, { env: { read: vars } });
+      return builder;
+    },
+    withFs(fs) {
+      if (fs) {
+        accumulated = mergeSpecs(accumulated, { fs });
+      }
+      return builder;
+    },
+    withNetwork(network) {
+      if (network) {
+        accumulated = mergeSpecs(accumulated, { network });
+      }
+      return builder;
+    },
+    withShell(shell) {
+      if (shell) {
+        accumulated = mergeSpecs(accumulated, { shell });
+      }
+      return builder;
+    },
+    withPlatform(platform) {
+      if (platform) {
+        accumulated = mergeSpecs(accumulated, { platform });
+      }
+      return builder;
+    },
+    withQuotas(quotas) {
+      if (quotas) {
+        accumulated = mergeSpecs(accumulated, { quotas });
+      }
+      return builder;
+    },
+    withStorage(storage) {
+      if (storage !== void 0) {
+        accumulated = mergeSpecs(accumulated, {
+          platform: { storage }
+        });
+      }
+      return builder;
+    },
+    withDatabase(database) {
+      if (database !== void 0) {
+        accumulated = mergeSpecs(accumulated, {
+          platform: { database }
+        });
+      }
+      return builder;
+    },
+    build() {
+      return toRuntimeFormat(accumulated);
+    }
+  };
+  return builder;
+}
+function combinePresets(...presets) {
+  let builder = combine();
+  for (const preset of presets) {
+    builder = builder.with(preset);
+  }
+  return builder.build();
+}
+
+export { ciEnvironment, combine, combinePresets, fullEnv, gitWorkflow, kbPlatform, llmAccess, minimal, npmPublish, presets_exports as presets, toRuntimeFormat, vectorStore };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/presets/minimal.ts","../src/presets/git-workflow.ts","../src/presets/npm-publish.ts","../src/presets/full-env.ts","../src/presets/kb-platform.ts","../src/presets/llm-access.ts","../src/presets/vector-store.ts","../src/presets/ci-environment.ts","../src/presets/index.ts","../src/combine.ts"],"names":[],"mappings":";;;;;;;AAMO,IAAM,OAAA,GAA4B;AAAA,EACvC,EAAA,EAAI,SAAA;AAAA,EACJ,WAAA,EAAa,sDAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM;AAAA,QACJ,UAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,QAAA;AAAA,QACA;AAAA;AACF;AACF;AAEJ;;;ACdO,IAAM,WAAA,GAAgC;AAAA,EAC3C,EAAA,EAAI,cAAA;AAAA,EACJ,WAAA,EAAa,6DAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM;AAAA;AAAA,QAEJ,MAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,OAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,QAAA;AAAA,QACA,IAAA;AAAA,QACA,QAAA;AAAA;AAAA,QAEA,OAAA;AAAA;AAAA,QACA,eAAA;AAAA;AAAA,QACA,eAAA;AAAA;AAAA,QAEA;AAAA;AACF,KACF;AAAA,IACA,EAAA,EAAI;AAAA,MACF,IAAA,EAAM,WAAA;AAAA,MACN,KAAA,EAAO;AAAA,QACL,YAAA;AAAA;AAAA,QACA,eAAA;AAAA,QACA;AAAA;AACF;AACF;AAEJ;;;ACjCO,IAAM,UAAA,GAA+B;AAAA,EAC1C,EAAA,EAAI,aAAA;AAAA,EACJ,WAAA,EAAa,iEAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM;AAAA;AAAA,QAEJ,MAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,QAAA;AAAA,QACA,MAAA;AAAA,QACA,QAAA;AAAA,QACA,IAAA;AAAA;AAAA,QAEA,WAAA;AAAA,QACA,gBAAA;AAAA,QACA,iBAAA;AAAA,QACA,OAAA;AAAA;AAAA;AAAA,QAEA,UAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,IACA,EAAA,EAAI;AAAA,MACF,IAAA,EAAM,WAAA;AAAA,MACN,KAAA,EAAO;AAAA,QACL,iBAAA;AAAA,QACA,sBAAA;AAAA,QACA,mBAAA;AAAA,QACA,WAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,IACA,OAAA,EAAS;AAAA,MACP,KAAA,EAAO;AAAA,QACL,oBAAA;AAAA,QACA;AAAA;AACF;AACF;AAEJ;;;ACxCO,IAAM,OAAA,GAA4B;AAAA,EACvC,EAAA,EAAI,UAAA;AAAA,EACJ,WAAA,EAAa,yEAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM,CAAC,GAAG;AAAA;AAAA;AACZ;AAEJ;;;ACTO,IAAM,UAAA,GAA+B;AAAA,EAC1C,EAAA,EAAI,aAAA;AAAA,EACJ,WAAA,EAAa,4DAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM;AAAA;AAAA,QAEJ,MAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,QAAA;AAAA,QACA,UAAA;AAAA;AAAA,QAEA;AAAA;AAAA;AACF,KACF;AAAA,IACA,EAAA,EAAI;AAAA,MACF,IAAA,EAAM,WAAA;AAAA,MACN,KAAA,EAAO;AAAA,QACL;AAAA;AAAA;AACF;AACF;AAEJ;;;ACvBO,IAAM,SAAA,GAA8B;AAAA,EACzC,EAAA,EAAI,YAAA;AAAA,EACJ,WAAA,EAAa,qDAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM;AAAA,QACJ,gBAAA;AAAA,QACA,eAAA;AAAA,QACA,iBAAA;AAAA,QACA,mBAAA;AAAA,QACA,gBAAA;AAAA;AAAA,QACA;AAAA;AAAA;AACF,KACF;AAAA,IACA,OAAA,EAAS;AAAA,MACP,KAAA,EAAO;AAAA,QACL,gBAAA;AAAA,QACA,mBAAA;AAAA,QACA;AAAA;AAAA;AACF;AACF;AAEJ;;;ACtBO,IAAM,WAAA,GAAgC;AAAA,EAC3C,EAAA,EAAI,cAAA;AAAA,EACJ,WAAA,EAAa,qDAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM;AAAA;AAAA,QAEJ,YAAA;AAAA,QACA,gBAAA;AAAA,QACA,UAAA;AAAA;AAAA,QAEA,kBAAA;AAAA,QACA,sBAAA;AAAA,QACA,YAAA;AAAA;AAAA,QAEA,cAAA;AAAA,QACA,kBAAA;AAAA,QACA,YAAA;AAAA;AAAA,QAEA,gBAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,IACA,OAAA,EAAS;AAAA,MACP,KAAA,EAAO;AAAA,QACL,WAAA;AAAA,QACA,WAAA;AAAA,QACA,aAAA;AAAA,QACA,eAAA;AAAA,QACA;AAAA;AACF;AACF;AAEJ;;;ACjCO,IAAM,aAAA,GAAkC;AAAA,EAC7C,EAAA,EAAI,gBAAA;AAAA,EACJ,WAAA,EAAa,+DAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM;AAAA;AAAA,QAEJ,IAAA;AAAA,QACA,MAAA;AAAA,QACA,wBAAA;AAAA;AAAA,QAEA,cAAA;AAAA,QACA,UAAA;AAAA,QACA,UAAA;AAAA;AAAA,QAEA,UAAA;AAAA,QACA,cAAA;AAAA;AAAA,QAEA,WAAA;AAAA,QACA,SAAA;AAAA;AAAA,QAEA,aAAA;AAAA,QACA,UAAA;AAAA,QACA;AAAA;AACF;AACF;AAEJ;;;ACjCA,IAAA,eAAA,GAAA;AAAA,QAAA,CAAA,eAAA,EAAA;AAAA,EAAA,aAAA,EAAA,MAAA,aAAA;AAAA,EAAA,OAAA,EAAA,MAAA,OAAA;AAAA,EAAA,WAAA,EAAA,MAAA,WAAA;AAAA,EAAA,UAAA,EAAA,MAAA,UAAA;AAAA,EAAA,SAAA,EAAA,MAAA,SAAA;AAAA,EAAA,OAAA,EAAA,MAAA,OAAA;AAAA,EAAA,UAAA,EAAA,MAAA,UAAA;AAAA,EAAA,WAAA,EAAA,MAAA;AAAA,CAAA,CAAA;;;ACKA,SAAS,WAAA,CAAY,GAAc,CAAA,EAAoC;AACrE,EAAA,IAAI,CAAC,CAAA,IAAK,CAAC,CAAA,EAAG;AAAC,IAAA,OAAO,MAAA;AAAA,EAAU;AAChC,EAAA,MAAM,GAAA,mBAAM,IAAI,GAAA,CAAI,CAAC,GAAI,CAAA,IAAK,EAAC,EAAI,GAAI,CAAA,IAAK,EAAG,CAAC,CAAA;AAChD,EAAA,OAAO,IAAI,IAAA,GAAO,CAAA,GAAI,CAAC,GAAG,GAAG,CAAA,GAAI,MAAA;AACnC;AAKA,SAAS,wBAAA,CACP,MACA,IAAA,EACwC;AACxC,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,IAAA,EAAM;AAAC,IAAA,OAAO,MAAA;AAAA,EAAU;AACtC,EAAA,IAAI,CAAC,IAAA,EAAM;AAAC,IAAA,OAAO,IAAA;AAAA,EAAK;AACxB,EAAA,IAAI,CAAC,IAAA,EAAM;AAAC,IAAA,OAAO,IAAA;AAAA,EAAK;AAExB,EAAA,MAAM,SAAqC,EAAC;AAG5C,EAAA,MAAM,IAAA,mBAAO,IAAI,GAAA,CAAI,CAAC,GAAG,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,EAAG,GAAG,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAC,CAAA;AAEjE,EAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,IAAA,MAAM,OAAA,GAAU,KAAK,GAAG,CAAA;AACxB,IAAA,MAAM,OAAA,GAAU,KAAK,GAAG,CAAA;AAExB,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,OAAA;AAAA,IAChB,CAAA,MAAA,IAAW,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG;AAEjC,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,WAAA;AAAA,QACZ,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,GAAI,OAAA,GAAU,MAAA;AAAA,QACnC;AAAA,OACF;AAAA,IACF,CAAA,MAAA,IAAW,OAAO,OAAA,KAAY,QAAA,IAAY,YAAY,IAAA,EAAM;AAE1D,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,EAAE,GAAI,OAAO,OAAA,KAAY,QAAA,GAAW,OAAA,GAAU,EAAC,EAAI,GAAG,OAAA,EAAQ;AAAA,IAC9E,CAAA,MAAO;AAEL,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,OAAA;AAAA,IAChB;AAAA,EACF;AAEA,EAAA,OAAO,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,MAAA,GAAS,IAAI,MAAA,GAAS,MAAA;AACnD;AAMA,SAAS,UAAA,CAAW,MAAsB,IAAA,EAAsC;AAC9E,EAAA,MAAM,SAAyB,EAAC;AAGhC,EAAA,IAAI,IAAA,CAAK,EAAA,IAAM,IAAA,CAAK,EAAA,EAAI;AACtB,IAAA,MAAA,CAAO,EAAA,GAAK;AAAA;AAAA,MAEV,IAAA,EAAM,IAAA,CAAK,EAAA,EAAI,IAAA,IAAQ,KAAK,EAAA,EAAI,IAAA;AAAA,MAChC,OAAO,WAAA,CAAY,IAAA,CAAK,IAAI,KAAA,EAAO,IAAA,CAAK,IAAI,KAAK;AAAA,KACnD;AAEA,IAAA,IAAI,MAAA,CAAO,EAAA,CAAG,IAAA,KAAS,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,EAAA,CAAG,IAAA;AAAA,IAAK;AACzD,IAAA,IAAI,MAAA,CAAO,EAAA,CAAG,KAAA,KAAU,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,EAAA,CAAG,KAAA;AAAA,IAAM;AAC3D,IAAA,IAAI,OAAO,IAAA,CAAK,MAAA,CAAO,EAAE,CAAA,CAAE,WAAW,CAAA,EAAG;AAAC,MAAA,OAAO,MAAA,CAAO,EAAA;AAAA,IAAG;AAAA,EAC7D;AAGA,EAAA,IAAI,IAAA,CAAK,GAAA,IAAO,IAAA,CAAK,GAAA,EAAK;AACxB,IAAA,MAAA,CAAO,GAAA,GAAM;AAAA,MACX,MAAM,WAAA,CAAY,IAAA,CAAK,KAAK,IAAA,EAAM,IAAA,CAAK,KAAK,IAAI;AAAA,KAClD;AACA,IAAA,IAAI,MAAA,CAAO,GAAA,CAAI,IAAA,KAAS,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,GAAA,CAAI,IAAA;AAAA,IAAK;AAC3D,IAAA,IAAI,OAAO,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,CAAE,WAAW,CAAA,EAAG;AAAC,MAAA,OAAO,MAAA,CAAO,GAAA;AAAA,IAAI;AAAA,EAC/D;AAGA,EAAA,IAAI,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,OAAA,EAAS;AAChC,IAAA,MAAA,CAAO,OAAA,GAAU;AAAA,MACf,OAAO,WAAA,CAAY,IAAA,CAAK,SAAS,KAAA,EAAO,IAAA,CAAK,SAAS,KAAK;AAAA,KAC7D;AACA,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,KAAA,KAAU,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,OAAA,CAAQ,KAAA;AAAA,IAAM;AACrE,IAAA,IAAI,OAAO,IAAA,CAAK,MAAA,CAAO,OAAO,CAAA,CAAE,WAAW,CAAA,EAAG;AAAC,MAAA,OAAO,MAAA,CAAO,OAAA;AAAA,IAAQ;AAAA,EACvE;AAGA,EAAA,IAAI,IAAA,CAAK,KAAA,IAAS,IAAA,CAAK,KAAA,EAAO;AAC5B,IAAA,MAAA,CAAO,KAAA,GAAQ;AAAA,MACb,OAAO,WAAA,CAAY,IAAA,CAAK,OAAO,KAAA,EAAO,IAAA,CAAK,OAAO,KAAK;AAAA,KACzD;AACA,IAAA,IAAI,MAAA,CAAO,KAAA,CAAM,KAAA,KAAU,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,KAAA,CAAM,KAAA;AAAA,IAAM;AACjE,IAAA,IAAI,OAAO,IAAA,CAAK,MAAA,CAAO,KAAK,CAAA,CAAE,WAAW,CAAA,EAAG;AAAC,MAAA,OAAO,MAAA,CAAO,KAAA;AAAA,IAAM;AAAA,EACnE;AAGA,EAAA,MAAA,CAAO,QAAA,GAAW,wBAAA,CAAyB,IAAA,CAAK,QAAA,EAAU,KAAK,QAAQ,CAAA;AAGvE,EAAA,IAAI,IAAA,CAAK,MAAA,IAAU,IAAA,CAAK,MAAA,EAAQ;AAC9B,IAAA,MAAA,CAAO,MAAA,GAAS;AAAA,MACd,SAAA,EAAW,IAAA,CAAK,MAAA,EAAQ,SAAA,IAAa,KAAK,MAAA,EAAQ,SAAA;AAAA,MAClD,QAAA,EAAU,IAAA,CAAK,MAAA,EAAQ,QAAA,IAAY,KAAK,MAAA,EAAQ,QAAA;AAAA,MAChD,KAAA,EAAO,IAAA,CAAK,MAAA,EAAQ,KAAA,IAAS,KAAK,MAAA,EAAQ;AAAA,KAC5C;AACA,IAAA,IAAI,MAAA,CAAO,MAAA,CAAO,SAAA,KAAc,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,MAAA,CAAO,SAAA;AAAA,IAAU;AAC3E,IAAA,IAAI,MAAA,CAAO,MAAA,CAAO,QAAA,KAAa,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,MAAA,CAAO,QAAA;AAAA,IAAS;AACzE,IAAA,IAAI,MAAA,CAAO,MAAA,CAAO,KAAA,KAAU,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,MAAA,CAAO,KAAA;AAAA,IAAM;AACnE,IAAA,IAAI,OAAO,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA,CAAE,WAAW,CAAA,EAAG;AAAC,MAAA,OAAO,MAAA,CAAO,MAAA;AAAA,IAAO;AAAA,EACrE;AAEA,EAAA,OAAO,MAAA;AACT;AAUA,SAAS,gBAAgB,IAAA,EAA6C;AACpE,EAAA,MAAM,SAAgC,EAAC;AAGvC,EAAA,IAAI,KAAK,EAAA,EAAI;AACX,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,IAAA,CAAK,EAAA;AAC7B,IAAA,MAAA,CAAO,KAAK,EAAC;AAEb,IAAA,IAAI,KAAA,IAAS,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG;AAE7B,MAAA,MAAA,CAAO,EAAA,CAAG,IAAA,GAAO,CAAC,GAAG,KAAK,CAAA;AAG1B,MAAA,IAAI,SAAS,WAAA,EAAa;AACxB,QAAA,MAAA,CAAO,EAAA,CAAG,KAAA,GAAQ,CAAC,GAAG,KAAK,CAAA;AAAA,MAC7B;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,IAAA,CAAK,MAAA,CAAO,EAAE,CAAA,CAAE,WAAW,CAAA,EAAG;AAAC,MAAA,OAAO,MAAA,CAAO,EAAA;AAAA,IAAG;AAAA,EAC7D;AAGA,EAAA,IAAI,KAAK,GAAA,EAAK;AACZ,IAAA,MAAA,CAAO,GAAA,GAAM,EAAE,GAAG,IAAA,CAAK,GAAA,EAAI;AAAA,EAC7B;AAEA,EAAA,IAAI,KAAK,OAAA,EAAS;AAChB,IAAA,MAAA,CAAO,OAAA,GAAU,EAAE,GAAG,IAAA,CAAK,OAAA,EAAQ;AAAA,EACrC;AAEA,EAAA,IAAI,KAAK,KAAA,EAAO;AACd,IAAA,MAAA,CAAO,KAAA,GAAQ,EAAE,GAAG,IAAA,CAAK,KAAA,EAAM;AAAA,EACjC;AAEA,EAAA,IAAI,KAAK,QAAA,EAAU;AACjB,IAAA,MAAA,CAAO,QAAA,GAAW,EAAE,GAAG,IAAA,CAAK,QAAA,EAAS;AAAA,EACvC;AAEA,EAAA,IAAI,KAAK,MAAA,EAAQ;AACf,IAAA,MAAA,CAAO,MAAA,GAAS,EAAE,GAAG,IAAA,CAAK,MAAA,EAAO;AAAA,EACnC;AAEA,EAAA,OAAO,MAAA;AACT;AAcO,SAAS,OAAA,GAAyB;AACvC,EAAA,IAAI,cAA8B,EAAC;AAEnC,EAAA,MAAM,OAAA,GAAyB;AAAA,IAC7B,KAAK,MAAA,EAA0D;AAC7D,MAAA,MAAM,IAAA,GAAO,aAAA,IAAiB,MAAA,GAAS,MAAA,CAAO,WAAA,GAAc,MAAA;AAC5D,MAAA,WAAA,GAAc,UAAA,CAAW,aAAa,IAAI,CAAA;AAC1C,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,QAAQ,IAAA,EAA+B;AACrC,MAAA,WAAA,GAAc,UAAA,CAAW,aAAa,EAAE,GAAA,EAAK,EAAE,IAAA,EAAM,IAAA,IAAQ,CAAA;AAC7D,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,OAAO,EAAA,EAAyC;AAC9C,MAAA,IAAI,EAAA,EAAI;AACN,QAAA,WAAA,GAAc,UAAA,CAAW,WAAA,EAAa,EAAE,EAAA,EAAI,CAAA;AAAA,MAC9C;AACA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,YAAY,OAAA,EAAmD;AAC7D,MAAA,IAAI,OAAA,EAAS;AACX,QAAA,WAAA,GAAc,UAAA,CAAW,WAAA,EAAa,EAAE,OAAA,EAAS,CAAA;AAAA,MACnD;AACA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,UAAU,KAAA,EAA+C;AACvD,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,WAAA,GAAc,UAAA,CAAW,WAAA,EAAa,EAAE,KAAA,EAAO,CAAA;AAAA,MACjD;AACA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,aAAa,QAAA,EAAqD;AAChE,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,WAAA,GAAc,UAAA,CAAW,WAAA,EAAa,EAAE,QAAA,EAAU,CAAA;AAAA,MACpD;AACA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,WAAW,MAAA,EAAiD;AAC1D,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,WAAA,GAAc,UAAA,CAAW,WAAA,EAAa,EAAE,MAAA,EAAQ,CAAA;AAAA,MAClD;AACA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,YAAY,OAAA,EAAwD;AAClE,MAAA,IAAI,YAAY,MAAA,EAAW;AACzB,QAAA,WAAA,GAAc,WAAW,WAAA,EAAa;AAAA,UACpC,QAAA,EAAU,EAAE,OAAA;AAAQ,SACrB,CAAA;AAAA,MACH;AACA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,aAAa,QAAA,EAA0D;AACrE,MAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,QAAA,WAAA,GAAc,WAAW,WAAA,EAAa;AAAA,UACpC,QAAA,EAAU,EAAE,QAAA;AAAS,SACtB,CAAA;AAAA,MACH;AACA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,KAAA,GAA+B;AAC7B,MAAA,OAAO,gBAAgB,WAAW,CAAA;AAAA,IACpC;AAAA,GACF;AAEA,EAAA,OAAO,OAAA;AACT;AAUO,SAAS,kBAAkB,OAAA,EAAuE;AACvG,EAAA,IAAI,UAAU,OAAA,EAAQ;AACtB,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,OAAA,GAAU,OAAA,CAAQ,KAAK,MAAM,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO,QAAQ,KAAA,EAAM;AACvB","file":"index.js","sourcesContent":["import type { PermissionPreset } from '../types';\n\n/**\n * Minimal preset - only basic Node.js environment\n * Use when plugin doesn't need any external access\n */\nexport const minimal: PermissionPreset = {\n  id: 'minimal',\n  description: 'Minimal permissions - basic Node.js environment only',\n  permissions: {\n    env: {\n      read: [\n        'NODE_ENV',\n        'PATH',\n        'LANG',\n        'LC_ALL',\n        'TZ',\n      ],\n    },\n  },\n};\n","import type { PermissionPreset } from '../types';\n\n/**\n * Git workflow preset - for plugins that use git (simple-git, etc.)\n * Includes HOME for ~/.gitconfig, USER for author info\n */\nexport const gitWorkflow: PermissionPreset = {\n  id: 'git-workflow',\n  description: 'Git operations - includes HOME, USER, and git config access',\n  permissions: {\n    env: {\n      read: [\n        // System (required for git to find config)\n        'HOME',\n        'USER',\n        'PATH',\n        'SHELL',\n        'TERM',\n        'LANG',\n        'LC_ALL',\n        'TZ',\n        'TMPDIR',\n        // Git-specific\n        'GIT_*',           // All git env vars (GIT_AUTHOR_NAME, GIT_DIR, etc.)\n        'SSH_AUTH_SOCK',   // For SSH key auth\n        'SSH_AGENT_PID',\n        // Node\n        'NODE_ENV',\n      ],\n    },\n    fs: {\n      mode: 'readWrite',\n      allow: [\n        '**/.git/**',      // Git directory\n        '**/.gitignore',\n        '**/.gitattributes',\n      ],\n    },\n  },\n};\n","import type { PermissionPreset } from '../types';\n\n/**\n * NPM publish preset - for plugins that publish to npm\n * Includes HOME for ~/.npmrc, npm auth tokens\n */\nexport const npmPublish: PermissionPreset = {\n  id: 'npm-publish',\n  description: 'NPM operations - includes HOME, npm tokens, and registry access',\n  permissions: {\n    env: {\n      read: [\n        // System (required for npm to find config)\n        'HOME',\n        'USER',\n        'PATH',\n        'TMPDIR',\n        'LANG',\n        'LC_ALL',\n        'TZ',\n        // NPM-specific\n        'NPM_TOKEN',\n        'NPM_AUTH_TOKEN',\n        'NODE_AUTH_TOKEN',\n        'npm_*',           // All npm env vars\n        // Node\n        'NODE_ENV',\n        'NODE_OPTIONS',\n      ],\n    },\n    fs: {\n      mode: 'readWrite',\n      allow: [\n        '**/package.json',\n        '**/package-lock.json',\n        '**/pnpm-lock.yaml',\n        '**/.npmrc',\n        '**/.npmignore',\n      ],\n    },\n    network: {\n      fetch: [\n        'registry.npmjs.org',\n        'npm.pkg.github.com',\n      ],\n    },\n  },\n};\n","import type { PermissionPreset } from '../types';\n\n/**\n * Full environment preset - access to all environment variables\n * Use for trusted plugins that need full system access\n * WARNING: This bypasses env filtering entirely\n */\nexport const fullEnv: PermissionPreset = {\n  id: 'full-env',\n  description: 'Full environment access - all env vars available (trusted plugins only)',\n  permissions: {\n    env: {\n      read: ['*'], // Wildcard - all env vars\n    },\n  },\n};\n","import type { PermissionPreset } from '../types';\n\n/**\n * KB Platform preset - for KB Labs internal plugins\n * Includes KB_* env vars and .kb/ directory access\n */\nexport const kbPlatform: PermissionPreset = {\n  id: 'kb-platform',\n  description: 'KB Labs platform access - KB_* env vars and .kb/ directory',\n  permissions: {\n    env: {\n      read: [\n        // System basics\n        'HOME',\n        'USER',\n        'PATH',\n        'TMPDIR',\n        'NODE_ENV',\n        // KB Labs specific\n        'KB_*',            // All KB env vars\n      ],\n    },\n    fs: {\n      mode: 'readWrite',\n      allow: [\n        '.kb/**',          // KB Labs config directory\n      ],\n    },\n  },\n};\n","import type { PermissionPreset } from '../types';\n\n/**\n * LLM Access preset - for plugins that use LLM APIs\n * Includes OpenAI and Anthropic API keys and network access\n */\nexport const llmAccess: PermissionPreset = {\n  id: 'llm-access',\n  description: 'LLM API access - OpenAI, Anthropic keys and network',\n  permissions: {\n    env: {\n      read: [\n        'OPENAI_API_KEY',\n        'OPENAI_ORG_ID',\n        'OPENAI_BASE_URL',\n        'ANTHROPIC_API_KEY',\n        'AZURE_OPENAI_*',     // Azure OpenAI\n        'LLM_*',              // Generic LLM config\n      ],\n    },\n    network: {\n      fetch: [\n        'api.openai.com',\n        'api.anthropic.com',\n        '*.openai.azure.com', // Azure OpenAI\n      ],\n    },\n  },\n};\n","import type { PermissionPreset } from '../types';\n\n/**\n * Vector Store preset - for plugins that use vector databases\n * Includes Qdrant, Pinecone, Weaviate access\n */\nexport const vectorStore: PermissionPreset = {\n  id: 'vector-store',\n  description: 'Vector database access - Qdrant, Pinecone, Weaviate',\n  permissions: {\n    env: {\n      read: [\n        // Qdrant\n        'QDRANT_URL',\n        'QDRANT_API_KEY',\n        'QDRANT_*',\n        // Pinecone\n        'PINECONE_API_KEY',\n        'PINECONE_ENVIRONMENT',\n        'PINECONE_*',\n        // Weaviate\n        'WEAVIATE_URL',\n        'WEAVIATE_API_KEY',\n        'WEAVIATE_*',\n        // Generic\n        'VECTOR_STORE_*',\n        'EMBEDDING_*',\n      ],\n    },\n    network: {\n      fetch: [\n        'localhost',\n        '127.0.0.1',\n        '*.qdrant.io',\n        '*.pinecone.io',\n        '*.weaviate.io',\n      ],\n    },\n  },\n};\n","import type { PermissionPreset } from '../types';\n\n/**\n * CI Environment preset - for plugins running in CI/CD\n * Includes GitHub Actions, GitLab CI, and common CI variables\n */\nexport const ciEnvironment: PermissionPreset = {\n  id: 'ci-environment',\n  description: 'CI/CD environment - GitHub Actions, GitLab CI tokens and vars',\n  permissions: {\n    env: {\n      read: [\n        // Common CI\n        'CI',\n        'CI_*',\n        'CONTINUOUS_INTEGRATION',\n        // GitHub Actions\n        'GITHUB_TOKEN',\n        'GITHUB_*',\n        'GH_TOKEN',\n        // GitLab CI\n        'GITLAB_*',\n        'CI_JOB_TOKEN',\n        // Jenkins\n        'JENKINS_*',\n        'BUILD_*',\n        // Generic\n        'BRANCH_NAME',\n        'TAG_NAME',\n        'COMMIT_SHA',\n      ],\n    },\n  },\n};\n","export { minimal } from './minimal';\nexport { gitWorkflow } from './git-workflow';\nexport { npmPublish } from './npm-publish';\nexport { fullEnv } from './full-env';\nexport { kbPlatform } from './kb-platform';\nexport { llmAccess } from './llm-access';\nexport { vectorStore } from './vector-store';\nexport { ciEnvironment } from './ci-environment';\n","import type { PermissionSpec, PermissionPreset, PresetBuilder, RuntimePermissionSpec, PlatformPermissions } from './types';\n\n/**\n * Merge two string arrays, removing duplicates\n */\nfunction mergeArrays(a?: string[], b?: string[]): string[] | undefined {\n  if (!a && !b) {return undefined;}\n  const set = new Set([...(a ?? []), ...(b ?? [])]);\n  return set.size > 0 ? [...set] : undefined;\n}\n\n/**\n * Merge platform permissions\n */\nfunction mergePlatformPermissions(\n  base?: PermissionSpec['platform'],\n  next?: PermissionSpec['platform']\n): PermissionSpec['platform'] | undefined {\n  if (!base && !next) {return undefined;}\n  if (!base) {return next;}\n  if (!next) {return base;}\n\n  const result: PermissionSpec['platform'] = {};\n\n  // Merge each platform service (second value wins for booleans, arrays are merged)\n  const keys = new Set([...Object.keys(base), ...Object.keys(next)]) as Set<keyof typeof base>;\n\n  for (const key of keys) {\n    const baseVal = base[key];\n    const nextVal = next[key];\n\n    if (nextVal === undefined) {\n      result[key] = baseVal as any;\n    } else if (Array.isArray(nextVal)) {\n      // Merge arrays (for cache namespaces, storage paths)\n      result[key] = mergeArrays(\n        Array.isArray(baseVal) ? baseVal : undefined,\n        nextVal\n      ) as any;\n    } else if (typeof nextVal === 'object' && nextVal !== null) {\n      // Merge objects (for llm.models, vectorStore.collections, etc.)\n      result[key] = { ...(typeof baseVal === 'object' ? baseVal : {}), ...nextVal } as any;\n    } else {\n      // Boolean or primitive - second value wins\n      result[key] = nextVal as any;\n    }\n  }\n\n  return Object.keys(result).length > 0 ? result : undefined;\n}\n\n/**\n * Merge two permission specs together\n * Arrays are merged (union), scalars use the second value\n */\nfunction mergeSpecs(base: PermissionSpec, next: PermissionSpec): PermissionSpec {\n  const result: PermissionSpec = {};\n\n  // Merge fs\n  if (base.fs || next.fs) {\n    result.fs = {\n      // readWrite wins over read\n      mode: next.fs?.mode ?? base.fs?.mode,\n      allow: mergeArrays(base.fs?.allow, next.fs?.allow),\n    };\n    // Clean up undefined fields\n    if (result.fs.mode === undefined) {delete result.fs.mode;}\n    if (result.fs.allow === undefined) {delete result.fs.allow;}\n    if (Object.keys(result.fs).length === 0) {delete result.fs;}\n  }\n\n  // Merge env\n  if (base.env || next.env) {\n    result.env = {\n      read: mergeArrays(base.env?.read, next.env?.read),\n    };\n    if (result.env.read === undefined) {delete result.env.read;}\n    if (Object.keys(result.env).length === 0) {delete result.env;}\n  }\n\n  // Merge network\n  if (base.network || next.network) {\n    result.network = {\n      fetch: mergeArrays(base.network?.fetch, next.network?.fetch),\n    };\n    if (result.network.fetch === undefined) {delete result.network.fetch;}\n    if (Object.keys(result.network).length === 0) {delete result.network;}\n  }\n\n  // Merge shell\n  if (base.shell || next.shell) {\n    result.shell = {\n      allow: mergeArrays(base.shell?.allow, next.shell?.allow),\n    };\n    if (result.shell.allow === undefined) {delete result.shell.allow;}\n    if (Object.keys(result.shell).length === 0) {delete result.shell;}\n  }\n\n  // Merge platform\n  result.platform = mergePlatformPermissions(base.platform, next.platform);\n\n  // Merge quotas (second value wins)\n  if (base.quotas || next.quotas) {\n    result.quotas = {\n      timeoutMs: next.quotas?.timeoutMs ?? base.quotas?.timeoutMs,\n      memoryMb: next.quotas?.memoryMb ?? base.quotas?.memoryMb,\n      cpuMs: next.quotas?.cpuMs ?? base.quotas?.cpuMs,\n    };\n    if (result.quotas.timeoutMs === undefined) {delete result.quotas.timeoutMs;}\n    if (result.quotas.memoryMb === undefined) {delete result.quotas.memoryMb;}\n    if (result.quotas.cpuMs === undefined) {delete result.quotas.cpuMs;}\n    if (Object.keys(result.quotas).length === 0) {delete result.quotas;}\n  }\n\n  return result;\n}\n\n/**\n * Convert declarative PermissionSpec to explicit RuntimePermissionSpec\n *\n * Transforms:\n *   { mode: 'readWrite', allow: ['*.json'] }\n * Into:\n *   { read: ['*.json'], write: ['*.json'] }\n */\nfunction toRuntimeFormat(spec: PermissionSpec): RuntimePermissionSpec {\n  const result: RuntimePermissionSpec = {};\n\n  // Convert fs: mode + allow → read[] + write[]\n  if (spec.fs) {\n    const { mode, allow } = spec.fs;\n    result.fs = {};\n\n    if (allow && allow.length > 0) {\n      // read is always granted for allowed paths\n      result.fs.read = [...allow];\n\n      // write only if mode is 'readWrite'\n      if (mode === 'readWrite') {\n        result.fs.write = [...allow];\n      }\n    }\n\n    if (Object.keys(result.fs).length === 0) {delete result.fs;}\n  }\n\n  // env, network, shell, platform, quotas pass through unchanged\n  if (spec.env) {\n    result.env = { ...spec.env };\n  }\n\n  if (spec.network) {\n    result.network = { ...spec.network };\n  }\n\n  if (spec.shell) {\n    result.shell = { ...spec.shell };\n  }\n\n  if (spec.platform) {\n    result.platform = { ...spec.platform };\n  }\n\n  if (spec.quotas) {\n    result.quotas = { ...spec.quotas };\n  }\n\n  return result;\n}\n\n/**\n * Create a builder for combining permission presets\n *\n * @example\n * ```typescript\n * const permissions = combine()\n *   .with(presets.gitWorkflow)\n *   .with(presets.npmPublish)\n *   .withEnv(['MY_CUSTOM_VAR'])\n *   .build();\n * ```\n */\nexport function combine(): PresetBuilder {\n  let accumulated: PermissionSpec = {};\n\n  const builder: PresetBuilder = {\n    with(preset: PermissionPreset | PermissionSpec): PresetBuilder {\n      const spec = 'permissions' in preset ? preset.permissions : preset;\n      accumulated = mergeSpecs(accumulated, spec);\n      return builder;\n    },\n\n    withEnv(vars: string[]): PresetBuilder {\n      accumulated = mergeSpecs(accumulated, { env: { read: vars } });\n      return builder;\n    },\n\n    withFs(fs: PermissionSpec['fs']): PresetBuilder {\n      if (fs) {\n        accumulated = mergeSpecs(accumulated, { fs });\n      }\n      return builder;\n    },\n\n    withNetwork(network: PermissionSpec['network']): PresetBuilder {\n      if (network) {\n        accumulated = mergeSpecs(accumulated, { network });\n      }\n      return builder;\n    },\n\n    withShell(shell: PermissionSpec['shell']): PresetBuilder {\n      if (shell) {\n        accumulated = mergeSpecs(accumulated, { shell });\n      }\n      return builder;\n    },\n\n    withPlatform(platform: PermissionSpec['platform']): PresetBuilder {\n      if (platform) {\n        accumulated = mergeSpecs(accumulated, { platform });\n      }\n      return builder;\n    },\n\n    withQuotas(quotas: PermissionSpec['quotas']): PresetBuilder {\n      if (quotas) {\n        accumulated = mergeSpecs(accumulated, { quotas });\n      }\n      return builder;\n    },\n\n    withStorage(storage: PlatformPermissions['storage']): PresetBuilder {\n      if (storage !== undefined) {\n        accumulated = mergeSpecs(accumulated, {\n          platform: { storage },\n        });\n      }\n      return builder;\n    },\n\n    withDatabase(database: PlatformPermissions['database']): PresetBuilder {\n      if (database !== undefined) {\n        accumulated = mergeSpecs(accumulated, {\n          platform: { database },\n        });\n      }\n      return builder;\n    },\n\n    build(): RuntimePermissionSpec {\n      return toRuntimeFormat(accumulated);\n    },\n  };\n\n  return builder;\n}\n\n/**\n * Quickly combine multiple presets into a single permission spec\n *\n * @example\n * ```typescript\n * const permissions = combinePresets(presets.gitWorkflow, presets.npmPublish);\n * ```\n */\nexport function combinePresets(...presets: (PermissionPreset | PermissionSpec)[]): RuntimePermissionSpec {\n  let builder = combine();\n  for (const preset of presets) {\n    builder = builder.with(preset);\n  }\n  return builder.build();\n}\n\n/**\n * Export toRuntimeFormat for advanced use cases\n */\nexport { toRuntimeFormat };\n"]}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@kb-labs/perm-presets",
+  "version": "1.0.0",
+  "description": "Composable permission presets for KB Labs plugins",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {},
+  "devDependencies": {
+    "@kb-labs/devkit": "link:../../../kb-labs-devkit",
+    "typescript": "^5.6.3",
+    "tsup": "^8.5.0",
+    "rimraf": "^6.0.1",
+    "vitest": "^3.2.4",
+    "@types/node": "^24.3.3"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=20.0.0",
+    "pnpm": ">=9.0.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "clean": "rimraf dist",
+    "test": "vitest run --passWithNoTests",
+    "test:watch": "vitest",
+    "dev": "tsup --config tsup.config.ts --watch",
+    "lint": "eslint src --ext .ts",
+    "lint:fix": "eslint . --fix",
+    "type-check": "tsc --noEmit"
+  }
+}