@kb-labs/perm-presets 2.94.0 → 2.98.0

package/dist/index.d.ts

@@ -1,3 +1,5 @@
+import { PermissionSpec as PermissionSpec$1 } from '@kb-labs/plugin-contracts';
+
 /**
  * Platform service permissions
  */
@@ -72,10 +74,18 @@ interface PlatformPermissions {
     /** Embeddings access */
     embeddings?: boolean;
     /** Event bus access */
-    eventBus?: boolean | {
+    events?: boolean | {
         publish?: string[];
         subscribe?: string[];
     };
+    /** Notifier access */
+    notifier?: {
+        emit?: boolean;
+        subscribe?: {
+            sources: string[];
+            severity?: Array<'info' | 'warn' | 'critical'>;
+        };
+    };
 }
 /**
  * Permission specification for preset building (declarative format)
@@ -98,6 +108,14 @@ interface PermissionSpec {
     /** Network permissions */
     network?: {
         fetch?: string[];
+        /** Raw TCP connect targets. Patterns: 'imap.gmail.com:993', '*.smtp.example.com:587' */
+        tcp?: {
+            connect?: string[];
+        };
+        /** WebSocket connect targets. Patterns: 'wss://api.openai.com', 'wss://*.slack.com' */
+        ws?: {
+            connect?: string[];
+        };
     };
     /** Platform service permissions */
     platform?: PlatformPermissions;
@@ -113,37 +131,10 @@ interface PermissionSpec {
     };
 }
 /**
- * Runtime permission specification (explicit format)
- * This is the format used by plugin-runtime fs-shim.
- * Matches PermissionSpec from @kb-labs/plugin-contracts.
+ * Runtime permission specification — canonical output of build().
+ * Alias for plugin-contracts PermissionSpec so manifests can use either import.
  */
-interface RuntimePermissionSpec {
-    /** File system permissions - explicit read/write lists */
-    fs?: {
-        read?: string[];
-        write?: string[];
-    };
-    /** Environment variable permissions */
-    env?: {
-        read?: string[];
-    };
-    /** Network permissions */
-    network?: {
-        fetch?: string[];
-    };
-    /** Platform service permissions */
-    platform?: PlatformPermissions;
-    /** Shell execution permissions */
-    shell?: {
-        allow?: string[];
-    };
-    /** Resource quotas */
-    quotas?: {
-        timeoutMs?: number;
-        memoryMb?: number;
-        cpuMs?: number;
-    };
-}
+type RuntimePermissionSpec = PermissionSpec$1;
 /**
  * A preset is a named permission configuration
  */
@@ -200,7 +191,7 @@ interface PresetBuilder {
      */
     withDatabase(database: PlatformPermissions['database']): PresetBuilder;
     /** Build the final permission spec (converts to runtime format) */
-    build(): RuntimePermissionSpec;
+    build(): PermissionSpec$1;
 }
 
 /**
@@ -265,14 +256,14 @@ declare namespace index {
 }
 
 /**
- * Convert declarative PermissionSpec to explicit RuntimePermissionSpec
+ * Convert declarative PermissionSpec to explicit ContractsPermissionSpec.
  *
  * Transforms:
- *   { mode: 'readWrite', allow: ['*.json'] }
- * Into:
- *   { read: ['*.json'], write: ['*.json'] }
+ *   fs: { mode: 'readWrite', allow: ['*.json'] } → fs: { read: ['*.json'], write: ['*.json'] }
+ *   platform.cache: ['ns:'] → platform.cache: { namespaces: ['ns:'] }
+ *   platform.storage: ['path/'] → platform.storage: { paths: ['path/'] }
  */
-declare function toRuntimeFormat(spec: PermissionSpec): RuntimePermissionSpec;
+declare function toRuntimeFormat(spec: PermissionSpec): PermissionSpec$1;
 /**
  * Create a builder for combining permission presets
  *
@@ -294,6 +285,6 @@ declare function combine(): PresetBuilder;
  * const permissions = combinePresets(presets.gitWorkflow, presets.npmPublish);
  * ```
  */
-declare function combinePresets(...presets: (PermissionPreset | PermissionSpec)[]): RuntimePermissionSpec;
+declare function combinePresets(...presets: (PermissionPreset | PermissionSpec)[]): PermissionSpec$1;
 
 export { type PermissionPreset, type PermissionSpec, type PresetBuilder, type RuntimePermissionSpec, ciEnvironment, combine, combinePresets, fullEnv, gitWorkflow, kbPlatform, llmAccess, minimal, npmPublish, index as presets, toRuntimeFormat, vectorStore };

package/dist/index.js

@@ -260,6 +260,13 @@ function mergeArrays(a, b) {
   const set = /* @__PURE__ */ new Set([...a ?? [], ...b ?? []]);
   return set.size > 0 ? [...set] : void 0;
 }
+function mergeConnectSpec(a, b) {
+  if (!a && !b) {
+    return void 0;
+  }
+  const connect = mergeArrays(a?.connect, b?.connect);
+  return connect !== void 0 ? { connect } : {};
+}
 function mergePlatformPermissions(base, next) {
   if (!base && !next) {
     return void 0;
@@ -321,11 +328,19 @@ function mergeSpecs(base, next) {
   }
   if (base.network || next.network) {
     result.network = {
-      fetch: mergeArrays(base.network?.fetch, next.network?.fetch)
+      fetch: mergeArrays(base.network?.fetch, next.network?.fetch),
+      tcp: mergeConnectSpec(base.network?.tcp, next.network?.tcp),
+      ws: mergeConnectSpec(base.network?.ws, next.network?.ws)
     };
     if (result.network.fetch === void 0) {
       delete result.network.fetch;
     }
+    if (result.network.tcp === void 0) {
+      delete result.network.tcp;
+    }
+    if (result.network.ws === void 0) {
+      delete result.network.ws;
+    }
     if (Object.keys(result.network).length === 0) {
       delete result.network;
     }
@@ -382,13 +397,34 @@ function toRuntimeFormat(spec) {
     result.env = { ...spec.env };
   }
   if (spec.network) {
-    result.network = { ...spec.network };
+    result.network = {};
+    if (spec.network.fetch) {
+      result.network.fetch = [...spec.network.fetch];
+    }
+    if (spec.network.tcp) {
+      result.network.tcp = { ...spec.network.tcp };
+    }
+    if (spec.network.ws) {
+      result.network.ws = { ...spec.network.ws };
+    }
+    if (Object.keys(result.network).length === 0) {
+      delete result.network;
+    }
   }
   if (spec.shell) {
     result.shell = { ...spec.shell };
   }
   if (spec.platform) {
-    result.platform = { ...spec.platform };
+    const { cache, storage, ...rest } = spec.platform;
+    result.platform = {
+      ...rest,
+      ...cache !== void 0 && {
+        cache: Array.isArray(cache) ? { namespaces: cache } : cache
+      },
+      ...storage !== void 0 && {
+        storage: Array.isArray(storage) ? { paths: storage } : storage
+      }
+    };
   }
   if (spec.quotas) {
     result.quotas = { ...spec.quotas };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/presets/minimal.ts","../src/presets/git-workflow.ts","../src/presets/npm-publish.ts","../src/presets/full-env.ts","../src/presets/kb-platform.ts","../src/presets/llm-access.ts","../src/presets/vector-store.ts","../src/presets/ci-environment.ts","../src/presets/index.ts","../src/combine.ts"],"names":[],"mappings":";;;;;;;AAMO,IAAM,OAAA,GAA4B;AAAA,EACvC,EAAA,EAAI,SAAA;AAAA,EACJ,WAAA,EAAa,sDAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM;AAAA,QACJ,UAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,QAAA;AAAA,QACA;AAAA;AACF;AACF;AAEJ;;;ACdO,IAAM,WAAA,GAAgC;AAAA,EAC3C,EAAA,EAAI,cAAA;AAAA,EACJ,WAAA,EAAa,6DAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM;AAAA;AAAA,QAEJ,MAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,OAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,QAAA;AAAA,QACA,IAAA;AAAA,QACA,QAAA;AAAA;AAAA,QAEA,OAAA;AAAA;AAAA,QACA,eAAA;AAAA;AAAA,QACA,eAAA;AAAA;AAAA,QAEA;AAAA;AACF,KACF;AAAA,IACA,EAAA,EAAI;AAAA,MACF,IAAA,EAAM,WAAA;AAAA,MACN,KAAA,EAAO;AAAA,QACL,YAAA;AAAA;AAAA,QACA,eAAA;AAAA,QACA;AAAA;AACF;AACF;AAEJ;;;ACjCO,IAAM,UAAA,GAA+B;AAAA,EAC1C,EAAA,EAAI,aAAA;AAAA,EACJ,WAAA,EAAa,iEAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM;AAAA;AAAA,QAEJ,MAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,QAAA;AAAA,QACA,MAAA;AAAA,QACA,QAAA;AAAA,QACA,IAAA;AAAA;AAAA,QAEA,WAAA;AAAA,QACA,gBAAA;AAAA,QACA,iBAAA;AAAA,QACA,OAAA;AAAA;AAAA;AAAA,QAEA,UAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,IACA,EAAA,EAAI;AAAA,MACF,IAAA,EAAM,WAAA;AAAA,MACN,KAAA,EAAO;AAAA,QACL,iBAAA;AAAA,QACA,sBAAA;AAAA,QACA,mBAAA;AAAA,QACA,WAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,IACA,OAAA,EAAS;AAAA,MACP,KAAA,EAAO;AAAA,QACL,oBAAA;AAAA,QACA;AAAA;AACF;AACF;AAEJ;;;ACxCO,IAAM,OAAA,GAA4B;AAAA,EACvC,EAAA,EAAI,UAAA;AAAA,EACJ,WAAA,EAAa,yEAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM,CAAC,GAAG;AAAA;AAAA;AACZ;AAEJ;;;ACTO,IAAM,UAAA,GAA+B;AAAA,EAC1C,EAAA,EAAI,aAAA;AAAA,EACJ,WAAA,EAAa,4DAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM;AAAA;AAAA,QAEJ,MAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,QAAA;AAAA,QACA,UAAA;AAAA;AAAA,QAEA;AAAA;AAAA;AACF,KACF;AAAA,IACA,EAAA,EAAI;AAAA,MACF,IAAA,EAAM,WAAA;AAAA,MACN,KAAA,EAAO;AAAA,QACL;AAAA;AAAA;AACF;AACF;AAEJ;;;ACvBO,IAAM,SAAA,GAA8B;AAAA,EACzC,EAAA,EAAI,YAAA;AAAA,EACJ,WAAA,EAAa,qDAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM;AAAA,QACJ,gBAAA;AAAA,QACA,eAAA;AAAA,QACA,iBAAA;AAAA,QACA,mBAAA;AAAA,QACA,gBAAA;AAAA;AAAA,QACA;AAAA;AAAA;AACF,KACF;AAAA,IACA,OAAA,EAAS;AAAA,MACP,KAAA,EAAO;AAAA,QACL,gBAAA;AAAA,QACA,mBAAA;AAAA,QACA;AAAA;AAAA;AACF;AACF;AAEJ;;;ACtBO,IAAM,WAAA,GAAgC;AAAA,EAC3C,EAAA,EAAI,cAAA;AAAA,EACJ,WAAA,EAAa,qDAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM;AAAA;AAAA,QAEJ,YAAA;AAAA,QACA,gBAAA;AAAA,QACA,UAAA;AAAA;AAAA,QAEA,kBAAA;AAAA,QACA,sBAAA;AAAA,QACA,YAAA;AAAA;AAAA,QAEA,cAAA;AAAA,QACA,kBAAA;AAAA,QACA,YAAA;AAAA;AAAA,QAEA,gBAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,IACA,OAAA,EAAS;AAAA,MACP,KAAA,EAAO;AAAA,QACL,WAAA;AAAA,QACA,WAAA;AAAA,QACA,aAAA;AAAA,QACA,eAAA;AAAA,QACA;AAAA;AACF;AACF;AAEJ;;;ACjCO,IAAM,aAAA,GAAkC;AAAA,EAC7C,EAAA,EAAI,gBAAA;AAAA,EACJ,WAAA,EAAa,+DAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM;AAAA;AAAA,QAEJ,IAAA;AAAA,QACA,MAAA;AAAA,QACA,wBAAA;AAAA;AAAA,QAEA,cAAA;AAAA,QACA,UAAA;AAAA,QACA,UAAA;AAAA;AAAA,QAEA,UAAA;AAAA,QACA,cAAA;AAAA;AAAA,QAEA,WAAA;AAAA,QACA,SAAA;AAAA;AAAA,QAEA,aAAA;AAAA,QACA,UAAA;AAAA,QACA;AAAA;AACF;AACF;AAEJ;;;ACjCA,IAAA,eAAA,GAAA;AAAA,QAAA,CAAA,eAAA,EAAA;AAAA,EAAA,aAAA,EAAA,MAAA,aAAA;AAAA,EAAA,OAAA,EAAA,MAAA,OAAA;AAAA,EAAA,WAAA,EAAA,MAAA,WAAA;AAAA,EAAA,UAAA,EAAA,MAAA,UAAA;AAAA,EAAA,SAAA,EAAA,MAAA,SAAA;AAAA,EAAA,OAAA,EAAA,MAAA,OAAA;AAAA,EAAA,UAAA,EAAA,MAAA,UAAA;AAAA,EAAA,WAAA,EAAA,MAAA;AAAA,CAAA,CAAA;;;ACKA,SAAS,WAAA,CAAY,GAAc,CAAA,EAAoC;AACrE,EAAA,IAAI,CAAC,CAAA,IAAK,CAAC,CAAA,EAAG;AAAC,IAAA,OAAO,MAAA;AAAA,EAAU;AAChC,EAAA,MAAM,GAAA,mBAAM,IAAI,GAAA,CAAI,CAAC,GAAI,CAAA,IAAK,EAAC,EAAI,GAAI,CAAA,IAAK,EAAG,CAAC,CAAA;AAChD,EAAA,OAAO,IAAI,IAAA,GAAO,CAAA,GAAI,CAAC,GAAG,GAAG,CAAA,GAAI,MAAA;AACnC;AAKA,SAAS,wBAAA,CACP,MACA,IAAA,EACwC;AACxC,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,IAAA,EAAM;AAAC,IAAA,OAAO,MAAA;AAAA,EAAU;AACtC,EAAA,IAAI,CAAC,IAAA,EAAM;AAAC,IAAA,OAAO,IAAA;AAAA,EAAK;AACxB,EAAA,IAAI,CAAC,IAAA,EAAM;AAAC,IAAA,OAAO,IAAA;AAAA,EAAK;AAIxB,EAAA,MAAM,SAAwC,EAAC;AAG/C,EAAA,MAAM,IAAA,mBAAO,IAAI,GAAA,CAAI,CAAC,GAAG,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,EAAG,GAAG,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAC,CAAA;AAEjE,EAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,IAAA,MAAM,OAAA,GAAU,KAAK,GAAG,CAAA;AACxB,IAAA,MAAM,OAAA,GAAU,KAAK,GAAG,CAAA;AAExB,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,MAAA,CAAO,GAAa,CAAA,GAAI,OAAA;AAAA,IAC1B,CAAA,MAAA,IAAW,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG;AAEjC,MAAA,MAAA,CAAO,GAAa,CAAA,GAAI,WAAA;AAAA,QACtB,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,GAAI,OAAA,GAAU,MAAA;AAAA,QACnC;AAAA,OACF;AAAA,IACF,CAAA,MAAA,IAAW,OAAO,OAAA,KAAY,QAAA,IAAY,YAAY,IAAA,EAAM;AAE1D,MAAA,MAAA,CAAO,GAAa,CAAA,GAAI,EAAE,GAAI,OAAO,OAAA,KAAY,QAAA,GAAW,OAAA,GAAU,EAAC,EAAI,GAAG,OAAA,EAAQ;AAAA,IACxF,CAAA,MAAO;AAEL,MAAA,MAAA,CAAO,GAAa,CAAA,GAAI,OAAA;AAAA,IAC1B;AAAA,EACF;AAEA,EAAA,OAAO,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,MAAA,GAAS,IAAK,MAAA,GAA0B,MAAA;AACrE;AAMA,SAAS,UAAA,CAAW,MAAsB,IAAA,EAAsC;AAC9E,EAAA,MAAM,SAAyB,EAAC;AAGhC,EAAA,IAAI,IAAA,CAAK,EAAA,IAAM,IAAA,CAAK,EAAA,EAAI;AACtB,IAAA,MAAA,CAAO,EAAA,GAAK;AAAA;AAAA,MAEV,IAAA,EAAM,IAAA,CAAK,EAAA,EAAI,IAAA,IAAQ,KAAK,EAAA,EAAI,IAAA;AAAA,MAChC,OAAO,WAAA,CAAY,IAAA,CAAK,IAAI,KAAA,EAAO,IAAA,CAAK,IAAI,KAAK;AAAA,KACnD;AAEA,IAAA,IAAI,MAAA,CAAO,EAAA,CAAG,IAAA,KAAS,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,EAAA,CAAG,IAAA;AAAA,IAAK;AACzD,IAAA,IAAI,MAAA,CAAO,EAAA,CAAG,KAAA,KAAU,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,EAAA,CAAG,KAAA;AAAA,IAAM;AAC3D,IAAA,IAAI,OAAO,IAAA,CAAK,MAAA,CAAO,EAAE,CAAA,CAAE,WAAW,CAAA,EAAG;AAAC,MAAA,OAAO,MAAA,CAAO,EAAA;AAAA,IAAG;AAAA,EAC7D;AAGA,EAAA,IAAI,IAAA,CAAK,GAAA,IAAO,IAAA,CAAK,GAAA,EAAK;AACxB,IAAA,MAAA,CAAO,GAAA,GAAM;AAAA,MACX,MAAM,WAAA,CAAY,IAAA,CAAK,KAAK,IAAA,EAAM,IAAA,CAAK,KAAK,IAAI;AAAA,KAClD;AACA,IAAA,IAAI,MAAA,CAAO,GAAA,CAAI,IAAA,KAAS,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,GAAA,CAAI,IAAA;AAAA,IAAK;AAC3D,IAAA,IAAI,OAAO,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,CAAE,WAAW,CAAA,EAAG;AAAC,MAAA,OAAO,MAAA,CAAO,GAAA;AAAA,IAAI;AAAA,EAC/D;AAGA,EAAA,IAAI,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,OAAA,EAAS;AAChC,IAAA,MAAA,CAAO,OAAA,GAAU;AAAA,MACf,OAAO,WAAA,CAAY,IAAA,CAAK,SAAS,KAAA,EAAO,IAAA,CAAK,SAAS,KAAK;AAAA,KAC7D;AACA,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,KAAA,KAAU,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,OAAA,CAAQ,KAAA;AAAA,IAAM;AACrE,IAAA,IAAI,OAAO,IAAA,CAAK,MAAA,CAAO,OAAO,CAAA,CAAE,WAAW,CAAA,EAAG;AAAC,MAAA,OAAO,MAAA,CAAO,OAAA;AAAA,IAAQ;AAAA,EACvE;AAGA,EAAA,IAAI,IAAA,CAAK,KAAA,IAAS,IAAA,CAAK,KAAA,EAAO;AAC5B,IAAA,MAAA,CAAO,KAAA,GAAQ;AAAA,MACb,OAAO,WAAA,CAAY,IAAA,CAAK,OAAO,KAAA,EAAO,IAAA,CAAK,OAAO,KAAK;AAAA,KACzD;AACA,IAAA,IAAI,MAAA,CAAO,KAAA,CAAM,KAAA,KAAU,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,KAAA,CAAM,KAAA;AAAA,IAAM;AACjE,IAAA,IAAI,OAAO,IAAA,CAAK,MAAA,CAAO,KAAK,CAAA,CAAE,WAAW,CAAA,EAAG;AAAC,MAAA,OAAO,MAAA,CAAO,KAAA;AAAA,IAAM;AAAA,EACnE;AAGA,EAAA,MAAA,CAAO,QAAA,GAAW,wBAAA,CAAyB,IAAA,CAAK,QAAA,EAAU,KAAK,QAAQ,CAAA;AAGvE,EAAA,IAAI,IAAA,CAAK,MAAA,IAAU,IAAA,CAAK,MAAA,EAAQ;AAC9B,IAAA,MAAA,CAAO,MAAA,GAAS;AAAA,MACd,SAAA,EAAW,IAAA,CAAK,MAAA,EAAQ,SAAA,IAAa,KAAK,MAAA,EAAQ,SAAA;AAAA,MAClD,QAAA,EAAU,IAAA,CAAK,MAAA,EAAQ,QAAA,IAAY,KAAK,MAAA,EAAQ,QAAA;AAAA,MAChD,KAAA,EAAO,IAAA,CAAK,MAAA,EAAQ,KAAA,IAAS,KAAK,MAAA,EAAQ;AAAA,KAC5C;AACA,IAAA,IAAI,MAAA,CAAO,MAAA,CAAO,SAAA,KAAc,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,MAAA,CAAO,SAAA;AAAA,IAAU;AAC3E,IAAA,IAAI,MAAA,CAAO,MAAA,CAAO,QAAA,KAAa,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,MAAA,CAAO,QAAA;AAAA,IAAS;AACzE,IAAA,IAAI,MAAA,CAAO,MAAA,CAAO,KAAA,KAAU,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,MAAA,CAAO,KAAA;AAAA,IAAM;AACnE,IAAA,IAAI,OAAO,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA,CAAE,WAAW,CAAA,EAAG;AAAC,MAAA,OAAO,MAAA,CAAO,MAAA;AAAA,IAAO;AAAA,EACrE;AAEA,EAAA,OAAO,MAAA;AACT;AAUA,SAAS,gBAAgB,IAAA,EAA6C;AACpE,EAAA,MAAM,SAAgC,EAAC;AAGvC,EAAA,IAAI,KAAK,EAAA,EAAI;AACX,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,IAAA,CAAK,EAAA;AAC7B,IAAA,MAAA,CAAO,KAAK,EAAC;AAEb,IAAA,IAAI,KAAA,IAAS,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG;AAE7B,MAAA,MAAA,CAAO,EAAA,CAAG,IAAA,GAAO,CAAC,GAAG,KAAK,CAAA;AAG1B,MAAA,IAAI,SAAS,WAAA,EAAa;AACxB,QAAA,MAAA,CAAO,EAAA,CAAG,KAAA,GAAQ,CAAC,GAAG,KAAK,CAAA;AAAA,MAC7B;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,IAAA,CAAK,MAAA,CAAO,EAAE,CAAA,CAAE,WAAW,CAAA,EAAG;AAAC,MAAA,OAAO,MAAA,CAAO,EAAA;AAAA,IAAG;AAAA,EAC7D;AAGA,EAAA,IAAI,KAAK,GAAA,EAAK;AACZ,IAAA,MAAA,CAAO,GAAA,GAAM,EAAE,GAAG,IAAA,CAAK,GAAA,EAAI;AAAA,EAC7B;AAEA,EAAA,IAAI,KAAK,OAAA,EAAS;AAChB,IAAA,MAAA,CAAO,OAAA,GAAU,EAAE,GAAG,IAAA,CAAK,OAAA,EAAQ;AAAA,EACrC;AAEA,EAAA,IAAI,KAAK,KAAA,EAAO;AACd,IAAA,MAAA,CAAO,KAAA,GAAQ,EAAE,GAAG,IAAA,CAAK,KAAA,EAAM;AAAA,EACjC;AAEA,EAAA,IAAI,KAAK,QAAA,EAAU;AACjB,IAAA,MAAA,CAAO,QAAA,GAAW,EAAE,GAAG,IAAA,CAAK,QAAA,EAAS;AAAA,EACvC;AAEA,EAAA,IAAI,KAAK,MAAA,EAAQ;AACf,IAAA,MAAA,CAAO,MAAA,GAAS,EAAE,GAAG,IAAA,CAAK,MAAA,EAAO;AAAA,EACnC;AAEA,EAAA,OAAO,MAAA;AACT;AAcO,SAAS,OAAA,GAAyB;AACvC,EAAA,IAAI,cAA8B,EAAC;AAEnC,EAAA,MAAM,OAAA,GAAyB;AAAA,IAC7B,KAAK,MAAA,EAA0D;AAC7D,MAAA,MAAM,IAAA,GAAO,aAAA,IAAiB,MAAA,GAAS,MAAA,CAAO,WAAA,GAAc,MAAA;AAC5D,MAAA,WAAA,GAAc,UAAA,CAAW,aAAa,IAAI,CAAA;AAC1C,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,QAAQ,IAAA,EAA+B;AACrC,MAAA,WAAA,GAAc,UAAA,CAAW,aAAa,EAAE,GAAA,EAAK,EAAE,IAAA,EAAM,IAAA,IAAQ,CAAA;AAC7D,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,OAAO,EAAA,EAAyC;AAC9C,MAAA,IAAI,EAAA,EAAI;AACN,QAAA,WAAA,GAAc,UAAA,CAAW,WAAA,EAAa,EAAE,EAAA,EAAI,CAAA;AAAA,MAC9C;AACA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,YAAY,OAAA,EAAmD;AAC7D,MAAA,IAAI,OAAA,EAAS;AACX,QAAA,WAAA,GAAc,UAAA,CAAW,WAAA,EAAa,EAAE,OAAA,EAAS,CAAA;AAAA,MACnD;AACA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,UAAU,KAAA,EAA+C;AACvD,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,WAAA,GAAc,UAAA,CAAW,WAAA,EAAa,EAAE,KAAA,EAAO,CAAA;AAAA,MACjD;AACA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,aAAa,QAAA,EAAqD;AAChE,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,WAAA,GAAc,UAAA,CAAW,WAAA,EAAa,EAAE,QAAA,EAAU,CAAA;AAAA,MACpD;AACA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,WAAW,MAAA,EAAiD;AAC1D,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,WAAA,GAAc,UAAA,CAAW,WAAA,EAAa,EAAE,MAAA,EAAQ,CAAA;AAAA,MAClD;AACA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,YAAY,OAAA,EAAwD;AAClE,MAAA,IAAI,YAAY,MAAA,EAAW;AACzB,QAAA,WAAA,GAAc,WAAW,WAAA,EAAa;AAAA,UACpC,QAAA,EAAU,EAAE,OAAA;AAAQ,SACrB,CAAA;AAAA,MACH;AACA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,aAAa,QAAA,EAA0D;AACrE,MAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,QAAA,WAAA,GAAc,WAAW,WAAA,EAAa;AAAA,UACpC,QAAA,EAAU,EAAE,QAAA;AAAS,SACtB,CAAA;AAAA,MACH;AACA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,KAAA,GAA+B;AAC7B,MAAA,OAAO,gBAAgB,WAAW,CAAA;AAAA,IACpC;AAAA,GACF;AAEA,EAAA,OAAO,OAAA;AACT;AAUO,SAAS,kBAAkB,OAAA,EAAuE;AACvG,EAAA,IAAI,UAAU,OAAA,EAAQ;AACtB,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,OAAA,GAAU,OAAA,CAAQ,KAAK,MAAM,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO,QAAQ,KAAA,EAAM;AACvB","file":"index.js","sourcesContent":["import type { PermissionPreset } from '../types';\n\n/**\n * Minimal preset - only basic Node.js environment\n * Use when plugin doesn't need any external access\n */\nexport const minimal: PermissionPreset = {\n  id: 'minimal',\n  description: 'Minimal permissions - basic Node.js environment only',\n  permissions: {\n    env: {\n      read: [\n        'NODE_ENV',\n        'PATH',\n        'LANG',\n        'LC_ALL',\n        'TZ',\n      ],\n    },\n  },\n};\n","import type { PermissionPreset } from '../types';\n\n/**\n * Git workflow preset - for plugins that use git (simple-git, etc.)\n * Includes HOME for ~/.gitconfig, USER for author info\n */\nexport const gitWorkflow: PermissionPreset = {\n  id: 'git-workflow',\n  description: 'Git operations - includes HOME, USER, and git config access',\n  permissions: {\n    env: {\n      read: [\n        // System (required for git to find config)\n        'HOME',\n        'USER',\n        'PATH',\n        'SHELL',\n        'TERM',\n        'LANG',\n        'LC_ALL',\n        'TZ',\n        'TMPDIR',\n        // Git-specific\n        'GIT_*',           // All git env vars (GIT_AUTHOR_NAME, GIT_DIR, etc.)\n        'SSH_AUTH_SOCK',   // For SSH key auth\n        'SSH_AGENT_PID',\n        // Node\n        'NODE_ENV',\n      ],\n    },\n    fs: {\n      mode: 'readWrite',\n      allow: [\n        '**/.git/**',      // Git directory\n        '**/.gitignore',\n        '**/.gitattributes',\n      ],\n    },\n  },\n};\n","import type { PermissionPreset } from '../types';\n\n/**\n * NPM publish preset - for plugins that publish to npm\n * Includes HOME for ~/.npmrc, npm auth tokens\n */\nexport const npmPublish: PermissionPreset = {\n  id: 'npm-publish',\n  description: 'NPM operations - includes HOME, npm tokens, and registry access',\n  permissions: {\n    env: {\n      read: [\n        // System (required for npm to find config)\n        'HOME',\n        'USER',\n        'PATH',\n        'TMPDIR',\n        'LANG',\n        'LC_ALL',\n        'TZ',\n        // NPM-specific\n        'NPM_TOKEN',\n        'NPM_AUTH_TOKEN',\n        'NODE_AUTH_TOKEN',\n        'npm_*',           // All npm env vars\n        // Node\n        'NODE_ENV',\n        'NODE_OPTIONS',\n      ],\n    },\n    fs: {\n      mode: 'readWrite',\n      allow: [\n        '**/package.json',\n        '**/package-lock.json',\n        '**/pnpm-lock.yaml',\n        '**/.npmrc',\n        '**/.npmignore',\n      ],\n    },\n    network: {\n      fetch: [\n        'registry.npmjs.org',\n        'npm.pkg.github.com',\n      ],\n    },\n  },\n};\n","import type { PermissionPreset } from '../types';\n\n/**\n * Full environment preset - access to all environment variables\n * Use for trusted plugins that need full system access\n * WARNING: This bypasses env filtering entirely\n */\nexport const fullEnv: PermissionPreset = {\n  id: 'full-env',\n  description: 'Full environment access - all env vars available (trusted plugins only)',\n  permissions: {\n    env: {\n      read: ['*'], // Wildcard - all env vars\n    },\n  },\n};\n","import type { PermissionPreset } from '../types';\n\n/**\n * KB Platform preset - for KB Labs internal plugins\n * Includes KB_* env vars and .kb/ directory access\n */\nexport const kbPlatform: PermissionPreset = {\n  id: 'kb-platform',\n  description: 'KB Labs platform access - KB_* env vars and .kb/ directory',\n  permissions: {\n    env: {\n      read: [\n        // System basics\n        'HOME',\n        'USER',\n        'PATH',\n        'TMPDIR',\n        'NODE_ENV',\n        // KB Labs specific\n        'KB_*',            // All KB env vars\n      ],\n    },\n    fs: {\n      mode: 'readWrite',\n      allow: [\n        '.kb/**',          // KB Labs config directory\n      ],\n    },\n  },\n};\n","import type { PermissionPreset } from '../types';\n\n/**\n * LLM Access preset - for plugins that use LLM APIs\n * Includes OpenAI and Anthropic API keys and network access\n */\nexport const llmAccess: PermissionPreset = {\n  id: 'llm-access',\n  description: 'LLM API access - OpenAI, Anthropic keys and network',\n  permissions: {\n    env: {\n      read: [\n        'OPENAI_API_KEY',\n        'OPENAI_ORG_ID',\n        'OPENAI_BASE_URL',\n        'ANTHROPIC_API_KEY',\n        'AZURE_OPENAI_*',     // Azure OpenAI\n        'LLM_*',              // Generic LLM config\n      ],\n    },\n    network: {\n      fetch: [\n        'api.openai.com',\n        'api.anthropic.com',\n        '*.openai.azure.com', // Azure OpenAI\n      ],\n    },\n  },\n};\n","import type { PermissionPreset } from '../types';\n\n/**\n * Vector Store preset - for plugins that use vector databases\n * Includes Qdrant, Pinecone, Weaviate access\n */\nexport const vectorStore: PermissionPreset = {\n  id: 'vector-store',\n  description: 'Vector database access - Qdrant, Pinecone, Weaviate',\n  permissions: {\n    env: {\n      read: [\n        // Qdrant\n        'QDRANT_URL',\n        'QDRANT_API_KEY',\n        'QDRANT_*',\n        // Pinecone\n        'PINECONE_API_KEY',\n        'PINECONE_ENVIRONMENT',\n        'PINECONE_*',\n        // Weaviate\n        'WEAVIATE_URL',\n        'WEAVIATE_API_KEY',\n        'WEAVIATE_*',\n        // Generic\n        'VECTOR_STORE_*',\n        'EMBEDDING_*',\n      ],\n    },\n    network: {\n      fetch: [\n        'localhost',\n        '127.0.0.1',\n        '*.qdrant.io',\n        '*.pinecone.io',\n        '*.weaviate.io',\n      ],\n    },\n  },\n};\n","import type { PermissionPreset } from '../types';\n\n/**\n * CI Environment preset - for plugins running in CI/CD\n * Includes GitHub Actions, GitLab CI, and common CI variables\n */\nexport const ciEnvironment: PermissionPreset = {\n  id: 'ci-environment',\n  description: 'CI/CD environment - GitHub Actions, GitLab CI tokens and vars',\n  permissions: {\n    env: {\n      read: [\n        // Common CI\n        'CI',\n        'CI_*',\n        'CONTINUOUS_INTEGRATION',\n        // GitHub Actions\n        'GITHUB_TOKEN',\n        'GITHUB_*',\n        'GH_TOKEN',\n        // GitLab CI\n        'GITLAB_*',\n        'CI_JOB_TOKEN',\n        // Jenkins\n        'JENKINS_*',\n        'BUILD_*',\n        // Generic\n        'BRANCH_NAME',\n        'TAG_NAME',\n        'COMMIT_SHA',\n      ],\n    },\n  },\n};\n","export { minimal } from './minimal';\nexport { gitWorkflow } from './git-workflow';\nexport { npmPublish } from './npm-publish';\nexport { fullEnv } from './full-env';\nexport { kbPlatform } from './kb-platform';\nexport { llmAccess } from './llm-access';\nexport { vectorStore } from './vector-store';\nexport { ciEnvironment } from './ci-environment';\n","import type { PermissionSpec, PermissionPreset, PresetBuilder, RuntimePermissionSpec, PlatformPermissions } from './types';\n\n/**\n * Merge two string arrays, removing duplicates\n */\nfunction mergeArrays(a?: string[], b?: string[]): string[] | undefined {\n  if (!a && !b) {return undefined;}\n  const set = new Set([...(a ?? []), ...(b ?? [])]);\n  return set.size > 0 ? [...set] : undefined;\n}\n\n/**\n * Merge platform permissions\n */\nfunction mergePlatformPermissions(\n  base?: PermissionSpec['platform'],\n  next?: PermissionSpec['platform']\n): PermissionSpec['platform'] | undefined {\n  if (!base && !next) {return undefined;}\n  if (!base) {return next;}\n  if (!next) {return base;}\n\n  type PlatformSpec = NonNullable<PermissionSpec['platform']>;\n  type PlatformValue = PlatformSpec[keyof PlatformSpec];\n  const result: Record<string, PlatformValue> = {};\n\n  // Merge each platform service (second value wins for booleans, arrays are merged)\n  const keys = new Set([...Object.keys(base), ...Object.keys(next)]) as Set<keyof PlatformSpec>;\n\n  for (const key of keys) {\n    const baseVal = base[key];\n    const nextVal = next[key];\n\n    if (nextVal === undefined) {\n      result[key as string] = baseVal;\n    } else if (Array.isArray(nextVal)) {\n      // Merge arrays (for cache namespaces, storage paths)\n      result[key as string] = mergeArrays(\n        Array.isArray(baseVal) ? baseVal : undefined,\n        nextVal\n      ) as PlatformValue;\n    } else if (typeof nextVal === 'object' && nextVal !== null) {\n      // Merge objects (for llm.models, vectorStore.collections, etc.)\n      result[key as string] = { ...(typeof baseVal === 'object' ? baseVal : {}), ...nextVal } as PlatformValue;\n    } else {\n      // Boolean or primitive - second value wins\n      result[key as string] = nextVal;\n    }\n  }\n\n  return Object.keys(result).length > 0 ? (result as PlatformSpec) : undefined;\n}\n\n/**\n * Merge two permission specs together\n * Arrays are merged (union), scalars use the second value\n */\nfunction mergeSpecs(base: PermissionSpec, next: PermissionSpec): PermissionSpec {\n  const result: PermissionSpec = {};\n\n  // Merge fs\n  if (base.fs || next.fs) {\n    result.fs = {\n      // readWrite wins over read\n      mode: next.fs?.mode ?? base.fs?.mode,\n      allow: mergeArrays(base.fs?.allow, next.fs?.allow),\n    };\n    // Clean up undefined fields\n    if (result.fs.mode === undefined) {delete result.fs.mode;}\n    if (result.fs.allow === undefined) {delete result.fs.allow;}\n    if (Object.keys(result.fs).length === 0) {delete result.fs;}\n  }\n\n  // Merge env\n  if (base.env || next.env) {\n    result.env = {\n      read: mergeArrays(base.env?.read, next.env?.read),\n    };\n    if (result.env.read === undefined) {delete result.env.read;}\n    if (Object.keys(result.env).length === 0) {delete result.env;}\n  }\n\n  // Merge network\n  if (base.network || next.network) {\n    result.network = {\n      fetch: mergeArrays(base.network?.fetch, next.network?.fetch),\n    };\n    if (result.network.fetch === undefined) {delete result.network.fetch;}\n    if (Object.keys(result.network).length === 0) {delete result.network;}\n  }\n\n  // Merge shell\n  if (base.shell || next.shell) {\n    result.shell = {\n      allow: mergeArrays(base.shell?.allow, next.shell?.allow),\n    };\n    if (result.shell.allow === undefined) {delete result.shell.allow;}\n    if (Object.keys(result.shell).length === 0) {delete result.shell;}\n  }\n\n  // Merge platform\n  result.platform = mergePlatformPermissions(base.platform, next.platform);\n\n  // Merge quotas (second value wins)\n  if (base.quotas || next.quotas) {\n    result.quotas = {\n      timeoutMs: next.quotas?.timeoutMs ?? base.quotas?.timeoutMs,\n      memoryMb: next.quotas?.memoryMb ?? base.quotas?.memoryMb,\n      cpuMs: next.quotas?.cpuMs ?? base.quotas?.cpuMs,\n    };\n    if (result.quotas.timeoutMs === undefined) {delete result.quotas.timeoutMs;}\n    if (result.quotas.memoryMb === undefined) {delete result.quotas.memoryMb;}\n    if (result.quotas.cpuMs === undefined) {delete result.quotas.cpuMs;}\n    if (Object.keys(result.quotas).length === 0) {delete result.quotas;}\n  }\n\n  return result;\n}\n\n/**\n * Convert declarative PermissionSpec to explicit RuntimePermissionSpec\n *\n * Transforms:\n *   { mode: 'readWrite', allow: ['*.json'] }\n * Into:\n *   { read: ['*.json'], write: ['*.json'] }\n */\nfunction toRuntimeFormat(spec: PermissionSpec): RuntimePermissionSpec {\n  const result: RuntimePermissionSpec = {};\n\n  // Convert fs: mode + allow → read[] + write[]\n  if (spec.fs) {\n    const { mode, allow } = spec.fs;\n    result.fs = {};\n\n    if (allow && allow.length > 0) {\n      // read is always granted for allowed paths\n      result.fs.read = [...allow];\n\n      // write only if mode is 'readWrite'\n      if (mode === 'readWrite') {\n        result.fs.write = [...allow];\n      }\n    }\n\n    if (Object.keys(result.fs).length === 0) {delete result.fs;}\n  }\n\n  // env, network, shell, platform, quotas pass through unchanged\n  if (spec.env) {\n    result.env = { ...spec.env };\n  }\n\n  if (spec.network) {\n    result.network = { ...spec.network };\n  }\n\n  if (spec.shell) {\n    result.shell = { ...spec.shell };\n  }\n\n  if (spec.platform) {\n    result.platform = { ...spec.platform };\n  }\n\n  if (spec.quotas) {\n    result.quotas = { ...spec.quotas };\n  }\n\n  return result;\n}\n\n/**\n * Create a builder for combining permission presets\n *\n * @example\n * ```typescript\n * const permissions = combine()\n *   .with(presets.gitWorkflow)\n *   .with(presets.npmPublish)\n *   .withEnv(['MY_CUSTOM_VAR'])\n *   .build();\n * ```\n */\nexport function combine(): PresetBuilder {\n  let accumulated: PermissionSpec = {};\n\n  const builder: PresetBuilder = {\n    with(preset: PermissionPreset | PermissionSpec): PresetBuilder {\n      const spec = 'permissions' in preset ? preset.permissions : preset;\n      accumulated = mergeSpecs(accumulated, spec);\n      return builder;\n    },\n\n    withEnv(vars: string[]): PresetBuilder {\n      accumulated = mergeSpecs(accumulated, { env: { read: vars } });\n      return builder;\n    },\n\n    withFs(fs: PermissionSpec['fs']): PresetBuilder {\n      if (fs) {\n        accumulated = mergeSpecs(accumulated, { fs });\n      }\n      return builder;\n    },\n\n    withNetwork(network: PermissionSpec['network']): PresetBuilder {\n      if (network) {\n        accumulated = mergeSpecs(accumulated, { network });\n      }\n      return builder;\n    },\n\n    withShell(shell: PermissionSpec['shell']): PresetBuilder {\n      if (shell) {\n        accumulated = mergeSpecs(accumulated, { shell });\n      }\n      return builder;\n    },\n\n    withPlatform(platform: PermissionSpec['platform']): PresetBuilder {\n      if (platform) {\n        accumulated = mergeSpecs(accumulated, { platform });\n      }\n      return builder;\n    },\n\n    withQuotas(quotas: PermissionSpec['quotas']): PresetBuilder {\n      if (quotas) {\n        accumulated = mergeSpecs(accumulated, { quotas });\n      }\n      return builder;\n    },\n\n    withStorage(storage: PlatformPermissions['storage']): PresetBuilder {\n      if (storage !== undefined) {\n        accumulated = mergeSpecs(accumulated, {\n          platform: { storage },\n        });\n      }\n      return builder;\n    },\n\n    withDatabase(database: PlatformPermissions['database']): PresetBuilder {\n      if (database !== undefined) {\n        accumulated = mergeSpecs(accumulated, {\n          platform: { database },\n        });\n      }\n      return builder;\n    },\n\n    build(): RuntimePermissionSpec {\n      return toRuntimeFormat(accumulated);\n    },\n  };\n\n  return builder;\n}\n\n/**\n * Quickly combine multiple presets into a single permission spec\n *\n * @example\n * ```typescript\n * const permissions = combinePresets(presets.gitWorkflow, presets.npmPublish);\n * ```\n */\nexport function combinePresets(...presets: (PermissionPreset | PermissionSpec)[]): RuntimePermissionSpec {\n  let builder = combine();\n  for (const preset of presets) {\n    builder = builder.with(preset);\n  }\n  return builder.build();\n}\n\n/**\n * Export toRuntimeFormat for advanced use cases\n */\nexport { toRuntimeFormat };\n"]}
+{"version":3,"sources":["../src/presets/minimal.ts","../src/presets/git-workflow.ts","../src/presets/npm-publish.ts","../src/presets/full-env.ts","../src/presets/kb-platform.ts","../src/presets/llm-access.ts","../src/presets/vector-store.ts","../src/presets/ci-environment.ts","../src/presets/index.ts","../src/combine.ts"],"names":[],"mappings":";;;;;;;AAMO,IAAM,OAAA,GAA4B;AAAA,EACvC,EAAA,EAAI,SAAA;AAAA,EACJ,WAAA,EAAa,sDAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM;AAAA,QACJ,UAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,QAAA;AAAA,QACA;AAAA;AACF;AACF;AAEJ;;;ACdO,IAAM,WAAA,GAAgC;AAAA,EAC3C,EAAA,EAAI,cAAA;AAAA,EACJ,WAAA,EAAa,6DAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM;AAAA;AAAA,QAEJ,MAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,OAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,QAAA;AAAA,QACA,IAAA;AAAA,QACA,QAAA;AAAA;AAAA,QAEA,OAAA;AAAA;AAAA,QACA,eAAA;AAAA;AAAA,QACA,eAAA;AAAA;AAAA,QAEA;AAAA;AACF,KACF;AAAA,IACA,EAAA,EAAI;AAAA,MACF,IAAA,EAAM,WAAA;AAAA,MACN,KAAA,EAAO;AAAA,QACL,YAAA;AAAA;AAAA,QACA,eAAA;AAAA,QACA;AAAA;AACF;AACF;AAEJ;;;ACjCO,IAAM,UAAA,GAA+B;AAAA,EAC1C,EAAA,EAAI,aAAA;AAAA,EACJ,WAAA,EAAa,iEAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM;AAAA;AAAA,QAEJ,MAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,QAAA;AAAA,QACA,MAAA;AAAA,QACA,QAAA;AAAA,QACA,IAAA;AAAA;AAAA,QAEA,WAAA;AAAA,QACA,gBAAA;AAAA,QACA,iBAAA;AAAA,QACA,OAAA;AAAA;AAAA;AAAA,QAEA,UAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,IACA,EAAA,EAAI;AAAA,MACF,IAAA,EAAM,WAAA;AAAA,MACN,KAAA,EAAO;AAAA,QACL,iBAAA;AAAA,QACA,sBAAA;AAAA,QACA,mBAAA;AAAA,QACA,WAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,IACA,OAAA,EAAS;AAAA,MACP,KAAA,EAAO;AAAA,QACL,oBAAA;AAAA,QACA;AAAA;AACF;AACF;AAEJ;;;ACxCO,IAAM,OAAA,GAA4B;AAAA,EACvC,EAAA,EAAI,UAAA;AAAA,EACJ,WAAA,EAAa,yEAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM,CAAC,GAAG;AAAA;AAAA;AACZ;AAEJ;;;ACTO,IAAM,UAAA,GAA+B;AAAA,EAC1C,EAAA,EAAI,aAAA;AAAA,EACJ,WAAA,EAAa,4DAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM;AAAA;AAAA,QAEJ,MAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,QAAA;AAAA,QACA,UAAA;AAAA;AAAA,QAEA;AAAA;AAAA;AACF,KACF;AAAA,IACA,EAAA,EAAI;AAAA,MACF,IAAA,EAAM,WAAA;AAAA,MACN,KAAA,EAAO;AAAA,QACL;AAAA;AAAA;AACF;AACF;AAEJ;;;ACvBO,IAAM,SAAA,GAA8B;AAAA,EACzC,EAAA,EAAI,YAAA;AAAA,EACJ,WAAA,EAAa,qDAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM;AAAA,QACJ,gBAAA;AAAA,QACA,eAAA;AAAA,QACA,iBAAA;AAAA,QACA,mBAAA;AAAA,QACA,gBAAA;AAAA;AAAA,QACA;AAAA;AAAA;AACF,KACF;AAAA,IACA,OAAA,EAAS;AAAA,MACP,KAAA,EAAO;AAAA,QACL,gBAAA;AAAA,QACA,mBAAA;AAAA,QACA;AAAA;AAAA;AACF;AACF;AAEJ;;;ACtBO,IAAM,WAAA,GAAgC;AAAA,EAC3C,EAAA,EAAI,cAAA;AAAA,EACJ,WAAA,EAAa,qDAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM;AAAA;AAAA,QAEJ,YAAA;AAAA,QACA,gBAAA;AAAA,QACA,UAAA;AAAA;AAAA,QAEA,kBAAA;AAAA,QACA,sBAAA;AAAA,QACA,YAAA;AAAA;AAAA,QAEA,cAAA;AAAA,QACA,kBAAA;AAAA,QACA,YAAA;AAAA;AAAA,QAEA,gBAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,IACA,OAAA,EAAS;AAAA,MACP,KAAA,EAAO;AAAA,QACL,WAAA;AAAA,QACA,WAAA;AAAA,QACA,aAAA;AAAA,QACA,eAAA;AAAA,QACA;AAAA;AACF;AACF;AAEJ;;;ACjCO,IAAM,aAAA,GAAkC;AAAA,EAC7C,EAAA,EAAI,gBAAA;AAAA,EACJ,WAAA,EAAa,+DAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,GAAA,EAAK;AAAA,MACH,IAAA,EAAM;AAAA;AAAA,QAEJ,IAAA;AAAA,QACA,MAAA;AAAA,QACA,wBAAA;AAAA;AAAA,QAEA,cAAA;AAAA,QACA,UAAA;AAAA,QACA,UAAA;AAAA;AAAA,QAEA,UAAA;AAAA,QACA,cAAA;AAAA;AAAA,QAEA,WAAA;AAAA,QACA,SAAA;AAAA;AAAA,QAEA,aAAA;AAAA,QACA,UAAA;AAAA,QACA;AAAA;AACF;AACF;AAEJ;;;ACjCA,IAAA,eAAA,GAAA;AAAA,QAAA,CAAA,eAAA,EAAA;AAAA,EAAA,aAAA,EAAA,MAAA,aAAA;AAAA,EAAA,OAAA,EAAA,MAAA,OAAA;AAAA,EAAA,WAAA,EAAA,MAAA,WAAA;AAAA,EAAA,UAAA,EAAA,MAAA,UAAA;AAAA,EAAA,SAAA,EAAA,MAAA,SAAA;AAAA,EAAA,OAAA,EAAA,MAAA,OAAA;AAAA,EAAA,UAAA,EAAA,MAAA,UAAA;AAAA,EAAA,WAAA,EAAA,MAAA;AAAA,CAAA,CAAA;;;ACMA,SAAS,WAAA,CAAY,GAAc,CAAA,EAAoC;AACrE,EAAA,IAAI,CAAC,CAAA,IAAK,CAAC,CAAA,EAAG;AAAC,IAAA,OAAO,MAAA;AAAA,EAAU;AAChC,EAAA,MAAM,GAAA,mBAAM,IAAI,GAAA,CAAI,CAAC,GAAI,CAAA,IAAK,EAAC,EAAI,GAAI,CAAA,IAAK,EAAG,CAAC,CAAA;AAChD,EAAA,OAAO,IAAI,IAAA,GAAO,CAAA,GAAI,CAAC,GAAG,GAAG,CAAA,GAAI,MAAA;AACnC;AAKA,SAAS,gBAAA,CACP,GACA,CAAA,EACoC;AACpC,EAAA,IAAI,CAAC,CAAA,IAAK,CAAC,CAAA,EAAG;AAAC,IAAA,OAAO,MAAA;AAAA,EAAU;AAChC,EAAA,MAAM,OAAA,GAAU,WAAA,CAAY,CAAA,EAAG,OAAA,EAAS,GAAG,OAAO,CAAA;AAClD,EAAA,OAAO,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,KAAY,EAAC;AAChD;AAKA,SAAS,wBAAA,CACP,MACA,IAAA,EACwC;AACxC,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,IAAA,EAAM;AAAC,IAAA,OAAO,MAAA;AAAA,EAAU;AACtC,EAAA,IAAI,CAAC,IAAA,EAAM;AAAC,IAAA,OAAO,IAAA;AAAA,EAAK;AACxB,EAAA,IAAI,CAAC,IAAA,EAAM;AAAC,IAAA,OAAO,IAAA;AAAA,EAAK;AAIxB,EAAA,MAAM,SAAwC,EAAC;AAG/C,EAAA,MAAM,IAAA,mBAAO,IAAI,GAAA,CAAI,CAAC,GAAG,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,EAAG,GAAG,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAC,CAAA;AAEjE,EAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,IAAA,MAAM,OAAA,GAAU,KAAK,GAAG,CAAA;AACxB,IAAA,MAAM,OAAA,GAAU,KAAK,GAAG,CAAA;AAExB,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,MAAA,CAAO,GAAa,CAAA,GAAI,OAAA;AAAA,IAC1B,CAAA,MAAA,IAAW,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG;AAEjC,MAAA,MAAA,CAAO,GAAa,CAAA,GAAI,WAAA;AAAA,QACtB,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,GAAI,OAAA,GAAU,MAAA;AAAA,QACnC;AAAA,OACF;AAAA,IACF,CAAA,MAAA,IAAW,OAAO,OAAA,KAAY,QAAA,IAAY,YAAY,IAAA,EAAM;AAE1D,MAAA,MAAA,CAAO,GAAa,CAAA,GAAI,EAAE,GAAI,OAAO,OAAA,KAAY,QAAA,GAAW,OAAA,GAAU,EAAC,EAAI,GAAG,OAAA,EAAQ;AAAA,IACxF,CAAA,MAAO;AAEL,MAAA,MAAA,CAAO,GAAa,CAAA,GAAI,OAAA;AAAA,IAC1B;AAAA,EACF;AAEA,EAAA,OAAO,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,MAAA,GAAS,IAAK,MAAA,GAA0B,MAAA;AACrE;AAMA,SAAS,UAAA,CAAW,MAAsB,IAAA,EAAsC;AAC9E,EAAA,MAAM,SAAyB,EAAC;AAGhC,EAAA,IAAI,IAAA,CAAK,EAAA,IAAM,IAAA,CAAK,EAAA,EAAI;AACtB,IAAA,MAAA,CAAO,EAAA,GAAK;AAAA;AAAA,MAEV,IAAA,EAAM,IAAA,CAAK,EAAA,EAAI,IAAA,IAAQ,KAAK,EAAA,EAAI,IAAA;AAAA,MAChC,OAAO,WAAA,CAAY,IAAA,CAAK,IAAI,KAAA,EAAO,IAAA,CAAK,IAAI,KAAK;AAAA,KACnD;AAEA,IAAA,IAAI,MAAA,CAAO,EAAA,CAAG,IAAA,KAAS,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,EAAA,CAAG,IAAA;AAAA,IAAK;AACzD,IAAA,IAAI,MAAA,CAAO,EAAA,CAAG,KAAA,KAAU,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,EAAA,CAAG,KAAA;AAAA,IAAM;AAC3D,IAAA,IAAI,OAAO,IAAA,CAAK,MAAA,CAAO,EAAE,CAAA,CAAE,WAAW,CAAA,EAAG;AAAC,MAAA,OAAO,MAAA,CAAO,EAAA;AAAA,IAAG;AAAA,EAC7D;AAGA,EAAA,IAAI,IAAA,CAAK,GAAA,IAAO,IAAA,CAAK,GAAA,EAAK;AACxB,IAAA,MAAA,CAAO,GAAA,GAAM;AAAA,MACX,MAAM,WAAA,CAAY,IAAA,CAAK,KAAK,IAAA,EAAM,IAAA,CAAK,KAAK,IAAI;AAAA,KAClD;AACA,IAAA,IAAI,MAAA,CAAO,GAAA,CAAI,IAAA,KAAS,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,GAAA,CAAI,IAAA;AAAA,IAAK;AAC3D,IAAA,IAAI,OAAO,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,CAAE,WAAW,CAAA,EAAG;AAAC,MAAA,OAAO,MAAA,CAAO,GAAA;AAAA,IAAI;AAAA,EAC/D;AAGA,EAAA,IAAI,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,OAAA,EAAS;AAChC,IAAA,MAAA,CAAO,OAAA,GAAU;AAAA,MACf,OAAO,WAAA,CAAY,IAAA,CAAK,SAAS,KAAA,EAAO,IAAA,CAAK,SAAS,KAAK,CAAA;AAAA,MAC3D,KAAK,gBAAA,CAAiB,IAAA,CAAK,SAAS,GAAA,EAAK,IAAA,CAAK,SAAS,GAAG,CAAA;AAAA,MAC1D,IAAI,gBAAA,CAAiB,IAAA,CAAK,SAAS,EAAA,EAAI,IAAA,CAAK,SAAS,EAAE;AAAA,KACzD;AACA,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,KAAA,KAAU,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,OAAA,CAAQ,KAAA;AAAA,IAAM;AACrE,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,GAAA,KAAQ,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,OAAA,CAAQ,GAAA;AAAA,IAAI;AACjE,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,EAAA,KAAO,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,OAAA,CAAQ,EAAA;AAAA,IAAG;AAC/D,IAAA,IAAI,OAAO,IAAA,CAAK,MAAA,CAAO,OAAO,CAAA,CAAE,WAAW,CAAA,EAAG;AAAC,MAAA,OAAO,MAAA,CAAO,OAAA;AAAA,IAAQ;AAAA,EACvE;AAGA,EAAA,IAAI,IAAA,CAAK,KAAA,IAAS,IAAA,CAAK,KAAA,EAAO;AAC5B,IAAA,MAAA,CAAO,KAAA,GAAQ;AAAA,MACb,OAAO,WAAA,CAAY,IAAA,CAAK,OAAO,KAAA,EAAO,IAAA,CAAK,OAAO,KAAK;AAAA,KACzD;AACA,IAAA,IAAI,MAAA,CAAO,KAAA,CAAM,KAAA,KAAU,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,KAAA,CAAM,KAAA;AAAA,IAAM;AACjE,IAAA,IAAI,OAAO,IAAA,CAAK,MAAA,CAAO,KAAK,CAAA,CAAE,WAAW,CAAA,EAAG;AAAC,MAAA,OAAO,MAAA,CAAO,KAAA;AAAA,IAAM;AAAA,EACnE;AAGA,EAAA,MAAA,CAAO,QAAA,GAAW,wBAAA,CAAyB,IAAA,CAAK,QAAA,EAAU,KAAK,QAAQ,CAAA;AAGvE,EAAA,IAAI,IAAA,CAAK,MAAA,IAAU,IAAA,CAAK,MAAA,EAAQ;AAC9B,IAAA,MAAA,CAAO,MAAA,GAAS;AAAA,MACd,SAAA,EAAW,IAAA,CAAK,MAAA,EAAQ,SAAA,IAAa,KAAK,MAAA,EAAQ,SAAA;AAAA,MAClD,QAAA,EAAU,IAAA,CAAK,MAAA,EAAQ,QAAA,IAAY,KAAK,MAAA,EAAQ,QAAA;AAAA,MAChD,KAAA,EAAO,IAAA,CAAK,MAAA,EAAQ,KAAA,IAAS,KAAK,MAAA,EAAQ;AAAA,KAC5C;AACA,IAAA,IAAI,MAAA,CAAO,MAAA,CAAO,SAAA,KAAc,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,MAAA,CAAO,SAAA;AAAA,IAAU;AAC3E,IAAA,IAAI,MAAA,CAAO,MAAA,CAAO,QAAA,KAAa,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,MAAA,CAAO,QAAA;AAAA,IAAS;AACzE,IAAA,IAAI,MAAA,CAAO,MAAA,CAAO,KAAA,KAAU,MAAA,EAAW;AAAC,MAAA,OAAO,OAAO,MAAA,CAAO,KAAA;AAAA,IAAM;AACnE,IAAA,IAAI,OAAO,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA,CAAE,WAAW,CAAA,EAAG;AAAC,MAAA,OAAO,MAAA,CAAO,MAAA;AAAA,IAAO;AAAA,EACrE;AAEA,EAAA,OAAO,MAAA;AACT;AAUA,SAAS,gBAAgB,IAAA,EAA+C;AACtE,EAAA,MAAM,SAAkC,EAAC;AAGzC,EAAA,IAAI,KAAK,EAAA,EAAI;AACX,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,IAAA,CAAK,EAAA;AAC7B,IAAA,MAAA,CAAO,KAAK,EAAC;AAEb,IAAA,IAAI,KAAA,IAAS,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG;AAC7B,MAAA,MAAA,CAAO,EAAA,CAAG,IAAA,GAAO,CAAC,GAAG,KAAK,CAAA;AAC1B,MAAA,IAAI,SAAS,WAAA,EAAa;AACxB,QAAA,MAAA,CAAO,EAAA,CAAG,KAAA,GAAQ,CAAC,GAAG,KAAK,CAAA;AAAA,MAC7B;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,IAAA,CAAK,MAAA,CAAO,EAAE,CAAA,CAAE,WAAW,CAAA,EAAG;AAAC,MAAA,OAAO,MAAA,CAAO,EAAA;AAAA,IAAG;AAAA,EAC7D;AAEA,EAAA,IAAI,KAAK,GAAA,EAAK;AAAE,IAAA,MAAA,CAAO,GAAA,GAAM,EAAE,GAAG,IAAA,CAAK,GAAA,EAAI;AAAA,EAAG;AAE9C,EAAA,IAAI,KAAK,OAAA,EAAS;AAChB,IAAA,MAAA,CAAO,UAAU,EAAC;AAClB,IAAA,IAAI,IAAA,CAAK,QAAQ,KAAA,EAAO;AAAC,MAAA,MAAA,CAAO,QAAQ,KAAA,GAAQ,CAAC,GAAG,IAAA,CAAK,QAAQ,KAAK,CAAA;AAAA,IAAE;AACxE,IAAA,IAAI,IAAA,CAAK,QAAQ,GAAA,EAAK;AAAC,MAAA,MAAA,CAAO,QAAQ,GAAA,GAAM,EAAE,GAAG,IAAA,CAAK,QAAQ,GAAA,EAAI;AAAA,IAAE;AACpE,IAAA,IAAI,IAAA,CAAK,QAAQ,EAAA,EAAI;AAAC,MAAA,MAAA,CAAO,QAAQ,EAAA,GAAK,EAAE,GAAG,IAAA,CAAK,QAAQ,EAAA,EAAG;AAAA,IAAE;AACjE,IAAA,IAAI,OAAO,IAAA,CAAK,MAAA,CAAO,OAAO,CAAA,CAAE,WAAW,CAAA,EAAG;AAAC,MAAA,OAAO,MAAA,CAAO,OAAA;AAAA,IAAQ;AAAA,EACvE;AAEA,EAAA,IAAI,KAAK,KAAA,EAAO;AAAE,IAAA,MAAA,CAAO,KAAA,GAAQ,EAAE,GAAG,IAAA,CAAK,KAAA,EAAM;AAAA,EAAG;AAEpD,EAAA,IAAI,KAAK,QAAA,EAAU;AACjB,IAAA,MAAM,EAAE,KAAA,EAAO,OAAA,EAAS,GAAG,IAAA,KAAS,IAAA,CAAK,QAAA;AACzC,IAAA,MAAA,CAAO,QAAA,GAAW;AAAA,MAChB,GAAG,IAAA;AAAA,MACH,GAAI,UAAU,MAAA,IAAa;AAAA,QACzB,KAAA,EAAO,MAAM,OAAA,CAAQ,KAAK,IAAI,EAAE,UAAA,EAAY,OAAM,GAAI;AAAA,OACxD;AAAA,MACA,GAAI,YAAY,MAAA,IAAa;AAAA,QAC3B,OAAA,EAAS,MAAM,OAAA,CAAQ,OAAO,IAAI,EAAE,KAAA,EAAO,SAAQ,GAAI;AAAA;AACzD,KACF;AAAA,EACF;AAEA,EAAA,IAAI,KAAK,MAAA,EAAQ;AAAE,IAAA,MAAA,CAAO,MAAA,GAAS,EAAE,GAAG,IAAA,CAAK,MAAA,EAAO;AAAA,EAAG;AAEvD,EAAA,OAAO,MAAA;AACT;AAcO,SAAS,OAAA,GAAyB;AACvC,EAAA,IAAI,cAA8B,EAAC;AAEnC,EAAA,MAAM,OAAA,GAAyB;AAAA,IAC7B,KAAK,MAAA,EAA0D;AAC7D,MAAA,MAAM,IAAA,GAAO,aAAA,IAAiB,MAAA,GAAS,MAAA,CAAO,WAAA,GAAc,MAAA;AAC5D,MAAA,WAAA,GAAc,UAAA,CAAW,aAAa,IAAI,CAAA;AAC1C,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,QAAQ,IAAA,EAA+B;AACrC,MAAA,WAAA,GAAc,UAAA,CAAW,aAAa,EAAE,GAAA,EAAK,EAAE,IAAA,EAAM,IAAA,IAAQ,CAAA;AAC7D,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,OAAO,EAAA,EAAyC;AAC9C,MAAA,IAAI,EAAA,EAAI;AACN,QAAA,WAAA,GAAc,UAAA,CAAW,WAAA,EAAa,EAAE,EAAA,EAAI,CAAA;AAAA,MAC9C;AACA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,YAAY,OAAA,EAAmD;AAC7D,MAAA,IAAI,OAAA,EAAS;AACX,QAAA,WAAA,GAAc,UAAA,CAAW,WAAA,EAAa,EAAE,OAAA,EAAS,CAAA;AAAA,MACnD;AACA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,UAAU,KAAA,EAA+C;AACvD,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,WAAA,GAAc,UAAA,CAAW,WAAA,EAAa,EAAE,KAAA,EAAO,CAAA;AAAA,MACjD;AACA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,aAAa,QAAA,EAAqD;AAChE,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,WAAA,GAAc,UAAA,CAAW,WAAA,EAAa,EAAE,QAAA,EAAU,CAAA;AAAA,MACpD;AACA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,WAAW,MAAA,EAAiD;AAC1D,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,WAAA,GAAc,UAAA,CAAW,WAAA,EAAa,EAAE,MAAA,EAAQ,CAAA;AAAA,MAClD;AACA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,YAAY,OAAA,EAAwD;AAClE,MAAA,IAAI,YAAY,MAAA,EAAW;AACzB,QAAA,WAAA,GAAc,WAAW,WAAA,EAAa;AAAA,UACpC,QAAA,EAAU,EAAE,OAAA;AAAQ,SACrB,CAAA;AAAA,MACH;AACA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,aAAa,QAAA,EAA0D;AACrE,MAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,QAAA,WAAA,GAAc,WAAW,WAAA,EAAa;AAAA,UACpC,QAAA,EAAU,EAAE,QAAA;AAAS,SACtB,CAAA;AAAA,MACH;AACA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,KAAA,GAAiC;AAC/B,MAAA,OAAO,gBAAgB,WAAW,CAAA;AAAA,IACpC;AAAA,GACF;AAEA,EAAA,OAAO,OAAA;AACT;AAUO,SAAS,kBAAkB,OAAA,EAAyE;AACzG,EAAA,IAAI,UAAU,OAAA,EAAQ;AACtB,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,OAAA,GAAU,OAAA,CAAQ,KAAK,MAAM,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO,QAAQ,KAAA,EAAM;AACvB","file":"index.js","sourcesContent":["import type { PermissionPreset } from '../types';\n\n/**\n * Minimal preset - only basic Node.js environment\n * Use when plugin doesn't need any external access\n */\nexport const minimal: PermissionPreset = {\n  id: 'minimal',\n  description: 'Minimal permissions - basic Node.js environment only',\n  permissions: {\n    env: {\n      read: [\n        'NODE_ENV',\n        'PATH',\n        'LANG',\n        'LC_ALL',\n        'TZ',\n      ],\n    },\n  },\n};\n","import type { PermissionPreset } from '../types';\n\n/**\n * Git workflow preset - for plugins that use git (simple-git, etc.)\n * Includes HOME for ~/.gitconfig, USER for author info\n */\nexport const gitWorkflow: PermissionPreset = {\n  id: 'git-workflow',\n  description: 'Git operations - includes HOME, USER, and git config access',\n  permissions: {\n    env: {\n      read: [\n        // System (required for git to find config)\n        'HOME',\n        'USER',\n        'PATH',\n        'SHELL',\n        'TERM',\n        'LANG',\n        'LC_ALL',\n        'TZ',\n        'TMPDIR',\n        // Git-specific\n        'GIT_*',           // All git env vars (GIT_AUTHOR_NAME, GIT_DIR, etc.)\n        'SSH_AUTH_SOCK',   // For SSH key auth\n        'SSH_AGENT_PID',\n        // Node\n        'NODE_ENV',\n      ],\n    },\n    fs: {\n      mode: 'readWrite',\n      allow: [\n        '**/.git/**',      // Git directory\n        '**/.gitignore',\n        '**/.gitattributes',\n      ],\n    },\n  },\n};\n","import type { PermissionPreset } from '../types';\n\n/**\n * NPM publish preset - for plugins that publish to npm\n * Includes HOME for ~/.npmrc, npm auth tokens\n */\nexport const npmPublish: PermissionPreset = {\n  id: 'npm-publish',\n  description: 'NPM operations - includes HOME, npm tokens, and registry access',\n  permissions: {\n    env: {\n      read: [\n        // System (required for npm to find config)\n        'HOME',\n        'USER',\n        'PATH',\n        'TMPDIR',\n        'LANG',\n        'LC_ALL',\n        'TZ',\n        // NPM-specific\n        'NPM_TOKEN',\n        'NPM_AUTH_TOKEN',\n        'NODE_AUTH_TOKEN',\n        'npm_*',           // All npm env vars\n        // Node\n        'NODE_ENV',\n        'NODE_OPTIONS',\n      ],\n    },\n    fs: {\n      mode: 'readWrite',\n      allow: [\n        '**/package.json',\n        '**/package-lock.json',\n        '**/pnpm-lock.yaml',\n        '**/.npmrc',\n        '**/.npmignore',\n      ],\n    },\n    network: {\n      fetch: [\n        'registry.npmjs.org',\n        'npm.pkg.github.com',\n      ],\n    },\n  },\n};\n","import type { PermissionPreset } from '../types';\n\n/**\n * Full environment preset - access to all environment variables\n * Use for trusted plugins that need full system access\n * WARNING: This bypasses env filtering entirely\n */\nexport const fullEnv: PermissionPreset = {\n  id: 'full-env',\n  description: 'Full environment access - all env vars available (trusted plugins only)',\n  permissions: {\n    env: {\n      read: ['*'], // Wildcard - all env vars\n    },\n  },\n};\n","import type { PermissionPreset } from '../types';\n\n/**\n * KB Platform preset - for KB Labs internal plugins\n * Includes KB_* env vars and .kb/ directory access\n */\nexport const kbPlatform: PermissionPreset = {\n  id: 'kb-platform',\n  description: 'KB Labs platform access - KB_* env vars and .kb/ directory',\n  permissions: {\n    env: {\n      read: [\n        // System basics\n        'HOME',\n        'USER',\n        'PATH',\n        'TMPDIR',\n        'NODE_ENV',\n        // KB Labs specific\n        'KB_*',            // All KB env vars\n      ],\n    },\n    fs: {\n      mode: 'readWrite',\n      allow: [\n        '.kb/**',          // KB Labs config directory\n      ],\n    },\n  },\n};\n","import type { PermissionPreset } from '../types';\n\n/**\n * LLM Access preset - for plugins that use LLM APIs\n * Includes OpenAI and Anthropic API keys and network access\n */\nexport const llmAccess: PermissionPreset = {\n  id: 'llm-access',\n  description: 'LLM API access - OpenAI, Anthropic keys and network',\n  permissions: {\n    env: {\n      read: [\n        'OPENAI_API_KEY',\n        'OPENAI_ORG_ID',\n        'OPENAI_BASE_URL',\n        'ANTHROPIC_API_KEY',\n        'AZURE_OPENAI_*',     // Azure OpenAI\n        'LLM_*',              // Generic LLM config\n      ],\n    },\n    network: {\n      fetch: [\n        'api.openai.com',\n        'api.anthropic.com',\n        '*.openai.azure.com', // Azure OpenAI\n      ],\n    },\n  },\n};\n","import type { PermissionPreset } from '../types';\n\n/**\n * Vector Store preset - for plugins that use vector databases\n * Includes Qdrant, Pinecone, Weaviate access\n */\nexport const vectorStore: PermissionPreset = {\n  id: 'vector-store',\n  description: 'Vector database access - Qdrant, Pinecone, Weaviate',\n  permissions: {\n    env: {\n      read: [\n        // Qdrant\n        'QDRANT_URL',\n        'QDRANT_API_KEY',\n        'QDRANT_*',\n        // Pinecone\n        'PINECONE_API_KEY',\n        'PINECONE_ENVIRONMENT',\n        'PINECONE_*',\n        // Weaviate\n        'WEAVIATE_URL',\n        'WEAVIATE_API_KEY',\n        'WEAVIATE_*',\n        // Generic\n        'VECTOR_STORE_*',\n        'EMBEDDING_*',\n      ],\n    },\n    network: {\n      fetch: [\n        'localhost',\n        '127.0.0.1',\n        '*.qdrant.io',\n        '*.pinecone.io',\n        '*.weaviate.io',\n      ],\n    },\n  },\n};\n","import type { PermissionPreset } from '../types';\n\n/**\n * CI Environment preset - for plugins running in CI/CD\n * Includes GitHub Actions, GitLab CI, and common CI variables\n */\nexport const ciEnvironment: PermissionPreset = {\n  id: 'ci-environment',\n  description: 'CI/CD environment - GitHub Actions, GitLab CI tokens and vars',\n  permissions: {\n    env: {\n      read: [\n        // Common CI\n        'CI',\n        'CI_*',\n        'CONTINUOUS_INTEGRATION',\n        // GitHub Actions\n        'GITHUB_TOKEN',\n        'GITHUB_*',\n        'GH_TOKEN',\n        // GitLab CI\n        'GITLAB_*',\n        'CI_JOB_TOKEN',\n        // Jenkins\n        'JENKINS_*',\n        'BUILD_*',\n        // Generic\n        'BRANCH_NAME',\n        'TAG_NAME',\n        'COMMIT_SHA',\n      ],\n    },\n  },\n};\n","export { minimal } from './minimal';\nexport { gitWorkflow } from './git-workflow';\nexport { npmPublish } from './npm-publish';\nexport { fullEnv } from './full-env';\nexport { kbPlatform } from './kb-platform';\nexport { llmAccess } from './llm-access';\nexport { vectorStore } from './vector-store';\nexport { ciEnvironment } from './ci-environment';\n","import type { PermissionSpec as ContractsPermissionSpec } from '@kb-labs/plugin-contracts';\nimport type { PermissionSpec, PermissionPreset, PresetBuilder, PlatformPermissions } from './types';\n\n/**\n * Merge two string arrays, removing duplicates\n */\nfunction mergeArrays(a?: string[], b?: string[]): string[] | undefined {\n  if (!a && !b) {return undefined;}\n  const set = new Set([...(a ?? []), ...(b ?? [])]);\n  return set.size > 0 ? [...set] : undefined;\n}\n\n/**\n * Merge { connect?: string[] } specs for TCP and WebSocket\n */\nfunction mergeConnectSpec(\n  a?: { connect?: string[] },\n  b?: { connect?: string[] }\n): { connect?: string[] } | undefined {\n  if (!a && !b) {return undefined;}\n  const connect = mergeArrays(a?.connect, b?.connect);\n  return connect !== undefined ? { connect } : {};\n}\n\n/**\n * Merge platform permissions\n */\nfunction mergePlatformPermissions(\n  base?: PermissionSpec['platform'],\n  next?: PermissionSpec['platform']\n): PermissionSpec['platform'] | undefined {\n  if (!base && !next) {return undefined;}\n  if (!base) {return next;}\n  if (!next) {return base;}\n\n  type PlatformSpec = NonNullable<PermissionSpec['platform']>;\n  type PlatformValue = PlatformSpec[keyof PlatformSpec];\n  const result: Record<string, PlatformValue> = {};\n\n  // Merge each platform service (second value wins for booleans, arrays are merged)\n  const keys = new Set([...Object.keys(base), ...Object.keys(next)]) as Set<keyof PlatformSpec>;\n\n  for (const key of keys) {\n    const baseVal = base[key];\n    const nextVal = next[key];\n\n    if (nextVal === undefined) {\n      result[key as string] = baseVal;\n    } else if (Array.isArray(nextVal)) {\n      // Merge arrays (for cache namespaces, storage paths)\n      result[key as string] = mergeArrays(\n        Array.isArray(baseVal) ? baseVal : undefined,\n        nextVal\n      ) as PlatformValue;\n    } else if (typeof nextVal === 'object' && nextVal !== null) {\n      // Merge objects (for llm.models, vectorStore.collections, etc.)\n      result[key as string] = { ...(typeof baseVal === 'object' ? baseVal : {}), ...nextVal } as PlatformValue;\n    } else {\n      // Boolean or primitive - second value wins\n      result[key as string] = nextVal;\n    }\n  }\n\n  return Object.keys(result).length > 0 ? (result as PlatformSpec) : undefined;\n}\n\n/**\n * Merge two permission specs together\n * Arrays are merged (union), scalars use the second value\n */\nfunction mergeSpecs(base: PermissionSpec, next: PermissionSpec): PermissionSpec {\n  const result: PermissionSpec = {};\n\n  // Merge fs\n  if (base.fs || next.fs) {\n    result.fs = {\n      // readWrite wins over read\n      mode: next.fs?.mode ?? base.fs?.mode,\n      allow: mergeArrays(base.fs?.allow, next.fs?.allow),\n    };\n    // Clean up undefined fields\n    if (result.fs.mode === undefined) {delete result.fs.mode;}\n    if (result.fs.allow === undefined) {delete result.fs.allow;}\n    if (Object.keys(result.fs).length === 0) {delete result.fs;}\n  }\n\n  // Merge env\n  if (base.env || next.env) {\n    result.env = {\n      read: mergeArrays(base.env?.read, next.env?.read),\n    };\n    if (result.env.read === undefined) {delete result.env.read;}\n    if (Object.keys(result.env).length === 0) {delete result.env;}\n  }\n\n  // Merge network\n  if (base.network || next.network) {\n    result.network = {\n      fetch: mergeArrays(base.network?.fetch, next.network?.fetch),\n      tcp: mergeConnectSpec(base.network?.tcp, next.network?.tcp),\n      ws: mergeConnectSpec(base.network?.ws, next.network?.ws),\n    };\n    if (result.network.fetch === undefined) {delete result.network.fetch;}\n    if (result.network.tcp === undefined) {delete result.network.tcp;}\n    if (result.network.ws === undefined) {delete result.network.ws;}\n    if (Object.keys(result.network).length === 0) {delete result.network;}\n  }\n\n  // Merge shell\n  if (base.shell || next.shell) {\n    result.shell = {\n      allow: mergeArrays(base.shell?.allow, next.shell?.allow),\n    };\n    if (result.shell.allow === undefined) {delete result.shell.allow;}\n    if (Object.keys(result.shell).length === 0) {delete result.shell;}\n  }\n\n  // Merge platform\n  result.platform = mergePlatformPermissions(base.platform, next.platform);\n\n  // Merge quotas (second value wins)\n  if (base.quotas || next.quotas) {\n    result.quotas = {\n      timeoutMs: next.quotas?.timeoutMs ?? base.quotas?.timeoutMs,\n      memoryMb: next.quotas?.memoryMb ?? base.quotas?.memoryMb,\n      cpuMs: next.quotas?.cpuMs ?? base.quotas?.cpuMs,\n    };\n    if (result.quotas.timeoutMs === undefined) {delete result.quotas.timeoutMs;}\n    if (result.quotas.memoryMb === undefined) {delete result.quotas.memoryMb;}\n    if (result.quotas.cpuMs === undefined) {delete result.quotas.cpuMs;}\n    if (Object.keys(result.quotas).length === 0) {delete result.quotas;}\n  }\n\n  return result;\n}\n\n/**\n * Convert declarative PermissionSpec to explicit ContractsPermissionSpec.\n *\n * Transforms:\n *   fs: { mode: 'readWrite', allow: ['*.json'] } → fs: { read: ['*.json'], write: ['*.json'] }\n *   platform.cache: ['ns:'] → platform.cache: { namespaces: ['ns:'] }\n *   platform.storage: ['path/'] → platform.storage: { paths: ['path/'] }\n */\nfunction toRuntimeFormat(spec: PermissionSpec): ContractsPermissionSpec {\n  const result: ContractsPermissionSpec = {};\n\n  // Convert fs: mode + allow → read[] + write[]\n  if (spec.fs) {\n    const { mode, allow } = spec.fs;\n    result.fs = {};\n\n    if (allow && allow.length > 0) {\n      result.fs.read = [...allow];\n      if (mode === 'readWrite') {\n        result.fs.write = [...allow];\n      }\n    }\n\n    if (Object.keys(result.fs).length === 0) {delete result.fs;}\n  }\n\n  if (spec.env) { result.env = { ...spec.env }; }\n\n  if (spec.network) {\n    result.network = {};\n    if (spec.network.fetch) {result.network.fetch = [...spec.network.fetch];}\n    if (spec.network.tcp) {result.network.tcp = { ...spec.network.tcp };}\n    if (spec.network.ws) {result.network.ws = { ...spec.network.ws };}\n    if (Object.keys(result.network).length === 0) {delete result.network;}\n  }\n\n  if (spec.shell) { result.shell = { ...spec.shell }; }\n\n  if (spec.platform) {\n    const { cache, storage, ...rest } = spec.platform;\n    result.platform = {\n      ...rest as NonNullable<ContractsPermissionSpec['platform']>,\n      ...(cache !== undefined && {\n        cache: Array.isArray(cache) ? { namespaces: cache } : cache,\n      }),\n      ...(storage !== undefined && {\n        storage: Array.isArray(storage) ? { paths: storage } : storage as boolean | { paths?: string[] },\n      }),\n    };\n  }\n\n  if (spec.quotas) { result.quotas = { ...spec.quotas }; }\n\n  return result;\n}\n\n/**\n * Create a builder for combining permission presets\n *\n * @example\n * ```typescript\n * const permissions = combine()\n *   .with(presets.gitWorkflow)\n *   .with(presets.npmPublish)\n *   .withEnv(['MY_CUSTOM_VAR'])\n *   .build();\n * ```\n */\nexport function combine(): PresetBuilder {\n  let accumulated: PermissionSpec = {};\n\n  const builder: PresetBuilder = {\n    with(preset: PermissionPreset | PermissionSpec): PresetBuilder {\n      const spec = 'permissions' in preset ? preset.permissions : preset;\n      accumulated = mergeSpecs(accumulated, spec);\n      return builder;\n    },\n\n    withEnv(vars: string[]): PresetBuilder {\n      accumulated = mergeSpecs(accumulated, { env: { read: vars } });\n      return builder;\n    },\n\n    withFs(fs: PermissionSpec['fs']): PresetBuilder {\n      if (fs) {\n        accumulated = mergeSpecs(accumulated, { fs });\n      }\n      return builder;\n    },\n\n    withNetwork(network: PermissionSpec['network']): PresetBuilder {\n      if (network) {\n        accumulated = mergeSpecs(accumulated, { network });\n      }\n      return builder;\n    },\n\n    withShell(shell: PermissionSpec['shell']): PresetBuilder {\n      if (shell) {\n        accumulated = mergeSpecs(accumulated, { shell });\n      }\n      return builder;\n    },\n\n    withPlatform(platform: PermissionSpec['platform']): PresetBuilder {\n      if (platform) {\n        accumulated = mergeSpecs(accumulated, { platform });\n      }\n      return builder;\n    },\n\n    withQuotas(quotas: PermissionSpec['quotas']): PresetBuilder {\n      if (quotas) {\n        accumulated = mergeSpecs(accumulated, { quotas });\n      }\n      return builder;\n    },\n\n    withStorage(storage: PlatformPermissions['storage']): PresetBuilder {\n      if (storage !== undefined) {\n        accumulated = mergeSpecs(accumulated, {\n          platform: { storage },\n        });\n      }\n      return builder;\n    },\n\n    withDatabase(database: PlatformPermissions['database']): PresetBuilder {\n      if (database !== undefined) {\n        accumulated = mergeSpecs(accumulated, {\n          platform: { database },\n        });\n      }\n      return builder;\n    },\n\n    build(): ContractsPermissionSpec {\n      return toRuntimeFormat(accumulated);\n    },\n  };\n\n  return builder;\n}\n\n/**\n * Quickly combine multiple presets into a single permission spec\n *\n * @example\n * ```typescript\n * const permissions = combinePresets(presets.gitWorkflow, presets.npmPublish);\n * ```\n */\nexport function combinePresets(...presets: (PermissionPreset | PermissionSpec)[]): ContractsPermissionSpec {\n  let builder = combine();\n  for (const preset of presets) {\n    builder = builder.with(preset);\n  }\n  return builder.build();\n}\n\n/**\n * Export toRuntimeFormat for advanced use cases\n */\nexport { toRuntimeFormat };\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kb-labs/perm-presets",
   "description": "Composable permission presets for KB Labs plugins",
-  "version": "2.94.0",
+  "version": "2.98.0",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -15,14 +15,16 @@
   "files": [
     "dist"
   ],
-  "dependencies": {},
+  "dependencies": {
+    "@kb-labs/plugin-contracts": "2.98.0"
+  },
   "devDependencies": {
     "@types/node": "^24.3.3",
     "rimraf": "^6.0.1",
     "tsup": "^8.5.0",
     "typescript": "^5.6.3",
-    "vitest": "^3.2.4",
-    "@kb-labs/devkit": "2.94.0"
+    "vitest": "^3.2.6",
+    "@kb-labs/devkit": "2.98.0"
   },
   "engines": {
     "node": ">=20.0.0",