@lannguyensi/harness 0.64.0 → 1.0.0

package/dist/policies/requires.d.ts

@@ -1,75 +0,0 @@
-import type { Requires } from "../schema/requires.js";
-export interface LedgerEntry {
-    id: string;
-    content: string;
-    source?: string;
-    createdAt: string | Date;
-    /**
-     * Phase 5 #4 — the wire bucket the entry came from. `flattenSummary`
-     * populates this from the `entries.<bucket>` key in the ledger_summary
-     * payload, mapping bucket names back to evidence-ledger types
-     * (`facts` → `fact`, `policyDecisions` → `policy_decision`, etc.).
-     *
-     * The requires evaluator uses this to skip `policy_decision` rows so
-     * past audit-log entries don't substring-match the tag they're about
-     * (the substring-pollution bug from PR #39's dogfood).
-     */
-    type?: string;
-}
-export interface RequiresEvaluation {
-    allowed: boolean;
-    reason: string;
-    matchedCount: number;
-    traceData: RequiresTrace;
-    /**
-     * One-line "to satisfy" hint describing what evidence-ledger entry
-     * would unblock the gate, derived from the policy's `requires` spec
-     * with no runtime context. Names the content to log and (if a
-     * `within` window is declared) the freshness bound. Always omits the
-     * "how": the policy gate accepts ledger entries from any producer,
-     * and naming a specific recording verb in the deny path would
-     * advertise a self-service path to an agent that the operator may
-     * not want it to take (see agent-tasks/88ca4bb3). Set on both allow
-     * and deny so consumers can show the same satisfaction contract
-     * uniformly (e.g. `harness explain <policy>` displaying it on a
-     * green-path policy).
-     */
-    recordHint: string;
-}
-export interface RequiresTrace {
-    ledgerTag: string;
-    windowSeconds: number | null;
-    totalEntries: number;
-    matchedEntryIds: string[];
-    countBound: {
-        min?: number;
-        max?: number;
-        exact?: number;
-    } | null;
-    evaluatedAt: string;
-}
-export interface EvaluateRequiresOptions {
-    /** Override "now" for deterministic testing. */
-    now?: Date;
-    /**
-     * Current git HEAD sha (40 lowercase hex chars). Consulted only when
-     * `requires.at_head === true`: an entry containing `head:<sha>`
-     * equal to this value satisfies the gate regardless of `within`.
-     * Pass `undefined` (or omit) on non-git events; the at_head branch
-     * then falls through to the standard time-window check.
-     */
-    currentHeadSha?: string;
-}
-export declare class RequiresEvaluationError extends Error {
-    constructor(message: string);
-}
-/**
- * Build a one-line "to satisfy" hint from a `requires` spec. Exported so
- * `harness explain <policy>` can show the same hint that `evaluateRequires`
- * surfaces in its deny path, without having to fire an actual evaluation.
- * `tag` is normally `requires.ledger_tag` after `${VAR}` substitution; the
- * caller may also pass the un-substituted template (explain non-trace path)
- * so the hint reads as a contract instead of a per-event message.
- */
-export declare function buildRecordHint(requires: Requires, tag: string): string;
-export declare function evaluateRequires(requires: Requires, ledgerEntries: LedgerEntry[], options?: EvaluateRequiresOptions): RequiresEvaluation;

package/dist/policies/requires.js

@@ -1,240 +0,0 @@
-import { POLICY_DECISION_TYPE } from "../io/ledger-record.js";
-import { InvalidDurationError, parseDurationSeconds } from "../io/duration.js";
-import { parseLedgerTimestamp } from "./timestamp.js";
-const HEAD_TOKEN_RE = /(?:^|\s)head:([0-9a-f]{40})(?:\s|$)/;
-function entryHeadSha(entry) {
-    const match = HEAD_TOKEN_RE.exec(entry.content);
-    return match ? match[1] : null;
-}
-export class RequiresEvaluationError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "RequiresEvaluationError";
-    }
-}
-// Matches against `content` and `source` per ARCHITECTURE.md §6
-// ("substring/regex match against ledger entries' content/source columns").
-// v1 is substring-only; regex is a v2 deferral.
-function entryMatches(entry, tag) {
-    // Phase 5 #4 — `policy_decision` rows are audit records, not
-    // evidence. Their serialised payload incidentally contains the tag
-    // they're about ("ledgerTag":"review:42"), which under the old
-    // substring filter inflated matchedCount on the same tag the
-    // decision was about. Skip them at the matcher.
-    if (entry.type === POLICY_DECISION_TYPE)
-        return false;
-    // Legacy backstop: pre-Phase-5-#4 audit rows were written with
-    // type='fact' + a `policy_decision:` content prefix. They land in
-    // the `facts` bucket and would otherwise sneak past the type guard.
-    // The content-prefix check is exact and cheap, so a user upgrading
-    // harness without flushing their dev ledger doesn't keep paying the
-    // pollution tax until the rows age out.
-    if (entry.content.startsWith(`${POLICY_DECISION_TYPE}:`))
-        return false;
-    if (entry.content.includes(tag))
-        return true;
-    if (entry.source && entry.source.includes(tag))
-        return true;
-    return false;
-}
-function entryTime(entry) {
-    const v = entry.createdAt;
-    const ms = v instanceof Date ? v.getTime() : parseLedgerTimestamp(v);
-    if (Number.isNaN(ms)) {
-        throw new RequiresEvaluationError(`ledger entry ${entry.id} has unparseable createdAt: ${String(v)}`);
-    }
-    return ms;
-}
-function describeBound(c) {
-    if (c.exact !== undefined)
-        return String(c.exact);
-    if (c.min !== undefined && c.max !== undefined)
-        return `${c.min}..${c.max}`;
-    if (c.min !== undefined)
-        return String(c.min);
-    if (c.max !== undefined)
-        return `≤${c.max}`;
-    return "?";
-}
-/**
- * Build a one-line "to satisfy" hint from a `requires` spec. Exported so
- * `harness explain <policy>` can show the same hint that `evaluateRequires`
- * surfaces in its deny path, without having to fire an actual evaluation.
- * `tag` is normally `requires.ledger_tag` after `${VAR}` substitution; the
- * caller may also pass the un-substituted template (explain non-trace path)
- * so the hint reads as a contract instead of a per-event message.
- */
-export function buildRecordHint(requires, tag) {
-    const count = requires.count;
-    // count.max-only is a "too many" shape: the satisfying action is not
-    // recording but keeping the count at or below the bound. Recording
-    // more entries would deny harder, so the "record N entries..."
-    // phrasing the other shapes use is exactly wrong here. Branch to a
-    // bound-phrased hint (agent-tasks/aee9c085).
-    const onlyMax = count?.max !== undefined && count.min === undefined && count.exact === undefined;
-    if (onlyMax) {
-        const windowPhrase = requires.within !== undefined ? ` within ${requires.within}` : "";
-        return `keep evidence-ledger entries containing \`${tag}\` at or below ${count.max}${windowPhrase}`;
-    }
-    let countPhrase;
-    if (count?.exact !== undefined) {
-        countPhrase = `${count.exact} evidence-ledger entr${count.exact === 1 ? "y" : "ies"}`;
-    }
-    else if (count?.min !== undefined) {
-        countPhrase = `${count.min} evidence-ledger entr${count.min === 1 ? "y" : "ies"}`;
-    }
-    else {
-        countPhrase = "an evidence-ledger entry";
-    }
-    const windowPhrase = requires.within !== undefined ? ` within ${requires.within}` : "";
-    return `record ${countPhrase} containing \`${tag}\`${windowPhrase}`;
-}
-export function evaluateRequires(requires, ledgerEntries, options = {}) {
-    const now = options.now ?? new Date();
-    const evaluatedAt = now.toISOString();
-    const tag = requires.ledger_tag;
-    let windowSeconds = null;
-    if (requires.within !== undefined) {
-        try {
-            windowSeconds = parseDurationSeconds(requires.within);
-        }
-        catch (err) {
-            if (err instanceof InvalidDurationError) {
-                throw new RequiresEvaluationError(err.message);
-            }
-            throw err;
-        }
-    }
-    if (requires.count?.min !== undefined && requires.count.min === 0) {
-        throw new RequiresEvaluationError("requires.count.min must be > 0 (count.min:0 is a no-op)");
-    }
-    const tagMatched = ledgerEntries.filter((e) => entryMatches(e, tag));
-    // at_head bypass: when the policy opts in and the runtime resolved a
-    // current HEAD, an entry whose `head:<sha>` token equals it satisfies
-    // regardless of the time-window. Bypass returns the head-matched
-    // subset as `windowMatched` so the rest of the evaluator (count
-    // check, allowed/reason summary) flows unchanged; falls through to
-    // the standard window check when there is no head match (entry
-    // predates the head shift, operator switched branches, producer
-    // ran on a different HEAD, runtime could not resolve a sha).
-    let headMatched = null;
-    if (requires.at_head === true &&
-        typeof options.currentHeadSha === "string" &&
-        options.currentHeadSha.length > 0) {
-        const current = options.currentHeadSha;
-        headMatched = tagMatched.filter((e) => entryHeadSha(e) === current);
-    }
-    let windowMatched;
-    if (headMatched && headMatched.length > 0) {
-        windowMatched = headMatched;
-    }
-    else if (windowSeconds !== null) {
-        const cutoff = now.getTime() - windowSeconds * 1000;
-        windowMatched = tagMatched.filter((e) => entryTime(e) >= cutoff);
-    }
-    else {
-        windowMatched = tagMatched;
-    }
-    const matchedCount = windowMatched.length;
-    const matchedEntryIds = windowMatched.map((e) => e.id);
-    const countBound = requires.count
-        ? {
-            ...(requires.count.min !== undefined && { min: requires.count.min }),
-            ...(requires.count.max !== undefined && { max: requires.count.max }),
-            ...(requires.count.exact !== undefined && { exact: requires.count.exact }),
-        }
-        : null;
-    const trace = {
-        ledgerTag: tag,
-        windowSeconds,
-        totalEntries: ledgerEntries.length,
-        matchedEntryIds,
-        countBound,
-        evaluatedAt,
-    };
-    const recordHint = buildRecordHint(requires, tag);
-    if (requires.count !== undefined) {
-        const c = requires.count;
-        const failsMin = c.min !== undefined && matchedCount < c.min;
-        const failsMax = c.max !== undefined && matchedCount > c.max;
-        const failsExact = c.exact !== undefined && matchedCount !== c.exact;
-        if (failsMin || failsMax || failsExact) {
-            let reason;
-            if (failsMax) {
-                reason = `${matchedCount} matching entries exceeds count.max ${c.max}`;
-            }
-            else {
-                const required = failsExact ? c.exact : c.min;
-                reason = `${matchedCount} of required ${required} entries found`;
-            }
-            return {
-                allowed: false,
-                reason,
-                matchedCount,
-                traceData: trace,
-                recordHint,
-            };
-        }
-        return {
-            allowed: true,
-            reason: `${matchedCount} entries matched (count bound: ${describeBound(c)})`,
-            matchedCount,
-            traceData: trace,
-            recordHint,
-        };
-    }
-    if (matchedCount === 0) {
-        // at_head opt-in but no head match: name the drift explicitly so
-        // the operator sees WHY a recent-looking preflight didn't satisfy.
-        // Quotes the latest head: token from the tag-matched entries (the
-        // last preflight ran on that sha) and the current sha for contrast.
-        if (headMatched !== null &&
-            typeof options.currentHeadSha === "string" &&
-            options.currentHeadSha.length > 0 &&
-            tagMatched.length > 0) {
-            const latestRecordedHead = entryHeadSha(tagMatched[tagMatched.length - 1]);
-            const current = options.currentHeadSha;
-            const driftSuffix = latestRecordedHead !== null
-                ? ` (HEAD drift: last preflight at ${latestRecordedHead.slice(0, 7)}, current ${current.slice(0, 7)})`
-                : ` (HEAD drift: current ${current.slice(0, 7)} has no preflight)`;
-            const base = windowSeconds !== null
-                ? `no matching entry within ${requires.within}`
-                : `no matching ledger entry for tag \`${tag}\``;
-            return {
-                allowed: false,
-                reason: `${base}${driftSuffix}`,
-                matchedCount,
-                traceData: trace,
-                recordHint,
-            };
-        }
-        if (windowSeconds !== null && tagMatched.length > 0) {
-            return {
-                allowed: false,
-                reason: `no matching entry within ${requires.within}`,
-                matchedCount,
-                traceData: trace,
-                recordHint,
-            };
-        }
-        return {
-            allowed: false,
-            reason: `no matching ledger entry for tag \`${tag}\``,
-            matchedCount,
-            traceData: trace,
-            recordHint,
-        };
-    }
-    const headSatisfied = headMatched !== null && headMatched.length > 0;
-    const baseAllowReason = `${matchedCount} matching ledger entr${matchedCount === 1 ? "y" : "ies"} for tag \`${tag}\``;
-    return {
-        allowed: true,
-        reason: headSatisfied
-            ? `${baseAllowReason} (HEAD ${options.currentHeadSha.slice(0, 7)})`
-            : baseAllowReason,
-        matchedCount,
-        traceData: trace,
-        recordHint,
-    };
-}
-//# sourceMappingURL=requires.js.map

package/dist/policies/requires.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"requires.js","sourceRoot":"","sources":["../../src/policies/requires.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AA+DtD,MAAM,aAAa,GAAG,qCAAqC,CAAC;AAE5D,SAAS,YAAY,CAAC,KAAkB;IACtC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,gEAAgE;AAChE,4EAA4E;AAC5E,gDAAgD;AAChD,SAAS,YAAY,CAAC,KAAkB,EAAE,GAAW;IACnD,6DAA6D;IAC7D,mEAAmE;IACnE,+DAA+D;IAC/D,6DAA6D;IAC7D,gDAAgD;IAChD,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO,KAAK,CAAC;IACtD,+DAA+D;IAC/D,kEAAkE;IAClE,oEAAoE;IACpE,mEAAmE;IACnE,oEAAoE;IACpE,wCAAwC;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,oBAAoB,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,KAAkB;IACnC,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC;IAC1B,MAAM,EAAE,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAC/B,gBAAgB,KAAK,CAAC,EAAE,+BAA+B,MAAM,CAAC,CAAC,CAAC,EAAE,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,aAAa,CAAC,CAAiC;IACtD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC;IAC5E,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;IAC5C,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,QAAkB,EAAE,GAAW;IAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,qEAAqE;IACrE,mEAAmE;IACnE,+DAA+D;IAC/D,mEAAmE;IACnE,6CAA6C;IAC7C,MAAM,OAAO,GACX,KAAK,EAAE,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC;IACnF,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,OAAO,6CAA6C,GAAG,kBAAkB,KAAK,CAAC,GAAG,GAAG,YAAY,EAAE,CAAC;IACtG,CAAC;IACD,IAAI,WAAmB,CAAC;IACxB,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,WAAW,GAAG,GAAG,KAAK,CAAC,KAAK,wBAAwB,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IACxF,CAAC;SAAM,IAAI,KAAK,EAAE,GAAG,KAAK,SAAS,EAAE,CAAC;QACpC,WAAW,GAAG,GAAG,KAAK,CAAC,GAAG,wBAAwB,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IACpF,CAAC;SAAM,CAAC;QACN,WAAW,GAAG,0BAA0B,CAAC;IAC3C,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,OAAO,UAAU,WAAW,iBAAiB,GAAG,KAAK,YAAY,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,QAAkB,EAClB,aAA4B,EAC5B,UAAmC,EAAE;IAErC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC;IAEhC,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,aAAa,GAAG,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;gBACxC,MAAM,IAAI,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,KAAK,EAAE,GAAG,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,uBAAuB,CAC/B,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAErE,qEAAqE;IACrE,sEAAsE;IACtE,iEAAiE;IACjE,gEAAgE;IAChE,mEAAmE;IACnE,+DAA+D;IAC/D,gEAAgE;IAChE,6DAA6D;IAC7D,IAAI,WAAW,GAAyB,IAAI,CAAC;IAC7C,IACE,QAAQ,CAAC,OAAO,KAAK,IAAI;QACzB,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ;QAC1C,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EACjC,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;QACvC,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,aAA4B,CAAC;IACjC,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,aAAa,GAAG,WAAW,CAAC;IAC9B,CAAC;SAAM,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,GAAG,IAAI,CAAC;QACpD,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC;IACnE,CAAC;SAAM,CAAC;QACN,aAAa,GAAG,UAAU,CAAC;IAC7B,CAAC;IAED,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC;IAC1C,MAAM,eAAe,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK;QAC/B,CAAC,CAAC;YACE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACpE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACpE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;SAC3E;QACH,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,KAAK,GAAkB;QAC3B,SAAS,EAAE,GAAG;QACd,aAAa;QACb,YAAY,EAAE,aAAa,CAAC,MAAM;QAClC,eAAe;QACf,UAAU;QACV,WAAW;KACZ,CAAC;IACF,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAElD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC;QAC7D,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC;QAC7D,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,YAAY,KAAK,CAAC,CAAC,KAAK,CAAC;QACrE,IAAI,QAAQ,IAAI,QAAQ,IAAI,UAAU,EAAE,CAAC;YACvC,IAAI,MAAc,CAAC;YACnB,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,YAAY,uCAAuC,CAAC,CAAC,GAAG,EAAE,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAI,CAAC;gBAChD,MAAM,GAAG,GAAG,YAAY,gBAAgB,QAAQ,gBAAgB,CAAC;YACnE,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM;gBACN,YAAY;gBACZ,SAAS,EAAE,KAAK;gBAChB,UAAU;aACX,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,GAAG,YAAY,kCAAkC,aAAa,CAAC,CAAC,CAAC,GAAG;YAC5E,YAAY;YACZ,SAAS,EAAE,KAAK;YAChB,UAAU;SACX,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,iEAAiE;QACjE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,IACE,WAAW,KAAK,IAAI;YACpB,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ;YAC1C,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YACjC,UAAU,CAAC,MAAM,GAAG,CAAC,EACrB,CAAC;YACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAC;YAC5E,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;YACvC,MAAM,WAAW,GACf,kBAAkB,KAAK,IAAI;gBACzB,CAAC,CAAC,mCAAmC,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG;gBACtG,CAAC,CAAC,yBAAyB,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,oBAAoB,CAAC;YACvE,MAAM,IAAI,GACR,aAAa,KAAK,IAAI;gBACpB,CAAC,CAAC,4BAA4B,QAAQ,CAAC,MAAM,EAAE;gBAC/C,CAAC,CAAC,sCAAsC,GAAG,IAAI,CAAC;YACpD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,GAAG,IAAI,GAAG,WAAW,EAAE;gBAC/B,YAAY;gBACZ,SAAS,EAAE,KAAK;gBAChB,UAAU;aACX,CAAC;QACJ,CAAC;QACD,IAAI,aAAa,KAAK,IAAI,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,4BAA4B,QAAQ,CAAC,MAAM,EAAE;gBACrD,YAAY;gBACZ,SAAS,EAAE,KAAK;gBAChB,UAAU;aACX,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,sCAAsC,GAAG,IAAI;YACrD,YAAY;YACZ,SAAS,EAAE,KAAK;YAChB,UAAU;SACX,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;IACrE,MAAM,eAAe,GAAG,GAAG,YAAY,wBAAwB,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,cAAc,GAAG,IAAI,CAAC;IACrH,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,aAAa;YACnB,CAAC,CAAC,GAAG,eAAe,UAAU,OAAO,CAAC,cAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG;YACpE,CAAC,CAAC,eAAe;QACnB,YAAY;QACZ,SAAS,EAAE,KAAK;QAChB,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/policies/timestamp.d.ts

@@ -1,14 +0,0 @@
-/**
- * Normalise a ledger `createdAt` string to an epoch-millis value.
- *
- * Accepted shapes:
- *   - `YYYY-MM-DD HH:MM:SS`            (SQLite `datetime('now')`, UTC)
- *   - `YYYY-MM-DD HH:MM:SS.sss`        (SQLite with subsecond precision)
- *   - `YYYY-MM-DDTHH:MM:SS[.sss]`      (ISO-8601 without zone) — treated as UTC
- *   - `YYYY-MM-DDTHH:MM:SS[.sss]Z`     (already-UTC ISO) — passed through
- *   - `YYYY-MM-DDTHH:MM:SS[.sss]±HH:MM` (zoned ISO) — passed through
- *
- * Returns `NaN` when the input does not match any of these. Callers that
- * want a hard failure should check `Number.isNaN`.
- */
-export declare function parseLedgerTimestamp(raw: string): number;

package/dist/policies/timestamp.js

@@ -1,36 +0,0 @@
-// Phase 5 #8 — shared ledger-timestamp parser.
-//
-// `evidence-ledger`'s `created_at` column is populated by SQLite's
-// `datetime('now')`, which writes UTC text in `YYYY-MM-DD HH:MM:SS`
-// format (no `T`, no trailing `Z`). `Date.parse` of a space-separated
-// timestamp without an explicit zone is implementation-defined; modern
-// V8 interprets it as local time, so on any non-UTC host the parsed
-// epoch lands `(host TZ offset)` hours away from the actual UTC moment.
-//
-// This helper normalises the input before delegating to `Date.parse` so
-// every caller sees a UTC-correct epoch regardless of `TZ`.
-/**
- * Normalise a ledger `createdAt` string to an epoch-millis value.
- *
- * Accepted shapes:
- *   - `YYYY-MM-DD HH:MM:SS`            (SQLite `datetime('now')`, UTC)
- *   - `YYYY-MM-DD HH:MM:SS.sss`        (SQLite with subsecond precision)
- *   - `YYYY-MM-DDTHH:MM:SS[.sss]`      (ISO-8601 without zone) — treated as UTC
- *   - `YYYY-MM-DDTHH:MM:SS[.sss]Z`     (already-UTC ISO) — passed through
- *   - `YYYY-MM-DDTHH:MM:SS[.sss]±HH:MM` (zoned ISO) — passed through
- *
- * Returns `NaN` when the input does not match any of these. Callers that
- * want a hard failure should check `Number.isNaN`.
- */
-export function parseLedgerTimestamp(raw) {
-    if (typeof raw !== "string" || raw.length === 0)
-        return NaN;
-    // Already-zoned (ends with Z or ±HH:MM after the time portion).
-    if (/[Zz]$/.test(raw) || /[+-]\d{2}:?\d{2}$/.test(raw)) {
-        return Date.parse(raw);
-    }
-    // Space-separated SQL DATETIME → coerce to ISO-with-Z.
-    const iso = raw.includes("T") ? `${raw}Z` : `${raw.replace(" ", "T")}Z`;
-    return Date.parse(iso);
-}
-//# sourceMappingURL=timestamp.js.map

package/dist/policies/timestamp.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"timestamp.js","sourceRoot":"","sources":["../../src/policies/timestamp.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,EAAE;AACF,mEAAmE;AACnE,oEAAoE;AACpE,sEAAsE;AACtE,uEAAuE;AACvE,oEAAoE;AACpE,wEAAwE;AACxE,EAAE;AACF,wEAAwE;AACxE,4DAA4D;AAE5D;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAC5D,gEAAgE;IAChE,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,uDAAuD;IACvD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC;IACxE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC"}

package/dist/policy-packs/builtin/permission-profiles.d.ts

@@ -1,11 +0,0 @@
-import type { PermissionProfile } from "../../schema/permission-profiles.js";
-export declare const PROFILE_SAFE_START = "safe-start";
-export declare const PROFILE_IMPLEMENTATION_AFTER_APPROVAL = "implementation-after-approval";
-export declare const PROFILE_HIGH_RISK_GRILL_ME = "high-risk-grill-me";
-export declare const KNOWN_PROFILE_NAMES: readonly ["safe-start", "implementation-after-approval", "high-risk-grill-me"];
-export type KnownProfileName = (typeof KNOWN_PROFILE_NAMES)[number];
-export declare function isKnownProfileName(name: string): name is KnownProfileName;
-export declare const SAFE_START: PermissionProfile;
-export declare const IMPLEMENTATION_AFTER_APPROVAL: PermissionProfile;
-export declare const HIGH_RISK_GRILL_ME: PermissionProfile;
-export declare function resolveProfile(name: string): PermissionProfile | null;

package/dist/policy-packs/builtin/permission-profiles.js

@@ -1,74 +0,0 @@
-// Phase 6 #5 — built-in permission profiles bundled with the
-// `understanding-before-execution` pack.
-//
-// Three profiles, each documented in
-// `docs/policy-packs/understanding-before-execution.md`. The pack's
-// `config.permission_profile` selects which profile is active; the
-// pack contributes the resolved profile's permission entries to the
-// generated `settings.json` at apply time.
-//
-// Profile actions translate to Claude Code's permissions block via
-// `profileToSettingsPermissions()` below. The mapping is intentionally
-// conservative: `limited` and `ask_or_deny` collapse to `ask` for v1
-// (Claude Code does not distinguish these natively); fine-grained
-// shaping is a Phase 6 #5 follow-up.
-export const PROFILE_SAFE_START = "safe-start";
-export const PROFILE_IMPLEMENTATION_AFTER_APPROVAL = "implementation-after-approval";
-export const PROFILE_HIGH_RISK_GRILL_ME = "high-risk-grill-me";
-export const KNOWN_PROFILE_NAMES = [
-    PROFILE_SAFE_START,
-    PROFILE_IMPLEMENTATION_AFTER_APPROVAL,
-    PROFILE_HIGH_RISK_GRILL_ME,
-];
-export function isKnownProfileName(name) {
-    return KNOWN_PROFILE_NAMES.includes(name);
-}
-export const SAFE_START = {
-    description: "Pre-approval default. Read-only path is open; everything write-capable is denied (commit/push/pr/deploy) or asks (edit/bash). Pair with `harness pack hook pre-tool-use` for the conditional unlock.",
-    actions: {
-        read: { allow: "true" },
-        edit: { allow: "ask" },
-        bash: { allow: "ask" },
-        commit: { allow: "false" },
-        push: { allow: "false" },
-        pr: { allow: "false" },
-        deploy: { allow: "false" },
-    },
-};
-export const IMPLEMENTATION_AFTER_APPROVAL = {
-    description: "Post-approval working profile. Edit/Bash flow without prompts; commit/push/pr ask. Activate after the operator has approved the Understanding Report (run `harness apply` again with this profile selected).",
-    actions: {
-        read: { allow: "true" },
-        edit: { allow: "true" },
-        bash: { allow: "ask" },
-        commit: { allow: "ask" },
-        push: { allow: "ask" },
-        pr: { allow: "ask" },
-        deploy: { allow: "false" },
-    },
-};
-export const HIGH_RISK_GRILL_ME = {
-    description: "High-friction profile for risky surfaces. Asks per-Edit and per-Bash even after approval; refuses commit/deploy outright. Use when the task touches security, infrastructure, or destructive writes.",
-    actions: {
-        read: { allow: "true" },
-        edit: { allow: "ask" },
-        bash: { allow: "ask" },
-        commit: { allow: "false" },
-        push: { allow: "false" },
-        pr: { allow: "ask" },
-        deploy: { allow: "false" },
-    },
-};
-export function resolveProfile(name) {
-    if (!isKnownProfileName(name))
-        return null;
-    switch (name) {
-        case PROFILE_SAFE_START:
-            return SAFE_START;
-        case PROFILE_IMPLEMENTATION_AFTER_APPROVAL:
-            return IMPLEMENTATION_AFTER_APPROVAL;
-        case PROFILE_HIGH_RISK_GRILL_ME:
-            return HIGH_RISK_GRILL_ME;
-    }
-}
-//# sourceMappingURL=permission-profiles.js.map

package/dist/policy-packs/builtin/permission-profiles.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"permission-profiles.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/permission-profiles.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,yCAAyC;AACzC,EAAE;AACF,qCAAqC;AACrC,oEAAoE;AACpE,mEAAmE;AACnE,oEAAoE;AACpE,2CAA2C;AAC3C,EAAE;AACF,mEAAmE;AACnE,uEAAuE;AACvE,qEAAqE;AACrE,kEAAkE;AAClE,qCAAqC;AAIrC,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAC/C,MAAM,CAAC,MAAM,qCAAqC,GAAG,+BAA+B,CAAC;AACrF,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAE/D,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,kBAAkB;IAClB,qCAAqC;IACrC,0BAA0B;CAClB,CAAC;AAGX,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAQ,mBAAyC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAsB;IAC3C,WAAW,EACT,sMAAsM;IACxM,OAAO,EAAE;QACP,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;QACvB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;QACtB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;QACtB,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QACxB,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QACtB,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;KAC3B;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAsB;IAC9D,WAAW,EACT,8MAA8M;IAChN,OAAO,EAAE;QACP,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;QACvB,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;QACvB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;QACtB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;QACxB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;QACtB,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;QACpB,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;KAC3B;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,WAAW,EACT,sMAAsM;IACxM,OAAO,EAAE;QACP,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;QACvB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;QACtB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;QACtB,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QACxB,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;QACpB,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;KAC3B;CACF,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,kBAAkB;YACrB,OAAO,UAAU,CAAC;QACpB,KAAK,qCAAqC;YACxC,OAAO,6BAA6B,CAAC;QACvC,KAAK,0BAA0B;YAC7B,OAAO,kBAAkB,CAAC;IAC9B,CAAC;AACH,CAAC"}