@melra/policy-core 0.3.0-alpha.3

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/index.d.ts

@@ -0,0 +1,49 @@
+import type { ApprovalChallenge, ApprovalResponse, Effect, EvidencePredicate, Operation, PolicyDecision, Risk, TaskRequest } from "@melra/protocol";
+export interface LocalPolicy {
+    version: string;
+    workspaceRoot: string;
+    allowedCommands: string[];
+    allowedDomains: string[];
+    allowLocalhost: boolean;
+    mutations: "deny" | "confirm";
+    approvalTtlMs: number;
+    maxFileBytes: number;
+}
+export interface PolicyEvaluation {
+    decision: PolicyDecision;
+    challenge?: ApprovalChallenge;
+}
+export declare function normalizeCommandName(command: string): string;
+export declare function createDefaultPolicy(workspaceRoot: string): LocalPolicy;
+export declare function loadPolicy(path: string | undefined, workspaceRoot: string): Promise<LocalPolicy>;
+export declare function classifyOperation(operation: Operation): {
+    effect: Effect;
+    risk: Risk;
+    capability: string;
+    target: string;
+};
+/**
+ * Evidence a mutation must satisfy when the caller declared none.
+ *
+ * Mutations still require evidence — that rule is the product's verification
+ * thesis and is not relaxed here. What changed is the failure mode: previously a
+ * caller who omitted `requiredEvidence` got a flat `mutation_requires_evidence`
+ * deny and had to guess the right predicate, so most callers simply gave up. Now
+ * the obvious post-condition is derived from the operation itself, and the task
+ * is held to it exactly as if the caller had written it.
+ *
+ * Returns `[]` when no post-condition is derivable from the request alone (for
+ * example a `terminal run`, whose effect depends on the command). Those still
+ * deny, because a mutation nobody can check is precisely what should not run
+ * unattended.
+ */
+export declare function defaultEvidenceFor(operation: Operation): EvidencePredicate[];
+export declare function evaluatePolicy(taskId: string, request: TaskRequest, policy: LocalPolicy): PolicyEvaluation;
+export declare function digestOperation(taskId: string, operation: Operation): string;
+export declare function validateApproval(challenge: ApprovalChallenge | undefined, response: ApprovalResponse | undefined): {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAChB,MAAM,EACN,iBAAiB,EACjB,SAAS,EACT,cAAc,EACd,IAAI,EACJ,WAAW,EACZ,MAAM,iBAAiB,CAAC;AAEzB,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,cAAc,CAAC;IACzB,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAqDD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAI5D;AAED,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,WAAW,CAgCtE;AAED,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC,CAWtB;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,SAAS,GAAG;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,CA0HA;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,SAAS,GACnB,iBAAiB,EAAE,CAyCrB;AAoCD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,WAAW,GAClB,gBAAgB,CAoGlB;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,MAAM,CAI5E;AAYD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,iBAAiB,GAAG,SAAS,EACxC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GACrC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAc9C"}

package/dist/index.js

@@ -0,0 +1,406 @@
+// Copyright 2026 XAGI Labs Private Limited
+// SPDX-License-Identifier: Apache-2.0
+import { readFile } from "node:fs/promises";
+import { basename, resolve } from "node:path";
+import { createHash, randomUUID } from "node:crypto";
+const READ_ONLY_GIT_ACTIONS = new Set([
+    "branch",
+    "diff",
+    "log",
+    "rev-parse",
+    "show",
+    "status",
+    "tag",
+]);
+const ALWAYS_DENIED_COMMANDS = new Set([
+    "bash",
+    "cmd",
+    "fish",
+    "osascript",
+    "powershell",
+    "pwsh",
+    "sh",
+    "sudo",
+    "su",
+    "zsh",
+]);
+/**
+ * Defaults tuned so a fresh install is usable without editing `policy.json`.
+ *
+ * `allowedDomains: ["*"]` is not the SSRF boundary and never was. `assertSafeUrl`
+ * in `@melra/browser-runtime` independently rejects non-http(s) protocols, URL
+ * credentials, private ranges, and cloud metadata (169.254/16), and it resolves
+ * DNS before allowing a navigation so a public name cannot be rebound to a
+ * private address. The domain list is a *narrowing* control on top of that guard,
+ * for operators who want to restrict which public sites are reachable — it is not
+ * what stops a browser from reaching the loopback interface.
+ *
+ * Defaulting it to `[]` made every single navigation fail with
+ * `browser_domain_not_allowed` out of the box, which is why browser use was
+ * reported as unusable. Operators who want an allowlist set one explicitly.
+ */
+/**
+ * Reduce a command to the name the allowlist is written in.
+ *
+ * On Windows an executable is spelled with an extension (`npm.cmd`, `node.exe`,
+ * `git.exe`), while allowlists are written bare. Comparing the raw basename made
+ * every extension-qualified spelling fail, so Windows users had no working
+ * spelling at all: bare `npm` passed policy but is a `.cmd` shim that does not
+ * spawn, and `npm.cmd` spawns but was denied. Only the executable suffixes in
+ * PATHEXT are stripped, so a command that merely contains a dot (`python3.11`)
+ * is left intact.
+ */
+const EXECUTABLE_SUFFIXES = [".exe", ".cmd", ".bat", ".com", ".ps1"];
+export function normalizeCommandName(command) {
+    const name = basename(command.replaceAll("\\", "/")).toLowerCase();
+    const suffix = EXECUTABLE_SUFFIXES.find((item) => name.endsWith(item));
+    return suffix === undefined ? name : name.slice(0, -suffix.length);
+}
+export function createDefaultPolicy(workspaceRoot) {
+    return {
+        version: "1",
+        workspaceRoot: resolve(workspaceRoot),
+        // One list for every platform. An entry naming a program the host does not
+        // have is inert — it fails at spawn with `terminal_command_not_found`, not
+        // at policy — so the Windows and POSIX read tools can both sit here rather
+        // than making the same policy mean different things on different machines.
+        allowedCommands: [
+            "cat",
+            "echo",
+            "findstr",
+            "git",
+            "head",
+            "ls",
+            "node",
+            "npm",
+            "npx",
+            "pnpm",
+            "pwd",
+            "rg",
+            "tail",
+            "tasklist",
+            "wc",
+            "where",
+        ],
+        allowedDomains: ["*"],
+        allowLocalhost: true,
+        mutations: "confirm",
+        approvalTtlMs: 5 * 60_000,
+        maxFileBytes: 10 * 1024 * 1024,
+    };
+}
+export async function loadPolicy(path, workspaceRoot) {
+    const defaults = createDefaultPolicy(workspaceRoot);
+    if (path === undefined)
+        return defaults;
+    const parsed = JSON.parse(await readFile(path, "utf8"));
+    return {
+        ...defaults,
+        ...parsed,
+        workspaceRoot: resolve(parsed.workspaceRoot ?? workspaceRoot),
+        allowedCommands: parsed.allowedCommands ?? defaults.allowedCommands,
+        allowedDomains: parsed.allowedDomains ?? defaults.allowedDomains,
+    };
+}
+export function classifyOperation(operation) {
+    switch (operation.kind) {
+        case "file": {
+            const read = new Set(["list", "read", "stat", "hash"]).has(operation.action);
+            const destructive = operation.action === "delete";
+            return {
+                effect: destructive ? "destructive" : read ? "read" : "mutate",
+                risk: destructive ? "high" : read ? "low" : "medium",
+                capability: `file.${operation.action}`,
+                target: operation.path,
+            };
+        }
+        case "terminal": {
+            if (operation.action === "status" || operation.action === "output") {
+                return {
+                    effect: "read",
+                    risk: "low",
+                    capability: `terminal.${operation.action}`,
+                    target: `job:${operation.jobId ?? "unknown"}`,
+                };
+            }
+            const command = normalizeCommandName(operation.command ?? "");
+            const gitRead = operation.action === "run" &&
+                command === "git" &&
+                operation.args.length > 0 &&
+                READ_ONLY_GIT_ACTIONS.has(operation.args[0] ?? "");
+            const readCommands = new Set([
+                "cat",
+                "findstr",
+                "head",
+                "ls",
+                "pwd",
+                "rg",
+                "tail",
+                "tasklist",
+                "wc",
+                "where",
+            ]);
+            const read = readCommands.has(command) || gitRead;
+            const packageMutation = new Set(["npm", "npx", "pnpm"]).has(command);
+            return {
+                effect: read ? "read" : "mutate",
+                risk: packageMutation ? "high" : read ? "low" : "medium",
+                capability: `terminal.${operation.action}`,
+                target: operation.action === "stop"
+                    ? `job:${operation.jobId ?? "unknown"}`
+                    : `command:${command}`,
+            };
+        }
+        case "browser": {
+            // Navigation and observation read the world; only actions that drive the
+            // page (click, type, upload, ...) change anything. `tab_new` and
+            // `tab_switch` are classified with `navigate` for the same reason it is:
+            // they move where we are looking, they do not act on a document. `wait`
+            // joins them — it blocks until the page reaches a state, and blocking is
+            // not acting.
+            const read = new Set([
+                "navigate",
+                "back",
+                "forward",
+                "reload",
+                "inspect",
+                "wait",
+                "screenshot",
+                "tabs",
+                "tab_new",
+                "tab_switch",
+                "scroll",
+            ]).has(operation.action);
+            return {
+                effect: read ? "read" : "mutate",
+                risk: read ? "low" : "medium",
+                capability: `browser.${operation.action}`,
+                target: operation.url === undefined
+                    ? operation.target?.selector ??
+                        operation.target?.name ??
+                        "active-page"
+                    : (() => {
+                        const target = new URL(operation.url);
+                        target.search = "";
+                        target.hash = "";
+                        return target.toString();
+                    })(),
+            };
+        }
+        case "memory": {
+            const read = operation.action === "search" || operation.action === "list";
+            const destructive = operation.action === "delete" || operation.action === "clear";
+            return {
+                effect: destructive ? "destructive" : read ? "read" : "mutate",
+                risk: destructive ? "high" : read ? "low" : "medium",
+                capability: `memory.${operation.action}`,
+                target: `${operation.scope}:${operation.action}:${operation.id ?? operation.key ?? "*"}`,
+            };
+        }
+        case "computer": {
+            const read = operation.action === "capabilities" ||
+                operation.action === "screenshot";
+            return {
+                effect: read ? "read" : "mutate",
+                risk: read ? "low" : "high",
+                capability: `computer.${operation.action}`,
+                target: operation.action === "click" || operation.action === "move"
+                    ? `${operation.coordinateSpace}:${operation.x ?? "?"},${operation.y ?? "?"}`
+                    : "active-desktop",
+            };
+        }
+        case "system":
+            return {
+                effect: "read",
+                risk: "low",
+                capability: "system.info",
+                target: "local-system",
+            };
+    }
+}
+/**
+ * Evidence a mutation must satisfy when the caller declared none.
+ *
+ * Mutations still require evidence — that rule is the product's verification
+ * thesis and is not relaxed here. What changed is the failure mode: previously a
+ * caller who omitted `requiredEvidence` got a flat `mutation_requires_evidence`
+ * deny and had to guess the right predicate, so most callers simply gave up. Now
+ * the obvious post-condition is derived from the operation itself, and the task
+ * is held to it exactly as if the caller had written it.
+ *
+ * Returns `[]` when no post-condition is derivable from the request alone (for
+ * example a `terminal run`, whose effect depends on the command). Those still
+ * deny, because a mutation nobody can check is precisely what should not run
+ * unattended.
+ */
+export function defaultEvidenceFor(operation) {
+    // Reads are never denied for missing evidence and already fall back to a
+    // synthetic `operation_completed` item, so synthesizing a predicate for them
+    // would only invent a way for a successful read to verify as `partial`.
+    if (classifyOperation(operation).effect === "read")
+        return [];
+    switch (operation.kind) {
+        case "file":
+            switch (operation.action) {
+                case "write":
+                case "mkdir":
+                    return [{ type: "file_exists", path: operation.path }];
+                case "delete":
+                    return [{ type: "file_absent", path: operation.path }];
+                case "move":
+                    return operation.destination === undefined
+                        ? []
+                        : [
+                            { type: "file_absent", path: operation.path },
+                            { type: "file_exists", path: operation.destination },
+                        ];
+                default:
+                    return [];
+            }
+        case "memory":
+            // Field names differ per action; each is the adapter's own report that the
+            // record actually changed, so a silent no-op cannot pass as a success.
+            // `clear` returns a count rather than a flag, so it has no boolean
+            // post-condition to assert.
+            return operation.action === "put"
+                ? [{ type: "result_equals", path: "stored", value: true }]
+                : operation.action === "delete"
+                    ? [{ type: "result_equals", path: "deleted", value: true }]
+                    : [];
+        case "browser":
+        case "computer":
+            // These adapters report an explicit `success` flag; hold the task to it
+            // rather than letting a silent no-op pass as a completed action.
+            return [{ type: "result_equals", path: "success", value: true }];
+        default:
+            return [];
+    }
+}
+function deny(effect, risk, reason, version) {
+    return { outcome: "deny", effect, risk, reason, policyVersion: version };
+}
+function isCommandAllowed(operation, policy) {
+    if (operation.kind !== "terminal")
+        return true;
+    if (operation.action === "status" || operation.action === "output") {
+        return operation.jobId !== undefined;
+    }
+    if (operation.action === "stop")
+        return operation.jobId !== undefined;
+    if (operation.command === undefined)
+        return false;
+    const command = normalizeCommandName(operation.command);
+    // Normalized on both sides so `powershell.exe` cannot slip past a deny entry
+    // written as `powershell`, and an operator's allowlist matches either spelling.
+    if (ALWAYS_DENIED_COMMANDS.has(command))
+        return false;
+    return policy.allowedCommands.some((allowed) => normalizeCommandName(allowed) === command);
+}
+function domainAllowed(operation, policy) {
+    if (operation.kind !== "browser" || operation.url === undefined)
+        return true;
+    const url = new URL(operation.url);
+    if (!["http:", "https:"].includes(url.protocol))
+        return false;
+    const host = url.hostname.toLowerCase();
+    if (host === "localhost" || host.endsWith(".localhost"))
+        return policy.allowLocalhost;
+    return policy.allowedDomains.some((domain) => domain === "*" ||
+        host === domain.toLowerCase() ||
+        host.endsWith(`.${domain.toLowerCase()}`));
+}
+export function evaluatePolicy(taskId, request, policy) {
+    const classified = classifyOperation(request.operation);
+    if (request.constraints.length > 0) {
+        return {
+            decision: deny(classified.effect, classified.risk, "freeform_constraints_not_enforceable", policy.version),
+        };
+    }
+    if (request.forbiddenEffects.includes(classified.effect)) {
+        return {
+            decision: deny(classified.effect, classified.risk, "effect_forbidden_by_request", policy.version),
+        };
+    }
+    if (!isCommandAllowed(request.operation, policy)) {
+        return {
+            decision: deny(classified.effect, "critical", "command_not_allowlisted", policy.version),
+        };
+    }
+    if (!domainAllowed(request.operation, policy)) {
+        return {
+            decision: deny(classified.effect, "high", "browser_domain_not_allowed", policy.version),
+        };
+    }
+    if (classified.effect !== "read" && request.requiredEvidence.length === 0) {
+        return {
+            decision: deny(classified.effect, classified.risk, "mutation_requires_evidence", policy.version),
+        };
+    }
+    if (classified.effect === "read") {
+        return {
+            decision: {
+                outcome: "allow",
+                effect: classified.effect,
+                risk: classified.risk,
+                reason: "read_only_operation",
+                policyVersion: policy.version,
+            },
+        };
+    }
+    if (policy.mutations === "deny") {
+        return {
+            decision: deny(classified.effect, classified.risk, "mutations_disabled", policy.version),
+        };
+    }
+    const digest = digestOperation(taskId, request.operation);
+    const approvalId = randomUUID();
+    const phrase = `APPROVE ${digest.slice(0, 12)}`;
+    return {
+        decision: {
+            outcome: "confirm",
+            effect: classified.effect,
+            risk: classified.risk,
+            reason: "explicit_approval_required",
+            policyVersion: policy.version,
+        },
+        challenge: {
+            approvalId,
+            taskId,
+            actionDigest: digest,
+            phrase,
+            expiresAt: new Date(Date.now() + policy.approvalTtlMs).toISOString(),
+        },
+    };
+}
+export function digestOperation(taskId, operation) {
+    return createHash("sha256")
+        .update(stableJson({ taskId, operation }))
+        .digest("hex");
+}
+function stableJson(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value) ?? "null";
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(",")}]`;
+    const object = value;
+    return `{${Object.keys(object)
+        .sort()
+        .map((key) => `${JSON.stringify(key)}:${stableJson(object[key])}`)
+        .join(",")}}`;
+}
+export function validateApproval(challenge, response) {
+    if (challenge === undefined || response === undefined) {
+        return { ok: false, reason: "approval_required" };
+    }
+    if (challenge.approvalId !== response.approvalId) {
+        return { ok: false, reason: "approval_id_mismatch" };
+    }
+    if (challenge.phrase !== response.phrase) {
+        return { ok: false, reason: "approval_phrase_mismatch" };
+    }
+    if (Date.parse(challenge.expiresAt) <= Date.now()) {
+        return { ok: false, reason: "approval_expired" };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,sCAAsC;AAEtC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA4BrD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,QAAQ;IACR,MAAM;IACN,KAAK;IACL,WAAW;IACX,MAAM;IACN,QAAQ;IACR,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,MAAM;IACN,KAAK;IACL,MAAM;IACN,WAAW;IACX,YAAY;IACZ,MAAM;IACN,IAAI;IACJ,MAAM;IACN,IAAI;IACJ,KAAK;CACN,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH;;;;;;;;;;GAUG;AACH,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAErE,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,aAAqB;IACvD,OAAO;QACL,OAAO,EAAE,GAAG;QACZ,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC;QACrC,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,eAAe,EAAE;YACf,KAAK;YACL,MAAM;YACN,SAAS;YACT,KAAK;YACL,MAAM;YACN,IAAI;YACJ,MAAM;YACN,KAAK;YACL,KAAK;YACL,MAAM;YACN,KAAK;YACL,IAAI;YACJ,MAAM;YACN,UAAU;YACV,IAAI;YACJ,OAAO;SACR;QACD,cAAc,EAAE,CAAC,GAAG,CAAC;QACrB,cAAc,EAAE,IAAI;QACpB,SAAS,EAAE,SAAS;QACpB,aAAa,EAAE,CAAC,GAAG,MAAM;QACzB,YAAY,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAwB,EACxB,aAAqB;IAErB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAyB,CAAC;IAChF,OAAO;QACL,GAAG,QAAQ;QACX,GAAG,MAAM;QACT,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,aAAa,CAAC;QAC7D,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe;QACnE,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc;KACjE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAoB;IAMpD,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC7E,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC;YAClD,OAAO;gBACL,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAC9D,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;gBACpD,UAAU,EAAE,QAAQ,SAAS,CAAC,MAAM,EAAE;gBACtC,MAAM,EAAE,SAAS,CAAC,IAAI;aACvB,CAAC;QACJ,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACnE,OAAO;oBACL,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,KAAK;oBACX,UAAU,EAAE,YAAY,SAAS,CAAC,MAAM,EAAE;oBAC1C,MAAM,EAAE,OAAO,SAAS,CAAC,KAAK,IAAI,SAAS,EAAE;iBAC9C,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YAC9D,MAAM,OAAO,GACX,SAAS,CAAC,MAAM,KAAK,KAAK;gBAC1B,OAAO,KAAK,KAAK;gBACjB,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;gBACzB,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;gBAC3B,KAAK;gBACL,SAAS;gBACT,MAAM;gBACN,IAAI;gBACJ,KAAK;gBACL,IAAI;gBACJ,MAAM;gBACN,UAAU;gBACV,IAAI;gBACJ,OAAO;aACR,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;YAClD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACrE,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAChC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;gBACxD,UAAU,EAAE,YAAY,SAAS,CAAC,MAAM,EAAE;gBAC1C,MAAM,EACJ,SAAS,CAAC,MAAM,KAAK,MAAM;oBACzB,CAAC,CAAC,OAAO,SAAS,CAAC,KAAK,IAAI,SAAS,EAAE;oBACvC,CAAC,CAAC,WAAW,OAAO,EAAE;aAC3B,CAAC;QACJ,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,yEAAyE;YACzE,iEAAiE;YACjE,yEAAyE;YACzE,wEAAwE;YACxE,yEAAyE;YACzE,cAAc;YACd,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC;gBACnB,UAAU;gBACV,MAAM;gBACN,SAAS;gBACT,QAAQ;gBACR,SAAS;gBACT,MAAM;gBACN,YAAY;gBACZ,MAAM;gBACN,SAAS;gBACT,YAAY;gBACZ,QAAQ;aACT,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACzB,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAChC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;gBAC7B,UAAU,EAAE,WAAW,SAAS,CAAC,MAAM,EAAE;gBACzC,MAAM,EACJ,SAAS,CAAC,GAAG,KAAK,SAAS;oBACzB,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ;wBAC1B,SAAS,CAAC,MAAM,EAAE,IAAI;wBACtB,aAAa;oBACf,CAAC,CAAC,CAAC,GAAG,EAAE;wBACJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;wBACtC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;wBACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;wBACjB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAC3B,CAAC,CAAC,EAAE;aACX,CAAC;QACJ,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC;YAC1E,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC;YAClF,OAAO;gBACL,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAC9D,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;gBACpD,UAAU,EAAE,UAAU,SAAS,CAAC,MAAM,EAAE;gBACxC,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,MAAM,IAC5C,SAAS,CAAC,EAAE,IAAI,SAAS,CAAC,GAAG,IAAI,GACnC,EAAE;aACH,CAAC;QACJ,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,IAAI,GACR,SAAS,CAAC,MAAM,KAAK,cAAc;gBACnC,SAAS,CAAC,MAAM,KAAK,YAAY,CAAC;YACpC,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAChC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;gBAC3B,UAAU,EAAE,YAAY,SAAS,CAAC,MAAM,EAAE;gBAC1C,MAAM,EACJ,SAAS,CAAC,MAAM,KAAK,OAAO,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM;oBACzD,CAAC,CAAC,GAAG,SAAS,CAAC,eAAe,IAAI,SAAS,CAAC,CAAC,IAAI,GAAG,IAAI,SAAS,CAAC,CAAC,IAAI,GAAG,EAAE;oBAC5E,CAAC,CAAC,gBAAgB;aACvB,CAAC;QACJ,CAAC;QACD,KAAK,QAAQ;YACX,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,KAAK;gBACX,UAAU,EAAE,aAAa;gBACzB,MAAM,EAAE,cAAc;aACvB,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAAoB;IAEpB,yEAAyE;IACzE,6EAA6E;IAC7E,wEAAwE;IACxE,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IAC9D,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM;YACT,QAAQ,SAAS,CAAC,MAAM,EAAE,CAAC;gBACzB,KAAK,OAAO,CAAC;gBACb,KAAK,OAAO;oBACV,OAAO,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzD,KAAK,QAAQ;oBACX,OAAO,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzD,KAAK,MAAM;oBACT,OAAO,SAAS,CAAC,WAAW,KAAK,SAAS;wBACxC,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC;4BACE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;4BAC7C,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE;yBACrD,CAAC;gBACR;oBACE,OAAO,EAAE,CAAC;YACd,CAAC;QACH,KAAK,QAAQ;YACX,2EAA2E;YAC3E,uEAAuE;YACvE,mEAAmE;YACnE,4BAA4B;YAC5B,OAAO,SAAS,CAAC,MAAM,KAAK,KAAK;gBAC/B,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBAC1D,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,QAAQ;oBAC7B,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;oBAC3D,CAAC,CAAC,EAAE,CAAC;QACX,KAAK,SAAS,CAAC;QACf,KAAK,UAAU;YACb,wEAAwE;YACxE,iEAAiE;YACjE,OAAO,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE;YACE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,IAAU,EAAE,MAAc,EAAE,OAAe;IACvE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAoB,EAAE,MAAmB;IACjE,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnE,OAAO,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC;IACvC,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC;IACtE,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACxD,6EAA6E;IAC7E,gFAAgF;IAChF,IAAI,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,CAChC,CAAC,OAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,CAAC,KAAK,OAAO,CACvD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,SAAoB,EAAE,MAAmB;IAC9D,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,MAAM,CAAC,cAAc,CAAC;IACtF,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAC/B,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,KAAK,GAAG;QACd,IAAI,KAAK,MAAM,CAAC,WAAW,EAAE;QAC7B,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,OAAoB,EACpB,MAAmB;IAEnB,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAExD,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,QAAQ,EAAE,IAAI,CACZ,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,IAAI,EACf,sCAAsC,EACtC,MAAM,CAAC,OAAO,CACf;SACF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,OAAO;YACL,QAAQ,EAAE,IAAI,CACZ,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,IAAI,EACf,6BAA6B,EAC7B,MAAM,CAAC,OAAO,CACf;SACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QACjD,OAAO;YACL,QAAQ,EAAE,IAAI,CACZ,UAAU,CAAC,MAAM,EACjB,UAAU,EACV,yBAAyB,EACzB,MAAM,CAAC,OAAO,CACf;SACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QAC9C,OAAO;YACL,QAAQ,EAAE,IAAI,CACZ,UAAU,CAAC,MAAM,EACjB,MAAM,EACN,4BAA4B,EAC5B,MAAM,CAAC,OAAO,CACf;SACF,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO;YACL,QAAQ,EAAE,IAAI,CACZ,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,IAAI,EACf,4BAA4B,EAC5B,MAAM,CAAC,OAAO,CACf;SACF,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACjC,OAAO;YACL,QAAQ,EAAE;gBACR,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,MAAM,EAAE,qBAAqB;gBAC7B,aAAa,EAAE,MAAM,CAAC,OAAO;aAC9B;SACF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,IAAI,CACZ,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,IAAI,EACf,oBAAoB,EACpB,MAAM,CAAC,OAAO,CACf;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,WAAW,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAChD,OAAO;QACL,QAAQ,EAAE;YACR,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,MAAM,EAAE,4BAA4B;YACpC,aAAa,EAAE,MAAM,CAAC,OAAO;SAC9B;QACD,SAAS,EAAE;YACT,UAAU;YACV,MAAM;YACN,YAAY,EAAE,MAAM;YACpB,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE;SACrE;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,SAAoB;IAClE,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;SACzC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;IACxF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACxE,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SAC3B,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;SACjE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,SAAwC,EACxC,QAAsC;IAEtC,IAAI,SAAS,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/index.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.test.d.ts.map

package/dist/index.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.d.ts","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":""}

package/dist/index.test.js

@@ -0,0 +1,259 @@
+// Copyright 2026 XAGI Labs Private Limited
+// SPDX-License-Identifier: Apache-2.0
+import { describe, expect, it } from "vitest";
+import { TaskRequestSchema } from "@melra/protocol";
+import { createDefaultPolicy, defaultEvidenceFor, evaluatePolicy, validateApproval, } from "./index.js";
+const root = "/tmp/melra-policy-test";
+describe("local policy", () => {
+    it("allows a read-only file operation", () => {
+        const request = TaskRequestSchema.parse({
+            goal: "Read the changelog",
+            operation: { kind: "file", action: "read", path: "CHANGELOG.md" },
+        });
+        const result = evaluatePolicy("4c5a0130-71a5-4c48-b22d-c7901f12688f", request, createDefaultPolicy(root));
+        expect(result.decision.outcome).toBe("allow");
+        expect(result.challenge).toBeUndefined();
+    });
+    it("requires evidence and approval for mutation", () => {
+        const missingEvidence = TaskRequestSchema.parse({
+            goal: "Write a file",
+            operation: {
+                kind: "file",
+                action: "write",
+                path: "result.txt",
+                content: "verified",
+            },
+        });
+        expect(evaluatePolicy("b47dded2-4e20-4d96-a993-fdf6b0034664", missingEvidence, createDefaultPolicy(root)).decision.reason).toBe("mutation_requires_evidence");
+        const request = TaskRequestSchema.parse({
+            ...missingEvidence,
+            requiredEvidence: [{ type: "file_exists", path: "result.txt" }],
+        });
+        const result = evaluatePolicy("b47dded2-4e20-4d96-a993-fdf6b0034664", request, createDefaultPolicy(root));
+        expect(result.decision.outcome).toBe("confirm");
+        expect(result.challenge?.phrase).toMatch(/^APPROVE [a-f0-9]{12}$/);
+    });
+    it("denies shells even if added to the allowlist", () => {
+        const request = TaskRequestSchema.parse({
+            goal: "Run an unrestricted shell",
+            operation: {
+                kind: "terminal",
+                action: "run",
+                command: "bash",
+                args: ["-lc", "echo unsafe"],
+            },
+        });
+        const policy = createDefaultPolicy(root);
+        policy.allowedCommands.push("bash");
+        expect(evaluatePolicy("71942756-af2a-407d-806e-73d7bb4fe5d0", request, policy).decision.reason).toBe("command_not_allowlisted");
+    });
+    it("allows computer inspection but gates input behind evidence and approval", () => {
+        const inspect = TaskRequestSchema.parse({
+            goal: "Inspect local computer-use support",
+            operation: { kind: "computer", action: "capabilities" },
+        });
+        expect(evaluatePolicy("c4e05bc0-c809-4ba3-a2a4-69102cdcf688", inspect, createDefaultPolicy(root)).decision.outcome).toBe("allow");
+        const click = TaskRequestSchema.parse({
+            goal: "Click a verified desktop target",
+            operation: {
+                kind: "computer",
+                action: "click",
+                coordinateSpace: "normalized",
+                x: 0.5,
+                y: 0.5,
+            },
+            requiredEvidence: [
+                { type: "result_equals", path: "success", value: true },
+            ],
+        });
+        const decision = evaluatePolicy("1aa2432a-a584-4b3f-b256-9ac3a6887630", click, createDefaultPolicy(root));
+        expect(decision.decision.outcome).toBe("confirm");
+        expect(decision.decision.risk).toBe("high");
+    });
+    it("validates the scoped approval phrase", () => {
+        const request = TaskRequestSchema.parse({
+            goal: "Store a memory",
+            operation: {
+                kind: "memory",
+                action: "put",
+                scope: "workspace",
+                key: "project",
+                value: "MELRA",
+            },
+            requiredEvidence: [
+                { type: "result_equals", path: "stored", value: true },
+            ],
+        });
+        const result = evaluatePolicy("db65d7da-9d59-46a7-86f7-aa1bd205382c", request, createDefaultPolicy(root));
+        const challenge = result.challenge;
+        expect(challenge).toBeDefined();
+        expect(validateApproval(challenge, {
+            approvalId: challenge.approvalId,
+            phrase: challenge.phrase,
+        })).toEqual({ ok: true });
+    });
+    it("never silently ignores caller constraints or forbidden effects", () => {
+        const constrained = TaskRequestSchema.parse({
+            goal: "Read with an unenforceable natural-language constraint",
+            operation: { kind: "file", action: "read", path: "README.md" },
+            constraints: ["only if the file is recent"],
+        });
+        expect(evaluatePolicy("ae8e57dd-e9f7-4821-82d7-ce50dc896008", constrained, createDefaultPolicy(root)).decision.reason).toBe("freeform_constraints_not_enforceable");
+        const forbidden = TaskRequestSchema.parse({
+            goal: "Do not permit a mutation",
+            operation: {
+                kind: "file",
+                action: "write",
+                path: "result.txt",
+                content: "blocked",
+            },
+            forbiddenEffects: ["mutate"],
+            requiredEvidence: [{ type: "file_exists", path: "result.txt" }],
+        });
+        expect(evaluatePolicy("e299a821-8dbf-4784-8ecf-f79d6812cc64", forbidden, createDefaultPolicy(root)).decision.reason).toBe("effect_forbidden_by_request");
+    });
+    it("allows a browser navigation with the shipped defaults", () => {
+        // Regression: allowedDomains defaulted to [] and denied every navigation
+        // out of the box, which is what made browser use unusable on a fresh install.
+        const request = TaskRequestSchema.parse({
+            goal: "Open a docs page",
+            operation: {
+                kind: "browser",
+                action: "navigate",
+                url: "https://example.com/docs",
+            },
+        });
+        expect(evaluatePolicy("0f9e6d2a-3c41-4b8e-9a77-1d5b8c2e4f60", request, createDefaultPolicy(root)).decision.outcome).toBe("allow");
+    });
+});
+describe("default evidence", () => {
+    it("derives the obvious post-condition per file action", () => {
+        expect(defaultEvidenceFor({
+            kind: "file",
+            action: "write",
+            path: "out.txt",
+            encoding: "utf8",
+            recursive: false,
+        })).toEqual([{ type: "file_exists", path: "out.txt" }]);
+        expect(defaultEvidenceFor({
+            kind: "file",
+            action: "delete",
+            path: "out.txt",
+            encoding: "utf8",
+            recursive: false,
+        })).toEqual([{ type: "file_absent", path: "out.txt" }]);
+        expect(defaultEvidenceFor({
+            kind: "file",
+            action: "move",
+            path: "a.txt",
+            destination: "b.txt",
+            encoding: "utf8",
+            recursive: false,
+        })).toEqual([
+            { type: "file_absent", path: "a.txt" },
+            { type: "file_exists", path: "b.txt" },
+        ]);
+    });
+    it("derives nothing for a terminal run, so it still denies", () => {
+        // The request says nothing about what the command should leave behind, so
+        // there is no honest post-condition to synthesize.
+        expect(defaultEvidenceFor({
+            kind: "terminal",
+            action: "run",
+            command: "npm",
+            args: ["run", "build"],
+            timeoutMs: 30_000,
+            maxOutputChars: 100_000,
+        })).toEqual([]);
+    });
+    it("derives nothing for a read, which already has a fallback", () => {
+        expect(defaultEvidenceFor({
+            kind: "file",
+            action: "read",
+            path: "a.txt",
+            encoding: "utf8",
+            recursive: false,
+        })).toEqual([]);
+    });
+    it("matches the field each memory action actually reports", () => {
+        expect(defaultEvidenceFor({
+            kind: "memory",
+            action: "put",
+            scope: "workspace",
+            key: "k",
+            value: "v",
+            confidence: 1,
+            tags: [],
+            includeSuperseded: false,
+            limit: 20,
+        })).toEqual([{ type: "result_equals", path: "stored", value: true }]);
+        // `clear` reports a count, not a boolean, so nothing is derivable.
+        expect(defaultEvidenceFor({
+            kind: "memory",
+            action: "clear",
+            scope: "workspace",
+            confidence: 1,
+            tags: [],
+            includeSuperseded: false,
+            limit: 20,
+        })).toEqual([]);
+    });
+    it("holds a browser mutation to the flag the runtime actually reports", () => {
+        // This predicate is only honest because `BrowserRuntime.execute` stamps
+        // `success: true` on every result. It did not, so a click with no declared
+        // evidence executed, mutated the page, and then verified as `partial`
+        // because the derived predicate read a key nobody wrote.
+        expect(defaultEvidenceFor({
+            kind: "browser",
+            action: "click",
+            target: { selector: "#go" },
+            fullPage: false,
+            timeoutMs: 30_000,
+            settleQuietMs: 180,
+            settleTimeoutMs: 1_500,
+            maxChars: 20_000,
+            delayMs: 0,
+            clearFirst: true,
+            pixels: 600,
+        })).toEqual([{ type: "result_equals", path: "success", value: true }]);
+    });
+});
+describe("Windows command spellings", () => {
+    const plan = (command, args = []) => evaluatePolicy("00000000-0000-4000-8000-000000000000", TaskRequestSchema.parse({
+        goal: "Run an allowlisted program",
+        operation: { kind: "terminal", action: "run", command, args },
+        requiredEvidence: [{ type: "exit_code", value: 0 }],
+    }), createDefaultPolicy(root)).decision;
+    it("accepts the extension-qualified spelling Windows actually runs", () => {
+        // The deadlock this closes: `npm` passed policy but is a `.cmd` shim that
+        // cannot be spawned, while `npm.cmd` could be spawned but was denied — so on
+        // Windows no spelling of an allowlisted command worked at all.
+        expect(plan("npm").reason).not.toBe("command_not_allowlisted");
+        expect(plan("npm.cmd").reason).not.toBe("command_not_allowlisted");
+        expect(plan("C:\\Program Files\\nodejs\\npm.cmd").reason).not.toBe("command_not_allowlisted");
+    });
+    it("still denies a shell however it is spelled", () => {
+        // Normalisation must apply to the deny list too, or stripping the extension
+        // would have turned it into a bypass.
+        for (const command of [
+            "powershell",
+            "powershell.exe",
+            "PowerShell.EXE",
+            "C:\\Windows\\System32\\cmd.exe",
+            "pwsh.exe",
+            "/bin/bash",
+        ]) {
+            expect(plan(command).reason).toBe("command_not_allowlisted");
+        }
+    });
+    it("does not strip a suffix that is merely part of the name", () => {
+        // `python3.11` ends in a dot-segment but not an executable suffix.
+        expect(plan("python3.11").reason).toBe("command_not_allowlisted");
+    });
+    it("classifies a Windows-spelled read command without demanding approval", () => {
+        expect(plan("git.exe", ["status"]).effect).toBe("read");
+        expect(plan("git.exe", ["push"]).effect).toBe("mutate");
+        expect(plan("npm.cmd", ["install"]).risk).toBe("high");
+    });
+});
+//# sourceMappingURL=index.test.js.map

package/dist/index.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.js","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,sCAAsC;AAEtC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,MAAM,IAAI,GAAG,wBAAwB,CAAC;AAEtC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC;YACtC,IAAI,EAAE,oBAAoB;YAC1B,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE;SAClE,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,cAAc,CAC3B,sCAAsC,EACtC,OAAO,EACP,mBAAmB,CAAC,IAAI,CAAC,CAC1B,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,CAAC;YAC9C,IAAI,EAAE,cAAc;YACpB,SAAS,EAAE;gBACT,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,UAAU;aACpB;SACF,CAAC,CAAC;QACH,MAAM,CACJ,cAAc,CACZ,sCAAsC,EACtC,eAAe,EACf,mBAAmB,CAAC,IAAI,CAAC,CAC1B,CAAC,QAAQ,CAAC,MAAM,CAClB,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAErC,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC;YACtC,GAAG,eAAe;YAClB,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;SAChE,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,cAAc,CAC3B,sCAAsC,EACtC,OAAO,EACP,mBAAmB,CAAC,IAAI,CAAC,CAC1B,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC;YACtC,IAAI,EAAE,2BAA2B;YACjC,SAAS,EAAE;gBACT,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC;aAC7B;SACF,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,CACJ,cAAc,CACZ,sCAAsC,EACtC,OAAO,EACP,MAAM,CACP,CAAC,QAAQ,CAAC,MAAM,CAClB,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC;YACtC,IAAI,EAAE,oCAAoC;YAC1C,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE;SACxD,CAAC,CAAC;QACH,MAAM,CACJ,cAAc,CACZ,sCAAsC,EACtC,OAAO,EACP,mBAAmB,CAAC,IAAI,CAAC,CAC1B,CAAC,QAAQ,CAAC,OAAO,CACnB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEhB,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC;YACpC,IAAI,EAAE,iCAAiC;YACvC,SAAS,EAAE;gBACT,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,OAAO;gBACf,eAAe,EAAE,YAAY;gBAC7B,CAAC,EAAE,GAAG;gBACN,CAAC,EAAE,GAAG;aACP;YACD,gBAAgB,EAAE;gBAChB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE;aACxD;SACF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,cAAc,CAC7B,sCAAsC,EACtC,KAAK,EACL,mBAAmB,CAAC,IAAI,CAAC,CAC1B,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC;YACtC,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,WAAW;gBAClB,GAAG,EAAE,SAAS;gBACd,KAAK,EAAE,OAAO;aACf;YACD,gBAAgB,EAAE;gBAChB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE;aACvD;SACF,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,cAAc,CAC3B,sCAAsC,EACtC,OAAO,EACP,mBAAmB,CAAC,IAAI,CAAC,CAC1B,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,CACJ,gBAAgB,CAAC,SAAS,EAAE;YAC1B,UAAU,EAAE,SAAU,CAAC,UAAU;YACjC,MAAM,EAAE,SAAU,CAAC,MAAM;SAC1B,CAAC,CACH,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC;YAC1C,IAAI,EAAE,wDAAwD;YAC9D,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE;YAC9D,WAAW,EAAE,CAAC,4BAA4B,CAAC;SAC5C,CAAC,CAAC;QACH,MAAM,CACJ,cAAc,CACZ,sCAAsC,EACtC,WAAW,EACX,mBAAmB,CAAC,IAAI,CAAC,CAC1B,CAAC,QAAQ,CAAC,MAAM,CAClB,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QAE/C,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC;YACxC,IAAI,EAAE,0BAA0B;YAChC,SAAS,EAAE;gBACT,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,SAAS;aACnB;YACD,gBAAgB,EAAE,CAAC,QAAQ,CAAC;YAC5B,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;SAChE,CAAC,CAAC;QACH,MAAM,CACJ,cAAc,CACZ,sCAAsC,EACtC,SAAS,EACT,mBAAmB,CAAC,IAAI,CAAC,CAC1B,CAAC,QAAQ,CAAC,MAAM,CAClB,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,yEAAyE;QACzE,8EAA8E;QAC9E,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC;YACtC,IAAI,EAAE,kBAAkB;YACxB,SAAS,EAAE;gBACT,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,UAAU;gBAClB,GAAG,EAAE,0BAA0B;aAChC;SACF,CAAC,CAAC;QACH,MAAM,CACJ,cAAc,CACZ,sCAAsC,EACtC,OAAO,EACP,mBAAmB,CAAC,IAAI,CAAC,CAC1B,CAAC,QAAQ,CAAC,OAAO,CACnB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CACJ,kBAAkB,CAAC;YACjB,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,KAAK;SACjB,CAAC,CACH,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACtD,MAAM,CACJ,kBAAkB,CAAC;YACjB,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,KAAK;SACjB,CAAC,CACH,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACtD,MAAM,CACJ,kBAAkB,CAAC;YACjB,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,OAAO;YACpB,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,KAAK;SACjB,CAAC,CACH,CAAC,OAAO,CAAC;YACR,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE;YACtC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE;SACvC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,0EAA0E;QAC1E,mDAAmD;QACnD,MAAM,CACJ,kBAAkB,CAAC;YACjB,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;YACtB,SAAS,EAAE,MAAM;YACjB,cAAc,EAAE,OAAO;SACxB,CAAC,CACH,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CACJ,kBAAkB,CAAC;YACjB,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,KAAK;SACjB,CAAC,CACH,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CACJ,kBAAkB,CAAC;YACjB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,WAAW;YAClB,GAAG,EAAE,GAAG;YACR,KAAK,EAAE,GAAG;YACV,UAAU,EAAE,CAAC;YACb,IAAI,EAAE,EAAE;YACR,iBAAiB,EAAE,KAAK;YACxB,KAAK,EAAE,EAAE;SACV,CAAC,CACH,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACpE,mEAAmE;QACnE,MAAM,CACJ,kBAAkB,CAAC;YACjB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,WAAW;YAClB,UAAU,EAAE,CAAC;YACb,IAAI,EAAE,EAAE;YACR,iBAAiB,EAAE,KAAK;YACxB,KAAK,EAAE,EAAE;SACV,CAAC,CACH,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,sEAAsE;QACtE,yDAAyD;QACzD,MAAM,CACJ,kBAAkB,CAAC;YACjB,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;YAC3B,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,MAAM;YACjB,aAAa,EAAE,GAAG;YAClB,eAAe,EAAE,KAAK;YACtB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,GAAG;SACZ,CAAC,CACH,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,OAAiB,EAAE,EAAE,EAAE,CACpD,cAAc,CACZ,sCAAsC,EACtC,iBAAiB,CAAC,KAAK,CAAC;QACtB,IAAI,EAAE,4BAA4B;QAClC,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;QAC7D,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;KACpD,CAAC,EACF,mBAAmB,CAAC,IAAI,CAAC,CAC1B,CAAC,QAAQ,CAAC;IAEb,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,0EAA0E;QAC1E,6EAA6E;QAC7E,+DAA+D;QAC/D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAChE,yBAAyB,CAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,4EAA4E;QAC5E,sCAAsC;QACtC,KAAK,MAAM,OAAO,IAAI;YACpB,YAAY;YACZ,gBAAgB;YAChB,gBAAgB;YAChB,gCAAgC;YAChC,UAAU;YACV,WAAW;SACZ,EAAE,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,mEAAmE;QACnE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@melra/policy-core",
+  "version": "0.3.0-alpha.3",
+  "description": "Policy evaluation and scoped approval primitives for MELRA.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/XAGI-Lab/melra.git",
+    "directory": "packages/policy-core"
+  },
+  "homepage": "https://github.com/XAGI-Lab/melra#readme",
+  "bugs": "https://github.com/XAGI-Lab/melra/issues",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@melra/protocol": "0.3.0-alpha.3"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "clean": "rm -rf dist",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}