@nexus-cortex/core 4.26.0

package/dist/middleware/permissions/PermissionConfigLoader.js

@@ -0,0 +1,296 @@
+/**
+ * Permission Configuration Loader
+ *
+ * Loads permission configuration from JSON files and instantiates
+ * policies and handlers.
+ *
+ * @module permissions/PermissionConfigLoader
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { WhitelistPolicy } from './WhitelistPolicy.js';
+import { BlacklistPolicy } from './BlacklistPolicy.js';
+import { FileOperationPolicy } from './FileOperationPolicy.js';
+import { BashCommandPolicy } from './BashCommandPolicy.js';
+import { CLIApprovalHandler } from './CLIApprovalHandler.js';
+import { AutoApproveHandler } from './AutoApproveHandler.js';
+import { DenyAllHandler } from './DenyAllHandler.js';
+import { PermissionAuditLogger } from './PermissionAuditLogger.js';
+import { PermissionsMiddleware } from '../PermissionsMiddleware.js';
+/**
+ * Configuration loader for permission system
+ *
+ * @example
+ * ```typescript
+ * const loader = new PermissionConfigLoader();
+ *
+ * const middleware = await loader.loadFromFile('/path/to/permissions.json');
+ * ```
+ */
+export class PermissionConfigLoader {
+    options;
+    constructor(options = {}) {
+        this.options = {
+            throwOnError: options.throwOnError ?? true,
+            enableLogging: options.enableLogging ?? false,
+        };
+    }
+    /**
+     * Load configuration from a JSON file
+     *
+     * @param filePath Path to the configuration file
+     * @returns Configured permissions middleware
+     */
+    async loadFromFile(filePath) {
+        const absolutePath = path.resolve(filePath);
+        if (!fs.existsSync(absolutePath)) {
+            const error = `Configuration file not found: ${absolutePath}`;
+            if (this.options.throwOnError) {
+                throw new Error(error);
+            }
+            else {
+                console.error(`[PermissionConfigLoader] ${error}`);
+                return this.createDefaultMiddleware();
+            }
+        }
+        try {
+            const content = await fs.promises.readFile(absolutePath, 'utf-8');
+            const config = JSON.parse(content);
+            return this.loadFromConfig(config);
+        }
+        catch (error) {
+            const errorMsg = `Failed to load configuration: ${error instanceof Error ? error.message : 'Unknown error'}`;
+            if (this.options.throwOnError) {
+                throw new Error(errorMsg);
+            }
+            else {
+                console.error(`[PermissionConfigLoader] ${errorMsg}`);
+                return this.createDefaultMiddleware();
+            }
+        }
+    }
+    /**
+     * Load policies from a JSON configuration file
+     *
+     * @param filePath Path to the configuration file
+     * @returns Array of configured permission policies
+     */
+    async loadPoliciesFromFile(filePath) {
+        const absolutePath = path.resolve(filePath);
+        if (!fs.existsSync(absolutePath)) {
+            const error = `Configuration file not found: ${absolutePath}`;
+            if (this.options.throwOnError) {
+                throw new Error(error);
+            }
+            else {
+                console.error(`[PermissionConfigLoader] ${error}`);
+                return [];
+            }
+        }
+        try {
+            const content = await fs.promises.readFile(absolutePath, 'utf-8');
+            const config = JSON.parse(content);
+            if (!config.enabled) {
+                if (this.options.enableLogging) {
+                    console.log('[PermissionConfigLoader] Permissions disabled by config');
+                }
+                return [];
+            }
+            return this.loadPolicies(config.policies);
+        }
+        catch (error) {
+            const errorMsg = `Failed to load policies from configuration: ${error instanceof Error ? error.message : 'Unknown error'}`;
+            if (this.options.throwOnError) {
+                throw new Error(errorMsg);
+            }
+            else {
+                console.error(`[PermissionConfigLoader] ${errorMsg}`);
+                return [];
+            }
+        }
+    }
+    /**
+     * Load configuration from an object
+     *
+     * @param config The permission configuration
+     * @returns Configured permissions middleware
+     */
+    loadFromConfig(config) {
+        if (!config.enabled) {
+            if (this.options.enableLogging) {
+                console.log('[PermissionConfigLoader] Permissions disabled by config');
+            }
+            // Return a permissive middleware with no policies
+            return new PermissionsMiddleware({
+                defaultPolicy: 'allow',
+                policies: [],
+            });
+        }
+        // Load policies
+        const policies = this.loadPolicies(config.policies);
+        // Load approval handler
+        const approvalHandler = this.loadApprovalHandler(config.approvalHandler);
+        // Load audit logger
+        const auditLogger = this.loadAuditLogger(config.auditLog);
+        return new PermissionsMiddleware({
+            policies,
+            approvalHandler,
+            auditLogger,
+            defaultPolicy: config.defaultPolicy,
+            enableLogging: config.enableLogging,
+        });
+    }
+    /**
+     * Load policies from configuration
+     */
+    loadPolicies(policyConfigs) {
+        const policies = [];
+        for (const policyConfig of policyConfigs) {
+            try {
+                const policy = this.createPolicy(policyConfig);
+                if (policy) {
+                    policies.push(policy);
+                    if (this.options.enableLogging) {
+                        console.log(`[PermissionConfigLoader] Loaded policy: ${policyConfig.type}`);
+                    }
+                }
+            }
+            catch (error) {
+                const errorMsg = `Failed to load policy ${policyConfig.type}: ${error instanceof Error ? error.message : 'Unknown error'}`;
+                if (this.options.throwOnError) {
+                    throw new Error(errorMsg);
+                }
+                else {
+                    console.error(`[PermissionConfigLoader] ${errorMsg}`);
+                }
+            }
+        }
+        return policies;
+    }
+    /**
+     * Create a policy from configuration
+     */
+    createPolicy(config) {
+        const enabled = config.enabled ?? true;
+        switch (config.type) {
+            case 'whitelist': {
+                const allowedTools = config.config.allowedTools || [];
+                if (allowedTools.length === 0) {
+                    // Hard whitelist with empty allowedTools denies every tool — refuse
+                    // to honor it. This is almost always a footgun in a shipped profile.
+                    console.warn(`[PermissionConfigLoader] Skipping whitelist policy with empty allowedTools (would deny every tool). To enforce a deny-all stance, use 'defaultPolicy: deny' instead.`);
+                    return null;
+                }
+                return new WhitelistPolicy(allowedTools, config.priority, enabled);
+            }
+            case 'blacklist':
+                return new BlacklistPolicy(config.config.blockedTools || [], config.priority, enabled);
+            case 'file-operation':
+                return new FileOperationPolicy({
+                    allowedPaths: config.config.allowedPaths || [],
+                    blockedPaths: config.config.blockedPaths || [],
+                    requireApprovalForDelete: config.config.requireApprovalForDelete ?? true,
+                    requireApprovalForWrite: config.config.requireApprovalForWrite ?? false,
+                    maxPathLength: config.config.maxPathLength,
+                }, config.priority, enabled);
+            case 'bash-command':
+                return new BashCommandPolicy({
+                    allowedCommands: config.config.allowedCommands || [],
+                    blockedCommands: config.config.blockedCommands || [],
+                    requireApprovalForDangerous: config.config.requireApprovalForDangerous ?? true,
+                    customDangerousPatterns: config.config.customDangerousPatterns,
+                }, config.priority, enabled);
+            case 'custom':
+                // Custom policies need to be registered separately
+                console.warn('[PermissionConfigLoader] Custom policy type not supported in loader');
+                return null;
+            default:
+                console.warn(`[PermissionConfigLoader] Unknown policy type: ${config.type}`);
+                return null;
+        }
+    }
+    /**
+     * Load approval handler from configuration
+     */
+    loadApprovalHandler(handlerType) {
+        if (!handlerType) {
+            return undefined;
+        }
+        switch (handlerType) {
+            case 'cli':
+                return new CLIApprovalHandler();
+            case 'auto-approve':
+                return new AutoApproveHandler();
+            case 'deny-all':
+                return new DenyAllHandler();
+            default:
+                console.warn(`[PermissionConfigLoader] Unknown approval handler type: ${handlerType}`);
+                return undefined;
+        }
+    }
+    /**
+     * Load audit logger from configuration
+     */
+    loadAuditLogger(auditConfig) {
+        if (!auditConfig || !auditConfig.enabled) {
+            return undefined;
+        }
+        const logPath = auditConfig.path || '.cortex/audit/permissions.log';
+        return new PermissionAuditLogger(logPath, {
+            maxFileSizeBytes: auditConfig.maxFileSizeBytes,
+            enableRotation: auditConfig.enableRotation,
+            maxRotatedFiles: auditConfig.maxRotatedFiles,
+        });
+    }
+    /**
+     * Create a default middleware with minimal configuration
+     */
+    createDefaultMiddleware() {
+        if (this.options.enableLogging) {
+            console.log('[PermissionConfigLoader] Creating default permissive middleware');
+        }
+        return new PermissionsMiddleware({
+            defaultPolicy: 'allow',
+            policies: [],
+        });
+    }
+    /**
+     * Validate configuration without loading
+     *
+     * @param config The configuration to validate
+     * @returns Array of validation errors (empty if valid)
+     */
+    validateConfig(config) {
+        const errors = [];
+        if (typeof config.enabled !== 'boolean') {
+            errors.push('enabled must be a boolean');
+        }
+        if (config.defaultPolicy !== 'allow' && config.defaultPolicy !== 'deny') {
+            errors.push('defaultPolicy must be "allow" or "deny"');
+        }
+        if (!Array.isArray(config.policies)) {
+            errors.push('policies must be an array');
+        }
+        else {
+            for (let i = 0; i < config.policies.length; i++) {
+                const policy = config.policies[i];
+                if (!policy) {
+                    errors.push(`policies[${i}] is null or undefined`);
+                    continue;
+                }
+                if (!policy.type) {
+                    errors.push(`policies[${i}] missing required field: type`);
+                }
+                if (!policy.config || typeof policy.config !== 'object') {
+                    errors.push(`policies[${i}] missing required field: config`);
+                }
+            }
+        }
+        if (config.approvalHandler &&
+            !['cli', 'auto-approve', 'deny-all'].includes(config.approvalHandler)) {
+            errors.push('approvalHandler must be "cli", "auto-approve", or "deny-all"');
+        }
+        return errors;
+    }
+}
+//# sourceMappingURL=PermissionConfigLoader.js.map

package/dist/middleware/permissions/PermissionConfigLoader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionConfigLoader.js","sourceRoot":"","sources":["../../../src/middleware/permissions/PermissionConfigLoader.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAQlC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAmBpE;;;;;;;;;GASG;AACH,MAAM,OAAO,sBAAsB;IACzB,OAAO,CAAgC;IAE/C,YAAY,UAA+B,EAAE;QAC3C,IAAI,CAAC,OAAO,GAAG;YACb,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;YAC1C,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,KAAK;SAC9C,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,iCAAiC,YAAY,EAAE,CAAC;YAE9D,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;gBACnD,OAAO,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACxC,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAClE,MAAM,MAAM,GAAqB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAErD,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;YAE7G,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;gBACtD,OAAO,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,QAAgB;QACzC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,iCAAiC,YAAY,EAAE,CAAC;YAE9D,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;gBACnD,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAClE,MAAM,MAAM,GAAqB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAErD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;oBAC/B,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;gBACzE,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,+CAA+C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;YAE3H,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;gBACtD,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,MAAwB;QACrC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC/B,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;YACzE,CAAC;YAED,kDAAkD;YAClD,OAAO,IAAI,qBAAqB,CAAC;gBAC/B,aAAa,EAAE,OAAO;gBACtB,QAAQ,EAAE,EAAE;aACb,CAAC,CAAC;QACL,CAAC;QAED,gBAAgB;QAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEpD,wBAAwB;QACxB,MAAM,eAAe,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAEzE,oBAAoB;QACpB,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE1D,OAAO,IAAI,qBAAqB,CAAC;YAC/B,QAAQ;YACR,eAAe;YACf,WAAW;YACX,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,aAAa,EAAE,MAAM,CAAC,aAAa;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,aAA6B;QAChD,MAAM,QAAQ,GAAuB,EAAE,CAAC;QAExC,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;gBAC/C,IAAI,MAAM,EAAE,CAAC;oBACX,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAEtB,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;wBAC/B,OAAO,CAAC,GAAG,CACT,2CAA2C,YAAY,CAAC,IAAI,EAAE,CAC/D,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,QAAQ,GAAG,yBAAyB,YAAY,CAAC,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;gBAE3H,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;oBAC9B,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC5B,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;gBACxD,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,MAAoB;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC;QAEvC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;gBACtD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC9B,oEAAoE;oBACpE,qEAAqE;oBACrE,OAAO,CAAC,IAAI,CACV,sKAAsK,CACvK,CAAC;oBACF,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,IAAI,eAAe,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACrE,CAAC;YAED,KAAK,WAAW;gBACd,OAAO,IAAI,eAAe,CACxB,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,EAChC,MAAM,CAAC,QAAQ,EACf,OAAO,CACR,CAAC;YAEJ,KAAK,gBAAgB;gBACnB,OAAO,IAAI,mBAAmB,CAC5B;oBACE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE;oBAC9C,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE;oBAC9C,wBAAwB,EACtB,MAAM,CAAC,MAAM,CAAC,wBAAwB,IAAI,IAAI;oBAChD,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,uBAAuB,IAAI,KAAK;oBACvE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa;iBAC3C,EACD,MAAM,CAAC,QAAQ,EACf,OAAO,CACR,CAAC;YAEJ,KAAK,cAAc;gBACjB,OAAO,IAAI,iBAAiB,CAC1B;oBACE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE;oBACpD,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE;oBACpD,2BAA2B,EACzB,MAAM,CAAC,MAAM,CAAC,2BAA2B,IAAI,IAAI;oBACnD,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,uBAAuB;iBAC/D,EACD,MAAM,CAAC,QAAQ,EACf,OAAO,CACR,CAAC;YAEJ,KAAK,QAAQ;gBACX,mDAAmD;gBACnD,OAAO,CAAC,IAAI,CACV,qEAAqE,CACtE,CAAC;gBACF,OAAO,IAAI,CAAC;YAEd;gBACE,OAAO,CAAC,IAAI,CACV,iDAAiD,MAAM,CAAC,IAAI,EAAE,CAC/D,CAAC;gBACF,OAAO,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,mBAAmB,CACzB,WAAoB;QAEpB,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,QAAQ,WAAW,EAAE,CAAC;YACpB,KAAK,KAAK;gBACR,OAAO,IAAI,kBAAkB,EAAE,CAAC;YAElC,KAAK,cAAc;gBACjB,OAAO,IAAI,kBAAkB,EAAE,CAAC;YAElC,KAAK,UAAU;gBACb,OAAO,IAAI,cAAc,EAAE,CAAC;YAE9B;gBACE,OAAO,CAAC,IAAI,CACV,2DAA2D,WAAW,EAAE,CACzE,CAAC;gBACF,OAAO,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,eAAe,CACrB,WAA4B;QAE5B,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,OAAO,GACX,WAAW,CAAC,IAAI,IAAI,+BAA+B,CAAC;QAEtD,OAAO,IAAI,qBAAqB,CAAC,OAAO,EAAE;YACxC,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;YAC9C,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,eAAe,EAAE,WAAW,CAAC,eAAe;SAC7C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,uBAAuB;QAC7B,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CACT,iEAAiE,CAClE,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,qBAAqB,CAAC;YAC/B,aAAa,EAAE,OAAO;YACtB,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,MAAwB;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,MAAM,CAAC,aAAa,KAAK,OAAO,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YACxE,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAChD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAElC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC;oBACnD,SAAS;gBACX,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;oBACjB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,gCAAgC,CAAC,CAAC;gBAC7D,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACxD,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,kCAAkC,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;QACH,CAAC;QAED,IACE,MAAM,CAAC,eAAe;YACtB,CAAC,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,EACrE,CAAC;YACD,MAAM,CAAC,IAAI,CACT,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/middleware/permissions/PermissionEvaluator.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Permission Policy Evaluator
+ *
+ * Evaluates multiple permission policies in priority order to make
+ * authorization decisions for tool executions.
+ *
+ * Evaluation Rules:
+ * 1. Policies evaluated in descending priority order (higher number first)
+ * 2. First `{ allowed: false, canApprove: false }` immediately blocks
+ * 3. First `{ allowed: false, canApprove: true }` triggers approval flow
+ * 4. If all policies return `{ allowed: true }`, execution proceeds
+ *
+ * @module permissions/PermissionEvaluator
+ */
+import type { PermissionPolicy, PermissionDecision, PermissionContext } from '../contracts/MiddlewareContracts.js';
+/**
+ * Options for the permission evaluator
+ */
+export interface PermissionEvaluatorOptions {
+    /**
+     * Default policy when no policies match
+     * @default 'deny'
+     */
+    defaultPolicy?: 'allow' | 'deny';
+    /**
+     * Whether to log evaluation decisions
+     * @default false
+     */
+    enableLogging?: boolean;
+}
+/**
+ * Result of policy evaluation with detailed information
+ */
+export interface EvaluationResult {
+    /**
+     * The final permission decision
+     */
+    decision: PermissionDecision;
+    /**
+     * The policy that made the decision (if any)
+     */
+    decidingPolicy?: string;
+    /**
+     * All policies that were evaluated
+     */
+    evaluatedPolicies: string[];
+    /**
+     * Evaluation duration in milliseconds
+     */
+    durationMs: number;
+}
+/**
+ * Permission Policy Evaluator
+ *
+ * @example
+ * ```typescript
+ * const evaluator = new PermissionEvaluator();
+ * evaluator.registerPolicy(new WhitelistPolicy(['read_file', 'write_file']));
+ * evaluator.registerPolicy(new FileOperationPolicy(['/workspace'], ['/etc']));
+ *
+ * const result = await evaluator.evaluate({
+ *   toolName: 'read_file',
+ *   toolInput: { file_path: '/workspace/file.txt' },
+ *   sessionId: '123',
+ *   timestamp: new Date()
+ * });
+ * ```
+ */
+export declare class PermissionEvaluator {
+    private policies;
+    private options;
+    constructor(options?: PermissionEvaluatorOptions);
+    /**
+     * Register a permission policy
+     *
+     * @param policy The policy to register
+     * @throws Error if a policy with the same name already exists
+     */
+    registerPolicy(policy: PermissionPolicy): void;
+    /**
+     * Unregister a permission policy by name
+     *
+     * @param policyName The name of the policy to unregister
+     * @returns True if the policy was found and removed
+     */
+    unregisterPolicy(policyName: string): boolean;
+    /**
+     * Get all registered policies
+     */
+    getPolicies(): ReadonlyArray<PermissionPolicy>;
+    /**
+     * Get a policy by name
+     */
+    getPolicy(name: string): PermissionPolicy | undefined;
+    /**
+     * Clear all registered policies
+     */
+    clearPolicies(): void;
+    /**
+     * Evaluate all policies for a permission context
+     *
+     * @param context The permission context to evaluate
+     * @returns Evaluation result with decision and metadata
+     */
+    evaluate(context: PermissionContext): Promise<EvaluationResult>;
+    /**
+     * Create default result based on default policy setting
+     */
+    private createDefaultResult;
+}
+//# sourceMappingURL=PermissionEvaluator.d.ts.map

package/dist/middleware/permissions/PermissionEvaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionEvaluator.d.ts","sourceRoot":"","sources":["../../../src/middleware/permissions/PermissionEvaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,qCAAqC,CAAC;AAE7C;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAEjC;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,QAAQ,EAAE,kBAAkB,CAAC;IAE7B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAE5B;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAA0B;IAC1C,OAAO,CAAC,OAAO,CAAuC;gBAE1C,OAAO,GAAE,0BAA+B;IAOpD;;;;;OAKG;IACH,cAAc,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI;IAgB9C;;;;;OAKG;IACH,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAe7C;;OAEG;IACH,WAAW,IAAI,aAAa,CAAC,gBAAgB,CAAC;IAI9C;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAIrD;;OAEG;IACH,aAAa,IAAI,IAAI;IAQrB;;;;;OAKG;IACG,QAAQ,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA6FrE;;OAEG;IACH,OAAO,CAAC,mBAAmB;CAoB5B"}

package/dist/middleware/permissions/PermissionEvaluator.js

@@ -0,0 +1,196 @@
+/**
+ * Permission Policy Evaluator
+ *
+ * Evaluates multiple permission policies in priority order to make
+ * authorization decisions for tool executions.
+ *
+ * Evaluation Rules:
+ * 1. Policies evaluated in descending priority order (higher number first)
+ * 2. First `{ allowed: false, canApprove: false }` immediately blocks
+ * 3. First `{ allowed: false, canApprove: true }` triggers approval flow
+ * 4. If all policies return `{ allowed: true }`, execution proceeds
+ *
+ * @module permissions/PermissionEvaluator
+ */
+/**
+ * Permission Policy Evaluator
+ *
+ * @example
+ * ```typescript
+ * const evaluator = new PermissionEvaluator();
+ * evaluator.registerPolicy(new WhitelistPolicy(['read_file', 'write_file']));
+ * evaluator.registerPolicy(new FileOperationPolicy(['/workspace'], ['/etc']));
+ *
+ * const result = await evaluator.evaluate({
+ *   toolName: 'read_file',
+ *   toolInput: { file_path: '/workspace/file.txt' },
+ *   sessionId: '123',
+ *   timestamp: new Date()
+ * });
+ * ```
+ */
+export class PermissionEvaluator {
+    policies = [];
+    options;
+    constructor(options = {}) {
+        this.options = {
+            defaultPolicy: options.defaultPolicy ?? 'deny',
+            enableLogging: options.enableLogging ?? false,
+        };
+    }
+    /**
+     * Register a permission policy
+     *
+     * @param policy The policy to register
+     * @throws Error if a policy with the same name already exists
+     */
+    registerPolicy(policy) {
+        if (this.policies.some((p) => p.name === policy.name)) {
+            throw new Error(`Policy with name "${policy.name}" already registered`);
+        }
+        this.policies.push(policy);
+        // Re-sort by priority (descending)
+        this.policies.sort((a, b) => b.priority - a.priority);
+        if (this.options.enableLogging) {
+            console.log(`[PermissionEvaluator] Registered policy "${policy.name}" with priority ${policy.priority}`);
+        }
+    }
+    /**
+     * Unregister a permission policy by name
+     *
+     * @param policyName The name of the policy to unregister
+     * @returns True if the policy was found and removed
+     */
+    unregisterPolicy(policyName) {
+        const index = this.policies.findIndex((p) => p.name === policyName);
+        if (index === -1) {
+            return false;
+        }
+        this.policies.splice(index, 1);
+        if (this.options.enableLogging) {
+            console.log(`[PermissionEvaluator] Unregistered policy "${policyName}"`);
+        }
+        return true;
+    }
+    /**
+     * Get all registered policies
+     */
+    getPolicies() {
+        return this.policies;
+    }
+    /**
+     * Get a policy by name
+     */
+    getPolicy(name) {
+        return this.policies.find((p) => p.name === name);
+    }
+    /**
+     * Clear all registered policies
+     */
+    clearPolicies() {
+        this.policies = [];
+        if (this.options.enableLogging) {
+            console.log('[PermissionEvaluator] Cleared all policies');
+        }
+    }
+    /**
+     * Evaluate all policies for a permission context
+     *
+     * @param context The permission context to evaluate
+     * @returns Evaluation result with decision and metadata
+     */
+    async evaluate(context) {
+        const startTime = Date.now();
+        const evaluatedPolicies = [];
+        // If no policies registered, use default policy
+        if (this.policies.length === 0) {
+            return this.createDefaultResult(startTime, evaluatedPolicies);
+        }
+        // Evaluate policies in priority order
+        for (const policy of this.policies) {
+            // Skip disabled policies
+            if (!policy.enabled) {
+                continue;
+            }
+            evaluatedPolicies.push(policy.name);
+            try {
+                const decision = await policy.evaluate(context);
+                if (this.options.enableLogging) {
+                    console.log(`[PermissionEvaluator] Policy "${policy.name}" returned:`, decision);
+                }
+                // If denied and cannot approve, block immediately
+                if (!decision.allowed && !decision.canApprove) {
+                    return {
+                        decision,
+                        decidingPolicy: policy.name,
+                        evaluatedPolicies,
+                        durationMs: Date.now() - startTime,
+                    };
+                }
+                // If denied but can approve, trigger approval flow
+                if (!decision.allowed && decision.canApprove) {
+                    return {
+                        decision,
+                        decidingPolicy: policy.name,
+                        evaluatedPolicies,
+                        durationMs: Date.now() - startTime,
+                    };
+                }
+                // If allowed with explicit tier, stop evaluating (whitelist/explicit approval)
+                if (decision.allowed && decision.tier) {
+                    return {
+                        decision,
+                        decidingPolicy: policy.name,
+                        evaluatedPolicies,
+                        durationMs: Date.now() - startTime,
+                    };
+                }
+                // If allowed without tier, continue to next policy (pass-through)
+            }
+            catch (error) {
+                // Policy evaluation error - fail closed (deny)
+                console.error(`[PermissionEvaluator] Error evaluating policy "${policy.name}":`, error);
+                return {
+                    decision: {
+                        allowed: false,
+                        reason: `Policy evaluation error: ${error instanceof Error ? error.message : 'Unknown error'}`,
+                        canApprove: false,
+                    },
+                    decidingPolicy: policy.name,
+                    evaluatedPolicies,
+                    durationMs: Date.now() - startTime,
+                };
+            }
+        }
+        // If no policies were evaluated (all disabled), use default policy
+        if (evaluatedPolicies.length === 0) {
+            return this.createDefaultResult(startTime, evaluatedPolicies);
+        }
+        // All evaluated policies allowed - proceed with execution
+        return {
+            decision: { allowed: true },
+            decidingPolicy: undefined,
+            evaluatedPolicies,
+            durationMs: Date.now() - startTime,
+        };
+    }
+    /**
+     * Create default result based on default policy setting
+     */
+    createDefaultResult(startTime, evaluatedPolicies) {
+        const decision = this.options.defaultPolicy === 'allow'
+            ? { allowed: true }
+            : {
+                allowed: false,
+                reason: 'No policies registered and default policy is deny',
+                canApprove: false,
+            };
+        return {
+            decision,
+            decidingPolicy: 'default',
+            evaluatedPolicies,
+            durationMs: Date.now() - startTime,
+        };
+    }
+}
+//# sourceMappingURL=PermissionEvaluator.js.map

package/dist/middleware/permissions/PermissionEvaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionEvaluator.js","sourceRoot":"","sources":["../../../src/middleware/permissions/PermissionEvaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAkDH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,mBAAmB;IACtB,QAAQ,GAAuB,EAAE,CAAC;IAClC,OAAO,CAAuC;IAEtD,YAAY,UAAsC,EAAE;QAClD,IAAI,CAAC,OAAO,GAAG;YACb,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,MAAM;YAC9C,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,KAAK;SAC9C,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,MAAwB;QACrC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,IAAI,sBAAsB,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3B,mCAAmC;QACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAEtD,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CACT,4CAA4C,MAAM,CAAC,IAAI,mBAAmB,MAAM,CAAC,QAAQ,EAAE,CAC5F,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,UAAkB;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;QACpE,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAE/B,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,8CAA8C,UAAU,GAAG,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,aAAa;QACX,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;QAEnB,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,OAA0B;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,iBAAiB,GAAa,EAAE,CAAC;QAEvC,gDAAgD;QAChD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAChE,CAAC;QAED,sCAAsC;QACtC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnC,yBAAyB;YACzB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,SAAS;YACX,CAAC;YAED,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAEpC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAEhD,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;oBAC/B,OAAO,CAAC,GAAG,CACT,iCAAiC,MAAM,CAAC,IAAI,aAAa,EACzD,QAAQ,CACT,CAAC;gBACJ,CAAC;gBAED,kDAAkD;gBAClD,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;oBAC9C,OAAO;wBACL,QAAQ;wBACR,cAAc,EAAE,MAAM,CAAC,IAAI;wBAC3B,iBAAiB;wBACjB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;qBACnC,CAAC;gBACJ,CAAC;gBAED,mDAAmD;gBACnD,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;oBAC7C,OAAO;wBACL,QAAQ;wBACR,cAAc,EAAE,MAAM,CAAC,IAAI;wBAC3B,iBAAiB;wBACjB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;qBACnC,CAAC;gBACJ,CAAC;gBAED,+EAA+E;gBAC/E,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACtC,OAAO;wBACL,QAAQ;wBACR,cAAc,EAAE,MAAM,CAAC,IAAI;wBAC3B,iBAAiB;wBACjB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;qBACnC,CAAC;gBACJ,CAAC;gBAED,kEAAkE;YACpE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,+CAA+C;gBAC/C,OAAO,CAAC,KAAK,CACX,kDAAkD,MAAM,CAAC,IAAI,IAAI,EACjE,KAAK,CACN,CAAC;gBAEF,OAAO;oBACL,QAAQ,EAAE;wBACR,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;wBAC9F,UAAU,EAAE,KAAK;qBAClB;oBACD,cAAc,EAAE,MAAM,CAAC,IAAI;oBAC3B,iBAAiB;oBACjB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAChE,CAAC;QAED,0DAA0D;QAC1D,OAAO;YACL,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAC3B,cAAc,EAAE,SAAS;YACzB,iBAAiB;YACjB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,mBAAmB,CACzB,SAAiB,EACjB,iBAA2B;QAE3B,MAAM,QAAQ,GACZ,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,OAAO;YACpC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;YACnB,CAAC,CAAC;gBACE,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,mDAAmD;gBAC3D,UAAU,EAAE,KAAK;aAClB,CAAC;QAER,OAAO;YACL,QAAQ;YACR,cAAc,EAAE,SAAS;YACzB,iBAAiB;YACjB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;CACF"}