@oobe-protocol-labs/sap-mcp-server 0.9.15 → 0.9.20

package/dist/policy/local-policy-engine.d.ts

@@ -1,15 +1,32 @@
 /**
- * Local Policy Engine
+ * @name policy/local-policy-engine
+ * @description Deterministic security policy engine for SAP MCP Server.
  *
- * Deterministic security policies for SAP MCP Server
- * Runs entirely locally - no external dependencies
+ * Runs entirely locally with no external dependencies. Enforces spend limits,
+ * program and address whitelists/blacklists, rate limiting per user, human
+ * escalation for sensitive tools, and time-based operation windows.
  *
- * Features:
- * - Spend limits per tool/operation
- * - Program whitelist/blacklist
- * - Address whitelist/blacklist
- * - Rate limiting per user
- * - Time-based restrictions
+ * @flow
+ *   1. `PolicyConfig` is constructed directly or via `createPolicyConfigFromEnv`.
+ *   2. `LocalPolicyEngine` is instantiated with the config.
+ *   3. `validateToolCall` runs all checks in priority order and returns a `PolicyDecision`.
+ *
+ * @module policy/local-policy-engine
+ */
+/**
+ * @name PolicyConfig
+ * @description Configuration for the local deterministic policy engine.
+ *
+ * @property spendLimits       — Maximum amount (in lamports) per tool call, keyed by tool name (`*` for global).
+ * @property programWhitelist  — Allowed program IDs (empty = allow all).
+ * @property programBlacklist  — Blocked program IDs.
+ * @property addressWhitelist  — Allowed destination addresses (empty = allow all).
+ * @property addressBlacklist  — Blocked destination addresses.
+ * @property rateLimits        — Max calls per minute per user, keyed by tool name (`*` for global).
+ * @property escalationTools   — Tools that require human approval before execution.
+ * @property allowedHours      — Optional UTC hour window when operations are permitted.
+ *
+ * @usedBy `LocalPolicyEngine`, `createPolicyConfigFromEnv`
  */
 export interface PolicyConfig {
     /** Maximum amount (in lamports) per tool call */
@@ -33,7 +50,17 @@ export interface PolicyConfig {
     };
 }
 /**
- * Contract describing policy decision data used by the SAP MCP runtime.
+ * @name PolicyDecision
+ * @description Outcome of validating a tool call against all policy rules.
+ *
+ * @property allowed    — Whether the operation is permitted.
+ * @property blocked    — Whether the operation is explicitly blocked.
+ * @property escalated  — Whether the operation requires human escalation.
+ * @property reason     — Human-readable explanation of the decision.
+ * @property rule       — Policy rule that was triggered.
+ * @property metadata   — Additional metadata for logging and auditing.
+ *
+ * @usedBy `LocalPolicyEngine.validateToolCall`, `policy-engine.ts`
  */
 export interface PolicyDecision {
     /** Whether the operation is allowed */
@@ -50,7 +77,18 @@ export interface PolicyDecision {
     metadata?: Record<string, unknown>;
 }
 /**
- * Contract describing policy context data used by the SAP MCP runtime.
+ * @name PolicyContext
+ * @description Context for a single tool call being evaluated by the policy engine.
+ *
+ * @property toolName    — Tool or function being called.
+ * @property args        — Tool arguments passed by the caller.
+ * @property user        — User or wallet identifier.
+ * @property amount      — Amount involved in lamports, if applicable.
+ * @property programId   — Program ID being interacted with, if applicable.
+ * @property destination — Destination address, if applicable.
+ * @property timestamp   — Current timestamp (defaults to `Date.now()`).
+ *
+ * @usedBy `LocalPolicyEngine.validateToolCall`
  */
 export interface PolicyContext {
     /** Tool/function being called */
@@ -69,7 +107,18 @@ export interface PolicyContext {
     timestamp?: number;
 }
 /**
- * Runtime service that implements local policy engine behavior.
+ * @name LocalPolicyEngine
+ * @description Runtime service that enforces deterministic local policy checks.
+ *
+ * Maintains in-memory call history for rate limiting and evaluates each
+ * tool call against blacklist, whitelist, spend, rate, escalation, and
+ * time-window rules in priority order.
+ *
+ * @method validateToolCall — Validate a tool call against all configured policy rules.
+ * @method getConfig        — Return a shallow copy of the current policy configuration.
+ * @method clearHistory     — Clear the in-memory call history (useful for testing).
+ *
+ * @usedBy `hybrid-policy-engine.ts`, `policy-engine.ts`
  */
 export declare class LocalPolicyEngine {
     private config;
@@ -113,7 +162,16 @@ export declare class LocalPolicyEngine {
     clearHistory(): void;
 }
 /**
- * Create policy config from environment variables
+ * @name createPolicyConfigFromEnv
+ * @description Create a `PolicyConfig` from environment variables.
+ *
+ * Reads `SAP_MCP_SPEND_LIMITS`, `SAP_MCP_RATE_LIMITS`, whitelist/blacklist
+ * env vars, escalation tools, and `SAP_MCP_ALLOWED_HOURS` to produce a
+ * fully populated configuration object. Invalid JSON falls back to empty defaults.
+ *
+ * @returns A `PolicyConfig` populated from environment variables.
+ *
+ * @usedBy `hybrid-policy-engine.ts`, `policy-engine.ts`
  */
 export declare function createPolicyConfigFromEnv(): PolicyConfig;
 //# sourceMappingURL=local-policy-engine.d.ts.map

package/dist/policy/local-policy-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-policy-engine.d.ts","sourceRoot":"","sources":["../../src/policy/local-policy-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,0BAA0B;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,0BAA0B;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,oCAAoC;IACpC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,oCAAoC;IACpC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,qDAAqD;IACrD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,2DAA2D;IAC3D,YAAY,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,sDAAsD;IACtD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,WAAW,CAAiE;gBAExE,MAAM,EAAE,YAAY;IAIhC;;OAEG;IACG,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAyDvE;;OAEG;IACH,OAAO,CAAC,cAAc;IAwBtB;;OAEG;IACH,OAAO,CAAC,cAAc;IA2BtB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAsCxB;;OAEG;IACH,OAAO,CAAC,eAAe;IAuCvB;;OAEG;IACH,OAAO,CAAC,eAAe;IAiBvB;;OAEG;IACH,OAAO,CAAC,eAAe;IAmCvB;;OAEG;IACH,SAAS,IAAI,YAAY;IAIzB;;OAEG;IACH,YAAY,IAAI,IAAI;CAGrB;AAED;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,YAAY,CA2DxD"}
+{"version":3,"file":"local-policy-engine.d.ts","sourceRoot":"","sources":["../../src/policy/local-policy-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,0BAA0B;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,0BAA0B;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,oCAAoC;IACpC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,oCAAoC;IACpC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,qDAAqD;IACrD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,2DAA2D;IAC3D,YAAY,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,sDAAsD;IACtD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,aAAa;IAC5B,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,WAAW,CAAiE;gBAExE,MAAM,EAAE,YAAY;IAIhC;;OAEG;IACG,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAyDvE;;OAEG;IACH,OAAO,CAAC,cAAc;IAwBtB;;OAEG;IACH,OAAO,CAAC,cAAc;IA2BtB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAsCxB;;OAEG;IACH,OAAO,CAAC,eAAe;IAuCvB;;OAEG;IACH,OAAO,CAAC,eAAe;IAiBvB;;OAEG;IACH,OAAO,CAAC,eAAe;IAmCvB;;OAEG;IACH,SAAS,IAAI,YAAY;IAIzB;;OAEG;IACH,YAAY,IAAI,IAAI;CAGrB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,IAAI,YAAY,CA2DxD"}

package/dist/policy/local-policy-engine.js

@@ -1,18 +1,31 @@
 /**
- * Local Policy Engine
+ * @name policy/local-policy-engine
+ * @description Deterministic security policy engine for SAP MCP Server.
  *
- * Deterministic security policies for SAP MCP Server
- * Runs entirely locally - no external dependencies
+ * Runs entirely locally with no external dependencies. Enforces spend limits,
+ * program and address whitelists/blacklists, rate limiting per user, human
+ * escalation for sensitive tools, and time-based operation windows.
  *
- * Features:
- * - Spend limits per tool/operation
- * - Program whitelist/blacklist
- * - Address whitelist/blacklist
- * - Rate limiting per user
- * - Time-based restrictions
+ * @flow
+ *   1. `PolicyConfig` is constructed directly or via `createPolicyConfigFromEnv`.
+ *   2. `LocalPolicyEngine` is instantiated with the config.
+ *   3. `validateToolCall` runs all checks in priority order and returns a `PolicyDecision`.
+ *
+ * @module policy/local-policy-engine
  */
 /**
- * Runtime service that implements local policy engine behavior.
+ * @name LocalPolicyEngine
+ * @description Runtime service that enforces deterministic local policy checks.
+ *
+ * Maintains in-memory call history for rate limiting and evaluates each
+ * tool call against blacklist, whitelist, spend, rate, escalation, and
+ * time-window rules in priority order.
+ *
+ * @method validateToolCall — Validate a tool call against all configured policy rules.
+ * @method getConfig        — Return a shallow copy of the current policy configuration.
+ * @method clearHistory     — Clear the in-memory call history (useful for testing).
+ *
+ * @usedBy `hybrid-policy-engine.ts`, `policy-engine.ts`
  */
 export class LocalPolicyEngine {
     config;
@@ -261,7 +274,16 @@ export class LocalPolicyEngine {
     }
 }
 /**
- * Create policy config from environment variables
+ * @name createPolicyConfigFromEnv
+ * @description Create a `PolicyConfig` from environment variables.
+ *
+ * Reads `SAP_MCP_SPEND_LIMITS`, `SAP_MCP_RATE_LIMITS`, whitelist/blacklist
+ * env vars, escalation tools, and `SAP_MCP_ALLOWED_HOURS` to produce a
+ * fully populated configuration object. Invalid JSON falls back to empty defaults.
+ *
+ * @returns A `PolicyConfig` populated from environment variables.
+ *
+ * @usedBy `hybrid-policy-engine.ts`, `policy-engine.ts`
  */
 export function createPolicyConfigFromEnv() {
     const spendLimitsRaw = process.env.SAP_MCP_SPEND_LIMITS || '{}';

package/dist/policy/local-policy-engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"local-policy-engine.js","sourceRoot":"","sources":["../../src/policy/local-policy-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA2DH;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACpB,MAAM,CAAe;IACrB,WAAW,GAAuD,IAAI,GAAG,EAAE,CAAC;IAEpF,YAAY,MAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAsB;QAC3C,MAAM,SAAS,GAAqB,EAAE,CAAC;QAEvC,wCAAwC;QACxC,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE/B,qBAAqB;QACrB,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE/B,wBAAwB;QACxB,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;YAC5B,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAEhC,uBAAuB;QACvB,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE/B,mCAAmC;QACnC,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,eAAe,CAAC,SAAS,EAAE,CAAC;YAC9B,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAEhC,wBAAwB;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE1B,oBAAoB;QACpB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,0BAA0B;YAClC,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE;gBACR,eAAe,EAAE,SAAS,CAAC,MAAM;gBACjC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,OAAsB;QAC3C,0BAA0B;QAC1B,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAClF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,WAAW,OAAO,CAAC,SAAS,iBAAiB;gBACrD,IAAI,EAAE,mBAAmB;aAC1B,CAAC;QACJ,CAAC;QAED,0BAA0B;QAC1B,IAAI,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACtF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,WAAW,OAAO,CAAC,WAAW,iBAAiB;gBACvD,IAAI,EAAE,mBAAmB;aAC1B,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACtD,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,OAAsB;QAC3C,wDAAwD;QACxD,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACjE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9D,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,WAAW,OAAO,CAAC,SAAS,qBAAqB;oBACzD,IAAI,EAAE,mBAAmB;iBAC1B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACnE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBAChE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,WAAW,OAAO,CAAC,WAAW,qBAAqB;oBAC3D,IAAI,EAAE,mBAAmB;iBAC1B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC7D,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,OAAsB;QAC7C,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACzD,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;YAClD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,UAAU,OAAO,CAAC,MAAM,kBAAkB,KAAK,QAAQ,OAAO,CAAC,QAAQ,EAAE;gBACjF,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE;oBACR,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,KAAK;oBACL,IAAI,EAAE,OAAO,CAAC,QAAQ;iBACvB;aACF,CAAC;QACJ,CAAC;QAED,oDAAoD;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;YAC9D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,UAAU,OAAO,CAAC,MAAM,yBAAyB,WAAW,EAAE;gBACtE,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE;oBACR,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,KAAK,EAAE,WAAW;iBACnB;aACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC1D,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,OAAsB;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,kBAAkB;QAC9C,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QAEtD,iCAAiC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAEpD,8BAA8B;QAC9B,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,CAAC;QAE5E,mBAAmB;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;QAClG,IAAI,WAAW,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;YAChC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,wBAAwB,WAAW,CAAC,MAAM,IAAI,KAAK,mBAAmB;gBAC9E,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE;oBACR,KAAK,EAAE,WAAW,CAAC,MAAM;oBACzB,KAAK;oBACL,QAAQ;iBACT;aACF,CAAC;QACJ,CAAC;QAED,mBAAmB;QACnB,WAAW,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAE3C,mCAAmC;QACnC,IAAI,WAAW,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACzD,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,OAAsB;QAC5C,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,QAAQ,OAAO,CAAC,QAAQ,0BAA0B;gBAC1D,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE;oBACR,IAAI,EAAE,OAAO,CAAC,QAAQ;oBACtB,cAAc,EAAE,gBAAgB;iBACjC;aACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC7D,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,OAAsB;QAC5C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAC3D,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAEhD,6CAA6C;QAC7C,IAAI,QAAiB,CAAC;QACtB,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;YACjB,QAAQ,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG,GAAG,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,2CAA2C;YAC3C,QAAQ,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG,GAAG,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,6BAA6B,IAAI,qBAAqB,KAAK,OAAO,GAAG,MAAM;gBACnF,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE;oBACR,WAAW,EAAE,IAAI;oBACjB,YAAY,EAAE,KAAK;oBACnB,UAAU,EAAE,GAAG;iBAChB;aACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,YAAY;QACV,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC;IAChE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC;IAE9D,IAAI,WAAmC,CAAC;IACxC,IAAI,UAAkC,CAAC;IAEvC,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,EAAE,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,EAAE,CAAC;IAClB,CAAC;IAED,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAC5D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAC5D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAC5D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAC5D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB;QAC1D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpE,CAAC,CAAC,CAAC,iBAAiB,EAAE,wBAAwB,EAAE,wBAAwB,CAAC,CAAC;IAE5E,kEAAkE;IAClE,IAAI,YAAwD,CAAC;IAC7D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACxD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,YAAY,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAChC,CAAC;IACH,CAAC;IAED,OAAO;QACL,WAAW;QACX,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;QAChB,UAAU;QACV,eAAe;QACf,YAAY;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"local-policy-engine.js","sourceRoot":"","sources":["../../src/policy/local-policy-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA+FH;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,iBAAiB;IACpB,MAAM,CAAe;IACrB,WAAW,GAAuD,IAAI,GAAG,EAAE,CAAC;IAEpF,YAAY,MAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAsB;QAC3C,MAAM,SAAS,GAAqB,EAAE,CAAC;QAEvC,wCAAwC;QACxC,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE/B,qBAAqB;QACrB,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE/B,wBAAwB;QACxB,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;YAC5B,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAEhC,uBAAuB;QACvB,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE/B,mCAAmC;QACnC,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,eAAe,CAAC,SAAS,EAAE,CAAC;YAC9B,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAEhC,wBAAwB;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE1B,oBAAoB;QACpB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,0BAA0B;YAClC,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE;gBACR,eAAe,EAAE,SAAS,CAAC,MAAM;gBACjC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,OAAsB;QAC3C,0BAA0B;QAC1B,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAClF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,WAAW,OAAO,CAAC,SAAS,iBAAiB;gBACrD,IAAI,EAAE,mBAAmB;aAC1B,CAAC;QACJ,CAAC;QAED,0BAA0B;QAC1B,IAAI,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACtF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,WAAW,OAAO,CAAC,WAAW,iBAAiB;gBACvD,IAAI,EAAE,mBAAmB;aAC1B,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACtD,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,OAAsB;QAC3C,wDAAwD;QACxD,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACjE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9D,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,WAAW,OAAO,CAAC,SAAS,qBAAqB;oBACzD,IAAI,EAAE,mBAAmB;iBAC1B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACnE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBAChE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,WAAW,OAAO,CAAC,WAAW,qBAAqB;oBAC3D,IAAI,EAAE,mBAAmB;iBAC1B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC7D,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,OAAsB;QAC7C,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACzD,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;YAClD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,UAAU,OAAO,CAAC,MAAM,kBAAkB,KAAK,QAAQ,OAAO,CAAC,QAAQ,EAAE;gBACjF,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE;oBACR,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,KAAK;oBACL,IAAI,EAAE,OAAO,CAAC,QAAQ;iBACvB;aACF,CAAC;QACJ,CAAC;QAED,oDAAoD;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;YAC9D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,UAAU,OAAO,CAAC,MAAM,yBAAyB,WAAW,EAAE;gBACtE,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE;oBACR,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,KAAK,EAAE,WAAW;iBACnB;aACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC1D,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,OAAsB;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,kBAAkB;QAC9C,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QAEtD,iCAAiC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAEpD,8BAA8B;QAC9B,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,CAAC;QAE5E,mBAAmB;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;QAClG,IAAI,WAAW,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;YAChC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,wBAAwB,WAAW,CAAC,MAAM,IAAI,KAAK,mBAAmB;gBAC9E,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE;oBACR,KAAK,EAAE,WAAW,CAAC,MAAM;oBACzB,KAAK;oBACL,QAAQ;iBACT;aACF,CAAC;QACJ,CAAC;QAED,mBAAmB;QACnB,WAAW,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAE3C,mCAAmC;QACnC,IAAI,WAAW,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACzD,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,OAAsB;QAC5C,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,QAAQ,OAAO,CAAC,QAAQ,0BAA0B;gBAC1D,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE;oBACR,IAAI,EAAE,OAAO,CAAC,QAAQ;oBACtB,cAAc,EAAE,gBAAgB;iBACjC;aACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC7D,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,OAAsB;QAC5C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAC3D,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAEhD,6CAA6C;QAC7C,IAAI,QAAiB,CAAC;QACtB,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;YACjB,QAAQ,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG,GAAG,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,2CAA2C;YAC3C,QAAQ,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG,GAAG,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,6BAA6B,IAAI,qBAAqB,KAAK,OAAO,GAAG,MAAM;gBACnF,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE;oBACR,WAAW,EAAE,IAAI;oBACjB,YAAY,EAAE,KAAK;oBACnB,UAAU,EAAE,GAAG;iBAChB;aACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,YAAY;QACV,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC;IAChE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC;IAE9D,IAAI,WAAmC,CAAC;IACxC,IAAI,UAAkC,CAAC;IAEvC,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,EAAE,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,EAAE,CAAC;IAClB,CAAC;IAED,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAC5D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAC5D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAC5D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAC5D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB;QAC1D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpE,CAAC,CAAC,CAAC,iBAAiB,EAAE,wBAAwB,EAAE,wBAAwB,CAAC,CAAC;IAE5E,kEAAkE;IAClE,IAAI,YAAwD,CAAC;IAC7D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACxD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,YAAY,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAChC,CAAC;IACH,CAAC;IAED,OAAO;QACL,WAAW;QACX,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;QAChB,UAAU;QACV,eAAe;QACf,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/policy/permission-checks.d.ts

@@ -1,16 +1,42 @@
 /**
- * Permission checks
+ * @name policy/permission-checks
+ * @description Permission validation utilities for SAP MCP tool calls.
+ *
+ * Provides functions to check whether a given permission or tool name
+ * is allowed by the server configuration's `allowedTools` list.
+ *
+ * @module policy/permission-checks
  */
 import type { SapPermission, SapMcpConfig } from '../core/types.js';
 /**
- * Check if permission is allowed
+ * @name checkPermission
+ * @description Check if a specific permission is allowed by the configuration.
+ *
+ * When `allowedTools` is `'all'`, every permission is allowed. Otherwise the
+ * permission must appear in the `allowedTools` array.
+ *
+ * @param config - The SAP MCP server configuration.
+ * @param permission - The permission string to check.
+ * @returns An object with `allowed` flag and optional `reason` string.
+ *
+ * @usedBy `checkToolAllowed`
  */
 export declare function checkPermission(config: SapMcpConfig, permission: SapPermission): {
     allowed: boolean;
     reason?: string;
 };
 /**
- * Check if tool is allowed
+ * @name checkToolAllowed
+ * @description Check if a tool is allowed by mapping its name to a permission.
+ *
+ * Extracts the action and category from the tool name, maps them to a
+ * `SapPermission` string, then delegates to `checkPermission`.
+ *
+ * @param config - The SAP MCP server configuration.
+ * @param toolName - The tool name to check (e.g., `sap_get_agent`).
+ * @returns An object with `allowed` flag and optional `reason` string.
+ *
+ * @usedBy `policy-engine.ts:PolicyEngine`
  */
 export declare function checkToolAllowed(config: SapMcpConfig, toolName: string): {
     allowed: boolean;

package/dist/policy/permission-checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-checks.d.ts","sourceRoot":"","sources":["../../src/policy/permission-checks.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEpE;;GAEG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,YAAY,EACpB,UAAU,EAAE,aAAa,GACxB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAevC;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,MAAM,GACf;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CASvC"}
+{"version":3,"file":"permission-checks.d.ts","sourceRoot":"","sources":["../../src/policy/permission-checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEpE;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,YAAY,EACpB,UAAU,EAAE,aAAa,GACxB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAevC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,MAAM,GACf;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CASvC"}

package/dist/policy/permission-checks.js

@@ -1,8 +1,24 @@
 /**
- * Permission checks
+ * @name policy/permission-checks
+ * @description Permission validation utilities for SAP MCP tool calls.
+ *
+ * Provides functions to check whether a given permission or tool name
+ * is allowed by the server configuration's `allowedTools` list.
+ *
+ * @module policy/permission-checks
  */
 /**
- * Check if permission is allowed
+ * @name checkPermission
+ * @description Check if a specific permission is allowed by the configuration.
+ *
+ * When `allowedTools` is `'all'`, every permission is allowed. Otherwise the
+ * permission must appear in the `allowedTools` array.
+ *
+ * @param config - The SAP MCP server configuration.
+ * @param permission - The permission string to check.
+ * @returns An object with `allowed` flag and optional `reason` string.
+ *
+ * @usedBy `checkToolAllowed`
  */
 export function checkPermission(config, permission) {
     // Check if allowed tools is 'all'
@@ -19,7 +35,17 @@ export function checkPermission(config, permission) {
     };
 }
 /**
- * Check if tool is allowed
+ * @name checkToolAllowed
+ * @description Check if a tool is allowed by mapping its name to a permission.
+ *
+ * Extracts the action and category from the tool name, maps them to a
+ * `SapPermission` string, then delegates to `checkPermission`.
+ *
+ * @param config - The SAP MCP server configuration.
+ * @param toolName - The tool name to check (e.g., `sap_get_agent`).
+ * @returns An object with `allowed` flag and optional `reason` string.
+ *
+ * @usedBy `policy-engine.ts:PolicyEngine`
  */
 export function checkToolAllowed(config, toolName) {
     if (config.allowedTools === 'all') {

package/dist/policy/permission-checks.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-checks.js","sourceRoot":"","sources":["../../src/policy/permission-checks.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAoB,EACpB,UAAyB;IAEzB,kCAAkC;IAClC,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,yCAAyC;IACzC,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,cAAc,UAAU,+BAA+B;KAChE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAoB,EACpB,QAAgB;IAEhB,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,2EAA2E;IAC3E,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAElD,OAAO,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,6FAA6F;IAC7F,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjD,uEAAuE;IACvE,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvD,uCAAuC;IACvC,MAAM,WAAW,GAA2B;QAC1C,UAAU,EAAE,UAAU;QACtB,UAAU,EAAE,UAAU;QACtB,YAAY,EAAE,YAAY;QAC1B,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,YAAY;QAC1B,QAAQ,EAAE,QAAQ;QAClB,aAAa,EAAE,aAAa;QAC5B,MAAM,EAAE,UAAU;QAClB,WAAW,EAAE,UAAU;QACvB,WAAW,EAAE,YAAY;KAC1B,CAAC;IAEF,MAAM,kBAAkB,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC;IAC/D,MAAM,OAAO,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACrK,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAElD,OAAO,GAAG,kBAAkB,IAAI,cAAc,EAAmB,CAAC;AACpE,CAAC"}
+{"version":3,"file":"permission-checks.js","sourceRoot":"","sources":["../../src/policy/permission-checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAoB,EACpB,UAAyB;IAEzB,kCAAkC;IAClC,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,yCAAyC;IACzC,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,cAAc,UAAU,+BAA+B;KAChE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAoB,EACpB,QAAgB;IAEhB,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,2EAA2E;IAC3E,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAElD,OAAO,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,6FAA6F;IAC7F,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjD,uEAAuE;IACvE,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvD,uCAAuC;IACvC,MAAM,WAAW,GAA2B;QAC1C,UAAU,EAAE,UAAU;QACtB,UAAU,EAAE,UAAU;QACtB,YAAY,EAAE,YAAY;QAC1B,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,YAAY;QAC1B,QAAQ,EAAE,QAAQ;QAClB,aAAa,EAAE,aAAa;QAC5B,MAAM,EAAE,UAAU;QAClB,WAAW,EAAE,UAAU;QACvB,WAAW,EAAE,YAAY;KAC1B,CAAC;IAEF,MAAM,kBAAkB,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC;IAC/D,MAAM,OAAO,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACrK,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAElD,OAAO,GAAG,kBAAkB,IAAI,cAAc,EAAmB,CAAC;AACpE,CAAC"}

package/dist/policy/policy-engine.d.ts

@@ -1,5 +1,12 @@
 /**
- * Policy engine for enforcing permissions and limits
+ * @name policy/policy-engine
+ * @description High-level policy engine for enforcing permissions and spend limits.
+ *
+ * Wraps the local and hybrid policy engines, loads default policies, and
+ * provides a unified API for permission validation, spend-limit checks,
+ * and runtime diagnostics.
+ *
+ * @module policy/policy-engine
  */
 import type { SapMcpConfig, SapPolicy, SapPermission } from '../core/types.js';
 interface PermissionContext {
@@ -11,7 +18,20 @@ interface PermissionContext {
     user?: string;
 }
 /**
- * Policy engine class
+ * @name PolicyEngine
+ * @description High-level policy engine combining default policies, config-based limits, and hybrid enforcement.
+ *
+ * Loads default policies at construction time, creates a `HybridPolicyEngine`
+ * when configured, and exposes permission validation, spend-limit checks,
+ * policy CRUD, and runtime status diagnostics.
+ *
+ * @method validatePermissions  — Validate a list of permission strings against the allowed-tools config.
+ * @method checkPermission       — Check whether a single permission and optional context is allowed.
+ * @method getRuntimeStatus      — Return current hybrid/Bento policy status for diagnostics.
+ * @method getPolicy             — Retrieve a registered policy by id.
+ * @method addPolicy             — Register a custom policy.
+ *
+ * @usedBy `server.ts`, `core/context.ts`
  */
 export declare class PolicyEngine {
     private config;

package/dist/policy/policy-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy-engine.d.ts","sourceRoot":"","sources":["../../src/policy/policy-engine.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAO/E,UAAU,iBAAiB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,QAAQ,CAAyB;IACzC,OAAO,CAAC,kBAAkB,CAA4B;gBAE1C,MAAM,EAAE,YAAY;IAiBhC;;OAEG;IACG,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACxD,KAAK,EAAE,OAAO,CAAC;QACf,WAAW,EAAE,aAAa,EAAE,CAAC;QAC7B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAmBF;;OAEG;IACG,eAAe,CACnB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAqCjD;;OAEG;IACH,gBAAgB,IAAI;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,eAAe,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,OAAO,CAAC;QACxB,iBAAiB,EAAE,OAAO,CAAC;KAC5B;IAaD,OAAO,CAAC,wBAAwB;YAqClB,iBAAiB;IAwB/B;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAIlD;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI;CAInC"}
+{"version":3,"file":"policy-engine.d.ts","sourceRoot":"","sources":["../../src/policy/policy-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAO/E,UAAU,iBAAiB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,QAAQ,CAAyB;IACzC,OAAO,CAAC,kBAAkB,CAA4B;gBAE1C,MAAM,EAAE,YAAY;IAiBhC;;OAEG;IACG,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACxD,KAAK,EAAE,OAAO,CAAC;QACf,WAAW,EAAE,aAAa,EAAE,CAAC;QAC7B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAmBF;;OAEG;IACG,eAAe,CACnB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAqCjD;;OAEG;IACH,gBAAgB,IAAI;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,eAAe,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,OAAO,CAAC;QACxB,iBAAiB,EAAE,OAAO,CAAC;KAC5B;IAaD,OAAO,CAAC,wBAAwB;YAqClB,iBAAiB;IAwB/B;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAIlD;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI;CAInC"}

package/dist/policy/policy-engine.js

@@ -1,12 +1,32 @@
 /**
- * Policy engine for enforcing permissions and limits
+ * @name policy/policy-engine
+ * @description High-level policy engine for enforcing permissions and spend limits.
+ *
+ * Wraps the local and hybrid policy engines, loads default policies, and
+ * provides a unified API for permission validation, spend-limit checks,
+ * and runtime diagnostics.
+ *
+ * @module policy/policy-engine
  */
 import { logger } from '../core/logger.js';
 import { defaultPolicies } from './default-policies.js';
 import { HybridPolicyEngine } from './hybrid-policy-engine.js';
 const LAMPORTS_PER_SOL = 1_000_000_000;
 /**
- * Policy engine class
+ * @name PolicyEngine
+ * @description High-level policy engine combining default policies, config-based limits, and hybrid enforcement.
+ *
+ * Loads default policies at construction time, creates a `HybridPolicyEngine`
+ * when configured, and exposes permission validation, spend-limit checks,
+ * policy CRUD, and runtime status diagnostics.
+ *
+ * @method validatePermissions  — Validate a list of permission strings against the allowed-tools config.
+ * @method checkPermission       — Check whether a single permission and optional context is allowed.
+ * @method getRuntimeStatus      — Return current hybrid/Bento policy status for diagnostics.
+ * @method getPolicy             — Retrieve a registered policy by id.
+ * @method addPolicy             — Register a custom policy.
+ *
+ * @usedBy `server.ts`, `core/context.ts`
  */
 export class PolicyEngine {
     config;

package/dist/policy/policy-engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-engine.js","sourceRoot":"","sources":["../../src/policy/policy-engine.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAA2B,MAAM,2BAA2B,CAAC;AAGxF,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAWvC;;GAEG;AACH,MAAM,OAAO,YAAY;IACf,MAAM,CAAe;IACrB,QAAQ,CAAyB;IACjC,kBAAkB,CAA4B;IAEtD,YAAY,MAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAEhE,wBAAwB;QACxB,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;YACrC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;YACvC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;YAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,YAAY;YACzC,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,KAAK;SAC7C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CAAC,WAAqB;QAK7C,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,gBAAgB,GAAoB,EAAE,CAAC;QAE7C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzF,MAAM,CAAC,IAAI,CAAC,cAAc,UAAU,wBAAwB,CAAC,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACN,gBAAgB,CAAC,IAAI,CAAC,UAA2B,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QACnD,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,UAAkB,EAClB,OAA2B;QAE3B,0CAA0C;QAC1C,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,UAAU,cAAc,EAAE,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YAChD,IAAI,OAAO,CAAC,SAAS,GAAG,aAAa,EAAE,CAAC;gBACtC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,UAAU,OAAO,CAAC,SAAS,oBAAoB,aAAa,MAAM;iBAC3E,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,CAAC;gBAC5D,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,UAAU,OAAO,CAAC,SAAS,sCAAsC,IAAI,CAAC,MAAM,CAAC,uBAAuB,OAAO;iBACpH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,cAAc,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAC9C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,cAAc,CAAC,MAAM;aAC9B,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,gBAAgB;QAMd,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,YAAY;gBAC9C,eAAe,EAAE,KAAK;gBACtB,cAAc,EAAE,KAAK;gBACrB,iBAAiB,EAAE,IAAI;aACxB,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,CAAC;IAC7C,CAAC;IAEO,wBAAwB,CAAC,MAAoB;QACnD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,YAAY,CAAC;QACvD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM;YAC9D,CAAC,CAAC;gBACE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;gBAC3B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,gBAAgB;gBACjD,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;aAChC;YACH,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,UAAU,KAAK,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAuB;YACvC,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,IAAI,KAAK;YAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,IAAI;YACvC,KAAK,EAAE;gBACL,WAAW,EAAE;oBACX,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,GAAG,gBAAgB,CAAC;iBACzD;gBACD,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,EAAE;gBACpB,UAAU,EAAE,MAAM,CAAC,eAAe;oBAChC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,kBAAkB,EAAE;oBACpC,CAAC,CAAC,EAAE;gBACN,eAAe,EAAE,EAAE;aACpB;SACF,CAAC;QAEF,OAAO,IAAI,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC9C,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,UAAkB,EAClB,OAA2B;QAE3B,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,UAAU,CAAC;QACjD,MAAM,aAAa,GAAkB;YACnC,QAAQ;YACR,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE;YACzB,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,kBAAkB;YACzC,MAAM,EAAE,OAAO,EAAE,SAAS,KAAK,SAAS;gBACtC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,gBAAgB,CAAC;YACpD,SAAS,EAAE,OAAO,EAAE,SAAS;YAC7B,WAAW,EAAE,OAAO,EAAE,WAAW;YACjC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,OAAO,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,QAAgB;QACxB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAiB;QACzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;CACF"}
+{"version":3,"file":"policy-engine.js","sourceRoot":"","sources":["../../src/policy/policy-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAA2B,MAAM,2BAA2B,CAAC;AAGxF,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAWvC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,YAAY;IACf,MAAM,CAAe;IACrB,QAAQ,CAAyB;IACjC,kBAAkB,CAA4B;IAEtD,YAAY,MAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAEhE,wBAAwB;QACxB,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;YACrC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;YACvC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;YAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,YAAY;YACzC,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,KAAK;SAC7C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CAAC,WAAqB;QAK7C,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,gBAAgB,GAAoB,EAAE,CAAC;QAE7C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzF,MAAM,CAAC,IAAI,CAAC,cAAc,UAAU,wBAAwB,CAAC,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACN,gBAAgB,CAAC,IAAI,CAAC,UAA2B,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QACnD,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,UAAkB,EAClB,OAA2B;QAE3B,0CAA0C;QAC1C,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,UAAU,cAAc,EAAE,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YAChD,IAAI,OAAO,CAAC,SAAS,GAAG,aAAa,EAAE,CAAC;gBACtC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,UAAU,OAAO,CAAC,SAAS,oBAAoB,aAAa,MAAM;iBAC3E,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,CAAC;gBAC5D,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,UAAU,OAAO,CAAC,SAAS,sCAAsC,IAAI,CAAC,MAAM,CAAC,uBAAuB,OAAO;iBACpH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,cAAc,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAC9C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,cAAc,CAAC,MAAM;aAC9B,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,gBAAgB;QAMd,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,YAAY;gBAC9C,eAAe,EAAE,KAAK;gBACtB,cAAc,EAAE,KAAK;gBACrB,iBAAiB,EAAE,IAAI;aACxB,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,CAAC;IAC7C,CAAC;IAEO,wBAAwB,CAAC,MAAoB;QACnD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,YAAY,CAAC;QACvD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM;YAC9D,CAAC,CAAC;gBACE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;gBAC3B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,gBAAgB;gBACjD,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;aAChC;YACH,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,UAAU,KAAK,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAuB;YACvC,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,IAAI,KAAK;YAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,IAAI;YACvC,KAAK,EAAE;gBACL,WAAW,EAAE;oBACX,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,GAAG,gBAAgB,CAAC;iBACzD;gBACD,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,EAAE;gBACpB,UAAU,EAAE,MAAM,CAAC,eAAe;oBAChC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,kBAAkB,EAAE;oBACpC,CAAC,CAAC,EAAE;gBACN,eAAe,EAAE,EAAE;aACpB;SACF,CAAC;QAEF,OAAO,IAAI,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC9C,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,UAAkB,EAClB,OAA2B;QAE3B,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,UAAU,CAAC;QACjD,MAAM,aAAa,GAAkB;YACnC,QAAQ;YACR,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE;YACzB,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,kBAAkB;YACzC,MAAM,EAAE,OAAO,EAAE,SAAS,KAAK,SAAS;gBACtC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,gBAAgB,CAAC;YACpD,SAAS,EAAE,OAAO,EAAE,SAAS;YAC7B,WAAW,EAAE,OAAO,EAAE,WAAW;YACjC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,OAAO,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,QAAgB;QACxB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAiB;QACzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;CACF"}

package/dist/policy/policy-types.d.ts

@@ -1,9 +1,28 @@
 /**
- * Policy type definitions
+ * @name policy/policy-types
+ * @description Core type definitions for the SAP MCP policy engine.
+ *
+ * Defines the shapes for policies, policy rules, evaluation results,
+ * and policy evaluation context. These types are consumed by the local
+ * policy engine, default-policies module, and the higher-level policy engine.
+ *
+ * @module policy/policy-types
  */
 import type { SapPermission, SapRiskLevel } from '../core/types.js';
 /**
- * Policy definition
+ * @name Policy
+ * @description A named policy with an ordered set of rules.
+ *
+ * Each policy has a unique id, a human-readable name and description,
+ * an array of rules to evaluate, and an enabled flag.
+ *
+ * @property id          — Unique policy identifier.
+ * @property name        — Human-readable policy name.
+ * @property description — Short description of the policy's purpose.
+ * @property rules       — Ordered list of rules to evaluate.
+ * @property enabled     — Whether the policy is active.
+ *
+ * @usedBy `default-policies.ts`, `policy-engine.ts:PolicyEngine`
  */
 export interface Policy {
     id: string;
@@ -13,7 +32,21 @@ export interface Policy {
     enabled: boolean;
 }
 /**
- * Policy rule
+ * @name PolicyRule
+ * @description A single rule within a policy.
+ *
+ * A rule has a condition expression, an action to take when the condition
+ * matches, and optional constraints on tools, permissions, amounts, and risk levels.
+ *
+ * @property id           — Unique rule identifier within the policy.
+ * @property condition    — Expression string evaluated against the policy context.
+ * @property action       — Action to take: `allow`, `deny`, or `require_approval`.
+ * @property tools        — Optional list of tool names this rule applies to.
+ * @property permissions  — Optional list of permissions this rule applies to.
+ * @property maxAmountSol — Optional maximum transaction amount in SOL.
+ * @property riskLevel    — Optional risk level this rule applies to.
+ *
+ * @usedBy `Policy.rules`, `default-policies.ts`
  */
 export interface PolicyRule {
     id: string;
@@ -25,7 +58,15 @@ export interface PolicyRule {
     riskLevel?: SapRiskLevel;
 }
 /**
- * Policy evaluation result
+ * @name PolicyResult
+ * @description Result of evaluating a policy against a request.
+ *
+ * @property allowed          — Whether the operation is permitted.
+ * @property reason           — Optional human-readable explanation.
+ * @property requiresApproval — Whether human approval is needed before proceeding.
+ * @property riskLevel        — Optional risk level associated with the operation.
+ *
+ * @usedBy `policy-engine.ts:PolicyEngine`
  */
 export interface PolicyResult {
     allowed: boolean;
@@ -34,7 +75,16 @@ export interface PolicyResult {
     riskLevel?: SapRiskLevel;
 }
 /**
- * Policy context
+ * @name PolicyContext
+ * @description Context passed to the policy engine for evaluation.
+ *
+ * @property toolName   — Name of the tool being called.
+ * @property permission — Permission required by the tool.
+ * @property amountSol  — Optional transaction amount in SOL.
+ * @property riskLevel  — Optional pre-computed risk level.
+ * @property sessionId  — Optional session identifier for correlation.
+ *
+ * @usedBy `policy-engine.ts:PolicyEngine`
  */
 export interface PolicyContext {
     toolName: string;

package/dist/policy/policy-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy-types.d.ts","sourceRoot":"","sources":["../../src/policy/policy-types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEpE;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,CAAC;IAC9C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,YAAY,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE,YAAY,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,aAAa,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}
+{"version":3,"file":"policy-types.d.ts","sourceRoot":"","sources":["../../src/policy/policy-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEpE;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,CAAC;IAC9C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,YAAY,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE,YAAY,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,aAAa,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/policy/policy-types.js

@@ -1,5 +1,12 @@
 /**
- * Policy type definitions
+ * @name policy/policy-types
+ * @description Core type definitions for the SAP MCP policy engine.
+ *
+ * Defines the shapes for policies, policy rules, evaluation results,
+ * and policy evaluation context. These types are consumed by the local
+ * policy engine, default-policies module, and the higher-level policy engine.
+ *
+ * @module policy/policy-types
  */
 export {};
 //# sourceMappingURL=policy-types.js.map

package/dist/policy/policy-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-types.js","sourceRoot":"","sources":["../../src/policy/policy-types.ts"],"names":[],"mappings":"AAAA;;GAEG"}
+{"version":3,"file":"policy-types.js","sourceRoot":"","sources":["../../src/policy/policy-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/policy/risk-level.d.ts

@@ -1,9 +1,29 @@
 /**
- * Risk level calculation
+ * @name policy/risk-level
+ * @description Risk level calculation utilities for SAP MCP transactions.
+ *
+ * Provides functions to compute a `SapRiskLevel` from transaction parameters
+ * and determine whether a given risk level requires human approval.
+ *
+ * @module policy/risk-level
  */
 import type { SapRiskLevel } from '../core/types.js';
 /**
- * Calculate risk level for a transaction
+ * @name calculateRiskLevel
+ * @description Calculate risk level for a transaction based on amount and operation type.
+ *
+ * Evaluates the transaction amount, whether it is a write operation, and whether
+ * it targets a known program to produce a graduated risk level from `safe` to `critical`.
+ * Write operations elevate risk by one tier; known operations reduce risk by one tier.
+ *
+ * @param params - Transaction parameters including amount, write flag, known flag, and tool name.
+ * @param params.amountSol - Transaction amount in SOL.
+ * @param params.isWriteOperation - Whether the operation mutates on-chain state.
+ * @param params.isKnownOperation - Whether the target program is in the known set.
+ * @param params.toolName - Name of the tool invoking the transaction.
+ * @returns A `SapRiskLevel` string: `safe`, `low`, `medium`, `high`, or `critical`.
+ *
+ * @usedBy `policy-engine.ts:PolicyEngine.checkPermission`
  */
 export declare function calculateRiskLevel(params: {
     amountSol: number;
@@ -12,7 +32,16 @@ export declare function calculateRiskLevel(params: {
     toolName: string;
 }): SapRiskLevel;
 /**
- * Check if risk level requires approval
+ * @name requiresApproval
+ * @description Check if a risk level requires human approval before execution.
+ *
+ * Returns `true` when the risk level is `high` or `critical`, indicating
+ * that the operation should be escalated for manual review.
+ *
+ * @param riskLevel - The risk level to evaluate.
+ * @returns `true` if the risk level is `high` or `critical`; otherwise `false`.
+ *
+ * @usedBy `policy-engine.ts:PolicyEngine.checkPermission`
  */
 export declare function requiresApproval(riskLevel: SapRiskLevel): boolean;
 //# sourceMappingURL=risk-level.d.ts.map

package/dist/policy/risk-level.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"risk-level.d.ts","sourceRoot":"","sources":["../../src/policy/risk-level.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,YAAY,CAgCf;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,YAAY,GAAG,OAAO,CAEjE"}
+{"version":3,"file":"risk-level.d.ts","sourceRoot":"","sources":["../../src/policy/risk-level.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,YAAY,CAgCf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,YAAY,GAAG,OAAO,CAEjE"}