@openagentsy/hooks 0.0.0-stage → 0.2.0

package/dist/policies/discovery.js

@@ -0,0 +1,130 @@
+/**
+ * The discovery of the policy modules a plugin brought (§21).
+ *
+ * A downstream project drops a module into `packages/hooks/src/policies/`
+ * and the host loads it. The host cannot trust what it loaded, so the shape
+ * is checked here: an id that is not a string, a version that is not a
+ * version, or a decision that is not a function is not a policy, and a
+ * module that fails the check is not in the stack.
+ *
+ * A module that came from a plugin is marked `external`, and an external
+ * module does not count towards the first-party release criteria.
+ */
+/** The layers a module may act at. */
+const LAYERS = [1, 2, 3, 4, 5, 6, 7, 8];
+/** The moments a module may be checked at. */
+const MOMENTS = [
+    'UserPromptSubmit',
+    'PreToolCall',
+    'PostToolCall',
+    'PreResponse',
+    'PostResponse',
+    'PreCompact',
+    'SubagentStop',
+];
+/** Whether a version is a version. */
+export function isSemver(version) {
+    return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version);
+}
+/** The record of a candidate, as far as it is one. */
+function readCandidate(candidate) {
+    if (typeof candidate !== 'object' || candidate === null)
+        return undefined;
+    return candidate;
+}
+/** The id of a candidate. */
+function readId(record) {
+    const id = record['id'];
+    if (typeof id !== 'string' || id.length === 0)
+        return undefined;
+    return id;
+}
+/** The version of a candidate. */
+function readVersion(record) {
+    const version = record['version'];
+    if (typeof version !== 'string' || !isSemver(version))
+        return undefined;
+    return version;
+}
+/** The layer of a candidate. */
+function readLayer(record) {
+    const layer = record['layer'];
+    if (typeof layer !== 'number')
+        return undefined;
+    if (!LAYERS.includes(layer))
+        return undefined;
+    return layer;
+}
+/** The moments of a candidate. */
+function readMoments(record) {
+    const appliesTo = record['appliesTo'];
+    if (!Array.isArray(appliesTo))
+        return undefined;
+    if (!appliesTo.every((moment) => MOMENTS.includes(moment)))
+        return undefined;
+    return appliesTo;
+}
+/** The decision of a candidate. */
+function readDecision(record) {
+    const evaluate = record['evaluate'];
+    if (typeof evaluate !== 'function')
+        return undefined;
+    return evaluate;
+}
+/**
+ * The policy a candidate is, when it is one.
+ *
+ * The candidate is read field by field, and a field that is missing or of
+ * the wrong shape makes the whole candidate not a policy: a module that
+ * half-loads is worse than a module that does not load at all.
+ */
+function toPolicyModule(candidate) {
+    const record = readCandidate(candidate);
+    if (record === undefined)
+        return undefined;
+    const id = readId(record);
+    const version = readVersion(record);
+    const layer = readLayer(record);
+    const description = record['description'];
+    const appliesTo = readMoments(record);
+    const evaluate = readDecision(record);
+    if (id === undefined)
+        return undefined;
+    if (version === undefined)
+        return undefined;
+    if (layer === undefined)
+        return undefined;
+    if (typeof description !== 'string')
+        return undefined;
+    if (appliesTo === undefined)
+        return undefined;
+    if (evaluate === undefined)
+        return undefined;
+    return {
+        id,
+        version,
+        layer,
+        description,
+        appliesTo,
+        origin: 'external',
+        evaluate,
+    };
+}
+/**
+ * The policies among the candidates.
+ *
+ * A candidate that is not a policy is dropped, and the ones that are are
+ * marked external unless they say otherwise: a module that came from a
+ * plugin is the plugin's, whatever it says about its origin.
+ */
+export function discoverPolicyModules(candidates) {
+    const found = [];
+    for (const candidate of candidates) {
+        const module = toPolicyModule(candidate);
+        if (module === undefined)
+            continue;
+        found.push(module);
+    }
+    return found;
+}
+//# sourceMappingURL=discovery.js.map

package/dist/policies/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/policies/discovery.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AAEH,sCAAsC;AACtC,MAAM,MAAM,GAA2B,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAEhE,8CAA8C;AAC9C,MAAM,OAAO,GAA4B;IACvC,kBAAkB;IAClB,aAAa;IACb,cAAc;IACd,aAAa;IACb,cAAc;IACd,YAAY;IACZ,cAAc;CACf,CAAC;AAEF,sCAAsC;AACtC,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,OAAO,0DAA0D,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAClF,CAAC;AAED,sDAAsD;AACtD,SAAS,aAAa,CAAC,SAAkB;IACvC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC1E,OAAO,SAAoC,CAAC;AAC9C,CAAC;AAED,6BAA6B;AAC7B,SAAS,MAAM,CAAC,MAA+B;IAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACxB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,kCAAkC;AAClC,SAAS,WAAW,CAAC,MAA+B;IAClD,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACxE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gCAAgC;AAChC,SAAS,SAAS,CAAC,MAA+B;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAoB,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,KAAoB,CAAC;AAC9B,CAAC;AAED,kCAAkC;AAClC,SAAS,WAAW,CAAC,MAA+B;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAsB,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7F,OAAO,SAA2B,CAAC;AACrC,CAAC;AAED,mCAAmC;AACnC,SAAS,YAAY,CAAC,MAA+B;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,QAAoC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,SAAkB;IACxC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACvC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO;QACL,EAAE;QACF,OAAO;QACP,KAAK;QACL,WAAW;QACX,SAAS;QACT,MAAM,EAAE,UAAU;QAClB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAA8B;IAClE,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/policies/high-risk.d.ts

@@ -0,0 +1,25 @@
+import { type PolicyModule } from '../policy.js';
+/**
+ * The high-risk domain policies (§21.2, §20.3).
+ *
+ * One module per domain of §20.3. The module is selected when the
+ * classifier fired on that domain (§21.4), and it flags the prose that
+ * touches it. It is a layer 4 module: the selection is layer 2, and the
+ * decision is about the output.
+ */
+/** The domains §20.3 names. */
+export declare const HIGH_RISK_DOMAINS: readonly ["self-harm", "abuse", "medical", "legal", "financial", "criminal", "political", "relational", "automated-decision", "civic"];
+/** The name of a high-risk domain. */
+export type HighRiskDomain = (typeof HIGH_RISK_DOMAINS)[number];
+/** The prefix every high-risk policy id carries. */
+export declare const HIGH_RISK_PREFIX = "oa.high-risk.";
+/**
+ * The policy of one high-risk domain.
+ *
+ * The id is the domain's, so a firing says which domain was in play, and
+ * the version is the policy's own.
+ */
+export declare function highRiskPolicy(domain: HighRiskDomain): PolicyModule;
+/** The policies of every high-risk domain. */
+export declare function highRiskPolicies(): PolicyModule[];
+//# sourceMappingURL=high-risk.d.ts.map

package/dist/policies/high-risk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"high-risk.d.ts","sourceRoot":"","sources":["../../src/policies/high-risk.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAG1E;;;;;;;GAOG;AAEH,+BAA+B;AAC/B,eAAO,MAAM,iBAAiB,wIAWpB,CAAC;AAEX,sCAAsC;AACtC,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE,oDAAoD;AACpD,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAoDhD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,YAAY,CAiBnE;AAED,8CAA8C;AAC9C,wBAAgB,gBAAgB,IAAI,YAAY,EAAE,CAEjD"}

package/dist/policies/high-risk.js

@@ -0,0 +1,105 @@
+import { allow, findingsOf, flag } from '../policy.js';
+import { matches } from './patterns.js';
+/**
+ * The high-risk domain policies (§21.2, §20.3).
+ *
+ * One module per domain of §20.3. The module is selected when the
+ * classifier fired on that domain (§21.4), and it flags the prose that
+ * touches it. It is a layer 4 module: the selection is layer 2, and the
+ * decision is about the output.
+ */
+/** The domains §20.3 names. */
+export const HIGH_RISK_DOMAINS = [
+    'self-harm',
+    'abuse',
+    'medical',
+    'legal',
+    'financial',
+    'criminal',
+    'political',
+    'relational',
+    'automated-decision',
+    'civic',
+];
+/** The prefix every high-risk policy id carries. */
+export const HIGH_RISK_PREFIX = 'oa.high-risk.';
+/**
+ * The words of a domain.
+ *
+ * The lists are the prose signals of §20.3, and they are deliberately
+ * small: the classifier of §20.3 decides whether a domain is in play, and
+ * this module only says where the prose touches it.
+ */
+const DOMAIN_WORDS = {
+    'self-harm': [
+        /\b(?:self[- ]harm|suicid\w*|eating\s+disorder|anorexi\w*|bulimi\w*)\b/gi,
+        /\b(?:crisis\s+line|end\s+my\s+life|take\s+my\s+own\s+life)\b/gi,
+    ],
+    abuse: [
+        /\b(?:abuse|coercive\s+control|stalking|domestic\s+violence)\b/gi,
+        /\b(?:violent\s+conflict|threat\w*\s+to\s+(?:hurt|harm))\b/gi,
+    ],
+    medical: [
+        /\b(?:medical|clinical|diagnosis|dosage|prognosis|symptoms?\s+of)\b/gi,
+        /\b(?:prescri\w+|treatment\s+plan|patient)\b/gi,
+    ],
+    legal: [
+        /\b(?:legal\s+advice|lawyer|attorney|litigat\w+|liability|statute)\b/gi,
+        /\b(?:court|prosecut\w+|defen[cs]e\s+rights)\b/gi,
+    ],
+    financial: [
+        /\b(?:financial\s+advice|investment|tax\s+(?:advice|return)|mortgage|portfolio)\b/gi,
+        /\b(?:interest\s+rate|retirement\s+fund|insurance\s+advice)\b/gi,
+    ],
+    criminal: [
+        /\b(?:evade\s+(?:the\s+)?(?:law|police)|criminal\s+activity|launder\w*)\b/gi,
+        /\b(?:cover\s+(?:up|your\s+tracks)|illegal\s+means)\b/gi,
+    ],
+    political: [
+        /\b(?:political\s+persuasion|voter\s+suppression|targeted\s+influence)\b/gi,
+        /\b(?:campaign\s+messaging|identity[- ]based\s+(?:politics|persuasion))\b/gi,
+    ],
+    relational: [
+        /\b(?:the\s+reviewer\s+was\s+wrong|they\s+are\s+the\s+problem\s+here)\b/gi,
+        /\b(?:moral\s+absolution|vindication|they\s+owe\s+me\s+an?\s+apology)\b/gi,
+    ],
+    'automated-decision': [
+        /\b(?:ranks?\s+applicants|scores?\s+applicants|lending\s+model|rescoring)\b/gi,
+        /\b(?:hiring\s+model|automated\s+(?:hiring|lending|eviction)|public\s+benefits\s+decision)\b/gi,
+    ],
+    civic: [
+        /\b(?:political\s+content\s+generation|generates?\s+political\s+content)\b/gi,
+        /\b(?:public\s+deliberation|voter\s+information\s+(?:campaign|service))\b/gi,
+    ],
+};
+/**
+ * The policy of one high-risk domain.
+ *
+ * The id is the domain's, so a firing says which domain was in play, and
+ * the version is the policy's own.
+ */
+export function highRiskPolicy(domain) {
+    const id = `${HIGH_RISK_PREFIX}${domain}`;
+    return {
+        id,
+        version: '1.0.0',
+        layer: 4,
+        description: `Flags the prose that touches the ${domain} domain (selected at layer 2).`,
+        appliesTo: ['UserPromptSubmit', 'PreResponse'],
+        origin: 'first-party',
+        evaluate(ctx) {
+            const text = ctx.response?.text ?? ctx.request?.text ?? '';
+            if (text === '')
+                return allow();
+            const found = matches(DOMAIN_WORDS[domain], text);
+            if (found.length === 0)
+                return allow();
+            return flag(findingsOf(id, 'high-risk-domain', found), 'error');
+        },
+    };
+}
+/** The policies of every high-risk domain. */
+export function highRiskPolicies() {
+    return HIGH_RISK_DOMAINS.map((domain) => highRiskPolicy(domain));
+}
+//# sourceMappingURL=high-risk.js.map

package/dist/policies/high-risk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"high-risk.js","sourceRoot":"","sources":["../../src/policies/high-risk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAqB,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC;;;;;;;GAOG;AAEH,+BAA+B;AAC/B,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,WAAW;IACX,OAAO;IACP,SAAS;IACT,OAAO;IACP,WAAW;IACX,UAAU;IACV,WAAW;IACX,YAAY;IACZ,oBAAoB;IACpB,OAAO;CACC,CAAC;AAKX,oDAAoD;AACpD,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,YAAY,GAA8C;IAC9D,WAAW,EAAE;QACX,yEAAyE;QACzE,gEAAgE;KACjE;IACD,KAAK,EAAE;QACL,iEAAiE;QACjE,6DAA6D;KAC9D;IACD,OAAO,EAAE;QACP,sEAAsE;QACtE,+CAA+C;KAChD;IACD,KAAK,EAAE;QACL,uEAAuE;QACvE,iDAAiD;KAClD;IACD,SAAS,EAAE;QACT,oFAAoF;QACpF,gEAAgE;KACjE;IACD,QAAQ,EAAE;QACR,4EAA4E;QAC5E,wDAAwD;KACzD;IACD,SAAS,EAAE;QACT,2EAA2E;QAC3E,4EAA4E;KAC7E;IACD,UAAU,EAAE;QACV,0EAA0E;QAC1E,0EAA0E;KAC3E;IACD,oBAAoB,EAAE;QACpB,8EAA8E;QAC9E,+FAA+F;KAChG;IACD,KAAK,EAAE;QACL,6EAA6E;QAC7E,4EAA4E;KAC7E;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAsB;IACnD,MAAM,EAAE,GAAG,GAAG,gBAAgB,GAAG,MAAM,EAAE,CAAC;IAC1C,OAAO;QACL,EAAE;QACF,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,CAAC;QACR,WAAW,EAAE,oCAAoC,MAAM,gCAAgC;QACvF,SAAS,EAAE,CAAC,kBAAkB,EAAE,aAAa,CAAC;QAC9C,MAAM,EAAE,aAAa;QACrB,QAAQ,CAAC,GAAG;YACV,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC;YAC3D,IAAI,IAAI,KAAK,EAAE;gBAAE,OAAO,KAAK,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,kBAAkB,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;QAClE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,gBAAgB;IAC9B,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;AACnE,CAAC"}

package/dist/policies/human-only-decisions.d.ts

@@ -0,0 +1,14 @@
+import { type PolicyModule } from '../policy.js';
+/**
+ * The human-only decisions policy (§21.2, layer 1).
+ *
+ * It blocks the calls that record a decision a person makes: a lesson
+ * decision, a quality waiver and a memory promotion. The permission map
+ * denies those tools to every agent role, and this policy is the second
+ * layer of the same guarantee.
+ */
+/** The stable id of the policy. */
+export declare const HUMAN_ONLY_DECISIONS_ID = "oa.human-only-decisions";
+/** The policy itself. */
+export declare const humanOnlyDecisions: PolicyModule;
+//# sourceMappingURL=human-only-decisions.d.ts.map

package/dist/policies/human-only-decisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"human-only-decisions.d.ts","sourceRoot":"","sources":["../../src/policies/human-only-decisions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAG/D;;;;;;;GAOG;AAEH,mCAAmC;AACnC,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAKjE,yBAAyB;AACzB,eAAO,MAAM,kBAAkB,EAAE,YAkBhC,CAAC"}

package/dist/policies/human-only-decisions.js

@@ -0,0 +1,33 @@
+import { allow, block } from '../policy.js';
+import { readToolCall } from './tool-call.js';
+/**
+ * The human-only decisions policy (§21.2, layer 1).
+ *
+ * It blocks the calls that record a decision a person makes: a lesson
+ * decision, a quality waiver and a memory promotion. The permission map
+ * denies those tools to every agent role, and this policy is the second
+ * layer of the same guarantee.
+ */
+/** The stable id of the policy. */
+export const HUMAN_ONLY_DECISIONS_ID = 'oa.human-only-decisions';
+/** The tools a person decides with. */
+const HUMAN_ONLY_TOOLS = ['oa_lesson_decide', 'oa_quality_waive', 'oa_memory_decide'];
+/** The policy itself. */
+export const humanOnlyDecisions = {
+    id: HUMAN_ONLY_DECISIONS_ID,
+    version: '1.0.0',
+    layer: 1,
+    description: 'Blocks the calls that record a decision a person makes.',
+    appliesTo: ['PreToolCall'],
+    origin: 'first-party',
+    evaluate(ctx) {
+        const call = readToolCall(ctx);
+        if (call === undefined)
+            return allow();
+        const humanOnly = HUMAN_ONLY_TOOLS.some((name) => call.name === name || call.name.endsWith(`_${name}`));
+        if (!humanOnly)
+            return allow();
+        return block('Lesson decisions, quality waivers and memory promotions are recorded by a person (/oa lesson, /oa waive, /oa memory). Propose it in chat with your evidence.');
+    },
+};
+//# sourceMappingURL=human-only-decisions.js.map

package/dist/policies/human-only-decisions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"human-only-decisions.js","sourceRoot":"","sources":["../../src/policies/human-only-decisions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAqB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C;;;;;;;GAOG;AAEH,mCAAmC;AACnC,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAEjE,uCAAuC;AACvC,MAAM,gBAAgB,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;AAEtF,yBAAyB;AACzB,MAAM,CAAC,MAAM,kBAAkB,GAAiB;IAC9C,EAAE,EAAE,uBAAuB;IAC3B,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,CAAC;IACR,WAAW,EAAE,yDAAyD;IACtE,SAAS,EAAE,CAAC,aAAa,CAAC;IAC1B,MAAM,EAAE,aAAa;IACrB,QAAQ,CAAC,GAAG;QACV,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CACrC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAC/D,CAAC;QACF,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,EAAE,CAAC;QAC/B,OAAO,KAAK,CACV,8JAA8J,CAC/J,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/policies/index.d.ts

@@ -0,0 +1,29 @@
+import type { PolicyModule } from '../policy.js';
+export * from './discovery.js';
+export * from './high-risk.js';
+export * from './selection.js';
+/** What the catalogue is built with. */
+export interface PolicyCatalogueOptions {
+    /** The workspace root: the project the agent works in. */
+    workspace: string;
+    /** The home directory the worktrees live under; the home of the user by default. */
+    home?: string | undefined;
+}
+/**
+ * The first-party policies (§21.2).
+ *
+ * The catalogue is built with the workspace it guards, because one of the
+ * modules decides against the roots of the workspace. The order is the
+ * order of the layers: the guardrails that hold the tool call first, then
+ * the ones that read the prose.
+ */
+export declare function firstPartyPolicyModules(options: PolicyCatalogueOptions): PolicyModule[];
+/**
+ * The ids of the first-party policies.
+ *
+ * The list is what the report compares the firing log against, so a policy
+ * that never fired is named. Every id is the one its module carries, so the
+ * list and the modules cannot drift apart.
+ */
+export declare const FIRST_PARTY_POLICY_IDS: readonly string[];
+//# sourceMappingURL=index.d.ts.map

package/dist/policies/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policies/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AA8BjD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAE/B,wCAAwC;AACxC,MAAM,WAAW,sBAAsB;IACrC,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,sBAAsB,GAAG,YAAY,EAAE,CAsBvF;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAoBnD,CAAC"}

package/dist/policies/index.js

@@ -0,0 +1,82 @@
+import { AGI_FRAMING_ID, agiFraming } from './agi-framing.js';
+import { ANTI_ANTHROPOMORPHISM_ID, antiAnthropomorphism } from './anti-anthropomorphism.js';
+import { ANTI_DEPENDENCE_ID, antiDependence } from './anti-dependence.js';
+import { ANTI_SYCOPHANCY_ID, antiSycophancy } from './anti-sycophancy.js';
+import { DARK_PATTERN_ID, darkPattern } from './dark-pattern.js';
+import { DESTRUCTIVE_NEEDS_APPROVAL_ID, destructiveNeedsApproval, } from './destructive-needs-approval.js';
+import { HIGH_RISK_DOMAINS, highRiskPolicies } from './high-risk.js';
+import { HUMAN_ONLY_DECISIONS_ID, humanOnlyDecisions } from './human-only-decisions.js';
+import { NO_SKIP_GIT_HOOKS_ID, noSkipGitHooks } from './no-skip-git-hooks.js';
+import { PACKAGE_MANAGER_ID, packageManager } from './package-manager.js';
+import { PRIVACY_TRANSPARENCY_ID, privacyTransparency } from './privacy-transparency.js';
+import { PROFESSIONAL_DISPLACEMENT_ID, professionalDisplacement, } from './professional-displacement.js';
+import { PROTECT_POLICY_ID, protectPolicy } from './protect-policy.js';
+import { SCOPE_ENFORCEMENT_ID, scopeEnforcement } from './scope-enforcement.js';
+import { SECRET_SCAN_WRITES_ID, secretScanWrites } from './secret-scan-writes.js';
+import { STRUCTURAL_BIAS_ID, structuralBias } from './structural-bias.js';
+import { THIRD_PARTY_IMPACT_ID, thirdPartyImpact } from './third-party-impact.js';
+import { TRUTHFULNESS_UNCERTAINTY_ID, truthfulnessUncertainty, } from './truthfulness-uncertainty.js';
+import { WORKSPACE_WRITES_ONLY_ID, workspaceWritesOnly } from './workspace-writes-only.js';
+export * from './discovery.js';
+export * from './high-risk.js';
+export * from './selection.js';
+/**
+ * The first-party policies (§21.2).
+ *
+ * The catalogue is built with the workspace it guards, because one of the
+ * modules decides against the roots of the workspace. The order is the
+ * order of the layers: the guardrails that hold the tool call first, then
+ * the ones that read the prose.
+ */
+export function firstPartyPolicyModules(options) {
+    return [
+        noSkipGitHooks,
+        packageManager,
+        workspaceWritesOnly(options),
+        protectPolicy,
+        humanOnlyDecisions,
+        secretScanWrites,
+        destructiveNeedsApproval,
+        truthfulnessUncertainty,
+        antiSycophancy,
+        antiAnthropomorphism,
+        antiDependence,
+        agiFraming,
+        professionalDisplacement,
+        structuralBias,
+        darkPattern,
+        scopeEnforcement,
+        privacyTransparency,
+        thirdPartyImpact,
+        ...highRiskPolicies(),
+    ];
+}
+/**
+ * The ids of the first-party policies.
+ *
+ * The list is what the report compares the firing log against, so a policy
+ * that never fired is named. Every id is the one its module carries, so the
+ * list and the modules cannot drift apart.
+ */
+export const FIRST_PARTY_POLICY_IDS = [
+    NO_SKIP_GIT_HOOKS_ID,
+    PACKAGE_MANAGER_ID,
+    WORKSPACE_WRITES_ONLY_ID,
+    PROTECT_POLICY_ID,
+    HUMAN_ONLY_DECISIONS_ID,
+    SECRET_SCAN_WRITES_ID,
+    DESTRUCTIVE_NEEDS_APPROVAL_ID,
+    TRUTHFULNESS_UNCERTAINTY_ID,
+    ANTI_SYCOPHANCY_ID,
+    ANTI_ANTHROPOMORPHISM_ID,
+    ANTI_DEPENDENCE_ID,
+    AGI_FRAMING_ID,
+    PROFESSIONAL_DISPLACEMENT_ID,
+    STRUCTURAL_BIAS_ID,
+    DARK_PATTERN_ID,
+    SCOPE_ENFORCEMENT_ID,
+    PRIVACY_TRANSPARENCY_ID,
+    THIRD_PARTY_IMPACT_ID,
+    ...HIGH_RISK_DOMAINS.map((domain) => `oa.high-risk.${domain}`),
+];
+//# sourceMappingURL=index.js.map

package/dist/policies/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policies/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACzF,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EACL,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAE3F,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAU/B;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAA+B;IACrE,OAAO;QACL,cAAc;QACd,cAAc;QACd,mBAAmB,CAAC,OAAO,CAAC;QAC5B,aAAa;QACb,kBAAkB;QAClB,gBAAgB;QAChB,wBAAwB;QACxB,uBAAuB;QACvB,cAAc;QACd,oBAAoB;QACpB,cAAc;QACd,UAAU;QACV,wBAAwB;QACxB,cAAc;QACd,WAAW;QACX,gBAAgB;QAChB,mBAAmB;QACnB,gBAAgB;QAChB,GAAG,gBAAgB,EAAE;KACtB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,oBAAoB;IACpB,kBAAkB;IAClB,wBAAwB;IACxB,iBAAiB;IACjB,uBAAuB;IACvB,qBAAqB;IACrB,6BAA6B;IAC7B,2BAA2B;IAC3B,kBAAkB;IAClB,wBAAwB;IACxB,kBAAkB;IAClB,cAAc;IACd,4BAA4B;IAC5B,kBAAkB;IAClB,eAAe;IACf,oBAAoB;IACpB,uBAAuB;IACvB,qBAAqB;IACrB,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,MAAM,EAAE,CAAC;CAC/D,CAAC"}

package/dist/policies/no-skip-git-hooks.d.ts

@@ -0,0 +1,14 @@
+import { type PolicyModule } from '../policy.js';
+/**
+ * The no-skip-git-hooks policy (§21.2, layer 1).
+ *
+ * It blocks the flags that skip the pre-commit hook: `--no-verify`, its
+ * short form `-n`, `HUSKY=0` and a moved `core.hooksPath`. The hook is
+ * where the lint and the typecheck run, so a commit that skips it skips the
+ * checks too.
+ */
+/** The stable id of the policy. */
+export declare const NO_SKIP_GIT_HOOKS_ID = "oa.no-skip-git-hooks";
+/** The policy itself. */
+export declare const noSkipGitHooks: PolicyModule;
+//# sourceMappingURL=no-skip-git-hooks.d.ts.map

package/dist/policies/no-skip-git-hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-skip-git-hooks.d.ts","sourceRoot":"","sources":["../../src/policies/no-skip-git-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAI/D;;;;;;;GAOG;AAEH,mCAAmC;AACnC,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D,yBAAyB;AACzB,eAAO,MAAM,cAAc,EAAE,YAa5B,CAAC"}

package/dist/policies/no-skip-git-hooks.js

@@ -0,0 +1,31 @@
+import { allow, block } from '../policy.js';
+import { skipsGitHooks } from '../rules.js';
+import { readToolCall } from './tool-call.js';
+/**
+ * The no-skip-git-hooks policy (§21.2, layer 1).
+ *
+ * It blocks the flags that skip the pre-commit hook: `--no-verify`, its
+ * short form `-n`, `HUSKY=0` and a moved `core.hooksPath`. The hook is
+ * where the lint and the typecheck run, so a commit that skips it skips the
+ * checks too.
+ */
+/** The stable id of the policy. */
+export const NO_SKIP_GIT_HOOKS_ID = 'oa.no-skip-git-hooks';
+/** The policy itself. */
+export const noSkipGitHooks = {
+    id: NO_SKIP_GIT_HOOKS_ID,
+    version: '1.0.0',
+    layer: 1,
+    description: 'Blocks the flags that skip the git hooks.',
+    appliesTo: ['PreToolCall'],
+    origin: 'first-party',
+    evaluate(ctx) {
+        const call = readToolCall(ctx);
+        if (call === undefined || call.command === undefined)
+            return allow();
+        if (!skipsGitHooks(call.command))
+            return allow();
+        return block('Git hooks (lint, typecheck) cannot be skipped. Fix the reported errors instead.');
+    },
+};
+//# sourceMappingURL=no-skip-git-hooks.js.map

package/dist/policies/no-skip-git-hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-skip-git-hooks.js","sourceRoot":"","sources":["../../src/policies/no-skip-git-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAqB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C;;;;;;;GAOG;AAEH,mCAAmC;AACnC,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE3D,yBAAyB;AACzB,MAAM,CAAC,MAAM,cAAc,GAAiB;IAC1C,EAAE,EAAE,oBAAoB;IACxB,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,CAAC;IACR,WAAW,EAAE,2CAA2C;IACxD,SAAS,EAAE,CAAC,aAAa,CAAC;IAC1B,MAAM,EAAE,aAAa;IACrB,QAAQ,CAAC,GAAG;QACV,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,KAAK,EAAE,CAAC;QACrE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC,iFAAiF,CAAC,CAAC;IAClG,CAAC;CACF,CAAC"}

package/dist/policies/package-manager.d.ts

@@ -0,0 +1,12 @@
+import { type PolicyModule } from '../policy.js';
+/**
+ * The package manager policy (§21.2, layer 1).
+ *
+ * It blocks the other package managers: a second lockfile is a second
+ * answer to what the project depends on, and the two disagree.
+ */
+/** The stable id of the policy. */
+export declare const PACKAGE_MANAGER_ID = "oa.package-manager";
+/** The policy itself. */
+export declare const packageManager: PolicyModule;
+//# sourceMappingURL=package-manager.d.ts.map

package/dist/policies/package-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-manager.d.ts","sourceRoot":"","sources":["../../src/policies/package-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAI/D;;;;;GAKG;AAEH,mCAAmC;AACnC,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD,yBAAyB;AACzB,eAAO,MAAM,cAAc,EAAE,YAe5B,CAAC"}

package/dist/policies/package-manager.js

@@ -0,0 +1,29 @@
+import { allow, block } from '../policy.js';
+import { usesOtherPackageManager } from '../rules.js';
+import { readToolCall } from './tool-call.js';
+/**
+ * The package manager policy (§21.2, layer 1).
+ *
+ * It blocks the other package managers: a second lockfile is a second
+ * answer to what the project depends on, and the two disagree.
+ */
+/** The stable id of the policy. */
+export const PACKAGE_MANAGER_ID = 'oa.package-manager';
+/** The policy itself. */
+export const packageManager = {
+    id: PACKAGE_MANAGER_ID,
+    version: '1.0.0',
+    layer: 1,
+    description: 'Blocks the package managers that are not the one this repo uses.',
+    appliesTo: ['PreToolCall'],
+    origin: 'first-party',
+    evaluate(ctx) {
+        const call = readToolCall(ctx);
+        if (call === undefined || call.command === undefined)
+            return allow();
+        if (!usesOtherPackageManager(call.command))
+            return allow();
+        return block('This repo uses Bun. Use `bun add` / `bun remove` / `bunx`, or `turbo run <task>`.');
+    },
+};
+//# sourceMappingURL=package-manager.js.map

package/dist/policies/package-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-manager.js","sourceRoot":"","sources":["../../src/policies/package-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAqB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C;;;;;GAKG;AAEH,mCAAmC;AACnC,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD,yBAAyB;AACzB,MAAM,CAAC,MAAM,cAAc,GAAiB;IAC1C,EAAE,EAAE,kBAAkB;IACtB,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,CAAC;IACR,WAAW,EAAE,kEAAkE;IAC/E,SAAS,EAAE,CAAC,aAAa,CAAC;IAC1B,MAAM,EAAE,aAAa;IACrB,QAAQ,CAAC,GAAG;QACV,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,KAAK,EAAE,CAAC;QACrE,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,EAAE,CAAC;QAC3D,OAAO,KAAK,CACV,mFAAmF,CACpF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/policies/patterns.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The patterns the output policies share.
+ *
+ * The detectors of §8.6 and the policies of §21.1 look at the same prose,
+ * so the way a pattern is applied to a text is written once: a pattern is
+ * tried against the text, the matches are collected, and a match that is
+ * already there is not collected twice.
+ */
+/**
+ * The text a set of patterns matched.
+ *
+ * Every pattern is tried against the whole text, and the matches are
+ * returned in the order the patterns are written, so a text that trips two
+ * of them says which two.
+ */
+export declare function matches(patterns: readonly RegExp[], text: string): string[];
+//# sourceMappingURL=patterns.d.ts.map

package/dist/policies/patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../src/policies/patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAW3E"}

package/dist/policies/patterns.js

@@ -0,0 +1,30 @@
+/**
+ * The patterns the output policies share.
+ *
+ * The detectors of §8.6 and the policies of §21.1 look at the same prose,
+ * so the way a pattern is applied to a text is written once: a pattern is
+ * tried against the text, the matches are collected, and a match that is
+ * already there is not collected twice.
+ */
+/**
+ * The text a set of patterns matched.
+ *
+ * Every pattern is tried against the whole text, and the matches are
+ * returned in the order the patterns are written, so a text that trips two
+ * of them says which two.
+ */
+export function matches(patterns, text) {
+    const found = [];
+    for (const pattern of patterns) {
+        for (const match of text.matchAll(pattern)) {
+            const value = match[0];
+            if (value === undefined || value.length === 0)
+                continue;
+            if (found.includes(value))
+                continue;
+            found.push(value);
+        }
+    }
+    return found;
+}
+//# sourceMappingURL=patterns.js.map

package/dist/policies/patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../src/policies/patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,QAA2B,EAAE,IAAY;IAC/D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACxD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,SAAS;YACpC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/policies/policies.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=policies.test.d.ts.map

package/dist/policies/policies.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.test.d.ts","sourceRoot":"","sources":["../../src/policies/policies.test.ts"],"names":[],"mappings":""}