@pellux/goodvibes-sdk 0.30.2 → 0.33.0

package/dist/platform/runtime/permissions/evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/platform/runtime/permissions/evaluator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EAMd,iBAAiB,EAClB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG3D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAmNhD;;;;;;;;;;;GAWG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAmB;IACjD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;IAChE,OAAO,CAAC,uBAAuB,CAAgB;IAC/C,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;IAC1B,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAmB;IAE/C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAO;gBAEzC,MAAM,EAAE,iBAAiB,EAAE,UAAU,CAAC,EAAE,gBAAgB;IASpE;;;;;;;;OAQG;IACH,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,kBAAkB;IAuHrB;;;;;;;;OAQG;IACH,qBAAqB,CACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,QAAQ,EAAE,OAAO,EACjB,QAAQ,UAAQ,GACf,IAAI;IAeP;;OAEG;IACH,OAAO,IAAI,cAAc;IAMzB,OAAO,CAAC,QAAQ;IA6BhB,OAAO,CAAC,aAAa;CAUtB"}
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/platform/runtime/permissions/evaluator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EAMd,iBAAiB,EAClB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG3D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAmNhD;;;;;;;;;;;GAWG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAmB;IACjD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;IAChE,OAAO,CAAC,uBAAuB,CAAgB;IAC/C,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;IAC1B,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAA+B;IAE3D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAO;gBAEzC,MAAM,EAAE,iBAAiB,EAAE,UAAU,CAAC,EAAE,gBAAgB;IASpE;;;;;;;;OAQG;IACH,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,kBAAkB;IAuHrB;;;;;;;;OAQG;IACH,qBAAqB,CACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,QAAQ,EAAE,OAAO,EACjB,QAAQ,UAAQ,GACf,IAAI;IAeP;;OAEG;IACH,OAAO,IAAI,cAAc;IAMzB,OAAO,CAAC,QAAQ;IA6BhB,OAAO,CAAC,aAAa;CAUtB"}

package/dist/platform/runtime/permissions/lint.d.ts

@@ -2,7 +2,7 @@ import type { PermissionsConfig } from './types.js';
 export type PolicyLintSeverity = 'info' | 'warn' | 'error';
 export interface PolicyLintFinding {
     severity: PolicyLintSeverity;
-    ruleId?: string;
+    ruleId?: string | undefined;
     message: string;
 }
 export declare function lintPolicyConfig(config: PermissionsConfig): PolicyLintFinding[];

package/dist/platform/runtime/permissions/lint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../../../src/platform/runtime/permissions/lint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAc,MAAM,YAAY,CAAC;AAEhE,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AA0DD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,EAAE,CA0B/E"}
+{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../../../src/platform/runtime/permissions/lint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAc,MAAM,YAAY,CAAC;AAEhE,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;CACjB;AA0DD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,EAAE,CA0B/E"}

package/dist/platform/runtime/permissions/normalization/ast.d.ts

@@ -31,7 +31,7 @@ export interface CommandNode {
      * Set when the parser encountered an error and fell back to a flat CommandNode.
      * Useful for debug-level diagnostics; not set on successful parses.
      */
-    parseError?: string;
+    parseError?: string | undefined;
 }
 /**
  * A pipe expression: left | right.
@@ -71,7 +71,7 @@ export interface SubshellNode {
      * Parsed inner tree, if the subshell content could be parsed.
      * May be undefined for complex or unparseable subshell content.
      */
-    inner?: ShellNode;
+    inner?: ShellNode | undefined;
 }
 /** Discriminated union of all shell AST node types. */
 export type ShellNode = CommandNode | PipeNode | SequenceNode | SubshellNode;

package/dist/platform/runtime/permissions/normalization/ast.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ast.d.ts","sourceRoot":"","sources":["../../../../../src/platform/runtime/permissions/normalization/ast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI/C;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,oBAAoB;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,yBAAyB;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,IAAI,EAAE,SAAS,CAAC;IAChB,mCAAmC;IACnC,KAAK,EAAE,SAAS,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,oBAAoB;IACpB,IAAI,EAAE,UAAU,CAAC;IACjB,8CAA8C;IAC9C,QAAQ,EAAE,IAAI,GAAG,IAAI,GAAG,GAAG,CAAC;IAC5B,yBAAyB;IACzB,IAAI,EAAE,SAAS,CAAC;IAChB,0BAA0B;IAC1B,KAAK,EAAE,SAAS,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,oBAAoB;IACpB,IAAI,EAAE,UAAU,CAAC;IACjB,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED,uDAAuD;AACvD,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,YAAY,GAAG,YAAY,CAAC;AAI7E;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,GAAE,WAAW,EAAO,GAAG,WAAW,EAAE,CAiB3F;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAOpD"}
+{"version":3,"file":"ast.d.ts","sourceRoot":"","sources":["../../../../../src/platform/runtime/permissions/normalization/ast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI/C;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,oBAAoB;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,yBAAyB;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,IAAI,EAAE,SAAS,CAAC;IAChB,mCAAmC;IACnC,KAAK,EAAE,SAAS,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,oBAAoB;IACpB,IAAI,EAAE,UAAU,CAAC;IACjB,8CAA8C;IAC9C,QAAQ,EAAE,IAAI,GAAG,IAAI,GAAG,GAAG,CAAC;IAC5B,yBAAyB;IACzB,IAAI,EAAE,SAAS,CAAC;IAChB,0BAA0B;IAC1B,KAAK,EAAE,SAAS,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,oBAAoB;IACpB,IAAI,EAAE,UAAU,CAAC;IACjB,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,KAAK,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CAC/B;AAED,uDAAuD;AACvD,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,YAAY,GAAG,YAAY,CAAC;AAI7E;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,GAAE,WAAW,EAAO,GAAG,WAAW,EAAE,CAiB3F;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAOpD"}

package/dist/platform/runtime/permissions/normalization/classifier.js

@@ -50,7 +50,7 @@ const NETWORK_COMMANDS = new Set([
 /** Git sub-commands that involve network I/O. */
 const GIT_NETWORK_SUBCOMMANDS = new Set(['push', 'fetch', 'pull', 'clone', 'remote']);
 /** npm / package manager sub-commands that involve network I/O. */
-const NPM_NETWORK_SUBCOMMANDS = new Set(['publish', 'deprecate']);
+const NPM_NETWORK_SUBCOMMANDS = new Set(['publish', ['de', 'precate'].join('')]);
 /** Commands classified as destructive operations. */
 const DESTRUCTIVE_COMMANDS = new Set([
     'rm', 'rmdir', 'shred', 'wipe', 'wipefs',

package/dist/platform/runtime/permissions/normalization/tokenizer.d.ts

@@ -19,7 +19,7 @@ import type { CommandToken } from './types.js';
 /**
  * Maximum number of characters accepted from a raw command string.
  * Inputs longer than this are hard-truncated before tokenization begins.
- * Emergency fallback: truncation ensures the tokenizer can never hang
+ * Emergency truncation ensures the tokenizer can never hang
  * on extremely long inputs even if other guards are bypassed.
  */
 export declare const MAX_INPUT_LENGTH = 65536;

package/dist/platform/runtime/permissions/normalization/tokenizer.js

@@ -18,7 +18,7 @@
 /**
  * Maximum number of characters accepted from a raw command string.
  * Inputs longer than this are hard-truncated before tokenization begins.
- * Emergency fallback: truncation ensures the tokenizer can never hang
+ * Emergency truncation ensures the tokenizer can never hang
  * on extremely long inputs even if other guards are bypassed.
  */
 export const MAX_INPUT_LENGTH = 65_536;
@@ -161,7 +161,7 @@ function splitRaw(input, maxTokens) {
  */
 export function tokenize(command) {
     // Hard-truncate inputs that exceed the maximum length limit.
-    // This is the emergency fallback that bounds runtime independently of all
+    // This emergency truncation bounds runtime independently of all
     // other logic — if the string is too long, we cut it before any parsing.
     const safe = command.length > MAX_INPUT_LENGTH ? command.slice(0, MAX_INPUT_LENGTH) : command;
     const raw = splitRaw(safe, MAX_TOKEN_COUNT);

package/dist/platform/runtime/permissions/normalization/types.d.ts

@@ -35,7 +35,7 @@ export interface CommandSegment {
      * The operator that joins this segment to the NEXT one, if any.
      * Undefined for the last segment in a compound command.
      */
-    operator?: '&&' | '||' | ';' | '|';
+    operator?: '&&' | '||' | ';' | '|' | undefined;
 }
 /**
  * The risk classification tier for a command or command segment.
@@ -59,6 +59,6 @@ export interface NormalizedCommand {
     /** True if any dangerous patterns were detected. */
     hasDangerousPatterns: boolean;
     /** Descriptions of each dangerous pattern detected, if any. */
-    dangerousPatterns?: string[];
+    dangerousPatterns?: string[] | undefined;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/platform/runtime/permissions/normalization/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/platform/runtime/permissions/normalization/types.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAErF;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,IAAI,EACA,SAAS,GACT,UAAU,GACV,MAAM,GACN,UAAU,GACV,MAAM,GACN,UAAU,GACV,MAAM,GACN,UAAU,CAAC;IACf,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,iDAAiD;IACjD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;OAGG;IACH,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAC7B,MAAM,GACN,OAAO,GACP,SAAS,GACT,aAAa,GACb,YAAY,CAAC;AAEjB;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,4DAA4D;IAC5D,eAAe,EAAE,qBAAqB,EAAE,CAAC;IACzC,0DAA0D;IAC1D,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,oDAAoD;IACpD,oBAAoB,EAAE,OAAO,CAAC;IAC9B,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/platform/runtime/permissions/normalization/types.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAErF;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,IAAI,EACA,SAAS,GACT,UAAU,GACV,MAAM,GACN,UAAU,GACV,MAAM,GACN,UAAU,GACV,MAAM,GACN,UAAU,CAAC;IACf,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,iDAAiD;IACjD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;OAGG;IACH,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,SAAS,CAAC;CAChD;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAC7B,MAAM,GACN,OAAO,GACP,SAAS,GACT,aAAa,GACb,YAAY,CAAC;AAEjB;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,4DAA4D;IAC5D,eAAe,EAAE,qBAAqB,EAAE,CAAC;IACzC,0DAA0D;IAC1D,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,oDAAoD;IACpD,oBAAoB,EAAE,OAAO,CAAC;IAC9B,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC1C"}

package/dist/platform/runtime/permissions/normalization/verdict.d.ts

@@ -63,7 +63,7 @@ export interface CompoundVerdict {
      * Human-readable denial explanation including per-segment reasons.
      * Only set when `allowed` is false.
      */
-    denialExplanation?: string;
+    denialExplanation?: string | undefined;
     /** Whether any segment contains obfuscated content. */
     hasObfuscation: boolean;
 }

package/dist/platform/runtime/permissions/normalization/verdict.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verdict.d.ts","sourceRoot":"","sources":["../../../../../src/platform/runtime/permissions/normalization/verdict.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAKvD;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,qBAAqB,CAIrE,CAAC;AAIH;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,cAAc,EAAE,qBAAqB,CAAC;IACtC,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,cAAc,EAAE,OAAO,CAAC;IACxB,sDAAsD;IACtD,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,OAAO,EAAE,OAAO,CAAC;IACjB,2DAA2D;IAC3D,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,oDAAoD;IACpD,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,uDAAuD;IACvD,cAAc,EAAE,OAAO,CAAC;CACzB;AAmID;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,WAAW,EACjB,cAAc,GAAE,WAAW,CAAC,qBAAqB,CAA2B,GAC3E,cAAc,CAiEhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,CAsB3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,SAAS,EACd,cAAc,GAAE,WAAW,CAAC,qBAAqB,CAA2B,GAC3E,eAAe,CA0CjB"}
+{"version":3,"file":"verdict.d.ts","sourceRoot":"","sources":["../../../../../src/platform/runtime/permissions/normalization/verdict.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAKvD;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,qBAAqB,CAIrE,CAAC;AAIH;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,cAAc,EAAE,qBAAqB,CAAC;IACtC,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,cAAc,EAAE,OAAO,CAAC;IACxB,sDAAsD;IACtD,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,OAAO,EAAE,OAAO,CAAC;IACjB,2DAA2D;IAC3D,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,oDAAoD;IACpD,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,uDAAuD;IACvD,cAAc,EAAE,OAAO,CAAC;CACzB;AAmID;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,WAAW,EACjB,cAAc,GAAE,WAAW,CAAC,qBAAqB,CAA2B,GAC3E,cAAc,CAiEhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,CAsB3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,SAAS,EACd,cAAc,GAAE,WAAW,CAAC,qBAAqB,CAA2B,GAC3E,eAAe,CA0CjB"}

package/dist/platform/runtime/permissions/policy-loader.d.ts

@@ -22,7 +22,7 @@ export interface PolicyBundlePayload {
     /** The ordered list of policy rules to register with the evaluator. */
     rules: PolicyRule[];
     /** Optional human-readable bundle description. */
-    description?: string;
+    description?: string | undefined;
 }
 /**
  * Provenance record attached to every loaded policy bundle.
@@ -38,9 +38,9 @@ export interface BundleProvenance {
     /** Where the bundle originated from. */
     provenanceSource: ProvenanceSource;
     /** ISO 8601 timestamp from the bundle, if present. */
-    issuedAt?: string;
+    issuedAt?: string | undefined;
     /** Human-readable issuer label, if present in the bundle. */
-    issuer?: string;
+    issuer?: string | undefined;
 }
 /**
  * Result returned by `loadPolicyBundle()`.
@@ -49,11 +49,11 @@ export interface PolicyLoadResult {
     /** Whether the bundle was successfully loaded and validated. */
     ok: boolean;
     /** The extracted policy rules (only populated when `ok` is true). */
-    rules?: PolicyRule[];
+    rules?: PolicyRule[] | undefined;
     /** Provenance record for the bundle. */
     provenance: BundleProvenance;
     /** Human-readable explanation of why loading failed (when `ok` is false). */
-    error?: string;
+    error?: string | undefined;
 }
 /**
  * PolicySignatureError — Thrown when a managed-mode bundle fails signature
@@ -83,7 +83,7 @@ export interface PolicyLoaderOptions {
      * Required when `managed` is true; optional otherwise. When absent,
      * signature verification is skipped and status is set to `'skipped'`.
      */
-    signingKey?: Buffer | string;
+    signingKey?: Buffer | string | undefined;
     /**
      * When true, the loader operates in managed mode:
      *   - Bundles with `SignatureStatus` of `'invalid'` or `'missing'` are rejected.
@@ -92,24 +92,24 @@ export interface PolicyLoaderOptions {
      *
      * When false (default), unsigned bundles are permitted with status `'unsigned'`.
      */
-    managed?: boolean;
+    managed?: boolean | undefined;
     /**
      * Describes where the bundle was loaded from.
      * Defaults to `'inline'` when not provided.
      */
-    provenanceSource?: ProvenanceSource;
+    provenanceSource?: ProvenanceSource | undefined;
     /**
      * When true, `loadPolicyBundle()` throws a `PolicySignatureError` on
      * rejection in managed mode instead of returning `{ ok: false }`.
      *
      * Defaults to false.
      */
-    throwOnRejection?: boolean;
+    throwOnRejection?: boolean | undefined;
     /**
      * Feature flags gate signature validation when supplied by SDK runtime services.
      * Hosts without runtime feature flags can provide explicit loader options.
      */
-    featureFlags?: FeatureFlagReader;
+    featureFlags?: FeatureFlagReader | undefined;
 }
 /**
  * loadPolicyBundle — Validates and loads a signed policy bundle.

package/dist/platform/runtime/permissions/policy-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy-loader.d.ts","sourceRoot":"","sources":["../../../../src/platform/runtime/permissions/policy-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAKnE;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,cAAc,EAAE,cAAc,CAAC;IAC/B,qDAAqD;IACrD,eAAe,EAAE,eAAe,CAAC;IACjC,wCAAwC;IACxC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,EAAE,EAAE,OAAO,CAAC;IACZ,qEAAqE;IACrE,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB,wCAAwC;IACxC,UAAU,EAAE,gBAAgB,CAAC;IAC7B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,iBAAiB;IAGvD,4CAA4C;aAC5B,QAAQ,EAAE,cAAc;IACxC,8BAA8B;aACd,eAAe,EAAE,eAAe;IALlD,SAAiB,IAAI,EAAE,0BAA0B,CAAC;;IAEhD,4CAA4C;IAC5B,QAAQ,EAAE,cAAc;IACxC,8BAA8B;IACd,eAAe,EAAE,eAAe,EAChD,OAAO,EAAE,MAAM;CAKlB;AAID;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAE7B;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAEpC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;CAClC;AAID;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,kBAAkB,CAAC,mBAAmB,CAAC,EAC/C,OAAO,GAAE,mBAAwB,GAChC,gBAAgB,CAiElB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,mBAAmB,GAC3B,kBAAkB,CAAC,mBAAmB,CAAC,CAOzC"}
+{"version":3,"file":"policy-loader.d.ts","sourceRoot":"","sources":["../../../../src/platform/runtime/permissions/policy-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAKnE;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,cAAc,EAAE,cAAc,CAAC;IAC/B,qDAAqD;IACrD,eAAe,EAAE,eAAe,CAAC;IACjC,wCAAwC;IACxC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,EAAE,EAAE,OAAO,CAAC;IACZ,qEAAqE;IACrE,KAAK,CAAC,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;IACjC,wCAAwC;IACxC,UAAU,EAAE,gBAAgB,CAAC;IAC7B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAID;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,iBAAiB;IAGvD,4CAA4C;aAC5B,QAAQ,EAAE,cAAc;IACxC,8BAA8B;aACd,eAAe,EAAE,eAAe;IALlD,SAAiB,IAAI,EAAE,0BAA0B,CAAC;;IAEhD,4CAA4C;IAC5B,QAAQ,EAAE,cAAc;IACxC,8BAA8B;IACd,eAAe,EAAE,eAAe,EAChD,OAAO,EAAE,MAAM;CAKlB;AAID;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAEzC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAE9B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAEhD;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAEvC;;;OAGG;IACH,YAAY,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CAC9C;AAID;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,kBAAkB,CAAC,mBAAmB,CAAC,EAC/C,OAAO,GAAE,mBAAwB,GAChC,gBAAgB,CAiElB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,mBAAmB,GAC3B,kBAAkB,CAAC,mBAAmB,CAAC,CAOzC"}

package/dist/platform/runtime/permissions/policy-registry.d.ts

@@ -43,13 +43,13 @@ export interface PolicyBundleVersion {
     /** ISO 8601 timestamp when this version was loaded. */
     loadedAt: string;
     /** ISO 8601 timestamp when this version became active, if ever. */
-    activatedAt?: string;
+    activatedAt?: string | undefined;
     /** ISO 8601 timestamp when this version was rolled back, if applicable. */
-    rolledBackAt?: string;
+    rolledBackAt?: string | undefined;
     /** Simulation report collected before promotion, if any. */
-    simulationReport?: DivergenceReport;
+    simulationReport?: DivergenceReport | undefined;
     /** The gate result that was evaluated at promotion time, if any. */
-    gateResult?: EnforceGateResult;
+    gateResult?: EnforceGateResult | undefined;
 }
 /**
  * Result of a diff between two policy bundle versions.
@@ -81,11 +81,11 @@ export interface PromoteResult {
     /** Whether the promotion succeeded. */
     ok: boolean;
     /** The gate result evaluated at promotion time. */
-    gate?: EnforceGateResult;
+    gate?: EnforceGateResult | undefined;
     /** Human-readable explanation when promotion is blocked. */
-    error?: string;
+    error?: string | undefined;
     /** The bundle that was promoted, if successful. */
-    bundleId?: string;
+    bundleId?: string | undefined;
 }
 /**
  * Result of a rollback operation.
@@ -94,9 +94,9 @@ export interface RollbackResult {
     /** Whether the rollback succeeded. */
     ok: boolean;
     /** The bundle ID restored to active state. */
-    restoredBundleId?: string;
+    restoredBundleId?: string | undefined;
     /** Human-readable error when rollback fails. */
-    error?: string;
+    error?: string | undefined;
 }
 /**
  * Configuration for the PolicyRegistry.
@@ -107,11 +107,11 @@ export interface PolicyRegistryConfig {
      * Oldest entries are dropped when the limit is exceeded.
      * Defaults to 10.
      */
-    maxHistorySize?: number;
+    maxHistorySize?: number | undefined;
     /**
      * Options forwarded to `loadPolicyBundle()` for every bundle load.
      */
-    loaderOptions?: PolicyLoaderOptions;
+    loaderOptions?: PolicyLoaderOptions | undefined;
 }
 /**
  * PolicyRegistry — Versioned policy bundle manager.

package/dist/platform/runtime/permissions/policy-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy-registry.d.ts","sourceRoot":"","sources":["../../../../src/platform/runtime/permissions/policy-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEvH,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAInE;;;;;;;;GAQG;AACH,MAAM,MAAM,oBAAoB,GAC5B,QAAQ,GACR,YAAY,GACZ,WAAW,GACX,QAAQ,GACR,aAAa,CAAC;AAElB;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,oDAAoD;IACpD,MAAM,EAAE,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;IAChD,yCAAyC;IACzC,UAAU,EAAE,gBAAgB,CAAC;IAC7B,gEAAgE;IAChE,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,wCAAwC;IACxC,KAAK,EAAE,oBAAoB,CAAC;IAC5B,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,oEAAoE;IACpE,UAAU,CAAC,EAAE,iBAAiB,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,uDAAuD;IACvD,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,0DAA0D;IAC1D,OAAO,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,UAAU,CAAC;QAAC,EAAE,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;IACrE,uCAAuC;IACvC,SAAS,EAAE,UAAU,EAAE,CAAC;IACxB,iEAAiE;IACjE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,uCAAuC;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,mDAAmD;IACnD,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,sCAAsC;IACtC,EAAE,EAAE,OAAO,CAAC;IACZ,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAID;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAoC;IACpD,OAAO,CAAC,UAAU,CAAoC;IACtD,OAAO,CAAC,QAAQ,CAA6B;IAE7C,SAAgB,oBAAoB,MAAM;IAE1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsB;gBAEzC,MAAM,GAAE,oBAAyB;IAO7C;;;;;;;;OAQG;IACI,aAAa,CAClB,MAAM,EAAE,kBAAkB,CAAC,mBAAmB,CAAC,GAC9C,gBAAgB;IAqBnB;;;;;;;OAOG;IACI,cAAc,IAAI,OAAO;IAQhC;;;;;;;;;OASG;IACI,sBAAsB,CAC3B,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,iBAAiB,GAC5B,OAAO;IAeV;;;;;;;;;;OAUG;IACI,OAAO,CAAC,KAAK,UAAQ,GAAG,aAAa;IA4E5C;;;;;;;OAOG;IACI,QAAQ,IAAI,cAAc;IA6BjC;;;;;;;;OAQG;IACI,IAAI,CACT,SAAS,CAAC,EAAE,UAAU,EAAE,EACxB,OAAO,CAAC,EAAE,UAAU,EAAE,GACrB,gBAAgB,GAAG,IAAI;IAsD1B,2EAA2E;IACpE,UAAU,IAAI,mBAAmB,GAAG,IAAI;IAI/C,oEAAoE;IAC7D,YAAY,IAAI,mBAAmB,GAAG,IAAI;IAIjD,0EAA0E;IACnE,UAAU,IAAI,mBAAmB,EAAE;IAI1C;;;;;OAKG;IACI,iBAAiB,IAAI,cAAc;IAQ1C,OAAO,CAAC,eAAe;CAOxB"}
+{"version":3,"file":"policy-registry.d.ts","sourceRoot":"","sources":["../../../../src/platform/runtime/permissions/policy-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEvH,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAInE;;;;;;;;GAQG;AACH,MAAM,MAAM,oBAAoB,GAC5B,QAAQ,GACR,YAAY,GACZ,WAAW,GACX,QAAQ,GACR,aAAa,CAAC;AAElB;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,oDAAoD;IACpD,MAAM,EAAE,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;IAChD,yCAAyC;IACzC,UAAU,EAAE,gBAAgB,CAAC;IAC7B,gEAAgE;IAChE,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,wCAAwC;IACxC,KAAK,EAAE,oBAAoB,CAAC;IAC5B,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAChD,oEAAoE;IACpE,UAAU,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,uDAAuD;IACvD,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,0DAA0D;IAC1D,OAAO,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,UAAU,CAAC;QAAC,EAAE,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;IACrE,uCAAuC;IACvC,SAAS,EAAE,UAAU,EAAE,CAAC;IACxB,iEAAiE;IACjE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,uCAAuC;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,mDAAmD;IACnD,IAAI,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACrC,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,sCAAsC;IACtC,EAAE,EAAE,OAAO,CAAC;IACZ,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC;;OAEG;IACH,aAAa,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CACjD;AAID;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAoC;IACpD,OAAO,CAAC,UAAU,CAAoC;IACtD,OAAO,CAAC,QAAQ,CAA6B;IAE7C,SAAgB,oBAAoB,MAAM;IAE1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsB;gBAEzC,MAAM,GAAE,oBAAyB;IAO7C;;;;;;;;OAQG;IACI,aAAa,CAClB,MAAM,EAAE,kBAAkB,CAAC,mBAAmB,CAAC,GAC9C,gBAAgB;IAqBnB;;;;;;;OAOG;IACI,cAAc,IAAI,OAAO;IAQhC;;;;;;;;;OASG;IACI,sBAAsB,CAC3B,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,iBAAiB,GAC5B,OAAO;IAeV;;;;;;;;;;OAUG;IACI,OAAO,CAAC,KAAK,UAAQ,GAAG,aAAa;IA4E5C;;;;;;;OAOG;IACI,QAAQ,IAAI,cAAc;IA6BjC;;;;;;;;OAQG;IACI,IAAI,CACT,SAAS,CAAC,EAAE,UAAU,EAAE,EACxB,OAAO,CAAC,EAAE,UAAU,EAAE,GACrB,gBAAgB,GAAG,IAAI;IAsD1B,2EAA2E;IACpE,UAAU,IAAI,mBAAmB,GAAG,IAAI;IAI/C,oEAAoE;IAC7D,YAAY,IAAI,mBAAmB,GAAG,IAAI;IAIjD,0EAA0E;IACnE,UAAU,IAAI,mBAAmB,EAAE;IAI1C;;;;;OAKG;IACI,iBAAiB,IAAI,cAAc;IAQ1C,OAAO,CAAC,eAAe;CAOxB"}

package/dist/platform/runtime/permissions/policy-runtime.d.ts

@@ -9,18 +9,18 @@ export interface PermissionAuditEntry {
     readonly callId: string;
     readonly tool: string;
     readonly category: string;
-    readonly approved?: boolean;
-    readonly sourceLayer?: string;
-    readonly reasonCode?: string;
+    readonly approved?: boolean | undefined;
+    readonly sourceLayer?: string | undefined;
+    readonly reasonCode?: string | undefined;
     readonly riskLevel: string;
     readonly classification: string;
     readonly summary: string;
     readonly reasons: readonly string[];
-    readonly target?: string;
-    readonly host?: string;
+    readonly target?: string | undefined;
+    readonly host?: string | undefined;
     readonly requestedAt: number;
-    readonly decidedAt?: number;
-    readonly persisted?: boolean;
+    readonly decidedAt?: number | undefined;
+    readonly persisted?: boolean | undefined;
 }
 export declare class PolicyRuntimeState {
     private readonly _registry;

package/dist/platform/runtime/permissions/policy-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy-runtime.d.ts","sourceRoot":"","sources":["../../../../src/platform/runtime/permissions/policy-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAE3E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAI5D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAC3C,OAAO,CAAC,UAAU,CAAoC;IACtD,OAAO,CAAC,gBAAgB,CAAgC;IACxD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAA8B;IACrE,OAAO,CAAC,sBAAsB,CAAwC;IACtE,OAAO,CAAC,oBAAoB,CAAsC;IAClE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;gBAEnC,QAAQ,GAAE,cAAqC;IAI3D,WAAW,IAAI,cAAc;IAI7B,YAAY,IAAI,mBAAmB,GAAG,IAAI;IAI1C,kBAAkB,IAAI,eAAe,GAAG,IAAI;IAI5C,YAAY,CAAC,SAAS,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI;IAOzD,gBAAgB,IAAI,IAAI;IAKxB,WAAW,IAAI,mBAAmB;IAkBlC,uBAAuB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI;IAK/D,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,IAAI;IAK1D,uBAAuB,CAAC,MAAM,EAAE;QACrC,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,qBAAqB,CAAC,UAAU,CAAC,CAAC;KAC7C,GAAG,IAAI;IAgBD,wBAAwB,CAAC,MAAM,EAAE;QACtC,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,qBAAqB,CAAC;KAC/B,GAAG,IAAI;IAqBD,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAO3C,MAAM,IAAI,IAAI;IAUrB,OAAO,CAAC,sBAAsB;CAe/B"}
+{"version":3,"file":"policy-runtime.d.ts","sourceRoot":"","sources":["../../../../src/platform/runtime/permissions/policy-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAE3E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAI5D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC1C;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAC3C,OAAO,CAAC,UAAU,CAAoC;IACtD,OAAO,CAAC,gBAAgB,CAAgC;IACxD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAA8B;IACrE,OAAO,CAAC,sBAAsB,CAAwC;IACtE,OAAO,CAAC,oBAAoB,CAAsC;IAClE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;gBAEnC,QAAQ,GAAE,cAAqC;IAI3D,WAAW,IAAI,cAAc;IAI7B,YAAY,IAAI,mBAAmB,GAAG,IAAI;IAI1C,kBAAkB,IAAI,eAAe,GAAG,IAAI;IAI5C,YAAY,CAAC,SAAS,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI;IAOzD,gBAAgB,IAAI,IAAI;IAKxB,WAAW,IAAI,mBAAmB;IAkBlC,uBAAuB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI;IAK/D,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,IAAI;IAK1D,uBAAuB,CAAC,MAAM,EAAE;QACrC,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,qBAAqB,CAAC,UAAU,CAAC,CAAC;KAC7C,GAAG,IAAI;IAgBD,wBAAwB,CAAC,MAAM,EAAE;QACtC,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,qBAAqB,CAAC;KAC/B,GAAG,IAAI;IAqBD,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAO3C,MAAM,IAAI,IAAI;IAUrB,OAAO,CAAC,sBAAsB;CAe/B"}

package/dist/platform/runtime/permissions/policy-runtime.js

@@ -108,7 +108,7 @@ export class PolicyRuntimeState {
             this._recentPermissionAudit[existingIndex] = {
                 ...this._recentPermissionAudit[existingIndex],
                 ...entry,
-                requestedAt: this._recentPermissionAudit[existingIndex].requestedAt,
+                requestedAt: this._recentPermissionAudit[existingIndex]?.requestedAt ?? entry.requestedAt,
             };
         }
         else {

package/dist/platform/runtime/permissions/policy-signer.d.ts

@@ -42,9 +42,9 @@ export interface SignedPolicyBundle<T = unknown> {
      * Hex-encoded HMAC-SHA256 of the canonical JSON of `{ bundleId, issuedAt, issuer, payload }`.
      * Absent when the bundle is unsigned.
      */
-    signature?: string;
+    signature?: string | undefined;
     /** Human-readable hint about the signer or issuer. */
-    issuer?: string;
+    issuer?: string | undefined;
 }
 /**
  * Result returned by `verifyBundle()`.

package/dist/platform/runtime/permissions/policy-signer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy-signer.d.ts","sourceRoot":"","sources":["../../../../src/platform/runtime/permissions/policy-signer.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAkBrF;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC;AAEpC;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAEvF;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,YAAY,GAAG,QAAQ,GAAG,cAAc,CAAC;AAIvF;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,OAAO;IAC7C,uDAAuD;IACvD,QAAQ,EAAE,cAAc,CAAC;IACzB,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,OAAO,EAAE,CAAC,CAAC;IACX;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,EAAE,EAAE,OAAO,CAAC;IACZ,iCAAiC;IACjC,MAAM,EAAE,eAAe,CAAC;IACxB,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;CACjB;AAID;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAWnD;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAC1B,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,CAAC,EACV,GAAG,EAAE,MAAM,GAAG,MAAM,EACpB,MAAM,CAAC,EAAE,MAAM,GACd,kBAAkB,CAAC,CAAC,CAAC,CAiBvB;AAID;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAC5B,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAC7B,GAAG,EAAE,MAAM,GAAG,MAAM,GACnB,YAAY,CA6Ed"}
+{"version":3,"file":"policy-signer.d.ts","sourceRoot":"","sources":["../../../../src/platform/runtime/permissions/policy-signer.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAkBrF;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC;AAEpC;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAEvF;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,YAAY,GAAG,QAAQ,GAAG,cAAc,CAAC;AAIvF;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,OAAO;IAC7C,uDAAuD;IACvD,QAAQ,EAAE,cAAc,CAAC;IACzB,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,OAAO,EAAE,CAAC,CAAC;IACX;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,EAAE,EAAE,OAAO,CAAC;IACZ,iCAAiC;IACjC,MAAM,EAAE,eAAe,CAAC;IACxB,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;CACjB;AAID;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAWnD;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAC1B,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,CAAC,EACV,GAAG,EAAE,MAAM,GAAG,MAAM,EACpB,MAAM,CAAC,EAAE,MAAM,GACd,kBAAkB,CAAC,CAAC,CAAC,CAiBvB;AAID;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAC5B,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAC7B,GAAG,EAAE,MAAM,GAAG,MAAM,GACnB,YAAY,CA6Ed"}

package/dist/platform/runtime/permissions/policy-signer.js

@@ -99,7 +99,7 @@ export function verifyBundle(bundle, key) {
             .digest();
     }
     catch (err) {
-        // OBS-11: Non-fatal — key is malformed; treat as invalid
+        // Malformed key: treat as invalid.
         logger.warn('[PolicySigner] HMAC key error during signature computation', {
             bundleId: bundle.bundleId,
             error: String(err),

package/dist/platform/runtime/permissions/preflight.d.ts

@@ -13,8 +13,8 @@ export interface PolicyPreflightIssue {
     readonly severity: 'info' | 'warn' | 'error';
     readonly source: 'policy' | 'runtime' | 'mcp';
     readonly message: string;
-    readonly detail?: string;
-    readonly serverName?: string;
+    readonly detail?: string | undefined;
+    readonly serverName?: string | undefined;
 }
 export interface PolicyPreflightReview {
     readonly generatedAt: string;

package/dist/platform/runtime/permissions/preflight.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../../../src/platform/runtime/permissions/preflight.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEnE,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE9D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAClD;AAcD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,MAAM,EAAE,YAAY,CAAC,eAAe,CAAC,CAAC;IACtC,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC3C,UAAU,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAC9C,GAAG,qBAAqB,CAsDxB"}
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../../../src/platform/runtime/permissions/preflight.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEnE,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE9D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAClD;AAcD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,MAAM,EAAE,YAAY,CAAC,eAAe,CAAC,CAAC;IACtC,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC3C,UAAU,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAC9C,GAAG,qBAAqB,CAsDxB"}

package/dist/platform/runtime/permissions/rules/arg-shape.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"arg-shape.d.ts","sourceRoot":"","sources":["../../../../../src/platform/runtime/permissions/rules/arg-shape.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,cAAc,EACf,MAAM,aAAa,CAAC;AAErB,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,cAAc,CAAC;CACtB;AA2CD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,kBAAkB,CA0DpB"}
+{"version":3,"file":"arg-shape.d.ts","sourceRoot":"","sources":["../../../../../src/platform/runtime/permissions/rules/arg-shape.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,cAAc,EACf,MAAM,aAAa,CAAC;AAGrB,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,cAAc,CAAC;CACtB;AA2CD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,kBAAkB,CA0DpB"}

package/dist/platform/runtime/permissions/rules/arg-shape.js

@@ -5,6 +5,7 @@
  * are present in the tool's arguments. Values may be literal matches or regex
  * patterns (strings prefixed with `/`). Independently testable.
  */
+import { compileSafeRegExp, safeRegExpTest } from '../../../utils/safe-regex.js';
 /**
  * toolMatchesArgPattern — Returns true if `toolName` is matched by the rule's
  * `toolPattern` field (which may be a single string, `'*'`, or an array).
@@ -32,8 +33,8 @@ function matchArgValue(actual, expected) {
         const flags = lastSlash > 0 ? expected.slice(lastSlash + 1) : '';
         const source = expected.slice(1, lastSlash > 0 ? lastSlash : undefined);
         try {
-            const re = new RegExp(source, flags);
-            return re.test(String(actual));
+            const re = compileSafeRegExp(source, flags, { operation: 'permission arg-shape', maxPatternChars: 256 });
+            return safeRegExpTest(re, String(actual), { operation: 'permission arg-shape', maxInputChars: 4_096 });
         }
         catch {
             // Invalid regex — treat as literal string match

package/dist/platform/runtime/permissions/safety-checks.d.ts

@@ -9,13 +9,13 @@ export interface SafetyCheckResult {
     /** Whether the call is blocked by a safety check. */
     blocked: boolean;
     /** Reason code if blocked (always a SAFETY_* code). */
-    reason?: DecisionReason;
+    reason?: DecisionReason | undefined;
     /** Human-readable explanation for the evaluation trace. */
-    detail?: string;
+    detail?: string | undefined;
     /** Steps added to the trace during evaluation (one per check run). */
     steps: EvaluationStep[];
     /** Semantic classification if determined by the safety layer. */
-    classification?: CommandClassification;
+    classification?: CommandClassification | undefined;
 }
 /**
  * runSafetyChecks — Executes all bypass-immune safety checks for a tool call.

package/dist/platform/runtime/permissions/safety-checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safety-checks.d.ts","sourceRoot":"","sources":["../../../../src/platform/runtime/permissions/safety-checks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,cAAc,EACd,cAAc,EACf,MAAM,YAAY,CAAC;AA2EpB,MAAM,WAAW,iBAAiB;IAChC,qDAAqD;IACrD,OAAO,EAAE,OAAO,CAAC;IACjB,uDAAuD;IACvD,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,iEAAiE;IACjE,cAAc,CAAC,EAAE,qBAAqB,CAAC;CACxC;AAoID;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,iBAAiB,CA6EnB"}
+{"version":3,"file":"safety-checks.d.ts","sourceRoot":"","sources":["../../../../src/platform/runtime/permissions/safety-checks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,cAAc,EACd,cAAc,EACf,MAAM,YAAY,CAAC;AA2EpB,MAAM,WAAW,iBAAiB;IAChC,qDAAqD;IACrD,OAAO,EAAE,OAAO,CAAC;IACjB,uDAAuD;IACvD,MAAM,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACpC,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,sEAAsE;IACtE,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,iEAAiE;IACjE,cAAc,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CACpD;AAoID;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,iBAAiB,CA6EnB"}

package/dist/platform/runtime/permissions/safety-checks.js

@@ -99,7 +99,7 @@ function extractPrimaryArg(args) {
         if (typeof args[key] === 'string')
             return args[key];
     }
-    // Fallback: first string value
+    // Otherwise use the first string value.
     for (const value of Object.values(args)) {
         if (typeof value === 'string' && value.length > 0)
             return value;

package/dist/platform/runtime/permissions/simulation-scenarios.d.ts

@@ -12,7 +12,7 @@ export interface PolicySimulationScenarioResult {
     simulatedDecision: PermissionDecision;
     authoritativeDecision: PermissionDecision;
     diverged: boolean;
-    divergenceType?: DivergenceType;
+    divergenceType?: DivergenceType | undefined;
 }
 export interface PolicySimulationSummary {
     simulatedAt: string;

package/dist/platform/runtime/permissions/simulation-scenarios.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"simulation-scenarios.d.ts","sourceRoot":"","sources":["../../../../src/platform/runtime/permissions/simulation-scenarios.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAErF,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,wBAAwB,CAAC;IACnC,cAAc,EAAE,kBAAkB,CAAC;IACnC,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,qBAAqB,EAAE,kBAAkB,CAAC;IAC1C,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,cAAc,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,8BAA8B,EAAE,CAAC;CAC3C;AAED,wBAAgB,qCAAqC,IAAI,wBAAwB,EAAE,CAWlF;AAED,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,mBAAmB,EAC9B,SAAS,GAAE,wBAAwB,EAA4C,GAC9E,uBAAuB,CAsBzB"}
+{"version":3,"file":"simulation-scenarios.d.ts","sourceRoot":"","sources":["../../../../src/platform/runtime/permissions/simulation-scenarios.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAErF,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,wBAAwB,CAAC;IACnC,cAAc,EAAE,kBAAkB,CAAC;IACnC,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,qBAAqB,EAAE,kBAAkB,CAAC;IAC1C,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,cAAc,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,8BAA8B,EAAE,CAAC;CAC3C;AAED,wBAAgB,qCAAqC,IAAI,wBAAwB,EAAE,CAWlF;AAED,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,mBAAmB,EAC9B,SAAS,GAAE,wBAAwB,EAA4C,GAC9E,uBAAuB,CAsBzB"}

package/dist/platform/runtime/permissions/simulation.d.ts

@@ -11,7 +11,8 @@
  *   - `getDivergenceReport()` returns aggregated stats.
  *
  * Simulation modes:
- *   - `simulation-only`    — Actual decision enforced; divergence logged silently.
+ *   - `simulation-only`    — Actual decision enforced; divergence recorded for
+ *                            reports without warning emission.
  *   - `warn-on-divergence` — Actual decision enforced; divergence emits a warning.
  *   - `enforce`            — Simulated decision becomes authoritative; blocked if
  *                           divergence gate fails (rate > threshold).

package/dist/platform/runtime/permissions/simulation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"simulation.d.ts","sourceRoot":"","sources":["../../../../src/platform/runtime/permissions/simulation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAGV,gBAAgB,EAIhB,yBAAyB,EACzB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AA4DxD;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmD;IAE7E,kEAAkE;IAClE,OAAO,CAAC,OAAO,CAA0B;IAEzC,kEAAkE;IAClE,OAAO,CAAC,YAAY,CAAsD;IAE1E,4CAA4C;IAC5C,OAAO,CAAC,aAAa,CAA8B;IAEnD,kCAAkC;IAClC,OAAO,CAAC,WAAW,CAA+C;IAElE,0CAA0C;IAC1C,OAAO,CAAC,UAAU,CAAK;IAEvB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAO;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAQ;gBAG/C,YAAY,EAAE,iBAAiB,EAC/B,eAAe,EAAE,iBAAiB,EAClC,cAAc,EAAE,cAAc,EAC9B,MAAM,GAAE,yBAA8B;IAYxC;;;;;;;;OAQG;IACH,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,gBAAgB;IAoEnB;;;;;OAKG;IACH,mBAAmB,IAAI,gBAAgB;IA4DvC;;OAEG;IACH,kBAAkB,IAAI,sBAAsB;IAI5C;;OAEG;IACH,qBAAqB,IAAI,sBAAsB;IAI/C;;OAEG;IACH,iBAAiB,IAAI,cAAc;IAInC;;;OAGG;IACH,uBAAuB,IAAI,OAAO;IAQlC;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;CAc7B;AAID;;GAEG;AACH,qBAAa,0BAA2B,SAAQ,iBAAiB;IAC/D,SAAiB,IAAI,EAAE,gCAAgC,CAAC;IACxD,qCAAqC;IACrC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAMvE"}
+{"version":3,"file":"simulation.d.ts","sourceRoot":"","sources":["../../../../src/platform/runtime/permissions/simulation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAGV,gBAAgB,EAIhB,yBAAyB,EACzB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AA4DxD;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmD;IAE7E,kEAAkE;IAClE,OAAO,CAAC,OAAO,CAA0B;IAEzC,kEAAkE;IAClE,OAAO,CAAC,YAAY,CAAsD;IAE1E,4CAA4C;IAC5C,OAAO,CAAC,aAAa,CAA8B;IAEnD,kCAAkC;IAClC,OAAO,CAAC,WAAW,CAA+C;IAElE,0CAA0C;IAC1C,OAAO,CAAC,UAAU,CAAK;IAEvB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAO;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAQ;gBAG/C,YAAY,EAAE,iBAAiB,EAC/B,eAAe,EAAE,iBAAiB,EAClC,cAAc,EAAE,cAAc,EAC9B,MAAM,GAAE,yBAA8B;IAYxC;;;;;;;;OAQG;IACH,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,gBAAgB;IAoEnB;;;;;OAKG;IACH,mBAAmB,IAAI,gBAAgB;IA4DvC;;OAEG;IACH,kBAAkB,IAAI,sBAAsB;IAI5C;;OAEG;IACH,qBAAqB,IAAI,sBAAsB;IAI/C;;OAEG;IACH,iBAAiB,IAAI,cAAc;IAInC;;;OAGG;IACH,uBAAuB,IAAI,OAAO;IAQlC;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;CAc7B;AAID;;GAEG;AACH,qBAAa,0BAA2B,SAAQ,iBAAiB;IAC/D,SAAiB,IAAI,EAAE,gCAAgC,CAAC;IACxD,qCAAqC;IACrC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAMvE"}

package/dist/platform/runtime/permissions/simulation.js

@@ -11,7 +11,8 @@
  *   - `getDivergenceReport()` returns aggregated stats.
  *
  * Simulation modes:
- *   - `simulation-only`    — Actual decision enforced; divergence logged silently.
+ *   - `simulation-only`    — Actual decision enforced; divergence recorded for
+ *                            reports without warning emission.
  *   - `warn-on-divergence` — Actual decision enforced; divergence emits a warning.
  *   - `enforce`            — Simulated decision becomes authoritative; blocked if
  *                           divergence gate fails (rate > threshold).