@permission-protocol/mcp-guard 0.1.0 → 0.2.0

package/dist/src/config.js

@@ -1,9 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.TOOLS_CALL = exports.DEFAULT_RECEIPT_TTL_SECONDS = exports.DEFAULT_APPROVAL_TTL_SECONDS = void 0;
 exports.loadConfig = loadConfig;
+exports.parseConfig = parseConfig;
+const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const yaml_1 = require("yaml");
+exports.DEFAULT_APPROVAL_TTL_SECONDS = 900;
+exports.DEFAULT_RECEIPT_TTL_SECONDS = 900;
+exports.TOOLS_CALL = 'tools/call';
 const VALID_ACTIONS = ['allow', 'block', 'require_approval'];
+const VALID_MODES = ['enforce', 'observe'];
+const VALID_REVERSIBILITY = ['reversible', 'irreversible'];
+const TOP_LEVEL_KEYS = new Set(['default_action', 'mode', 'rules', 'approval_ttl_seconds', 'receipt_ttl_seconds']);
+const RULE_KEYS = new Set([
+    'id', 'method', 'tool', 'action', 'reversibility', 'countdown_seconds', 'cap_usd', 'amount_arg', 'verify_threshold',
+]);
 function loadConfig(configPath) {
     let raw;
     try {
@@ -12,37 +24,112 @@ function loadConfig(configPath) {
     catch (err) {
         throw new Error(`Failed to read config file: ${configPath} (${err.code ?? err.message})`);
     }
+    return parseConfig(raw);
+}
+/** Parse and strictly validate a policy. Anything unrecognized is an error, never ignored. */
+function parseConfig(raw) {
     const parsed = (0, yaml_1.parse)(raw);
-    if (!parsed || typeof parsed !== 'object') {
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
         throw new Error('Config must be a YAML object');
     }
+    for (const key of Object.keys(parsed)) {
+        if (!TOP_LEVEL_KEYS.has(key))
+            throw new Error(`Unknown config key: "${key}"`);
+    }
     if (!VALID_ACTIONS.includes(parsed.default_action)) {
         throw new Error(`Invalid default_action: "${parsed.default_action}". Must be one of: ${VALID_ACTIONS.join(', ')}`);
     }
-    const VALID_MODES = ['enforce', 'observe'];
     const mode = parsed.mode ?? 'enforce';
     if (!VALID_MODES.includes(mode)) {
         throw new Error(`Invalid mode: "${parsed.mode}". Must be one of: ${VALID_MODES.join(', ')}`);
     }
+    const approvalTtl = positiveInt(parsed.approval_ttl_seconds, 'approval_ttl_seconds', exports.DEFAULT_APPROVAL_TTL_SECONDS);
+    const receiptTtl = positiveInt(parsed.receipt_ttl_seconds, 'receipt_ttl_seconds', exports.DEFAULT_RECEIPT_TTL_SECONDS);
     if (!Array.isArray(parsed.rules)) {
         throw new Error('Config must include a "rules" array');
     }
+    const seenIds = new Set();
+    const seenTargets = new Set();
     const rules = parsed.rules.map((r, i) => {
+        if (!r || typeof r !== 'object' || Array.isArray(r))
+            throw new Error(`Rule ${i} must be an object`);
+        for (const key of Object.keys(r)) {
+            if (!RULE_KEYS.has(key))
+                throw new Error(`Rule ${i} has unknown key: "${key}"`);
+        }
         if (!r.id || typeof r.id !== 'string') {
             throw new Error(`Rule ${i} missing valid "id"`);
         }
-        if (!r.tool || typeof r.tool !== 'string') {
-            throw new Error(`Rule ${i} missing valid "tool"`);
+        if (seenIds.has(r.id))
+            throw new Error(`Rule ${i} duplicates id "${r.id}"`);
+        seenIds.add(r.id);
+        const method = r.method ?? exports.TOOLS_CALL;
+        if (typeof method !== 'string' || !method)
+            throw new Error(`Rule ${i} has invalid method`);
+        if (method === exports.TOOLS_CALL) {
+            if (!r.tool || typeof r.tool !== 'string')
+                throw new Error(`Rule ${i} missing valid "tool"`);
+        }
+        else if (r.tool !== undefined) {
+            throw new Error(`Rule ${i}: "tool" applies only to ${exports.TOOLS_CALL} rules`);
         }
+        const target = `${method}\u0000${r.tool ?? ''}`;
+        if (seenTargets.has(target)) {
+            throw new Error(`Rule ${i} duplicates another rule for ${r.tool ? `tool "${r.tool}"` : `method "${method}"`}`);
+        }
+        seenTargets.add(target);
         if (!VALID_ACTIONS.includes(r.action)) {
             throw new Error(`Rule ${i} has invalid action: "${r.action}"`);
         }
-        return { id: r.id, tool: r.tool, action: r.action };
+        if (r.reversibility !== undefined && !VALID_REVERSIBILITY.includes(r.reversibility)) {
+            throw new Error(`Rule ${i} has invalid reversibility: "${r.reversibility}". Must be one of: ${VALID_REVERSIBILITY.join(', ')}`);
+        }
+        for (const numField of ['countdown_seconds', 'cap_usd', 'verify_threshold']) {
+            if (r[numField] !== undefined && (typeof r[numField] !== 'number' || !Number.isFinite(r[numField]) || r[numField] < 0)) {
+                throw new Error(`Rule ${i} has invalid ${numField}: must be a non-negative number`);
+            }
+        }
+        if (r.verify_threshold !== undefined && r.verify_threshold > 100) {
+            throw new Error(`Rule ${i} has invalid verify_threshold: must be 0-100`);
+        }
+        if (r.countdown_seconds !== undefined && r.countdown_seconds > 0 && r.reversibility !== 'reversible') {
+            throw new Error(`Rule ${i}: countdown_seconds requires reversibility: reversible`);
+        }
+        if (r.cap_usd !== undefined && (typeof r.amount_arg !== 'string' || !r.amount_arg)) {
+            throw new Error(`Rule ${i}: cap_usd requires amount_arg (the tool argument holding the amount)`);
+        }
+        if (r.amount_arg !== undefined && r.cap_usd === undefined) {
+            throw new Error(`Rule ${i}: amount_arg is only valid with cap_usd`);
+        }
+        if (r.amount_arg !== undefined && r.amount_arg.startsWith('_pp')) {
+            throw new Error(`Rule ${i}: amount_arg cannot read agent metadata (_pp)`);
+        }
+        return {
+            id: r.id,
+            method,
+            ...(r.tool !== undefined ? { tool: r.tool } : {}),
+            action: r.action,
+            ...(r.reversibility !== undefined ? { reversibility: r.reversibility } : {}),
+            ...(r.countdown_seconds !== undefined ? { countdown_seconds: r.countdown_seconds } : {}),
+            ...(r.cap_usd !== undefined ? { cap_usd: r.cap_usd, amount_arg: r.amount_arg } : {}),
+            ...(r.verify_threshold !== undefined ? { verify_threshold: r.verify_threshold } : {}),
+        };
     });
     return {
         default_action: parsed.default_action,
         mode,
         rules,
+        approval_ttl_seconds: approvalTtl,
+        receipt_ttl_seconds: receiptTtl,
+        policy_sha256: (0, node_crypto_1.createHash)('sha256').update(raw).digest('hex'),
     };
 }
+function positiveInt(v, name, fallback) {
+    if (v === undefined)
+        return fallback;
+    if (typeof v !== 'number' || !Number.isInteger(v) || v <= 0) {
+        throw new Error(`Invalid ${name}: must be a positive integer`);
+    }
+    return v;
+}
 //# sourceMappingURL=config.js.map

package/dist/src/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":";;AAqBA,gCA8CC;AAnED,qCAAuC;AACvC,+BAA6B;AAkB7B,MAAM,aAAa,GAAa,CAAC,OAAO,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC;AAEvE,SAAgB,UAAU,CAAC,UAAkB;IAC3C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,+BAA+B,UAAU,KAAK,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,YAAK,EAAC,GAAG,CAAC,CAAC;IAE1B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,cAAc,sBAAsB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrH,CAAC;IAED,MAAM,WAAW,GAAW,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACnD,MAAM,IAAI,GAAS,MAAM,CAAC,IAAI,IAAI,SAAS,CAAC;IAC5C,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,IAAI,sBAAsB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,KAAK,GAAW,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,CAAS,EAAE,EAAE;QAC3D,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAgB,EAAE,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,cAAwB;QAC/C,IAAI;QACJ,KAAK;KACN,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":";;;AAkDA,gCAQC;AAGD,kCAoGC;AAjKD,6CAAyC;AACzC,qCAAuC;AACvC,+BAA6B;AAoChB,QAAA,4BAA4B,GAAG,GAAG,CAAC;AACnC,QAAA,2BAA2B,GAAG,GAAG,CAAC;AAClC,QAAA,UAAU,GAAG,YAAY,CAAC;AAEvC,MAAM,aAAa,GAAa,CAAC,OAAO,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC;AACvE,MAAM,WAAW,GAAW,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACnD,MAAM,mBAAmB,GAAoB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AAC5E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AACnH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,mBAAmB,EAAE,SAAS,EAAE,YAAY,EAAE,kBAAkB;CACpH,CAAC,CAAC;AAEH,SAAgB,UAAU,CAAC,UAAkB;IAC3C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,+BAA+B,UAAU,KAAK,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,8FAA8F;AAC9F,SAAgB,WAAW,CAAC,GAAW;IACrC,MAAM,MAAM,GAAG,IAAA,YAAK,EAAC,GAAG,CAAC,CAAC;IAE1B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,GAAG,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,cAAc,sBAAsB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrH,CAAC;IAED,MAAM,IAAI,GAAS,MAAM,CAAC,IAAI,IAAI,SAAS,CAAC;IAC5C,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,IAAI,sBAAsB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,oBAAoB,EAAE,sBAAsB,EAAE,oCAA4B,CAAC,CAAC;IACnH,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,mCAA2B,CAAC,CAAC;IAE/G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,KAAK,GAAW,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,CAAS,EAAE,EAAE;QAC3D,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QACpG,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,sBAAsB,GAAG,GAAG,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAElB,MAAM,MAAM,GAAW,CAAC,CAAC,MAAM,IAAI,kBAAU,CAAC;QAC9C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QAC3F,IAAI,MAAM,KAAK,kBAAU,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC;QAC/F,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,4BAA4B,kBAAU,QAAQ,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QAChD,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,WAAW,MAAM,GAAG,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAExB,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC,aAAa,sBAAsB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClI,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,CAAC,mBAAmB,EAAE,SAAS,EAAE,kBAAkB,CAAU,EAAE,CAAC;YACrF,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACvH,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,gBAAgB,QAAQ,iCAAiC,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,CAAC,gBAAgB,GAAG,GAAG,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,8CAA8C,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,CAAC,iBAAiB,KAAK,SAAS,IAAI,CAAC,CAAC,iBAAiB,GAAG,CAAC,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;YACrG,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,wDAAwD,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,sEAAsE,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,yCAAyC,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,+CAA+C,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,MAAM;YACN,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,EAAE,CAAC,CAAC,MAAgB;YAC1B,GAAG,CAAC,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,aAA8B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,CAAC,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,cAAwB;QAC/C,IAAI;QACJ,KAAK;QACL,oBAAoB,EAAE,WAAW;QACjC,mBAAmB,EAAE,UAAU;QAC/B,aAAa,EAAE,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,CAAU,EAAE,IAAY,EAAE,QAAgB;IAC7D,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACrC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,8BAA8B,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/src/enforcement/index.d.ts

@@ -0,0 +1,12 @@
+import { CanonicalPayload, SignedToken } from './types';
+import { loadPolicy, getToolPolicy, ToolPolicy } from './policy';
+import { verifyAuthorization } from './verifier';
+export { CanonicalPayload, SignedToken, ToolPolicy, loadPolicy, getToolPolicy, verifyAuthorization };
+export declare function interceptToolCall(jsonRpcMessage: any, publicKeyPem: string, expectedKeyId?: string): Promise<{
+    allowed: boolean;
+    reason?: string;
+    payload?: CanonicalPayload;
+    token?: SignedToken;
+    policy?: ToolPolicy;
+    policy_hash?: string;
+}>;

package/dist/src/enforcement/index.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyAuthorization = exports.getToolPolicy = exports.loadPolicy = void 0;
+exports.interceptToolCall = interceptToolCall;
+const policy_1 = require("./policy");
+Object.defineProperty(exports, "loadPolicy", { enumerable: true, get: function () { return policy_1.loadPolicy; } });
+Object.defineProperty(exports, "getToolPolicy", { enumerable: true, get: function () { return policy_1.getToolPolicy; } });
+const verifier_1 = require("./verifier");
+Object.defineProperty(exports, "verifyAuthorization", { enumerable: true, get: function () { return verifier_1.verifyAuthorization; } });
+async function interceptToolCall(jsonRpcMessage, publicKeyPem, expectedKeyId = 'pp-prod-1') {
+    if (jsonRpcMessage.method !== 'tools/call') {
+        return { allowed: true };
+    }
+    const toolName = jsonRpcMessage.params?.name;
+    let policy;
+    let policyHash;
+    try {
+        policy = (0, policy_1.getToolPolicy)(toolName);
+        policyHash = (0, policy_1.loadPolicy)().policy_hash;
+    }
+    catch (err) {
+        // No policy means no basis to allow anything.
+        return { allowed: false, reason: err.message };
+    }
+    if (policy?.protected) {
+        const args = jsonRpcMessage.params?.arguments || {};
+        const authorization = args._authorization;
+        if (!authorization) {
+            return { allowed: false, reason: 'Missing _authorization block' };
+        }
+        const payload = authorization.payload;
+        const token = authorization.token;
+        if (!payload || !token) {
+            return { allowed: false, reason: 'Malformed authorization block' };
+        }
+        const { _authorization, ...executionArgs } = args;
+        if (payload.action !== toolName) {
+            return { allowed: false, reason: 'Payload action mismatch' };
+        }
+        if (JSON.stringify(executionArgs) !== JSON.stringify(payload.args)) {
+            return { allowed: false, reason: 'Arguments mismatch' };
+        }
+        try {
+            await (0, verifier_1.verifyAuthorization)(payload, token, publicKeyPem, policy, expectedKeyId);
+            return { allowed: true, payload, token, policy, policy_hash: policyHash };
+        }
+        catch (err) {
+            return { allowed: false, reason: err.message };
+        }
+    }
+    return { allowed: true }; // Unprotected tools pass through
+}
+//# sourceMappingURL=index.js.map

package/dist/src/enforcement/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/enforcement/index.ts"],"names":[],"mappings":";;;AAaA,8CAqDC;AAjED,qCAAiE;AAO/D,2FAPO,mBAAU,OAOP;AACV,8FARmB,sBAAa,OAQnB;AAPf,yCAAiD;AAQ/C,oGARO,8BAAmB,OAQP;AAGd,KAAK,UAAU,iBAAiB,CACrC,cAAmB,EACnB,YAAoB,EACpB,gBAAwB,WAAW;IAEnC,IAAI,cAAc,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC;IAC7C,IAAI,MAAyB,CAAC;IAC9B,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,sBAAa,EAAC,QAAQ,CAAC,CAAC;QACjC,UAAU,GAAG,IAAA,mBAAU,GAAE,CAAC,WAAW,CAAC;IACxC,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,8CAA8C;QAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,MAAM,EAAE,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC;QACpD,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC;QAC1C,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QACpE,CAAC;QAED,MAAM,OAAO,GAAqB,aAAa,CAAC,OAAO,CAAC;QACxD,MAAM,KAAK,GAAgB,aAAa,CAAC,KAAK,CAAC;QAE/C,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;QACrE,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,GAAG,aAAa,EAAE,GAAG,IAAI,CAAC;QAElD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;QAC/D,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAA,8BAAmB,EAAC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;YAC/E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;QAC5E,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,iCAAiC;AAC7D,CAAC"}

package/dist/src/enforcement/policy.d.ts

@@ -0,0 +1,29 @@
+export interface ToolPolicy {
+    protected: boolean;
+    risk?: string;
+    required_authorization?: string;
+    allowed_signers?: string[];
+    allowed_roles?: string[];
+    required_approvals?: number;
+    conditions?: Array<{
+        field: string;
+        equals: any;
+    }>;
+    max_ttl_seconds?: number;
+}
+export interface PPConfig {
+    tools: Record<string, ToolPolicy>;
+    policy_hash?: string;
+}
+/**
+ * A policy that cannot be loaded is an error, never "no tool is protected".
+ * Callers treat it as a denial.
+ */
+export declare class PolicyError extends Error {
+    readonly code: 'PP_POLICY_MISSING' | 'PP_POLICY_INVALID';
+    constructor(code: 'PP_POLICY_MISSING' | 'PP_POLICY_INVALID', message: string);
+}
+export declare function loadPolicy(configPathArg?: string): PPConfig;
+/** Test helper: forget the cached policy. */
+export declare function _resetPolicyCache(): void;
+export declare function getToolPolicy(toolName: string): ToolPolicy | null;

package/dist/src/enforcement/policy.js

@@ -0,0 +1,60 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyError = void 0;
+exports.loadPolicy = loadPolicy;
+exports._resetPolicyCache = _resetPolicyCache;
+exports.getToolPolicy = getToolPolicy;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const yaml_1 = require("yaml");
+/**
+ * A policy that cannot be loaded is an error, never "no tool is protected".
+ * Callers treat it as a denial.
+ */
+class PolicyError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+exports.PolicyError = PolicyError;
+let cachedConfig = null;
+function loadPolicy(configPathArg) {
+    if (cachedConfig && !configPathArg)
+        return cachedConfig;
+    const configPath = configPathArg || process.env.PP_CONFIG_PATH || path_1.default.join(process.cwd(), 'pp.config.yaml');
+    if (!fs_1.default.existsSync(configPath)) {
+        throw new PolicyError('PP_POLICY_MISSING', `Policy file not found: ${configPath}`);
+    }
+    const fileContents = fs_1.default.readFileSync(configPath, 'utf8');
+    let parsed;
+    try {
+        parsed = (0, yaml_1.parse)(fileContents);
+    }
+    catch (err) {
+        throw new PolicyError('PP_POLICY_INVALID', `Policy file is not valid YAML: ${configPath} (${err.message})`);
+    }
+    const tools = parsed?.tools;
+    if (!tools || typeof tools !== 'object' || Array.isArray(tools)) {
+        throw new PolicyError('PP_POLICY_INVALID', `Policy file has no "tools" map: ${configPath}`);
+    }
+    cachedConfig = {
+        tools,
+        policy_hash: crypto_1.default.createHash('sha256').update(fileContents).digest('hex').substring(0, 12),
+    };
+    return cachedConfig;
+}
+/** Test helper: forget the cached policy. */
+function _resetPolicyCache() {
+    cachedConfig = null;
+}
+function getToolPolicy(toolName) {
+    const config = loadPolicy();
+    return config.tools[toolName] || null;
+}
+//# sourceMappingURL=policy.js.map

package/dist/src/enforcement/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/enforcement/policy.ts"],"names":[],"mappings":";;;;;;AAiCA,gCAyBC;AAGD,8CAEC;AAED,sCAGC;AApED,oDAA4B;AAC5B,4CAAoB;AACpB,gDAAwB;AACxB,+BAA6B;AAkB7B;;;GAGG;AACH,MAAa,WAAY,SAAQ,KAAK;IACf;IAArB,YAAqB,IAA+C,EAAE,OAAe;QACnF,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,SAAI,GAAJ,IAAI,CAA2C;IAEpE,CAAC;CACF;AAJD,kCAIC;AAED,IAAI,YAAY,GAAoB,IAAI,CAAC;AAEzC,SAAgB,UAAU,CAAC,aAAsB;IAC/C,IAAI,YAAY,IAAI,CAAC,aAAa;QAAE,OAAO,YAAY,CAAC;IAExD,MAAM,UAAU,GAAG,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAC7G,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE,0BAA0B,UAAU,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,YAAY,GAAG,YAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,YAAK,EAAC,YAAY,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE,kCAAkC,UAAU,KAAM,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,KAAK,GAAI,MAA0B,EAAE,KAAK,CAAC;IACjD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE,mCAAmC,UAAU,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,YAAY,GAAG;QACb,KAAK;QACL,WAAW,EAAE,gBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC;KAC7F,CAAC;IACF,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,6CAA6C;AAC7C,SAAgB,iBAAiB;IAC/B,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED,SAAgB,aAAa,CAAC,QAAgB;IAC5C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,OAAO,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;AACxC,CAAC"}

package/dist/src/enforcement/types.d.ts

@@ -0,0 +1,19 @@
+export interface CanonicalPayload {
+    request_id: string;
+    action: string;
+    args: Record<string, any>;
+    issued_at: number;
+    expires_at: number;
+    nonce: string;
+}
+export interface SignedToken {
+    request_id: string;
+    decision: string;
+    payload_hash: string;
+    signers: string[];
+    roles: string[];
+    signed_at: number;
+    expires_at: number;
+    key_id: string;
+    signature: string;
+}

package/dist/src/enforcement/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/src/enforcement/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/enforcement/types.ts"],"names":[],"mappings":""}

package/dist/src/enforcement/verifier.d.ts

@@ -0,0 +1,4 @@
+import { CanonicalPayload, SignedToken } from './types';
+import { ToolPolicy } from './policy';
+export declare function buildAuthorizationSigningBytes(token: SignedToken): string;
+export declare function verifyAuthorization(payload: CanonicalPayload, token: SignedToken, publicKeyPem: string, policy: ToolPolicy, expectedKeyId?: string): Promise<boolean>;

package/dist/src/enforcement/verifier.js

@@ -0,0 +1,110 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildAuthorizationSigningBytes = buildAuthorizationSigningBytes;
+exports.verifyAuthorization = verifyAuthorization;
+const fast_json_stable_stringify_1 = __importDefault(require("fast-json-stable-stringify"));
+const crypto_1 = __importDefault(require("crypto"));
+const verify_core_js_1 = require("../verify-core.js");
+// In-memory replay cache: each authorization is honored once per process.
+const usedNonces = new verify_core_js_1.ReplayCache();
+function buildAuthorizationSigningBytes(token) {
+    return (0, fast_json_stable_stringify_1.default)({
+        request_id: token.request_id,
+        decision: token.decision,
+        payload_hash: token.payload_hash,
+        signers: token.signers,
+        roles: token.roles,
+        signed_at: token.signed_at,
+        expires_at: token.expires_at,
+        key_id: token.key_id,
+    });
+}
+async function verifyAuthorization(payload, token, publicKeyPem, policy, expectedKeyId = 'pp-prod-1') {
+    // 0. Schema Validation (Fail fast)
+    if (!payload || typeof payload !== 'object') {
+        throw new Error('Missing or invalid payload block');
+    }
+    if (!payload.request_id || !payload.action || !payload.args || !payload.issued_at || !payload.expires_at || !payload.nonce) {
+        throw new Error('Malformed payload schema: missing required fields');
+    }
+    if (!token || typeof token !== 'object') {
+        throw new Error('Missing or invalid token block');
+    }
+    if (!token.request_id || !token.decision || !token.payload_hash || !token.signers || !token.roles || !token.signed_at || !token.expires_at || !token.key_id || !token.signature) {
+        throw new Error('Malformed token schema: missing required fields');
+    }
+    if (token.request_id !== payload.request_id) {
+        throw new Error('Request ID mismatch - token does not authorize this payload');
+    }
+    // Trust boundary: Check key identity
+    if (token.key_id !== expectedKeyId) {
+        throw new Error(`Untrusted key_id: expected ${expectedKeyId}, got ${token.key_id}`);
+    }
+    // 1. Check Expiry
+    const now = Math.floor(Date.now() / 1000);
+    if (token.expires_at < now) {
+        throw new Error('Authorization token expired');
+    }
+    if (payload.expires_at < now) {
+        throw new Error('Payload expired');
+    }
+    // 2. Enforce Decision
+    if (token.decision !== 'approved') {
+        throw new Error(`Invalid decision: ${token.decision}`);
+    }
+    // 3. Stable Stringify & Hash
+    const canonicalString = (0, fast_json_stable_stringify_1.default)(payload);
+    const recomputedHash = crypto_1.default.createHash('sha256').update(canonicalString).digest('hex');
+    // 4. Compare Hashes (Exact Binding)
+    if (recomputedHash !== token.payload_hash.replace('sha256:', '')) {
+        throw new Error('Payload hash mismatch - args were modified after approval');
+    }
+    // 5. Verify Signature (shared core: pinned key for the expected key id only)
+    const sigError = (0, verify_core_js_1.verifyDetached)(buildAuthorizationSigningBytes(token), token.signature, token.key_id, { [expectedKeyId]: publicKeyPem });
+    if (sigError) {
+        throw new Error(`Cryptographic signature verification failed: ${sigError}`);
+    }
+    // 6. Policy Enforcement (The Authority Plane)
+    // A. Multi-Sig & Role-Based Auth
+    const requiredApprovals = policy.required_approvals || 1;
+    let validSignatures = 0;
+    // Each distinct signer counts once: a repeated name is not a second approval.
+    for (const signer of new Set(token.signers)) {
+        const isAllowedSigner = policy.allowed_signers ? policy.allowed_signers.includes(signer) : true;
+        const hasAllowedRole = policy.allowed_roles ? token.roles.some(r => policy.allowed_roles.includes(r)) : true;
+        if (isAllowedSigner && hasAllowedRole) {
+            validSignatures++;
+        }
+    }
+    if (validSignatures < requiredApprovals) {
+        throw new Error(`Policy violation: Requires ${requiredApprovals} valid approvals, found ${validSignatures}. Evaluated signers: ${token.signers.join(', ')}`);
+    }
+    // B. Basic Conditions
+    if (policy.conditions) {
+        for (const cond of policy.conditions) {
+            const keys = cond.field.split('.');
+            let val = payload;
+            for (const k of keys) {
+                val = val?.[k];
+            }
+            if (val !== cond.equals) {
+                throw new Error(`Policy violation: Condition '${cond.field} == ${cond.equals}' failed (got '${val}')`);
+            }
+        }
+    }
+    if (policy.max_ttl_seconds) {
+        const ttl = token.expires_at - token.signed_at;
+        if (ttl > policy.max_ttl_seconds) {
+            throw new Error(`Policy violation: Token TTL (${ttl}s) exceeds policy max_ttl_seconds (${policy.max_ttl_seconds}s)`);
+        }
+    }
+    // 7. Replay Protection (Single-use)
+    if (!usedNonces.use(`${payload.request_id}:${payload.nonce}`)) {
+        throw new Error('Replay detected - authorization has already been used');
+    }
+    return true;
+}
+//# sourceMappingURL=verifier.js.map

package/dist/src/enforcement/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../src/enforcement/verifier.ts"],"names":[],"mappings":";;;;;AASA,wEAWC;AAED,kDA+GC;AArID,4FAAyD;AACzD,oDAA4B;AAG5B,sDAAgE;AAEhE,0EAA0E;AAC1E,MAAM,UAAU,GAAG,IAAI,4BAAW,EAAE,CAAC;AAErC,SAAgB,8BAA8B,CAAC,KAAkB;IAC/D,OAAO,IAAA,oCAAe,EAAC;QACrB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,mBAAmB,CACvC,OAAyB,EACzB,KAAkB,EAClB,YAAoB,EACpB,MAAkB,EAClB,gBAAwB,WAAW;IAEnC,mCAAmC;IACnC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC3H,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAChL,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,qCAAqC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,8BAA8B,aAAa,SAAS,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IAED,sBAAsB;IACtB,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,6BAA6B;IAC7B,MAAM,eAAe,GAAG,IAAA,oCAAe,EAAC,OAAO,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,gBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEzF,oCAAoC;IACpC,IAAI,cAAc,KAAK,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,IAAA,+BAAc,EAC7B,8BAA8B,CAAC,KAAK,CAAC,EACrC,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,MAAM,EACZ,EAAE,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,CAClC,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,gDAAgD,QAAQ,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,8CAA8C;IAE9C,iCAAiC;IACjC,MAAM,iBAAiB,GAAG,MAAM,CAAC,kBAAkB,IAAI,CAAC,CAAC;IACzD,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,8EAA8E;IAC9E,KAAK,MAAM,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChG,MAAM,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,aAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAE9G,IAAI,eAAe,IAAI,cAAc,EAAE,CAAC;YACtC,eAAe,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAED,IAAI,eAAe,GAAG,iBAAiB,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,8BAA8B,iBAAiB,2BAA2B,eAAe,wBAAwB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/J,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,GAAG,GAAQ,OAAO,CAAC;YACvB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;YACD,IAAI,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC,CAAC;YACzG,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QAC/C,IAAI,GAAG,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,sCAAsC,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC;QACvH,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/engine.d.ts

@@ -1,7 +1,16 @@
-import type { Config } from './config.js';
+import { type Config, type Reversibility } from './config.js';
+export type Lane = 'decide' | 'unblock' | 'verify';
 export interface Decision {
     decision: 'allowed' | 'blocked' | 'held_for_approval';
     rule_id: string | null;
     reason: string;
+    lane?: Lane;
+    reversibility?: Reversibility;
+    countdown_seconds?: number;
+    confidence?: number;
 }
-export declare function evaluate(toolName: string, _toolArgs: Record<string, unknown> | undefined, config: Config): Decision;
+/**
+ * Decide a gated request. `toolName` is the tool for `tools/call` and null for other
+ * methods; rules match on method plus (for tools/call) the exact tool name.
+ */
+export declare function evaluate(toolName: string | null, toolArgs: Record<string, unknown> | undefined, config: Config, method?: string): Decision;

package/dist/src/engine.js

@@ -1,25 +1,31 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.evaluate = evaluate;
+const config_js_1 = require("./config.js");
+const classify_js_1 = require("./classify.js");
 const ACTION_TO_DECISION = {
     allow: 'allowed',
     block: 'blocked',
     require_approval: 'held_for_approval',
 };
-function evaluate(toolName, _toolArgs, config) {
-    for (const rule of config.rules) {
-        if (rule.tool === toolName) {
-            return {
-                decision: ACTION_TO_DECISION[rule.action],
-                rule_id: rule.id,
-                reason: `Matched rule "${rule.id}"`,
-            };
+/**
+ * Decide a gated request. `toolName` is the tool for `tools/call` and null for other
+ * methods; rules match on method plus (for tools/call) the exact tool name.
+ */
+function evaluate(toolName, toolArgs, config, method = config_js_1.TOOLS_CALL) {
+    const matched = config.rules.find((rule) => (rule.method ?? config_js_1.TOOLS_CALL) === method && (method !== config_js_1.TOOLS_CALL || rule.tool === toolName)) ?? null;
+    const base = matched
+        ? {
+            decision: ACTION_TO_DECISION[matched.action],
+            rule_id: matched.id,
+            reason: `Matched rule "${matched.id}"`,
         }
-    }
-    return {
-        decision: ACTION_TO_DECISION[config.default_action],
-        rule_id: null,
-        reason: `No matching rule; default action "${config.default_action}"`,
-    };
+        : {
+            decision: ACTION_TO_DECISION[config.default_action],
+            rule_id: null,
+            reason: `No matching rule; default action "${config.default_action}"`,
+        };
+    // Enrich with reversibility/confidence lane routing (Permission Deck).
+    return (0, classify_js_1.classify)(base, matched, (0, classify_js_1.extractMeta)(toolArgs), toolArgs);
 }
 //# sourceMappingURL=engine.js.map

package/dist/src/engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/engine.ts"],"names":[],"mappings":";;AAcA,4BAgBC;AAtBD,MAAM,kBAAkB,GAAG;IACzB,KAAK,EAAE,SAAS;IAChB,KAAK,EAAE,SAAS;IAChB,gBAAgB,EAAE,mBAAmB;CAC7B,CAAC;AAEX,SAAgB,QAAQ,CAAC,QAAgB,EAAE,SAA8C,EAAE,MAAc;IACvG,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,OAAO;gBACL,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;gBACzC,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,MAAM,EAAE,iBAAiB,IAAI,CAAC,EAAE,GAAG;aACpC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC;QACnD,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,qCAAqC,MAAM,CAAC,cAAc,GAAG;KACtE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/engine.ts"],"names":[],"mappings":";;AA2BA,4BAuBC;AAlDD,2CAAqF;AACrF,+CAAsD;AAgBtD,MAAM,kBAAkB,GAAG;IACzB,KAAK,EAAE,SAAS;IAChB,KAAK,EAAE,SAAS;IAChB,gBAAgB,EAAE,mBAAmB;CAC7B,CAAC;AAEX;;;GAGG;AACH,SAAgB,QAAQ,CACtB,QAAuB,EACvB,QAA6C,EAC7C,MAAc,EACd,SAAiB,sBAAU;IAE3B,MAAM,OAAO,GACX,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,sBAAU,CAAC,KAAK,MAAM,IAAI,CAAC,MAAM,KAAK,sBAAU,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IAEnI,MAAM,IAAI,GAAa,OAAO;QAC5B,CAAC,CAAC;YACE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5C,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,MAAM,EAAE,iBAAiB,OAAO,CAAC,EAAE,GAAG;SACvC;QACH,CAAC,CAAC;YACE,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC;YACnD,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,qCAAqC,MAAM,CAAC,cAAc,GAAG;SACtE,CAAC;IAEN,uEAAuE;IACvE,OAAO,IAAA,sBAAQ,EAAC,IAAI,EAAE,OAAO,EAAE,IAAA,yBAAW,EAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAClE,CAAC"}

package/dist/src/frame.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Inbound JSON-RPC framing for the stdio proxy.
+ *
+ * The guard only ever forwards a message it parsed and evaluated, re-serialized from
+ * the parsed object, so the server cannot read a line differently than the guard did.
+ * Anything that is not a single well-formed JSON-RPC 2.0 object is answered with an
+ * error and never forwarded. MCP does not use JSON-RPC batching, so arrays are refused.
+ */
+export type JsonRpcId = string | number | null;
+export interface JsonRpcMessage {
+    jsonrpc: '2.0';
+    id?: JsonRpcId;
+    method?: string;
+    params?: unknown;
+    result?: unknown;
+    error?: unknown;
+}
+export type Frame = {
+    kind: 'request';
+    msg: JsonRpcMessage & {
+        method: string;
+        id: JsonRpcId;
+    };
+} | {
+    kind: 'notification';
+    msg: JsonRpcMessage & {
+        method: string;
+    };
+} | {
+    kind: 'response';
+    msg: JsonRpcMessage;
+} | {
+    kind: 'invalid';
+    id: JsonRpcId;
+    code: number;
+    message: string;
+};
+export declare const PARSE_ERROR = -32700;
+export declare const INVALID_REQUEST = -32600;
+export declare const METHOD_NOT_FOUND = -32601;
+export declare const INVALID_PARAMS = -32602;
+export declare const BLOCKED = -32001;
+export declare const HELD = -32002;
+export declare const DENIED = -32003;
+export declare const EXPIRED = -32004;
+export declare const RELEASE_FAILED = -32005;
+/**
+ * Methods that carry no action or data access of their own. Everything else — tools/call,
+ * resources/read, prompts/get, resources/subscribe and any method the guard does not
+ * know — goes through the policy.
+ */
+export declare const PASSTHROUGH_METHODS: Set<string>;
+export declare function isPassthrough(method: string): boolean;
+export declare function parseFrame(line: string): Frame;
+export declare function errorLine(id: JsonRpcId, code: number, message: string): string;
+/**
+ * The tools/call target and arguments, validated. Returns an error message when the
+ * params are malformed (the call is then refused, never forwarded).
+ */
+export declare function toolCallTarget(params: unknown): {
+    name: string;
+    args: Record<string, unknown> | undefined;
+} | {
+    error: string;
+};
+/** A copy of the message with Permission Deck agent metadata (`_pp`) removed from tool arguments. */
+export declare function stripAgentMetadata(msg: JsonRpcMessage): JsonRpcMessage;