@praxis.guard/auditor-cli 0.0.45 → 0.0.47

package/dist/codex/evaluate-tool.js

@@ -1,171 +1,7 @@
-import { appendAuditJsonl } from "../audit/jsonl.js";
-import { toolInputSha256 } from "../approval/fingerprint.js";
 import { resolveGuardStorageRoot } from "../bridge/guard-storage-root.js";
-import { formatHookDenyMessages } from "../hooks/agent-message.js";
-import { resolveMutateHookPermission } from "../hooks/before-mcp-mutate.js";
-import { resolveShellMutateHookPermission } from "../hooks/before-shell-mutate.js";
-import { loadPoliciesV1, readPoliciesV1Revision } from "../policy/index.js";
-import { analyzeShellCommand } from "../shell/analyze-command.js";
-import { commandMayContainGovernedTool } from "../shell/governed-tools.js";
-import { evaluateMcpProposal } from "../shell/evaluate.js";
-import { sendGuardEvent } from "../telemetry/guard-events.js";
-import { recordCodexPermissionHandoff } from "./permission-handoff.js";
-export function parseCodexMcpToolName(toolName) {
-    if (!toolName.startsWith("mcp__"))
-        return null;
-    const parts = toolName.slice("mcp__".length).split("__");
-    if (parts.length < 2)
-        return null;
-    return { server: parts.slice(0, -1).join("__") || "stdio", tool: parts.at(-1) || "_" };
-}
-export function isPraxisGuardTool(toolName) {
-    const identity = parseCodexMcpToolName(toolName);
-    if (!identity || (identity.tool !== "guard" && identity.tool !== "guard_wait"))
-        return false;
-    return /^praxis(?:-|_)guard$/i.test(identity.server);
-}
-function codexReason(input) {
-    const formatted = formatHookDenyMessages({
-        hook: input.kind === "shell" ? "beforeShellExecution" : "beforeMCPExecution",
-        tier: input.tier,
-        argv: input.argv,
-        reasons: input.reasons,
-        toolName: input.toolName,
-        inlineApproval: input.inlineApproval,
-    });
-    return formatted.agent_message;
-}
-async function auditAndSend(input) {
-    const event = {
-        ts: new Date().toISOString(),
-        hook: "codexPreToolUse",
-        agent: "codex-app",
-        tool_name: input.payload.tool_name,
-        tool_input: input.payload.tool_input,
-        argv: input.argv,
-        tier: input.tier,
-        decision: input.allowed ? "allow" : "block",
-        governed: input.governed,
-        ticketConsumed: input.ticketConsumed,
-        reasons: input.reasons,
-        latency_ms: input.latencyMs,
-    };
-    await appendAuditJsonl(event, input.storageRoot).catch((error) => {
-        process.stderr.write(`[auditor] audit log append failed: ${String(error)}\n`);
-    });
-    await sendGuardEvent({
-        ...event,
-        status: input.allowed ? "passed" : "blocked",
-        tool: input.kind === "shell" ? "auditor-hook" : "auditor-hook-mcp",
-        command_path: input.argv[0] ?? null,
-        verb: input.argv[1] ?? null,
-        resource: input.argv.slice(2).join(" ") || null,
-        kind: input.kind,
-        ...(input.policyRevision !== null ? { policy_revision: input.policyRevision } : {}),
-    });
-}
-function shellReasons(analysis) {
-    const reasons = [];
-    if (!analysis.primary.evaluation.classification.matched)
-        reasons.push("unknown_command(default_deny)");
-    if (analysis.primary.evaluation.flags.metacharacters || analysis.raw_metacharacters)
-        reasons.push("metacharacters");
-    if (analysis.primary.evaluation.flags.dangerous_flags)
-        reasons.push("dangerous_flags");
-    if (analysis.fail_closed)
-        reasons.push("unparseable(fail_closed)");
-    if (analysis.invocations.length > 1)
-        reasons.push(`multiple_governed_invocations(${analysis.invocations.length})`);
-    return reasons;
-}
-async function evaluateBash(payload, started) {
-    const command = payload.tool_input && typeof payload.tool_input === "object"
-        ? payload.tool_input.command
-        : undefined;
-    const rawCommand = typeof command === "string" ? command : "";
-    const storageRoot = resolveGuardStorageRoot(payload.cwd);
-    if (!rawCommand || !commandMayContainGovernedTool(rawCommand)) {
-        return { governed: false, allowed: true, tier: "READ", argv: [], storageRoot };
-    }
-    const [policy, policyRevision] = await Promise.all([loadPoliciesV1(), readPoliciesV1Revision()]);
-    const analysis = analyzeShellCommand(rawCommand, policy);
-    if (analysis.skipped) {
-        return { governed: false, allowed: true, tier: "READ", argv: [], storageRoot };
-    }
-    const argv = analysis.primary.canonical_argv;
-    const tier = analysis.tier;
-    const reasons = shellReasons(analysis);
-    let allowed = tier === "READ";
-    let ticketConsumed = false;
-    let inlineApproval = null;
-    if (tier === "MUTATE") {
-        const mutate = await resolveShellMutateHookPermission({
-            tier,
-            argv,
-            analysis,
-            storageRoot,
-            rawDisplay: rawCommand,
-            policyRevision,
-            initialReasons: reasons,
-        });
-        allowed = mutate.permission === "allow";
-        ticketConsumed = mutate.ticketConsumed;
-        inlineApproval = mutate.inlineApproval;
-        reasons.splice(0, reasons.length, ...mutate.reasons);
-    }
-    if (ticketConsumed) {
-        await recordCodexPermissionHandoff({ storageRoot, argv, turnId: payload.turn_id });
-    }
-    const reason = allowed ? undefined : codexReason({ kind: "shell", tier, argv, reasons, inlineApproval });
-    await auditAndSend({ payload, kind: "shell", tier, argv, allowed, governed: true, ticketConsumed, reasons, policyRevision, storageRoot, latencyMs: performance.now() - started });
-    return { governed: true, allowed, tier, argv, reason, storageRoot };
-}
-async function evaluateMcp(payload, started) {
-    const toolName = payload.tool_name ?? "";
-    const identity = parseCodexMcpToolName(toolName);
-    const storageRoot = resolveGuardStorageRoot(payload.cwd);
-    if (!identity || isPraxisGuardTool(toolName)) {
-        return { governed: false, allowed: true, tier: "READ", argv: [], storageRoot };
-    }
-    const argv = ["mcp", identity.server, identity.tool];
-    const [policy, policyRevision] = await Promise.all([loadPoliciesV1(), readPoliciesV1Revision()]);
-    const { skipped, evaluation } = evaluateMcpProposal(policy, argv);
-    if (skipped)
-        return { governed: false, allowed: true, tier: "READ", argv, storageRoot };
-    const tier = evaluation.tier;
-    const reasons = evaluation.reasons.map((reason) => reason.message);
-    const toolInputHash = toolInputSha256(payload.tool_input);
-    let allowed = tier === "READ";
-    let ticketConsumed = false;
-    let inlineApproval = null;
-    if (tier === "MUTATE") {
-        const mutate = await resolveMutateHookPermission({
-            argv,
-            tier,
-            storageRoot,
-            toolInputHash,
-            rawToolName: toolName,
-            toolInputPreview: JSON.stringify(payload.tool_input ?? {}).slice(0, 200),
-            policyRevision,
-            initialReasons: reasons,
-        });
-        allowed = mutate.permission === "allow";
-        ticketConsumed = mutate.ticketConsumed;
-        inlineApproval = mutate.inlineApproval;
-        reasons.splice(0, reasons.length, ...mutate.reasons);
-    }
-    if (ticketConsumed) {
-        await recordCodexPermissionHandoff({
-            storageRoot,
-            argv,
-            toolInputHash,
-            turnId: payload.turn_id,
-        });
-    }
-    const reason = allowed ? undefined : codexReason({ kind: "mcp", tier, argv, reasons, toolName, inlineApproval });
-    await auditAndSend({ payload, kind: "mcp", tier, argv, allowed, governed: true, ticketConsumed, reasons, policyRevision, storageRoot, latencyMs: performance.now() - started });
-    return { governed: true, allowed, tier, argv, reason, storageRoot, toolInputHash };
-}
+import { evaluateBash } from "./evaluate-tool-bash.js";
+import { evaluateMcp } from "./evaluate-tool-mcp.js";
+export { isPraxisGuardTool, parseCodexMcpToolName } from "./evaluate-tool-types.js";
 export async function evaluateCodexTool(payload) {
     const started = performance.now();
     if (payload.tool_name === "Bash")

package/dist/codex/evaluate-tool.js.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate-tool.js","sourceRoot":"","sources":["../../src/codex/evaluate-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAa,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAwBvE,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7F,OAAO,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,KAOpB;IACC,MAAM,SAAS,GAAG,sBAAsB,CAAC;QACvC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,oBAAoB;QAC5E,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,aAAa,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAY3B;IACC,MAAM,KAAK,GAAG;QACZ,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,WAAW;QAClB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;QACpC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;QAC3C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,SAAS;KAC5B,CAAC;IACF,MAAM,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IACH,MAAM,cAAc,CAAC;QACnB,GAAG,KAAK;QACR,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QAC5C,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,kBAAkB;QAClE,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QACnC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QAC3B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI;QAC/C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,QAAuB;IAC3C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACvG,IAAI,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,cAAc,IAAI,QAAQ,CAAC,kBAAkB;QAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpH,IAAI,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,eAAe;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACvF,IAAI,QAAQ,CAAC,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,iCAAiC,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;IACnH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAyB,EAAE,OAAe;IACpE,MAAM,OAAO,GACX,OAAO,CAAC,UAAU,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ;QAC1D,CAAC,CAAE,OAAO,CAAC,UAAoC,CAAC,OAAO;QACvD,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,UAAU,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,UAAU,IAAI,CAAC,6BAA6B,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;IACjF,CAAC;IAED,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAG,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;IACjF,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAEvC,IAAI,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC;IAC9B,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,cAAc,GAAoD,IAAI,CAAC;IAC3E,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,gCAAgC,CAAC;YACpD,IAAI;YACJ,IAAI;YACJ,QAAQ;YACR,WAAW;YACX,UAAU,EAAE,UAAU;YACtB,cAAc;YACd,cAAc,EAAE,OAAO;SACxB,CAAC,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC;QACxC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QACvC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QACvC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,4BAA4B,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IACzG,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAClL,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAyB,EAAE,OAAe;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;IACjG,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClE,IAAI,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAExF,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC7B,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC;IAC9B,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,cAAc,GAAoD,IAAI,CAAC;IAC3E,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC;YAC/C,IAAI;YACJ,IAAI;YACJ,WAAW;YACX,aAAa;YACb,WAAW,EAAE,QAAQ;YACrB,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACxE,cAAc;YACd,cAAc,EAAE,OAAO;SACxB,CAAC,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC;QACxC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QACvC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QACvC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,4BAA4B,CAAC;YACjC,WAAW;YACX,IAAI;YACJ,aAAa;YACb,MAAM,EAAE,OAAO,CAAC,OAAO;SACxB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;IACjH,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAChL,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAyB;IAC/D,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAClC,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM;QAAE,OAAO,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjF,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,EAAE;QACR,WAAW,EAAE,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC;KAClD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"evaluate-tool.js","sourceRoot":"","sources":["../../src/codex/evaluate-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAIrD,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEpF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAyB;IAC/D,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAClC,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM;QAAE,OAAO,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjF,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,EAAE;QACR,WAAW,EAAE,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC;KAClD,CAAC;AACJ,CAAC"}

package/dist/policy/classify.d.ts

@@ -0,0 +1,9 @@
+import type { Classification, PoliciesV1 } from "./schema.js";
+export declare function classifyArgv(policy: PoliciesV1, argv: readonly string[]): {
+    classification: Classification;
+    flags: {
+        metacharacters: boolean;
+        dangerous_flags: boolean;
+    };
+};
+//# sourceMappingURL=classify.d.ts.map

package/dist/policy/classify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../src/policy/classify.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAQ,MAAM,aAAa,CAAC;AA0BpE,wBAAgB,YAAY,CAC1B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB;IAAE,cAAc,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE;QAAE,cAAc,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAoFlG"}

package/dist/policy/classify.js

@@ -0,0 +1,97 @@
+function hasMetacharacters(argv) {
+    const bad = [";", "&&", "||", "|", "`", "$(", ">", "<"];
+    return argv.some((t) => bad.some((b) => t.includes(b)));
+}
+function hasDangerousFlags(argv, dangerousFlags) {
+    const s = new Set(dangerousFlags);
+    return argv.some((t) => s.has(t));
+}
+function tryMultiTokenVerb(verbsToTiers, rest, verbIndex, verb1) {
+    if (!verb1)
+        return verb1;
+    const verb2 = rest[verbIndex + 1];
+    if (!verb2)
+        return verb1;
+    const combined = `${verb1} ${verb2}`;
+    if (verbsToTiers[combined])
+        return combined;
+    return verb1;
+}
+export function classifyArgv(policy, argv) {
+    const tool = argv[0] ?? null;
+    const metacharacters = hasMetacharacters(argv);
+    const dangerous_flags = hasDangerousFlags(argv, policy.dangerous_flags);
+    if (!tool || !policy.policies[tool]) {
+        return {
+            classification: { tool, command_path: null, verb: null, tier: "MUTATE", matched: false },
+            flags: { metacharacters, dangerous_flags },
+        };
+    }
+    const rest = argv.slice(1);
+    const toolTable = policy.policies[tool];
+    if (rest.length === 0) {
+        const root = toolTable["__root__"];
+        const tier = root?.["__default__"];
+        if (tier) {
+            return {
+                classification: { tool, command_path: "__root__", verb: null, tier, matched: true },
+                flags: { metacharacters, dangerous_flags },
+            };
+        }
+    }
+    if (rest.length > 0 && toolTable["__root__"]) {
+        const root = toolTable["__root__"];
+        const verb = rest[0] ?? null;
+        let tier;
+        if (verb) {
+            tier = root[verb];
+            if (tier === undefined)
+                tier = root["*"];
+        }
+        else {
+            tier = root["__default__"];
+        }
+        if (tier !== undefined) {
+            return {
+                classification: { tool, command_path: "__root__", verb, tier, matched: true },
+                flags: { metacharacters, dangerous_flags },
+            };
+        }
+    }
+    const pathKeys = Object.keys(toolTable).sort((a, b) => b.split(" ").length - a.split(" ").length);
+    for (const pathKey of pathKeys) {
+        const k = pathKey.split(" ");
+        const prefix = rest.slice(0, k.length);
+        const matches = k.length > 0 && prefix.length === k.length && prefix.every((t, i) => t === k[i]);
+        if (!matches)
+            continue;
+        const verbIndex = k.length;
+        const verb1 = rest[verbIndex] ?? null;
+        const verbsToTiers = toolTable[pathKey] ?? {};
+        const verb = tryMultiTokenVerb(verbsToTiers, rest, verbIndex, verb1);
+        let tier;
+        if (verb) {
+            tier = verbsToTiers[verb];
+            if (tier === undefined)
+                tier = verbsToTiers["*"];
+        }
+        else {
+            tier = verbsToTiers["__default__"];
+        }
+        if (tier === undefined) {
+            return {
+                classification: { tool, command_path: pathKey, verb, tier: "MUTATE", matched: false },
+                flags: { metacharacters, dangerous_flags },
+            };
+        }
+        return {
+            classification: { tool, command_path: pathKey, verb, tier, matched: true },
+            flags: { metacharacters, dangerous_flags },
+        };
+    }
+    return {
+        classification: { tool, command_path: rest[0] ?? null, verb: rest[1] ?? null, tier: "MUTATE", matched: false },
+        flags: { metacharacters, dangerous_flags },
+    };
+}
+//# sourceMappingURL=classify.js.map

package/dist/policy/classify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.js","sourceRoot":"","sources":["../../src/policy/classify.ts"],"names":[],"mappings":"AAEA,SAAS,iBAAiB,CAAC,IAAuB;IAChD,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAuB,EAAE,cAAiC;IACnF,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,iBAAiB,CACxB,YAAkC,EAClC,IAAuB,EACvB,SAAiB,EACjB,KAAoB;IAEpB,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC;IACrC,IAAI,YAAY,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,MAAkB,EAClB,IAAuB;IAEvB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC7B,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,eAAe,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAExE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;YACxF,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,SAAS,GAAyC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAG3E,CAAC;IAEF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,aAAa,CAAC,CAAC;QACnC,IAAI,IAAI,EAAE,CAAC;YACT,OAAO;gBACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;gBACnF,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;aAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC7B,IAAI,IAAsB,CAAC;QAC3B,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,IAAI,IAAI,KAAK,SAAS;gBAAE,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO;gBACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;gBAC7E,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;aAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAClG,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjG,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;QACtC,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,IAAK,EAA2B,CAAC;QACxE,MAAM,IAAI,GAAG,iBAAiB,CAAC,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAErE,IAAI,IAAsB,CAAC;QAC3B,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,IAAI,KAAK,SAAS;gBAAE,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO;gBACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;gBACrF,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;aAC3C,CAAC;QACJ,CAAC;QAED,OAAO;YACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;YAC1E,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QAC9G,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;KAC3C,CAAC;AACJ,CAAC"}

package/dist/policy/index.d.ts

@@ -1,55 +1,6 @@
-import { z } from "zod";
-export declare const TierSchema: z.ZodEnum<{
-    READ: "READ";
-    MUTATE: "MUTATE";
-    DESTRUCTIVE: "DESTRUCTIVE";
-}>;
-export type Tier = z.infer<typeof TierSchema>;
-export declare const PoliciesV1Schema: z.ZodObject<{
-    tiers: z.ZodArray<z.ZodEnum<{
-        READ: "READ";
-        MUTATE: "MUTATE";
-        DESTRUCTIVE: "DESTRUCTIVE";
-    }>>;
-    dangerous_flags: z.ZodArray<z.ZodString>;
-    policies: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodEnum<{
-        READ: "READ";
-        MUTATE: "MUTATE";
-        DESTRUCTIVE: "DESTRUCTIVE";
-    }>>>>;
-    shell: z.ZodOptional<z.ZodObject<{
-        prelude_verbs: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        privilege_verbs: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-export type PoliciesV1 = z.infer<typeof PoliciesV1Schema>;
-export type Classification = {
-    tool: string | null;
-    command_path: string | null;
-    verb: string | null;
-    tier: Tier;
-    matched: boolean;
-};
-export declare function ensureTiersComplete(tiers: readonly Tier[]): void;
-export declare function parsePoliciesV1Json(raw: unknown): PoliciesV1;
-export declare function defaultPoliciesV1Path(): string;
-/** Effective path when `opts.policyPath` is omitted (env override matches `auditor doctor` / help). */
-export declare function resolvedPoliciesV1Path(opts?: {
-    policyPath?: string;
-}): string;
-export declare function policiesV1MetaPathFor(policyFilePath: string): string;
-export declare function defaultPoliciesMetaPath(): string;
-export declare function readPoliciesV1Revision(opts?: {
-    policyPath?: string;
-}): Promise<number | null>;
-export declare function loadPoliciesV1(opts?: {
-    policyPath?: string;
-}): Promise<PoliciesV1>;
-export declare function classifyArgv(policy: PoliciesV1, argv: readonly string[]): {
-    classification: Classification;
-    flags: {
-        metacharacters: boolean;
-        dangerous_flags: boolean;
-    };
-};
+export type { Classification, PoliciesV1, Tier } from "./schema.js";
+export { parsePoliciesV1Json } from "./schema.js";
+export { defaultPoliciesMetaPath, defaultPoliciesV1Path, policiesV1MetaPathFor, resolvedPoliciesV1Path, } from "./paths.js";
+export { loadPoliciesV1, readPoliciesV1Revision } from "./load.js";
+export { classifyArgv } from "./classify.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/policy/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,UAAU;;;;EAA4C,CAAC;AACpE,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;iBAU3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,QAOzD;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAO5D;AAuBD,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,uGAAuG;AACvG,wBAAgB,sBAAsB,CAAC,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAK7E;AAED,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAIpE;AAED,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD;AAED,wBAAsB,sBAAsB,CAAC,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWnG;AA0BD,wBAAsB,cAAc,CAAC,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAUxF;AA0BD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB;IAAE,cAAc,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE;QAAE,cAAc,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAoFlG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAEnE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC"}

package/dist/policy/index.js

@@ -1,214 +1,5 @@
-import { existsSync } from "node:fs";
-import { copyFile, mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import { fileURLToPath } from "node:url";
-import os from "node:os";
-import path from "node:path";
-import { z } from "zod";
-export const TierSchema = z.enum(["READ", "MUTATE", "DESTRUCTIVE"]);
-export const PoliciesV1Schema = z.object({
-    tiers: z.array(TierSchema).nonempty(),
-    dangerous_flags: z.array(z.string()),
-    policies: z.record(z.string(), z.record(z.string(), z.record(z.string(), TierSchema))),
-    shell: z
-        .object({
-        prelude_verbs: z.array(z.string()).optional(),
-        privilege_verbs: z.array(z.string()).optional(),
-    })
-        .optional(),
-});
-export function ensureTiersComplete(tiers) {
-    const s = new Set(tiers);
-    for (const required of ["READ", "MUTATE", "DESTRUCTIVE"]) {
-        if (!s.has(required)) {
-            throw new Error(`policies.v1.json tiers missing: ${required}`);
-        }
-    }
-}
-export function parsePoliciesV1Json(raw) {
-    const parsed = PoliciesV1Schema.safeParse(raw);
-    if (!parsed.success) {
-        throw new Error(`Invalid policies: ${parsed.error.message}`);
-    }
-    ensureTiersComplete(parsed.data.tiers);
-    return parsed.data;
-}
-function bundledPoliciesCandidates() {
-    const here = path.dirname(fileURLToPath(import.meta.url));
-    return [
-        path.resolve(here, "../policies.v1.json"),
-        path.resolve(here, "../../../auditor/policies.v1.json"),
-    ];
-}
-function resolveBundledPoliciesPath() {
-    for (const candidate of bundledPoliciesCandidates()) {
-        if (existsSync(candidate))
-            return candidate;
-    }
-    throw new Error(`No bundled policies.v1.json found. Tried:\n${bundledPoliciesCandidates().map((p) => `  - ${p}`).join("\n")}`);
-}
-function defaultPraxisDir() {
-    return path.join(os.homedir(), ".praxis");
-}
-export function defaultPoliciesV1Path() {
-    return path.join(defaultPraxisDir(), "policies.v1.json");
-}
-/** Effective path when `opts.policyPath` is omitted (env override matches `auditor doctor` / help). */
-export function resolvedPoliciesV1Path(opts) {
-    if (opts?.policyPath?.trim())
-        return opts.policyPath.trim();
-    const fromEnv = process.env.PRAXIS_POLICIES_V1_PATH?.trim();
-    if (fromEnv)
-        return fromEnv;
-    return defaultPoliciesV1Path();
-}
-export function policiesV1MetaPathFor(policyFilePath) {
-    const dir = path.dirname(policyFilePath);
-    const base = path.basename(policyFilePath, ".json");
-    return path.join(dir, `${base}.meta.json`);
-}
-export function defaultPoliciesMetaPath() {
-    return policiesV1MetaPathFor(defaultPoliciesV1Path());
-}
-export async function readPoliciesV1Revision(opts) {
-    const policyPath = resolvedPoliciesV1Path(opts);
-    const metaPath = policiesV1MetaPathFor(policyPath);
-    try {
-        const raw = await readFile(metaPath, "utf8");
-        const parsed = JSON.parse(raw);
-        const r = Number(parsed.revision);
-        return Number.isFinite(r) ? r : null;
-    }
-    catch {
-        return null;
-    }
-}
-async function bootstrapPoliciesIfMissing(policyPath) {
-    if (existsSync(policyPath))
-        return;
-    const bundledPath = resolveBundledPoliciesPath();
-    const dir = path.dirname(policyPath);
-    await mkdir(dir, { recursive: true });
-    const tmpPolicy = `${policyPath}.tmp.${process.pid}`;
-    await copyFile(bundledPath, tmpPolicy);
-    await rename(tmpPolicy, policyPath);
-    const metaPath = policiesV1MetaPathFor(policyPath);
-    if (!existsSync(metaPath)) {
-        const bootstrapMeta = {
-            revision: 0,
-            syncedAt: new Date().toISOString(),
-            source: "bundled-bootstrap",
-        };
-        const tmpMeta = `${metaPath}.tmp.${process.pid}`;
-        await writeFile(tmpMeta, `${JSON.stringify(bootstrapMeta, null, 2)}\n`, "utf8");
-        await rename(tmpMeta, metaPath);
-    }
-}
-export async function loadPoliciesV1(opts) {
-    const policyPath = resolvedPoliciesV1Path(opts);
-    await bootstrapPoliciesIfMissing(policyPath);
-    const raw = await readFile(policyPath, "utf8");
-    try {
-        return parsePoliciesV1Json(JSON.parse(raw));
-    }
-    catch (e) {
-        const msg = e instanceof Error ? e.message : String(e);
-        throw new Error(`Invalid policies file at ${policyPath}: ${msg}`);
-    }
-}
-function hasMetacharacters(argv) {
-    const bad = [";", "&&", "||", "|", "`", "$(", ">", "<"];
-    return argv.some((t) => bad.some((b) => t.includes(b)));
-}
-function hasDangerousFlags(argv, dangerousFlags) {
-    const s = new Set(dangerousFlags);
-    return argv.some((t) => s.has(t));
-}
-function tryMultiTokenVerb(verbsToTiers, rest, verbIndex, verb1) {
-    if (!verb1)
-        return verb1;
-    const verb2 = rest[verbIndex + 1];
-    if (!verb2)
-        return verb1;
-    const combined = `${verb1} ${verb2}`;
-    if (verbsToTiers[combined])
-        return combined;
-    return verb1;
-}
-export function classifyArgv(policy, argv) {
-    const tool = argv[0] ?? null;
-    const metacharacters = hasMetacharacters(argv);
-    const dangerous_flags = hasDangerousFlags(argv, policy.dangerous_flags);
-    if (!tool || !policy.policies[tool]) {
-        return {
-            classification: { tool, command_path: null, verb: null, tier: "MUTATE", matched: false },
-            flags: { metacharacters, dangerous_flags },
-        };
-    }
-    const rest = argv.slice(1);
-    const toolTable = policy.policies[tool];
-    if (rest.length === 0) {
-        const root = toolTable["__root__"];
-        const tier = root?.["__default__"];
-        if (tier) {
-            return {
-                classification: { tool, command_path: "__root__", verb: null, tier, matched: true },
-                flags: { metacharacters, dangerous_flags },
-            };
-        }
-    }
-    if (rest.length > 0 && toolTable["__root__"]) {
-        const root = toolTable["__root__"];
-        const verb = rest[0] ?? null;
-        let tier;
-        if (verb) {
-            tier = root[verb];
-            if (tier === undefined)
-                tier = root["*"];
-        }
-        else {
-            tier = root["__default__"];
-        }
-        if (tier !== undefined) {
-            return {
-                classification: { tool, command_path: "__root__", verb, tier, matched: true },
-                flags: { metacharacters, dangerous_flags },
-            };
-        }
-    }
-    const pathKeys = Object.keys(toolTable).sort((a, b) => b.split(" ").length - a.split(" ").length);
-    for (const pathKey of pathKeys) {
-        const k = pathKey.split(" ");
-        const prefix = rest.slice(0, k.length);
-        const matches = k.length > 0 && prefix.length === k.length && prefix.every((t, i) => t === k[i]);
-        if (!matches)
-            continue;
-        const verbIndex = k.length;
-        const verb1 = rest[verbIndex] ?? null;
-        const verbsToTiers = toolTable[pathKey] ?? {};
-        const verb = tryMultiTokenVerb(verbsToTiers, rest, verbIndex, verb1);
-        let tier;
-        if (verb) {
-            tier = verbsToTiers[verb];
-            if (tier === undefined)
-                tier = verbsToTiers["*"];
-        }
-        else {
-            tier = verbsToTiers["__default__"];
-        }
-        if (tier === undefined) {
-            return {
-                classification: { tool, command_path: pathKey, verb, tier: "MUTATE", matched: false },
-                flags: { metacharacters, dangerous_flags },
-            };
-        }
-        return {
-            classification: { tool, command_path: pathKey, verb, tier, matched: true },
-            flags: { metacharacters, dangerous_flags },
-        };
-    }
-    return {
-        classification: { tool, command_path: rest[0] ?? null, verb: rest[1] ?? null, tier: "MUTATE", matched: false },
-        flags: { metacharacters, dangerous_flags },
-    };
-}
+export { parsePoliciesV1Json } from "./schema.js";
+export { defaultPoliciesMetaPath, defaultPoliciesV1Path, policiesV1MetaPathFor, resolvedPoliciesV1Path, } from "./paths.js";
+export { loadPoliciesV1, readPoliciesV1Revision } from "./load.js";
+export { classifyArgv } from "./classify.js";
 //# sourceMappingURL=index.js.map

package/dist/policy/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AAGpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACrC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IACtF,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAChD,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAYH,MAAM,UAAU,mBAAmB,CAAC,KAAsB;IACxD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,KAAK,MAAM,QAAQ,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAU,EAAE,CAAC;QAClE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,yBAAyB;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO;QACL,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,qBAAqB,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,mCAAmC,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B;IACjC,KAAK,MAAM,SAAS,IAAI,yBAAyB,EAAE,EAAE,CAAC;QACpD,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,KAAK,CACb,8CAA8C,yBAAyB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9G,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAC3D,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,sBAAsB,CAAC,IAA8B;IACnE,IAAI,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,qBAAqB,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,cAAsB;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,YAAY,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO,qBAAqB,CAAC,qBAAqB,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAA8B;IACzE,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;QACzD,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,UAAkB;IAC1D,IAAI,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO;IAEnC,MAAM,WAAW,GAAG,0BAA0B,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEtC,MAAM,SAAS,GAAG,GAAG,UAAU,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACrD,MAAM,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACvC,MAAM,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAEpC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,aAAa,GAAG;YACpB,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,MAAM,EAAE,mBAAmB;SAC5B,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACjD,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChF,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAA8B;IACjE,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAuB;IAChD,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAuB,EAAE,cAAiC;IACnF,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,iBAAiB,CACxB,YAAkC,EAClC,IAAuB,EACvB,SAAiB,EACjB,KAAoB;IAEpB,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC;IACrC,IAAI,YAAY,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,MAAkB,EAClB,IAAuB;IAEvB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC7B,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,eAAe,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAExE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;YACxF,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,SAAS,GAAyC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAG3E,CAAC;IAEF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,aAAa,CAAC,CAAC;QACnC,IAAI,IAAI,EAAE,CAAC;YACT,OAAO;gBACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;gBACnF,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;aAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC7B,IAAI,IAAsB,CAAC;QAC3B,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,IAAI,IAAI,KAAK,SAAS;gBAAE,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO;gBACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;gBAC7E,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;aAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAClG,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjG,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;QACtC,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,IAAK,EAA2B,CAAC;QACxE,MAAM,IAAI,GAAG,iBAAiB,CAAC,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAErE,IAAI,IAAsB,CAAC;QAC3B,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,IAAI,KAAK,SAAS;gBAAE,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO;gBACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;gBACrF,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;aAC3C,CAAC;QACJ,CAAC;QAED,OAAO;YACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;YAC1E,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QAC9G,KAAK,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;KAC3C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAEnE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC"}

package/dist/policy/load.d.ts

@@ -0,0 +1,8 @@
+import { type PoliciesV1 } from "./schema.js";
+export declare function readPoliciesV1Revision(opts?: {
+    policyPath?: string;
+}): Promise<number | null>;
+export declare function loadPoliciesV1(opts?: {
+    policyPath?: string;
+}): Promise<PoliciesV1>;
+//# sourceMappingURL=load.d.ts.map

package/dist/policy/load.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../src/policy/load.ts"],"names":[],"mappings":"AAIA,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAGnE,wBAAsB,sBAAsB,CAAC,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWnG;AA0BD,wBAAsB,cAAc,CAAC,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAUxF"}