@rewind-ai/cli 0.6.2

package/dist/src/paths.js

@@ -0,0 +1,354 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { realpath, lstat, access } from "node:fs/promises";
+import { constants as fsConstants, existsSync, readFileSync } from "node:fs";
+import os from "node:os";
+/**
+ * Path safety for REWIND.
+ *
+ * Fail closed: only approved project-local sandboxes may be mutated
+ * (sandbox-test-project, sandbox-enforced-project). Checkpoint data lives
+ * under .rewind/ inside the *user project*, never inside the npm package.
+ */
+export const SANDBOX_DIR_NAME = "sandbox-test-project";
+export const ENFORCED_SANDBOX_DIR_NAME = "sandbox-enforced-project";
+export const REWIND_DIR_NAME = ".rewind";
+export const APPROVED_SANDBOX_NAMES = [
+    SANDBOX_DIR_NAME,
+    ENFORCED_SANDBOX_DIR_NAME,
+];
+/**
+ * Absolute path to the installed REWIND *package* (read-only runtime).
+ * Never write user/project state here.
+ */
+export function getPackageRoot() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    const norm = here.replace(/\\/g, "/");
+    // dist/src/paths.js → package root is ../..
+    if (norm.endsWith("/dist/src")) {
+        return path.resolve(here, "../..");
+    }
+    // src/paths.ts (tsx/dev) → package root is ..
+    if (path.basename(here) === "src") {
+        return path.resolve(here, "..");
+    }
+    // Fallback: walk up for this package's package.json
+    let dir = here;
+    for (let i = 0; i < 6; i++) {
+        const pkg = path.join(dir, "package.json");
+        if (existsSync(pkg)) {
+            try {
+                const raw = JSON.parse(readFileSync(pkg, "utf8"));
+                if (raw.name === "@rewind-ai/cli" || raw.name === "rewind")
+                    return dir;
+            }
+            catch {
+                /* continue */
+            }
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return path.resolve(here, "../..");
+}
+/**
+ * Absolute path to the *user project* REWIND operates on.
+ * Defaults to process.cwd() — never the npm package / dist tree.
+ */
+export function getProjectRoot() {
+    if (process.env.REWIND_PROJECT_ROOT) {
+        return path.resolve(process.env.REWIND_PROJECT_ROOT);
+    }
+    return path.resolve(process.cwd());
+}
+/** Global user state directory (~/.rewind) — credentials, commercial, keys. */
+export function getUserRewindDir(override = process.env.REWIND_USER_DIR) {
+    if (override)
+        return path.resolve(override);
+    return path.join(os.homedir(), ".rewind");
+}
+/**
+ * How to invoke the installed REWIND CLI (portable — no tsx / src paths).
+ */
+export function resolveRewindCliInvocation(extraArgs = []) {
+    if (process.env.REWIND_BIN_PATH) {
+        return { command: process.env.REWIND_BIN_PATH, args: [...extraArgs] };
+    }
+    const entry = process.argv[1] ? path.resolve(process.argv[1]) : "";
+    if (entry.endsWith(`${path.sep}cli.js`)) {
+        return { command: process.execPath, args: [entry, ...extraArgs] };
+    }
+    // Dev: running via tsx src/cli.ts — prefer built dist if present
+    if (entry.endsWith(`${path.sep}cli.ts`)) {
+        const distCli = path.join(getPackageRoot(), "dist", "src", "cli.js");
+        if (existsSync(distCli)) {
+            return { command: process.execPath, args: [distCli, ...extraArgs] };
+        }
+    }
+    // Global / PATH install after `npm install -g @rewind-ai/cli`
+    return { command: "rewind", args: [...extraArgs] };
+}
+export function assertSandboxName(name) {
+    if (name === SANDBOX_DIR_NAME ||
+        name === ENFORCED_SANDBOX_DIR_NAME) {
+        return name;
+    }
+    throw new PathSafetyError(`Unknown sandbox name: ${name}`);
+}
+export function getSandboxPath(projectRoot = getProjectRoot(), sandboxName = SANDBOX_DIR_NAME) {
+    return path.join(projectRoot, assertSandboxName(sandboxName));
+}
+export function getEnforcedSandboxPath(projectRoot = getProjectRoot()) {
+    return getSandboxPath(projectRoot, ENFORCED_SANDBOX_DIR_NAME);
+}
+export function getPolicyDir(projectRoot = getProjectRoot()) {
+    return path.join(getRewindHome(projectRoot), "policy");
+}
+export function getTrustDir(projectRoot = getProjectRoot()) {
+    return path.join(getRewindHome(projectRoot), "trust");
+}
+export function getEnforcementDir(projectRoot = getProjectRoot()) {
+    return path.join(getRewindHome(projectRoot), "enforcement");
+}
+export function getRewindHome(projectRoot = getProjectRoot()) {
+    return path.join(projectRoot, REWIND_DIR_NAME);
+}
+export function getCheckpointsDir(projectRoot = getProjectRoot()) {
+    return path.join(getRewindHome(projectRoot), "checkpoints");
+}
+export function getTransactionsDir(projectRoot = getProjectRoot()) {
+    return path.join(getRewindHome(projectRoot), "transactions");
+}
+export function getSessionsDir(projectRoot = getProjectRoot()) {
+    return path.join(getRewindHome(projectRoot), "sessions");
+}
+export function getActionsDir(projectRoot = getProjectRoot()) {
+    return path.join(getRewindHome(projectRoot), "actions");
+}
+export function getObjectsDir(projectRoot = getProjectRoot()) {
+    return path.join(getRewindHome(projectRoot), "objects");
+}
+export function getMcpSessionsDir(projectRoot = getProjectRoot()) {
+    return path.join(getRewindHome(projectRoot), "mcp-sessions");
+}
+export class PathSafetyError extends Error {
+    name = "PathSafetyError";
+    constructor(message) {
+        super(message);
+    }
+}
+/** Normalize to absolute, resolved path without requiring existence. */
+export function normalizeAbsolute(input) {
+    return path.resolve(input);
+}
+/**
+ * Returns true if `candidate` is exactly `root` or a path strictly inside it.
+ * Both arguments should be absolute. Does not follow symlinks.
+ * Also treats path strings as equal when they differ only by a shared
+ * realpath prefix mismatch that the caller already normalized.
+ */
+export function isPathInside(root, candidate) {
+    const rootNorm = path.resolve(root);
+    const candNorm = path.resolve(candidate);
+    if (candNorm === rootNorm)
+        return true;
+    const prefix = rootNorm.endsWith(path.sep)
+        ? rootNorm
+        : rootNorm + path.sep;
+    return candNorm.startsWith(prefix);
+}
+/**
+ * Like isPathInside, but resolves both sides with realpath when they exist.
+ * Handles macOS /var vs /private/var discrepancies.
+ */
+export async function isPathInsideAsync(root, candidate) {
+    if (isPathInside(root, candidate))
+        return true;
+    let realRoot = path.resolve(root);
+    let realCand = path.resolve(candidate);
+    try {
+        realRoot = await realpath(realRoot);
+    }
+    catch {
+        /* keep */
+    }
+    try {
+        realCand = await realpath(realCand);
+    }
+    catch {
+        // For non-existent candidates, realpath the parent and join basename.
+        try {
+            const parent = await realpath(path.dirname(realCand));
+            realCand = path.join(parent, path.basename(realCand));
+        }
+        catch {
+            /* keep */
+        }
+    }
+    return isPathInside(realRoot, realCand);
+}
+/** Forbidden roots that must never be targeted. */
+export function getForbiddenRoots() {
+    const home = os.homedir();
+    return [
+        home,
+        path.join(home, "Desktop"),
+        path.join(home, "Documents"),
+        path.join(home, "Downloads"),
+        "/",
+        "/System",
+        "/Library",
+        "/usr",
+        "/bin",
+        "/sbin",
+        "/etc",
+        "/var",
+        "/private",
+        "/Applications",
+    ].map((p) => path.resolve(p));
+}
+/**
+ * Assert a relative path from sandbox has no traversal / absolute / null bytes.
+ * Returns a cleaned POSIX-style relative path.
+ */
+export function assertSafeRelativePath(rel) {
+    if (rel.length === 0) {
+        throw new PathSafetyError("Empty relative path");
+    }
+    if (rel.includes("\0")) {
+        throw new PathSafetyError("Null byte in path");
+    }
+    if (path.isAbsolute(rel)) {
+        throw new PathSafetyError(`Absolute path not allowed: ${rel}`);
+    }
+    const normalized = path.posix.normalize(rel.replace(/\\/g, "/"));
+    if (normalized === ".." ||
+        normalized.startsWith("../") ||
+        normalized.split("/").includes("..")) {
+        throw new PathSafetyError(`Path traversal rejected: ${rel}`);
+    }
+    if (normalized.startsWith("./")) {
+        return normalized.slice(2);
+    }
+    return normalized;
+}
+/**
+ * Resolve a relative sandbox path to an absolute path and ensure it stays
+ * inside the approved sandbox. Does not follow the final component if it is
+ * a dangling symlink (uses join + resolve of parent).
+ */
+export function resolveInsideSandbox(relativePath, sandboxRoot = getSandboxPath()) {
+    const safeRel = assertSafeRelativePath(relativePath);
+    const absolute = path.resolve(sandboxRoot, safeRel);
+    if (!isPathInside(sandboxRoot, absolute)) {
+        throw new PathSafetyError(`Resolved path escapes sandbox: ${relativePath} -> ${absolute}`);
+    }
+    return absolute;
+}
+/**
+ * Validate that `target` is exactly an approved sandbox directory
+ * (sandbox-test-project or sandbox-enforced-project).
+ * Fail closed on missing paths, wrong identity, or symlink escape.
+ */
+export async function assertApprovedSandbox(target, projectRoot = getProjectRoot(), sandboxName) {
+    const targetAbs = normalizeAbsolute(target);
+    const basename = path.basename(targetAbs);
+    const resolvedName = sandboxName
+        ? assertSandboxName(sandboxName)
+        : assertSandboxName(basename);
+    const approvedAbs = normalizeAbsolute(getSandboxPath(projectRoot, resolvedName));
+    // Exact path identity (before realpath) — refuse siblings / parents.
+    if (targetAbs !== approvedAbs) {
+        throw new PathSafetyError(`Target is not the approved sandbox.\n` +
+            `  Target:   ${targetAbs}\n` +
+            `  Approved: ${approvedAbs}`);
+    }
+    // Refuse if target equals a forbidden root (paranoia for misconfig).
+    for (const forbidden of getForbiddenRoots()) {
+        if (targetAbs === forbidden) {
+            throw new PathSafetyError(`Refusing forbidden root: ${targetAbs}`);
+        }
+    }
+    // Parent of sandbox must be the project root.
+    if (path.dirname(targetAbs) !== normalizeAbsolute(projectRoot)) {
+        throw new PathSafetyError(`Sandbox parent is not project root: ${path.dirname(targetAbs)}`);
+    }
+    let realTarget;
+    try {
+        await access(targetAbs, fsConstants.F_OK);
+        realTarget = await realpath(targetAbs);
+    }
+    catch (err) {
+        const code = err && typeof err === "object" && "code" in err
+            ? String(err.code)
+            : "";
+        if (code === "ENOENT") {
+            throw new PathSafetyError(`Sandbox does not exist: ${targetAbs}`);
+        }
+        throw new PathSafetyError(`Cannot access sandbox: ${targetAbs} (${String(err)})`);
+    }
+    const realApproved = await realpath(approvedAbs);
+    if (realTarget !== realApproved) {
+        throw new PathSafetyError(`Sandbox realpath mismatch (possible symlink escape).\n` +
+            `  Real target:   ${realTarget}\n` +
+            `  Real approved: ${realApproved}`);
+    }
+    // Ensure resolved path still sits under project root realpath.
+    const realProject = await realpath(projectRoot);
+    if (!isPathInside(realProject, realTarget)) {
+        throw new PathSafetyError(`Sandbox realpath escapes project root: ${realTarget}`);
+    }
+    return {
+        ok: true,
+        target: targetAbs,
+        approvedSandbox: approvedAbs,
+        realTarget,
+    };
+}
+/**
+ * After resolving a path that may be a symlink, ensure the real target
+ * remains inside the sandbox. Used when reading/writing individual files.
+ */
+export async function assertNoSymlinkEscape(absolutePath, sandboxRoot) {
+    if (!(await isPathInsideAsync(sandboxRoot, absolutePath))) {
+        throw new PathSafetyError(`Path outside sandbox: ${absolutePath}`);
+    }
+    let st;
+    try {
+        st = await lstat(absolutePath);
+    }
+    catch (err) {
+        const code = err && typeof err === "object" && "code" in err
+            ? String(err.code)
+            : "";
+        if (code === "ENOENT")
+            return; // creating new file is fine
+        throw err;
+    }
+    if (st.isSymbolicLink()) {
+        let real;
+        try {
+            real = await realpath(absolutePath);
+        }
+        catch {
+            // Dangling symlink: resolve the link text relative to parent.
+            const { readlink } = await import("node:fs/promises");
+            const target = await readlink(absolutePath);
+            real = path.resolve(path.dirname(absolutePath), target);
+        }
+        if (!(await isPathInsideAsync(sandboxRoot, real))) {
+            throw new PathSafetyError(`Symlink escape blocked: ${absolutePath} -> ${real}`);
+        }
+    }
+}
+/** Print chaos-test safety banner. Throws if not approved. */
+export async function printChaosSafetyBanner(target, projectRoot = getProjectRoot()) {
+    const validation = await assertApprovedSandbox(target, projectRoot);
+    console.log("REWIND CHAOS TEST");
+    console.log(`Target: ${validation.target}`);
+    console.log("Approved sandbox: YES");
+    return validation;
+}
+//# sourceMappingURL=paths.js.map

package/dist/src/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/paths.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AACpE,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC;AAMzC,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC5D,gBAAgB;IAChB,yBAAyB;CACjB,CAAC;AAEX;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtC,4CAA4C;IAC5C,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IACD,8CAA8C;IAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,oDAAoD;IACpD,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC3C,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAsB,CAAC;gBACvE,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,GAAG,CAAC;YACzE,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAC9B,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe;IAEtC,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,YAAsB,EAAE;IAExB,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;IACxE,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,iEAAiE;IACjE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrE,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC;QACtE,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IACE,IAAI,KAAK,gBAAgB;QACzB,IAAI,KAAK,yBAAyB,EAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,eAAe,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,WAAW,GAAG,cAAc,EAAE,EAC9B,cAA2B,gBAAgB;IAE3C,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,WAAW,GAAG,cAAc,EAAE;IACnE,OAAO,cAAc,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,WAAW,GAAG,cAAc,EAAE;IACzD,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,WAAW,GAAG,cAAc,EAAE;IACxD,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,WAAW,GAAG,cAAc,EAAE;IAC9D,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,WAAW,GAAG,cAAc,EAAE;IAC1D,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,WAAW,GAAG,cAAc,EAAE;IAC9D,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,WAAW,GAAG,cAAc,EAAE;IAC/D,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,WAAW,GAAG,cAAc,EAAE;IAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,WAAW,GAAG,cAAc,EAAE;IAC1D,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,WAAW,GAAG,cAAc,EAAE;IAC1D,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,WAAW,GAAG,cAAc,EAAE;IAC9D,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACtB,IAAI,GAAG,iBAAiB,CAAC;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAED,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,SAAiB;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QACxC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC;IACxB,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,SAAiB;IAEjB,IAAI,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,UAAU;IACZ,CAAC;IACD,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YACtD,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,UAAU;QACZ,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,iBAAiB;IAC/B,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,OAAO;QACL,IAAI;QACJ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;QAC5B,GAAG;QACH,SAAS;QACT,UAAU;QACV,MAAM;QACN,MAAM;QACN,OAAO;QACP,MAAM;QACN,MAAM;QACN,UAAU;QACV,eAAe;KAChB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,eAAe,CAAC,mBAAmB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,eAAe,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACjE,IACE,UAAU,KAAK,IAAI;QACnB,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EACpC,CAAC;QACD,MAAM,IAAI,eAAe,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAoB,EACpB,WAAW,GAAG,cAAc,EAAE;IAE9B,MAAM,OAAO,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,eAAe,CACvB,kCAAkC,YAAY,OAAO,QAAQ,EAAE,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AASD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,WAAW,GAAG,cAAc,EAAE,EAC9B,WAAyB;IAEzB,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,WAAW;QAC9B,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC;QAChC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,WAAW,GAAG,iBAAiB,CACnC,cAAc,CAAC,WAAW,EAAE,YAAY,CAAC,CAC1C,CAAC;IAEF,qEAAqE;IACrE,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;QAC9B,MAAM,IAAI,eAAe,CACvB,uCAAuC;YACrC,eAAe,SAAS,IAAI;YAC5B,eAAe,WAAW,EAAE,CAC/B,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,KAAK,MAAM,SAAS,IAAI,iBAAiB,EAAE,EAAE,CAAC;QAC5C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,eAAe,CAAC,4BAA4B,SAAS,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,eAAe,CACvB,uCAAuC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CACjE,CAAC;IACJ,CAAC;IAED,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QAC1C,UAAU,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GACR,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;YAC7C,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC;YACzC,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,eAAe,CAAC,2BAA2B,SAAS,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,0BAA0B,SAAS,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QAChC,MAAM,IAAI,eAAe,CACvB,wDAAwD;YACtD,oBAAoB,UAAU,IAAI;YAClC,oBAAoB,YAAY,EAAE,CACrC,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,eAAe,CACvB,0CAA0C,UAAU,EAAE,CACvD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,SAAS;QACjB,eAAe,EAAE,WAAW;QAC5B,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,WAAmB;IAEnB,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,eAAe,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GACR,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;YAC7C,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC;YACzC,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,4BAA4B;QAC3D,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;QACxB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;YAC9D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC5C,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,eAAe,CACvB,2BAA2B,YAAY,OAAO,IAAI,EAAE,CACrD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAc,EACd,WAAW,GAAG,cAAc,EAAE;IAE9B,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,WAAW,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrC,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/src/permission/engine.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Local permission decision layer.
+ * Default policy: ALLOW (preserves existing FS test usability).
+ * Evaluated BEFORE mutation.
+ */
+import type { PermissionContext, PermissionEvaluation, PolicyDocument, PolicyRule } from "./types.js";
+export declare function defaultPolicyDocument(): PolicyDocument;
+export declare function policyPath(projectRoot?: string): string;
+export declare function loadPolicy(projectRoot?: string): Promise<PolicyDocument>;
+export declare function savePolicy(doc: PolicyDocument, projectRoot?: string): Promise<void>;
+/** Glob match: ** / * / literals. Paths use POSIX separators. */
+export declare function matchResourcePattern(pattern: string, resource: string): boolean;
+export declare function evaluatePermission(doc: PolicyDocument, ctx: PermissionContext): PermissionEvaluation;
+export declare function decidePermission(ctx: PermissionContext, projectRoot?: string): Promise<PermissionEvaluation>;
+export declare function upsertRule(rule: PolicyRule, projectRoot?: string): Promise<PolicyDocument>;

package/dist/src/permission/engine.js

@@ -0,0 +1,147 @@
+/**
+ * Local permission decision layer.
+ * Default policy: ALLOW (preserves existing FS test usability).
+ * Evaluated BEFORE mutation.
+ */
+import path from "node:path";
+import { mkdir, readFile, writeFile, rename } from "node:fs/promises";
+import { getRewindHome, getProjectRoot } from "../paths.js";
+export function defaultPolicyDocument() {
+    return {
+        version: 1,
+        updatedAt: new Date().toISOString(),
+        defaultEffect: "ALLOW",
+        rules: [
+            // Example future-shaped rules — disabled so defaults stay ALLOW.
+            {
+                id: "deny-outside-sandbox-marker",
+                priority: 10,
+                effect: "DENY",
+                reason: "Writes outside approved sandbox are denied by path safety (adapter); this rule is documentation-only",
+                adapter: "filesystem",
+                operation: "write",
+                resourcePattern: "../**",
+                enabled: false,
+            },
+        ],
+    };
+}
+export function policyPath(projectRoot = getProjectRoot()) {
+    return path.join(getRewindHome(projectRoot), "policy", "permissions.json");
+}
+async function writeJsonAtomic(file, data) {
+    await mkdir(path.dirname(file), { recursive: true });
+    const tmp = `${file}.tmp-${process.pid}`;
+    await writeFile(tmp, JSON.stringify(data, null, 2) + "\n", "utf8");
+    await rename(tmp, file);
+}
+export async function loadPolicy(projectRoot = getProjectRoot()) {
+    try {
+        const raw = await readFile(policyPath(projectRoot), "utf8");
+        const doc = JSON.parse(raw);
+        if (doc.version !== 1 || !Array.isArray(doc.rules)) {
+            return defaultPolicyDocument();
+        }
+        return doc;
+    }
+    catch {
+        return defaultPolicyDocument();
+    }
+}
+export async function savePolicy(doc, projectRoot = getProjectRoot()) {
+    doc.updatedAt = new Date().toISOString();
+    await writeJsonAtomic(policyPath(projectRoot), doc);
+}
+/** Glob match: ** / * / literals. Paths use POSIX separators. */
+export function matchResourcePattern(pattern, resource) {
+    const norm = resource.replace(/\\/g, "/");
+    const pat = pattern.replace(/\\/g, "/");
+    if (pat === "**" || pat === "**/*")
+        return true;
+    // Escape regex specials except our glob tokens
+    let re = "";
+    for (let i = 0; i < pat.length; i++) {
+        const c = pat[i];
+        if (c === "*" && pat[i + 1] === "*") {
+            re += ".*";
+            i++;
+            if (pat[i + 1] === "/")
+                i++;
+        }
+        else if (c === "*") {
+            re += "[^/]*";
+        }
+        else if (c === "?") {
+            re += "[^/]";
+        }
+        else if (/[.+^${}()|[\]\\]/.test(c)) {
+            re += "\\" + c;
+        }
+        else {
+            re += c;
+        }
+    }
+    return new RegExp(`^${re}$`).test(norm);
+}
+function ruleMatches(rule, ctx) {
+    if (!rule.enabled)
+        return false;
+    if (rule.adapter && rule.adapter !== ctx.intent.adapter)
+        return false;
+    if (rule.operation && rule.operation !== ctx.intent.operation)
+        return false;
+    if (rule.actorClient &&
+        rule.actorClient !== ctx.intent.actor.client) {
+        return false;
+    }
+    if (rule.reversibility &&
+        ctx.reversibility &&
+        rule.reversibility !== ctx.reversibility) {
+        return false;
+    }
+    if (rule.risk && ctx.risk && rule.risk !== ctx.risk)
+        return false;
+    if (rule.resourcePattern) {
+        if (!matchResourcePattern(rule.resourcePattern, ctx.resource)) {
+            return false;
+        }
+    }
+    return true;
+}
+export function evaluatePermission(doc, ctx) {
+    const evaluatedAt = new Date().toISOString();
+    const rules = [...doc.rules].sort((a, b) => a.priority - b.priority);
+    for (const rule of rules) {
+        if (ruleMatches(rule, ctx)) {
+            return {
+                decision: rule.effect,
+                reason: rule.reason,
+                policyId: rule.id,
+                matchedRule: rule,
+                evaluatedAt,
+            };
+        }
+    }
+    return {
+        decision: doc.defaultEffect,
+        reason: `default:${doc.defaultEffect}`,
+        policyId: null,
+        matchedRule: null,
+        evaluatedAt,
+    };
+}
+export async function decidePermission(ctx, projectRoot = ctx.projectRoot) {
+    const doc = await loadPolicy(projectRoot);
+    return evaluatePermission(doc, ctx);
+}
+export async function upsertRule(rule, projectRoot = getProjectRoot()) {
+    const doc = await loadPolicy(projectRoot);
+    const idx = doc.rules.findIndex((r) => r.id === rule.id);
+    if (idx >= 0)
+        doc.rules[idx] = rule;
+    else
+        doc.rules.push(rule);
+    await savePolicy(doc, projectRoot);
+    return doc;
+}
+//# sourceMappingURL=engine.js.map

package/dist/src/permission/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../../src/permission/engine.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAQ5D,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,aAAa,EAAE,OAAO;QACtB,KAAK,EAAE;YACL,iEAAiE;YACjE;gBACE,EAAE,EAAE,6BAA6B;gBACjC,QAAQ,EAAE,EAAE;gBACZ,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,sGAAsG;gBAC9G,OAAO,EAAE,YAAY;gBACrB,SAAS,EAAE,OAAO;gBAClB,eAAe,EAAE,OAAO;gBACxB,OAAO,EAAE,KAAK;aACf;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,WAAW,GAAG,cAAc,EAAE;IACvD,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,IAAa;IACxD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACnE,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,WAAW,GAAG,cAAc,EAAE;IAE9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;QAC9C,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACnD,OAAO,qBAAqB,EAAE,CAAC;QACjC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,qBAAqB,EAAE,CAAC;IACjC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAmB,EACnB,WAAW,GAAG,cAAc,EAAE;IAE9B,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,eAAe,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,QAAgB;IAEhB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAChD,+CAA+C;IAC/C,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpC,EAAE,IAAI,IAAI,CAAC;YACX,CAAC,EAAE,CAAC;YACJ,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC;QAC9B,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,EAAE,IAAI,OAAO,CAAC;QAChB,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,EAAE,IAAI,MAAM,CAAC;QACf,CAAC;aAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,IAAgB,EAAE,GAAsB;IAC3D,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,GAAG,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5E,IACE,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAC5C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IACE,IAAI,CAAC,aAAa;QAClB,GAAG,CAAC,aAAa;QACjB,IAAI,CAAC,aAAa,KAAK,GAAG,CAAC,aAAa,EACxC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,GAAmB,EACnB,GAAsB;IAEtB,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IACrE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,QAAQ,EAAE,IAAI,CAAC,MAAM;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,EAAE;gBACjB,WAAW,EAAE,IAAI;gBACjB,WAAW;aACZ,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,aAAa;QAC3B,MAAM,EAAE,WAAW,GAAG,CAAC,aAAa,EAAE;QACtC,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,IAAI;QACjB,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAsB,EACtB,WAAW,GAAG,GAAG,CAAC,WAAW;IAE7B,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC;IAC1C,OAAO,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAgB,EAChB,WAAW,GAAG,cAAc,EAAE;IAE9B,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,GAAG,IAAI,CAAC;QAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;;QAC/B,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/permission/types.d.ts

@@ -0,0 +1,42 @@
+/** Permission policy types — generic across adapters. */
+import type { AdapterId, PermissionDecision, ReversibilityClass, TransactionIntent } from "../core/types.js";
+export type PolicyEffect = PermissionDecision;
+export interface PolicyRule {
+    id: string;
+    /** Lower number = higher priority. First match wins. */
+    priority: number;
+    effect: PolicyEffect;
+    reason: string;
+    /** Match filters — omitted means any. */
+    actorClient?: string | null | undefined;
+    adapter?: AdapterId | null | undefined;
+    operation?: string | null | undefined;
+    /** Glob-like path/resource pattern (**, *, literal). */
+    resourcePattern?: string | null | undefined;
+    reversibility?: ReversibilityClass | null | undefined;
+    /** Optional risk tag match. */
+    risk?: string | null | undefined;
+    enabled: boolean;
+}
+export interface PolicyDocument {
+    version: 1;
+    updatedAt: string;
+    /** Default when no rule matches. */
+    defaultEffect: PolicyEffect;
+    rules: PolicyRule[];
+}
+export interface PermissionEvaluation {
+    decision: PermissionDecision;
+    reason: string;
+    policyId: string | null;
+    matchedRule: PolicyRule | null;
+    evaluatedAt: string;
+}
+export interface PermissionContext {
+    intent: TransactionIntent;
+    projectRoot: string;
+    /** Resource path already identified by adapter. */
+    resource: string;
+    risk?: string;
+    reversibility?: ReversibilityClass;
+}

package/dist/src/permission/types.js

@@ -0,0 +1,3 @@
+/** Permission policy types — generic across adapters. */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/permission/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/permission/types.ts"],"names":[],"mappings":"AAAA,yDAAyD"}

package/dist/src/product/setup.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Product setup / doctor / uninstall / open — user-facing install path.
+ */
+export declare const PRODUCT_VERSION = "0.6.2";
+export interface DoctorCheck {
+    id: string;
+    status: "PASS" | "WARN" | "FAIL";
+    title: string;
+    detail: string;
+}
+export interface ProjectConfig {
+    version: 6;
+    initializedAt: string;
+    projectRoot: string;
+    product: "REWIND Personal";
+    mediation: "connected";
+    notes: string[];
+}
+export declare function loadProjectConfig(projectRoot?: string): Promise<ProjectConfig | null>;
+export declare function runSetup(projectRoot?: string, opts?: {
+    skipMcp?: boolean;
+    skipSandbox?: boolean;
+}): Promise<string>;
+export declare function runDoctor(projectRoot?: string): Promise<{
+    checks: DoctorCheck[];
+    text: string;
+}>;
+export interface UninstallOptions {
+    /** Delete .rewind recovery data — requires explicit true */
+    deleteRecoveryData?: boolean;
+    removeMcp?: boolean;
+    projectRoot?: string;
+}
+export declare function runUninstall(opts?: UninstallOptions): Promise<string>;
+export declare function versionText(): string;