@roackb2/heddle 1.4.0 → 1.6.0

package/dist/src/core/approvals/remembered-rules/schemas.d.ts

@@ -0,0 +1,55 @@
+import { z } from 'zod';
+export declare const ApprovalModeSchema: z.ZodEnum<{
+    exact: "exact";
+    tool: "tool";
+    prefix: "prefix";
+}>;
+export declare const ApprovalRuleToolSchema: z.ZodEnum<{
+    list_files: "list_files";
+    read_file: "read_file";
+    edit_file: "edit_file";
+    run_shell_mutate: "run_shell_mutate";
+}>;
+export declare const ProjectApprovalRuleSchema: z.ZodObject<{
+    tool: z.ZodEnum<{
+        list_files: "list_files";
+        read_file: "read_file";
+        edit_file: "edit_file";
+        run_shell_mutate: "run_shell_mutate";
+    }>;
+    mode: z.ZodEnum<{
+        exact: "exact";
+        tool: "tool";
+        prefix: "prefix";
+    }>;
+    command: z.ZodString;
+    scope: z.ZodString;
+    capability: z.ZodString;
+    createdAt: z.ZodString;
+}, z.core.$strip>;
+export declare const ProjectApprovalRuleListSchema: z.ZodArray<z.ZodObject<{
+    tool: z.ZodEnum<{
+        list_files: "list_files";
+        read_file: "read_file";
+        edit_file: "edit_file";
+        run_shell_mutate: "run_shell_mutate";
+    }>;
+    mode: z.ZodEnum<{
+        exact: "exact";
+        tool: "tool";
+        prefix: "prefix";
+    }>;
+    command: z.ZodString;
+    scope: z.ZodString;
+    capability: z.ZodString;
+    createdAt: z.ZodString;
+}, z.core.$strip>>;
+export declare const ProjectApprovalRuleCandidateSchema: z.ZodObject<{
+    tool: z.ZodOptional<z.ZodString>;
+    mode: z.ZodOptional<z.ZodString>;
+    command: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodString>;
+    capability: z.ZodOptional<z.ZodString>;
+    createdAt: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/src/core/approvals/remembered-rules/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../../../src/core/approvals/remembered-rules/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,kBAAkB;;;;EACsC,CAAC;AAEtE,eAAO,MAAM,sBAAsB;;;;;EACyB,CAAC;AAE7D,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;iBAOoB,CAAC;AAE3D,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;kBACyB,CAAC;AAEpE,eAAO,MAAM,kCAAkC;;;;;;;iBAO2C,CAAC"}

package/dist/src/core/approvals/remembered-rules/schemas.js

@@ -0,0 +1,24 @@
+import { z } from 'zod';
+export const ApprovalModeSchema = z.enum(['exact', 'prefix', 'tool'])
+    .describe('How the remembered approval matches future tool calls.');
+export const ApprovalRuleToolSchema = z.enum(['run_shell_mutate', 'edit_file', 'read_file', 'list_files'])
+    .describe('Tool covered by the remembered approval rule.');
+export const ProjectApprovalRuleSchema = z.object({
+    tool: ApprovalRuleToolSchema,
+    mode: ApprovalModeSchema,
+    command: z.string().describe('Normalized command, path, or wildcard target covered by the rule.'),
+    scope: z.string().describe('Execution or file scope covered by the approval.'),
+    capability: z.string().describe('Capability category covered by the approval.'),
+    createdAt: z.string().describe('ISO timestamp for when the rule was created.'),
+}).describe('Persisted remembered project approval rule.');
+export const ProjectApprovalRuleListSchema = z.array(ProjectApprovalRuleSchema)
+    .describe('Persisted list of remembered project approval rules.');
+export const ProjectApprovalRuleCandidateSchema = z.object({
+    tool: z.string().optional().describe('Persisted tool name from current or legacy approval data.'),
+    mode: z.string().optional().describe('Persisted match mode from current or legacy approval data.'),
+    command: z.string().optional().describe('Persisted command, path, or wildcard target.'),
+    scope: z.string().optional().describe('Persisted execution or file scope.'),
+    capability: z.string().optional().describe('Persisted capability category.'),
+    createdAt: z.string().optional().describe('Persisted creation timestamp.'),
+}).passthrough().describe('Tolerant approval-rule candidate used when reading disk data.');
+//# sourceMappingURL=schemas.js.map

package/dist/src/core/approvals/remembered-rules/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../../../src/core/approvals/remembered-rules/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;KAClE,QAAQ,CAAC,wDAAwD,CAAC,CAAC;AAEtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;KACvG,QAAQ,CAAC,+CAA+C,CAAC,CAAC;AAE7D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,sBAAsB;IAC5B,IAAI,EAAE,kBAAkB;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mEAAmE,CAAC;IACjG,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC;IAC9E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;CAC/E,CAAC,CAAC,QAAQ,CAAC,6CAA6C,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;KAC5E,QAAQ,CAAC,sDAAsD,CAAC,CAAC;AAEpE,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;IACjG,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4DAA4D,CAAC;IAClG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;IACvF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC3E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;CAC3E,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,+DAA+D,CAAC,CAAC"}

package/dist/src/core/approvals/remembered-rules/service.d.ts

@@ -0,0 +1,28 @@
+import type { ToolCall } from '../../../core/types.js';
+import type { ProjectApprovalRule } from './types.js';
+/**
+ * Owns remembered approval rule semantics: target extraction, matching,
+ * normalization, rule creation, and user-facing descriptions.
+ */
+export declare class ProjectApprovalRules {
+    static normalizeCommand(command: string): string;
+    static findMatching(args: {
+        rules: ProjectApprovalRule[];
+        tool: string;
+        input: unknown;
+    }): ProjectApprovalRule | undefined;
+    static createForCommand(command: string): ProjectApprovalRule;
+    static createForCall(call: ToolCall): ProjectApprovalRule | undefined;
+    static describe(rule: ProjectApprovalRule): string;
+    static extractTarget(args: {
+        tool: string;
+        input: unknown;
+    }): string | undefined;
+    static normalizePath(path: string): string;
+    static buildLegacyVerificationPrefix(command: string): string | undefined;
+    private static createShellRule;
+    private static shouldUseVerificationPrefixApproval;
+    private static buildVerificationPrefix;
+    private static canonicalizeVerificationCommand;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/src/core/approvals/remembered-rules/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../../src/core/approvals/remembered-rules/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAOhD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD;;;GAGG;AACH,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAIhD,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;QACxB,KAAK,EAAE,mBAAmB,EAAE,CAAC;QAC7B,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,OAAO,CAAC;KAChB,GAAG,mBAAmB,GAAG,SAAS;IA0BnC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB;IAI7D,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,GAAG,mBAAmB,GAAG,SAAS;IAgCrE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM;IAgBlD,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,OAAO,CAAC;KAChB,GAAG,MAAM,GAAG,SAAS;IA8BtB,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAS1C,MAAM,CAAC,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAczE,OAAO,CAAC,MAAM,CAAC,eAAe;IAuC9B,OAAO,CAAC,MAAM,CAAC,mCAAmC;IAYlD,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAqBtC,OAAO,CAAC,MAAM,CAAC,+BAA+B;CAgC/C"}

package/dist/src/core/approvals/remembered-rules/service.js

@@ -0,0 +1,200 @@
+import { classifyShellCommandPolicy, DEFAULT_MUTATE_RULES, } from '../../../core/tools/toolkits/shell-process/run-shell.js';
+/**
+ * Owns remembered approval rule semantics: target extraction, matching,
+ * normalization, rule creation, and user-facing descriptions.
+ */
+export class ProjectApprovalRules {
+    static normalizeCommand(command) {
+        return ProjectApprovalRules.canonicalizeVerificationCommand(command.trim().replace(/\s+/g, ' '));
+    }
+    static findMatching(args) {
+        const target = ProjectApprovalRules.extractTarget({
+            tool: args.tool,
+            input: args.input,
+        });
+        if (!target) {
+            return undefined;
+        }
+        return args.rules.find((rule) => {
+            if (rule.tool !== args.tool) {
+                return false;
+            }
+            if (rule.mode === 'tool') {
+                return true;
+            }
+            if (rule.mode === 'prefix') {
+                return target === rule.command || target.startsWith(`${rule.command} `);
+            }
+            return rule.command === target;
+        });
+    }
+    static createForCommand(command) {
+        return ProjectApprovalRules.createShellRule(ProjectApprovalRules.normalizeCommand(command));
+    }
+    static createForCall(call) {
+        if (call.tool === 'edit_file') {
+            return {
+                tool: 'edit_file',
+                mode: 'tool',
+                command: '*',
+                scope: 'workspace',
+                capability: 'file_edit',
+                createdAt: new Date().toISOString(),
+            };
+        }
+        if (call.tool === 'read_file' || call.tool === 'list_files') {
+            const target = ProjectApprovalRules.extractTarget({ tool: call.tool, input: call.input });
+            return target ? {
+                tool: call.tool,
+                mode: 'exact',
+                command: target,
+                scope: 'outside_workspace',
+                capability: 'file_inspection',
+                createdAt: new Date().toISOString(),
+            } : undefined;
+        }
+        if (call.tool !== 'run_shell_mutate') {
+            return undefined;
+        }
+        const target = ProjectApprovalRules.extractTarget({ tool: call.tool, input: call.input });
+        return target ? ProjectApprovalRules.createShellRule(target) : undefined;
+    }
+    static describe(rule) {
+        if (rule.tool === 'edit_file') {
+            return 'allow edit_file for this project';
+        }
+        if (rule.tool === 'read_file' || rule.tool === 'list_files') {
+            return `allow ${rule.tool} for this project`;
+        }
+        if (rule.mode === 'prefix') {
+            return `allow ${rule.command} command family for this project`;
+        }
+        return 'allow exact command';
+    }
+    static extractTarget(args) {
+        if (args.tool === 'run_shell_mutate') {
+            if (typeof args.input === 'string') {
+                return ProjectApprovalRules.normalizeCommand(args.input);
+            }
+            if (!args.input || typeof args.input !== 'object' || Array.isArray(args.input)) {
+                return undefined;
+            }
+            const command = args.input.command;
+            return typeof command === 'string' && command.trim() ? ProjectApprovalRules.normalizeCommand(command) : undefined;
+        }
+        if (args.tool === 'edit_file' || args.tool === 'read_file' || args.tool === 'list_files') {
+            if (typeof args.input === 'string') {
+                return ProjectApprovalRules.normalizePath(args.input);
+            }
+            if (!args.input || typeof args.input !== 'object' || Array.isArray(args.input)) {
+                return undefined;
+            }
+            const path = args.input.path;
+            return typeof path === 'string' && path.trim() ? ProjectApprovalRules.normalizePath(path) : undefined;
+        }
+        return undefined;
+    }
+    static normalizePath(path) {
+        const trimmed = path.trim();
+        if (trimmed === './' || trimmed === '.') {
+            return '.';
+        }
+        return trimmed.replace(/\/+$/, '') || '.';
+    }
+    static buildLegacyVerificationPrefix(command) {
+        const argv = command.split(' ').filter(Boolean);
+        if (argv[0] !== 'yarn') {
+            return undefined;
+        }
+        const subcommand = argv[1];
+        if (subcommand === 'test' || subcommand === 'build' || subcommand === 'lint' || subcommand === 'vitest') {
+            return `yarn ${subcommand}`;
+        }
+        return undefined;
+    }
+    static createShellRule(command) {
+        const policy = classifyShellCommandPolicy(command, {
+            toolName: 'run_shell_mutate',
+            rules: DEFAULT_MUTATE_RULES,
+            allowUnknown: true,
+        });
+        if (!('error' in policy) && ProjectApprovalRules.shouldUseVerificationPrefixApproval(command, policy.scope, policy.capability)) {
+            return {
+                tool: 'run_shell_mutate',
+                mode: 'prefix',
+                command: ProjectApprovalRules.buildVerificationPrefix(command),
+                scope: policy.scope,
+                capability: policy.capability,
+                createdAt: new Date().toISOString(),
+            };
+        }
+        if (!('error' in policy)) {
+            return {
+                tool: 'run_shell_mutate',
+                mode: 'exact',
+                command,
+                scope: policy.scope,
+                capability: policy.capability,
+                createdAt: new Date().toISOString(),
+            };
+        }
+        return {
+            tool: 'run_shell_mutate',
+            mode: 'exact',
+            command,
+            scope: 'workspace',
+            capability: 'unknown_workspace',
+            createdAt: new Date().toISOString(),
+        };
+    }
+    static shouldUseVerificationPrefixApproval(command, scope, capability) {
+        if (scope !== 'workspace' || capability !== 'verification') {
+            return false;
+        }
+        return ProjectApprovalRules.buildVerificationPrefix(command) !== command;
+    }
+    static buildVerificationPrefix(command) {
+        const argv = command.split(' ').filter(Boolean);
+        if (argv.length === 0) {
+            return command;
+        }
+        if (argv[0] === 'yarn' && typeof argv[1] === 'string' && !argv[1].startsWith('-')) {
+            return `${argv[0]} ${argv[1]}`;
+        }
+        if (argv[0] === 'vitest' && typeof argv[1] === 'string' && !argv[1].startsWith('-')) {
+            return `${argv[0]} ${argv[1]}`;
+        }
+        if (argv[0] === 'tsc') {
+            return 'tsc';
+        }
+        return command;
+    }
+    static canonicalizeVerificationCommand(command) {
+        const argv = command.split(' ').filter(Boolean);
+        if (argv.length === 0) {
+            return command;
+        }
+        if (argv[0] === 'npx' && typeof argv[1] === 'string') {
+            if (argv[1] === 'tsc') {
+                return ['tsc', ...argv.slice(2)].join(' ');
+            }
+            if (argv[1] === 'vitest') {
+                return ['vitest', ...argv.slice(2)].join(' ');
+            }
+            if (argv[1] === 'eslint') {
+                return ['eslint', ...argv.slice(2)].join(' ');
+            }
+        }
+        if (argv[0] === './node_modules/.bin/tsc' || argv[0] === 'node_modules/.bin/tsc') {
+            return ['tsc', ...argv.slice(1)].join(' ');
+        }
+        if (argv[0] === './node_modules/.bin/vitest' || argv[0] === 'node_modules/.bin/vitest') {
+            return ['vitest', ...argv.slice(1)].join(' ');
+        }
+        if (argv[0] === './node_modules/.bin/eslint' || argv[0] === 'node_modules/.bin/eslint') {
+            return ['eslint', ...argv.slice(1)].join(' ');
+        }
+        return command;
+    }
+}
+//# sourceMappingURL=service.js.map

package/dist/src/core/approvals/remembered-rules/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../../../src/core/approvals/remembered-rules/service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GAGrB,MAAM,kDAAkD,CAAC;AAG1D;;;GAGG;AACH,MAAM,OAAO,oBAAoB;IAC/B,MAAM,CAAC,gBAAgB,CAAC,OAAe;QACrC,OAAO,oBAAoB,CAAC,+BAA+B,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,IAInB;QACC,MAAM,MAAM,GAAG,oBAAoB,CAAC,aAAa,CAAC;YAChD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,OAAO,MAAM,KAAK,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;YAC1E,CAAC;YAED,OAAO,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,gBAAgB,CAAC,OAAe;QACrC,OAAO,oBAAoB,CAAC,eAAe,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,IAAc;QACjC,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC9B,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,GAAG;gBACZ,KAAK,EAAE,WAAW;gBAClB,UAAU,EAAE,WAAW;gBACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,oBAAoB,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAC1F,OAAO,MAAM,CAAC,CAAC,CAAC;gBACd,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,MAAM;gBACf,KAAK,EAAE,mBAAmB;gBAC1B,UAAU,EAAE,iBAAiB;gBAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChB,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACrC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1F,OAAO,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAAyB;QACvC,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC9B,OAAO,kCAAkC,CAAC;QAC5C,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC5D,OAAO,SAAS,IAAI,CAAC,IAAI,mBAAmB,CAAC;QAC/C,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,OAAO,SAAS,IAAI,CAAC,OAAO,kCAAkC,CAAC;QACjE,CAAC;QAED,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,IAGpB;QACC,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACrC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACnC,OAAO,oBAAoB,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3D,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/E,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,OAAO,GAAI,IAAI,CAAC,KAA+B,CAAC,OAAO,CAAC;YAC9D,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpH,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACzF,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACnC,OAAO,oBAAoB,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxD,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/E,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,IAAI,GAAI,IAAI,CAAC,KAA4B,CAAC,IAAI,CAAC;YACrD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxG,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,IAAY;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACxC,OAAO,GAAG,CAAC;QACb,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IAC5C,CAAC;IAED,MAAM,CAAC,6BAA6B,CAAC,OAAe;QAClD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;YACxG,OAAO,QAAQ,UAAU,EAAE,CAAC;QAC9B,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,MAAM,CAAC,eAAe,CAAC,OAAe;QAC5C,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,EAAE;YACjD,QAAQ,EAAE,kBAAkB;YAC5B,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,oBAAoB,CAAC,mCAAmC,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/H,OAAO;gBACL,IAAI,EAAE,kBAAkB;gBACxB,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,oBAAoB,CAAC,uBAAuB,CAAC,OAAO,CAAC;gBAC9D,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,IAAI,EAAE,kBAAkB;gBACxB,IAAI,EAAE,OAAO;gBACb,OAAO;gBACP,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;QACJ,CAAC;QAED,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,OAAO;YACb,OAAO;YACP,KAAK,EAAE,WAAW;YAClB,UAAU,EAAE,mBAAmB;YAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,mCAAmC,CAChD,OAAe,EACf,KAAoB,EACpB,UAA8B;QAE9B,IAAI,KAAK,KAAK,WAAW,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;YAC3D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,oBAAoB,CAAC,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC;IAC3E,CAAC;IAEO,MAAM,CAAC,uBAAuB,CAAC,OAAe;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAClF,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,CAAC;QAED,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpF,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,CAAC;QAED,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,MAAM,CAAC,+BAA+B,CAAC,OAAe;QAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACrD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACzB,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACzB,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,yBAAyB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,uBAAuB,EAAE,CAAC;YACjF,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,4BAA4B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,0BAA0B,EAAE,CAAC;YACvF,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,4BAA4B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,0BAA0B,EAAE,CAAC;YACvF,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/src/core/approvals/remembered-rules/types.d.ts

@@ -0,0 +1,12 @@
+import type { RunShellCapability, RunShellScope } from '../../../core/tools/toolkits/shell-process/run-shell.js';
+export type ApprovalMode = 'exact' | 'prefix' | 'tool';
+export type ApprovalRuleTool = 'run_shell_mutate' | 'edit_file' | 'read_file' | 'list_files';
+export type ProjectApprovalRule = {
+    tool: ApprovalRuleTool;
+    mode: ApprovalMode;
+    command: string;
+    scope: RunShellScope | 'workspace' | 'outside_workspace';
+    capability: RunShellCapability | 'file_edit' | 'file_inspection';
+    createdAt: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/src/core/approvals/remembered-rules/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/approvals/remembered-rules/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,kDAAkD,CAAC;AAE1G,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEvD,MAAM,MAAM,gBAAgB,GAAG,kBAAkB,GAAG,WAAW,GAAG,WAAW,GAAG,YAAY,CAAC;AAE7F,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,aAAa,GAAG,WAAW,GAAG,mBAAmB,CAAC;IACzD,UAAU,EAAE,kBAAkB,GAAG,WAAW,GAAG,iBAAiB,CAAC;IACjE,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/src/core/approvals/remembered-rules/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/core/approvals/remembered-rules/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../src/core/approvals/remembered-rules/types.ts"],"names":[],"mappings":""}

package/dist/src/core/approvals/service.d.ts

@@ -0,0 +1,13 @@
+import type { EvaluateToolApprovalPoliciesArgs, ResolveToolApprovalArgs, ToolApprovalDecision, ToolApprovalPolicyDecision } from './types.js';
+/**
+ * Owns ordered approval-policy resolution for one tool call.
+ *
+ * Policies may allow, deny, request a human decision, or abstain. This service
+ * preserves that policy-chain behavior without owning host UI or remembered
+ * approval storage.
+ */
+export declare class ToolApprovalService {
+    static evaluate(args: EvaluateToolApprovalPoliciesArgs): Promise<ToolApprovalPolicyDecision | undefined>;
+    static resolve(args: ResolveToolApprovalArgs): Promise<ToolApprovalDecision>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/src/core/approvals/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/approvals/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gCAAgC,EAChC,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,YAAY,CAAC;AAEpB;;;;;;GAMG;AACH,qBAAa,mBAAmB;WACjB,QAAQ,CAAC,IAAI,EAAE,gCAAgC,GAAG,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC;WAWjG,OAAO,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAiCnF"}

package/dist/src/core/approvals/service.js

@@ -0,0 +1,45 @@
+/**
+ * Owns ordered approval-policy resolution for one tool call.
+ *
+ * Policies may allow, deny, request a human decision, or abstain. This service
+ * preserves that policy-chain behavior without owning host UI or remembered
+ * approval storage.
+ */
+export class ToolApprovalService {
+    static async evaluate(args) {
+        for (const policy of args.policies) {
+            const decision = await policy(args.context);
+            if (decision) {
+                return decision;
+            }
+        }
+        return undefined;
+    }
+    static async resolve(args) {
+        let requestReason;
+        for (const policy of args.policies) {
+            const decision = await policy(args.context);
+            if (!decision) {
+                continue;
+            }
+            if (decision.type === 'deny') {
+                return { approved: false, reason: decision.reason };
+            }
+            if (decision.type === 'allow') {
+                return { approved: true, reason: decision.reason };
+            }
+            requestReason ??= decision.reason;
+        }
+        if (!requestReason) {
+            return { approved: true };
+        }
+        if (!args.requestHumanApproval) {
+            return {
+                approved: false,
+                reason: `No approval handler configured for ${args.context.call.tool}${requestReason ? `: ${requestReason}` : ''}`,
+            };
+        }
+        return args.requestHumanApproval(args.context, requestReason);
+    }
+}
+//# sourceMappingURL=service.js.map

package/dist/src/core/approvals/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../../src/core/approvals/service.ts"],"names":[],"mappings":"AAOA;;;;;;GAMG;AACH,MAAM,OAAO,mBAAmB;IAC9B,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAsC;QAC1D,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAA6B;QAChD,IAAI,aAAiC,CAAC;QAEtC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,SAAS;YACX,CAAC;YAED,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC7B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;YACtD,CAAC;YAED,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC9B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrD,CAAC;YAED,aAAa,KAAK,QAAQ,CAAC,MAAM,CAAC;QACpC,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC/B,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,sCAAsC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACnH,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAChE,CAAC;CACF"}

package/dist/src/core/approvals/types.d.ts

@@ -1,4 +1,4 @@
-import type { ToolCall, ToolDefinition } from '../types.js';
+import type { ToolCall, ToolDefinition } from '../../core/types.js';
 export type ToolApprovalDecision = {
     approved: boolean;
     reason?: string;
@@ -20,4 +20,27 @@ export type ToolApprovalPolicyContext = {
 };
 export type ToolApprovalPolicy = (context: ToolApprovalPolicyContext) => ToolApprovalPolicyDecision | undefined | Promise<ToolApprovalPolicyDecision | undefined>;
 export type ToolApprovalSurface = (context: ToolApprovalPolicyContext) => Promise<ToolApprovalDecision>;
+export type EvaluateToolApprovalPoliciesArgs = {
+    policies: ToolApprovalPolicy[];
+    context: ToolApprovalPolicyContext;
+};
+export type ResolveToolApprovalArgs = EvaluateToolApprovalPoliciesArgs & {
+    requestHumanApproval?: (context: ToolApprovalPolicyContext, reason?: string) => Promise<ToolApprovalDecision>;
+};
+export type PendingToolApprovalView = {
+    tool: string;
+    callId: string;
+    input: unknown;
+    requestedAt: string;
+};
+export type RequestPendingToolApprovalArgs = {
+    call: ToolCall;
+    tool: ToolDefinition;
+    createView?: (call: ToolCall, tool: ToolDefinition) => PendingToolApprovalView;
+    publish?: (view: PendingToolApprovalView, call: ToolCall, tool: ToolDefinition) => void;
+    storePending?: (pending: {
+        view: PendingToolApprovalView;
+        resolve: (decision: ToolApprovalDecision) => void;
+    }) => void;
+};
 //# sourceMappingURL=types.d.ts.map

package/dist/src/core/approvals/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/approvals/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE5D,MAAM,MAAM,oBAAoB,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1E,MAAM,MAAM,0BAA0B,GAClC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,cAAc,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,CAC/B,OAAO,EAAE,yBAAyB,KAC/B,0BAA0B,GAAG,SAAS,GAAG,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAAC;AAE9F,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,EAAE,yBAAyB,KAC/B,OAAO,CAAC,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/approvals/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEhE,MAAM,MAAM,oBAAoB,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1E,MAAM,MAAM,0BAA0B,GAClC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,cAAc,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,CAC/B,OAAO,EAAE,yBAAyB,KAC/B,0BAA0B,GAAG,SAAS,GAAG,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAAC;AAE9F,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,EAAE,yBAAyB,KAC/B,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAEnC,MAAM,MAAM,gCAAgC,GAAG;IAC7C,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,OAAO,EAAE,yBAAyB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,gCAAgC,GAAG;IACvE,oBAAoB,CAAC,EAAE,CAAC,OAAO,EAAE,yBAAyB,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC/G,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IAC3C,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,cAAc,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,KAAK,uBAAuB,CAAC;IAC/E,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,KAAK,IAAI,CAAC;IACxF,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,uBAAuB,CAAC;QAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,oBAAoB,KAAK,IAAI,CAAA;KAAE,KAAK,IAAI,CAAC;CACxH,CAAC"}

package/dist/src/core/auth/index.d.ts

@@ -0,0 +1,4 @@
+export { ProviderCredentialRepository } from './provider-credentials.js';
+export { OpenAiOAuthService } from './openai-oauth.js';
+export type { OpenAiIdTokenClaims, OpenAiOAuthCredential, OpenAiOAuthLoginOptions, OpenAiOAuthRefreshOptions, OpenAiOAuthTokenResponse, PkceCodes, ProviderCredentialStore, ProviderCredentialSummary, StoredProviderCredential, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/core/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,SAAS,EACT,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,YAAY,CAAC"}

package/dist/src/core/auth/index.js

@@ -0,0 +1,3 @@
+export { ProviderCredentialRepository } from './provider-credentials.js';
+export { OpenAiOAuthService } from './openai-oauth.js';
+//# sourceMappingURL=index.js.map

package/dist/src/core/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/src/core/auth/openai-oauth.d.ts

@@ -1,68 +1,48 @@
-import type { StoredProviderCredential } from './provider-credentials.js';
+import type { OpenAiIdTokenClaims, OpenAiOAuthCredential, OpenAiOAuthLoginOptions, OpenAiOAuthRefreshOptions, OpenAiOAuthTokenResponse, PkceCodes } from './types.js';
 export declare const OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 export declare const OPENAI_AUTH_ISSUER = "https://auth.openai.com";
 export declare const OPENAI_CODEX_RESPONSES_ENDPOINT = "https://chatgpt.com/backend-api/codex/responses";
 export declare const OPENAI_OAUTH_CALLBACK_PATH = "/auth/callback";
 export declare const DEFAULT_OPENAI_OAUTH_PORT = 1455;
-export type PkceCodes = {
-    verifier: string;
-    challenge: string;
-};
-export type OpenAiOAuthTokenResponse = {
-    id_token?: string;
-    access_token: string;
-    refresh_token: string;
-    expires_in?: number;
-};
-export type OpenAiOAuthCredential = Extract<StoredProviderCredential, {
-    type: 'oauth';
-}>;
-export type OpenAiOAuthLoginOptions = {
-    port?: number;
-    openBrowser?: boolean;
-    timeoutMs?: number;
-    fetchImpl?: typeof fetch;
-    openUrl?: (url: string) => Promise<void> | void;
-    onAuthorizeUrl?: (url: string) => void;
-};
-export type OpenAiOAuthRefreshOptions = {
-    refreshToken: string;
-    fetchImpl?: typeof fetch;
-};
-export type OpenAiIdTokenClaims = {
-    chatgpt_account_id?: string;
-    organizations?: Array<{
-        id?: string;
-    }>;
-    'https://api.openai.com/auth'?: {
-        chatgpt_account_id?: string;
+/**
+ * OpenAI account sign-in service. It owns OAuth URL construction, callback
+ * handling, token exchange/refresh, credential creation, and browser launch.
+ */
+export declare class OpenAiOAuthService {
+    static generatePkceCodes(): PkceCodes;
+    static generateState(): string;
+    static buildAuthorizeUrl(args: {
+        redirectUri: string;
+        pkce: PkceCodes;
+        state: string;
+        originator?: string;
+    }): string;
+    static runBrowserLogin(options?: OpenAiOAuthLoginOptions): Promise<OpenAiOAuthCredential>;
+    static refreshCredential(credential: OpenAiOAuthCredential, options?: {
+        fetchImpl?: typeof fetch;
+    }): Promise<OpenAiOAuthCredential>;
+    static exchangeCode(args: {
+        code: string;
+        redirectUri: string;
+        codeVerifier: string;
+        fetchImpl?: typeof fetch;
+    }): Promise<OpenAiOAuthTokenResponse>;
+    static refreshToken(options: OpenAiOAuthRefreshOptions): Promise<OpenAiOAuthTokenResponse>;
+    static createCredential(tokens: OpenAiOAuthTokenResponse, now?: number): OpenAiOAuthCredential;
+    static parseJwtClaims(token: string): OpenAiIdTokenClaims | undefined;
+    static extractAccountId(tokens: Pick<OpenAiOAuthTokenResponse, 'id_token' | 'access_token'>): string | undefined;
+    static extractAccountIdFromClaims(claims: OpenAiIdTokenClaims): string | undefined;
+    static buildOpenUrlCommand(url: string, platform?: NodeJS.Platform): {
+        command: string;
+        args: string[];
     };
-};
-export declare function generatePkceCodes(): PkceCodes;
-export declare function generateOAuthState(): string;
-export declare function buildOpenAiAuthorizeUrl(args: {
-    redirectUri: string;
-    pkce: PkceCodes;
-    state: string;
-    originator?: string;
-}): string;
-export declare function runOpenAiBrowserOAuthLogin(options?: OpenAiOAuthLoginOptions): Promise<OpenAiOAuthCredential>;
-export declare function refreshOpenAiOAuthCredential(credential: OpenAiOAuthCredential, options?: {
-    fetchImpl?: typeof fetch;
-}): Promise<OpenAiOAuthCredential>;
-export declare function exchangeOpenAiOAuthCode(args: {
-    code: string;
-    redirectUri: string;
-    codeVerifier: string;
-    fetchImpl?: typeof fetch;
-}): Promise<OpenAiOAuthTokenResponse>;
-export declare function refreshOpenAiOAuthToken(options: OpenAiOAuthRefreshOptions): Promise<OpenAiOAuthTokenResponse>;
-export declare function createOpenAiOAuthCredential(tokens: OpenAiOAuthTokenResponse, now?: number): OpenAiOAuthCredential;
-export declare function parseJwtClaims(token: string): OpenAiIdTokenClaims | undefined;
-export declare function extractOpenAiAccountId(tokens: Pick<OpenAiOAuthTokenResponse, 'id_token' | 'access_token'>): string | undefined;
-export declare function extractOpenAiAccountIdFromClaims(claims: OpenAiIdTokenClaims): string | undefined;
-export declare function buildOpenUrlCommand(url: string, platform?: NodeJS.Platform): {
-    command: string;
-    args: string[];
-};
+    private static startCallbackServer;
+    private static normalizeTokenResponse;
+    private static base64UrlEncode;
+    private static getServerPort;
+    private static openUrlInBrowser;
+    private static escapePowerShellSingleQuotedString;
+    private static renderCallbackHtml;
+    private static escapeHtml;
+}
 //# sourceMappingURL=openai-oauth.d.ts.map

package/dist/src/core/auth/openai-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openai-oauth.d.ts","sourceRoot":"","sources":["../../../../src/core/auth/openai-oauth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAE1E,eAAO,MAAM,sBAAsB,iCAAiC,CAAC;AACrE,eAAO,MAAM,kBAAkB,4BAA4B,CAAC;AAC5D,eAAO,MAAM,+BAA+B,oDAAoD,CAAC;AACjG,eAAO,MAAM,0BAA0B,mBAAmB,CAAC;AAC3D,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,wBAAwB,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAEzF,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAChD,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvC,6BAA6B,CAAC,EAAE;QAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;CACH,CAAC;AAEF,wBAAgB,iBAAiB,IAAI,SAAS,CAI7C;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,MAAM,CAeT;AAED,wBAAsB,0BAA0B,CAC9C,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,qBAAqB,CAAC,CA2BhC;AAED,wBAAsB,4BAA4B,CAChD,UAAU,EAAE,qBAAqB,EACjC,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CAAO,GACzC,OAAO,CAAC,qBAAqB,CAAC,CAUhC;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAmBpC;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,wBAAwB,CAAC,CAiBnC;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,wBAAwB,EAChC,GAAG,SAAa,GACf,qBAAqB,CAavB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAW7E;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC,wBAAwB,EAAE,UAAU,GAAG,cAAc,CAAC,GAAG,MAAM,GAAG,SAAS,CAS9H;AAED,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS,CAMhG;AA+ID,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAclI"}
+{"version":3,"file":"openai-oauth.d.ts","sourceRoot":"","sources":["../../../../src/core/auth/openai-oauth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,mBAAmB,EAEnB,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,SAAS,EACV,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,sBAAsB,iCAAiC,CAAC;AACrE,eAAO,MAAM,kBAAkB,4BAA4B,CAAC;AAC5D,eAAO,MAAM,+BAA+B,oDAAoD,CAAC;AACjG,eAAO,MAAM,0BAA0B,mBAAmB,CAAC;AAC3D,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C;;;GAGG;AACH,qBAAa,kBAAkB;IAC7B,MAAM,CAAC,iBAAiB,IAAI,SAAS;IAMrC,MAAM,CAAC,aAAa,IAAI,MAAM;IAI9B,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;QAC7B,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,EAAE,SAAS,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GAAG,MAAM;WAiBG,eAAe,CAAC,OAAO,GAAE,uBAA4B,GAAG,OAAO,CAAC,qBAAqB,CAAC;WA6BtF,iBAAiB,CAC5B,UAAU,EAAE,qBAAqB,EACjC,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;KAAO,GACzC,OAAO,CAAC,qBAAqB,CAAC;WAYpB,YAAY,CAAC,IAAI,EAAE;QAC9B,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;KAC1B,GAAG,OAAO,CAAC,wBAAwB,CAAC;WAqBxB,YAAY,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAmBhG,MAAM,CAAC,gBAAgB,CACrB,MAAM,EAAE,wBAAwB,EAChC,GAAG,SAAa,GACf,qBAAqB;IAexB,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS;IAarE,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,wBAAwB,EAAE,UAAU,GAAG,cAAc,CAAC,GAAG,MAAM,GAAG,SAAS;IAWhH,MAAM,CAAC,0BAA0B,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS;IAQlF,MAAM,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE;mBAgBrG,mBAAmB;IAgGxC,OAAO,CAAC,MAAM,CAAC,sBAAsB;IAqBrC,OAAO,CAAC,MAAM,CAAC,eAAe;IAI9B,OAAO,CAAC,MAAM,CAAC,aAAa;mBAKP,gBAAgB;IASrC,OAAO,CAAC,MAAM,CAAC,kCAAkC;IAIjD,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAWjC,OAAO,CAAC,MAAM,CAAC,UAAU;CAQ1B"}