@solongate/policy-engine 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,246 @@
+import { PolicySet, PolicyRule, ExecutionRequest, PolicyDecision, TrustLevel } from '@solongate/core';
+
+interface ValidationResult {
+    readonly valid: boolean;
+    readonly errors: readonly string[];
+    readonly warnings: readonly string[];
+}
+declare function validatePolicyRule(input: unknown): ValidationResult;
+declare function validatePolicySet(input: unknown): ValidationResult;
+
+interface SecurityWarning {
+    readonly level: 'WARNING' | 'CRITICAL';
+    readonly code: string;
+    readonly message: string;
+    readonly ruleId?: string;
+    readonly recommendation: string;
+}
+/** Analyzes a policy set and returns security warnings. Pure function. */
+declare function analyzeSecurityWarnings(policySet: PolicySet): readonly SecurityWarning[];
+
+/**
+ * A versioned snapshot of a policy set.
+ * Immutable once created - modifications create new versions.
+ */
+interface PolicyVersion {
+    readonly version: number;
+    readonly policySet: PolicySet;
+    readonly hash: string;
+    readonly reason: string;
+    readonly createdBy: string;
+    readonly createdAt: string;
+}
+/**
+ * Diff between two policy versions.
+ */
+interface PolicyDiff {
+    readonly added: readonly PolicyRule[];
+    readonly removed: readonly PolicyRule[];
+    readonly modified: readonly {
+        readonly old: PolicyRule;
+        readonly new: PolicyRule;
+    }[];
+}
+/**
+ * In-memory versioned policy store.
+ * Stores complete history of policy changes with cryptographic hashes.
+ *
+ * Security properties:
+ * - Immutable versions: once saved, a version cannot be modified
+ * - Hash chain: each version includes SHA256 of the policy content
+ * - Full history: no version is ever deleted
+ */
+declare class PolicyStore {
+    private readonly versions;
+    /**
+     * Saves a new version of a policy set.
+     * The version number auto-increments.
+     */
+    saveVersion(policySet: PolicySet, reason: string, createdBy: string): PolicyVersion;
+    /**
+     * Gets a specific version of a policy set.
+     */
+    getVersion(id: string, version: number): PolicyVersion | null;
+    /**
+     * Gets the latest version of a policy set.
+     */
+    getLatest(id: string): PolicyVersion | null;
+    /**
+     * Gets the full version history of a policy set.
+     */
+    getHistory(id: string): readonly PolicyVersion[];
+    /**
+     * Rolls back to a previous version by creating a new version
+     * with the same content as the target version.
+     */
+    rollback(id: string, toVersion: number): PolicyVersion;
+    /**
+     * Computes a diff between two policy versions.
+     */
+    diff(v1: PolicyVersion, v2: PolicyVersion): PolicyDiff;
+    /**
+     * Computes SHA256 hash of a policy set for integrity verification.
+     */
+    computeHash(policySet: PolicySet): string;
+}
+
+/**
+ * PolicyEngine is the primary interface for policy evaluation.
+ *
+ * Wraps pure evaluation functions with:
+ * - Policy set management (load, validate, swap)
+ * - Timeout protection
+ * - Warning aggregation
+ * - Optional versioned policy store
+ */
+declare class PolicyEngine {
+    private policySet;
+    private readonly timeoutMs;
+    private readonly store;
+    constructor(options?: {
+        policySet?: PolicySet;
+        timeoutMs?: number;
+        store?: PolicyStore;
+    });
+    /**
+     * Evaluates an execution request against the current policy set.
+     * Never throws for denials - denial is a normal outcome, not an error.
+     */
+    evaluate(request: ExecutionRequest): PolicyDecision;
+    /**
+     * Loads a new policy set, replacing the current one.
+     * Validates before accepting. Auto-saves version when store is present.
+     */
+    loadPolicySet(policySet: PolicySet, options?: {
+        reason?: string;
+        createdBy?: string;
+    }): ValidationResult;
+    /**
+     * Rolls back to a previous policy version.
+     * Only available when a PolicyStore is configured.
+     */
+    rollback(version: number): PolicyVersion;
+    getPolicySet(): Readonly<PolicySet>;
+    getSecurityWarnings(): readonly SecurityWarning[];
+    getStore(): PolicyStore | null;
+    reset(): void;
+}
+
+/**
+ * Evaluates a policy set against an execution request.
+ *
+ * Pure function: no side effects, no I/O, fully deterministic.
+ *
+ * Algorithm:
+ * 1. Sort rules by priority (ascending - lower number = higher priority)
+ * 2. Find the first matching rule
+ * 3. If a rule matches, return its effect
+ * 4. If no rule matches, return DENY (default-deny)
+ */
+declare function evaluatePolicy(policySet: PolicySet, request: ExecutionRequest): PolicyDecision;
+
+/**
+ * Pure function: determines if a policy rule matches an execution request.
+ * No side effects. No I/O. Fully deterministic.
+ */
+declare function ruleMatchesRequest(rule: PolicyRule, request: ExecutionRequest): boolean;
+/**
+ * Glob-style tool name pattern matching.
+ * Supports:
+ *   '*'        → match all
+ *   'prefix*'  → starts with prefix
+ *   '*suffix'  → ends with suffix
+ *   '*infix*'  → contains infix
+ * Does NOT support regex (ReDoS prevention).
+ */
+declare function toolPatternMatches(pattern: string, toolName: string): boolean;
+declare function trustLevelMeetsMinimum(actual: TrustLevel, minimum: TrustLevel): boolean;
+
+/**
+ * Creates the default "deny all" policy set.
+ * This is the starting policy for any new SolonGate deployment.
+ */
+declare function createDefaultDenyPolicySet(): PolicySet;
+/**
+ * Creates a permissive "allow all" policy set.
+ * Allows all tool executions — useful for development or when
+ * using SolonGate only for monitoring and audit logging.
+ */
+declare function createPermissivePolicySet(): PolicySet;
+/**
+ * Creates a read-only policy set for a specific tool pattern.
+ * Allows reads for VERIFIED requests only.
+ */
+declare function createReadOnlyPolicySet(toolPattern: string): PolicySet;
+/**
+ * Creates a sandboxed policy set for a given root directory.
+ * Allows file operations within rootDir, blocks dangerous commands,
+ * denies access to sensitive files.
+ */
+declare function createSandboxedPolicySet(rootDir: string): PolicySet;
+
+type PathConstraints = NonNullable<PolicyRule['pathConstraints']>;
+/**
+ * Normalizes a file path for consistent matching.
+ * Resolves . and .. segments, normalizes separators.
+ */
+declare function normalizePath(path: string): string;
+/**
+ * Checks if a path is within a root directory (sandbox boundary).
+ * Prevents escaping via .., symlinks, etc.
+ */
+declare function isWithinRoot(path: string, root: string): boolean;
+/**
+ * Glob-style path pattern matching.
+ * Supports:
+ * - * matches any single path segment (not /)
+ * - ** matches any number of path segments
+ * - Exact match
+ *
+ * Does NOT support regex (ReDoS prevention).
+ */
+declare function matchPathPattern(path: string, pattern: string): boolean;
+/**
+ * Checks if a path is allowed by the given constraints.
+ *
+ * Evaluation order:
+ * 1. If rootDirectory is set, path must be within it
+ * 2. If denied list exists, path must NOT match any denied pattern
+ * 3. If allowed list exists, path must match at least one allowed pattern
+ * 4. If neither list exists, path is allowed (constraints are optional)
+ */
+declare function isPathAllowed(path: string, constraints: PathConstraints): boolean;
+/**
+ * Extracts path-like arguments from tool call arguments.
+ * Heuristic: any string argument containing / or \ is treated as a path.
+ */
+declare function extractPathArguments(args: Readonly<Record<string, unknown>>): string[];
+
+type CommandConstraints = NonNullable<PolicyRule['commandConstraints']>;
+/**
+ * Extracts command-like arguments from tool call arguments.
+ * Looks for known field names and string values that look like commands.
+ */
+declare function extractCommandArguments(args: Readonly<Record<string, unknown>>): string[];
+/**
+ * Glob-style command pattern matching.
+ * Matches against the command string (first word) or full command line.
+ *
+ * Patterns:
+ *   'ls'       → exact match on command name
+ *   'git*'     → command starts with 'git'
+ *   '*sql*'    → command contains 'sql'
+ *   'rm -rf *' → full command line starts with 'rm -rf '
+ */
+declare function matchCommandPattern(command: string, pattern: string): boolean;
+/**
+ * Checks if a command is allowed by the given constraints.
+ *
+ * Evaluation order:
+ * 1. If denied list exists, command must NOT match any denied pattern
+ * 2. If allowed list exists, command must match at least one allowed pattern
+ * 3. If neither list exists, command is allowed (constraints are optional)
+ */
+declare function isCommandAllowed(command: string, constraints: CommandConstraints): boolean;
+
+export { type PolicyDiff, PolicyEngine, PolicyStore, type PolicyVersion, type SecurityWarning, type ValidationResult, analyzeSecurityWarnings, createDefaultDenyPolicySet, createPermissivePolicySet, createReadOnlyPolicySet, createSandboxedPolicySet, evaluatePolicy, extractCommandArguments, extractPathArguments, isCommandAllowed, isPathAllowed, isWithinRoot, matchCommandPattern, matchPathPattern, normalizePath, ruleMatchesRequest, toolPatternMatches, trustLevelMeetsMinimum, validatePolicyRule, validatePolicySet };

package/dist/index.js

@@ -0,0 +1,843 @@
+import { TrustLevel, DEFAULT_POLICY_EFFECT, PolicyRuleSchema, UNSAFE_CONFIGURATION_WARNINGS, PolicySetSchema, MAX_RULES_PER_POLICY_SET, Permission, PolicyEffect, POLICY_EVALUATION_TIMEOUT_MS } from '@solongate/core';
+import { createHash } from 'crypto';
+
+// src/engine.ts
+
+// src/path-matcher.ts
+function normalizePath(path) {
+  let normalized = path.replace(/\\/g, "/");
+  if (normalized.length > 1 && normalized.endsWith("/")) {
+    normalized = normalized.slice(0, -1);
+  }
+  const parts = normalized.split("/");
+  const resolved = [];
+  for (const part of parts) {
+    if (part === "." || part === "") {
+      if (resolved.length === 0) resolved.push("");
+      continue;
+    }
+    if (part === "..") {
+      if (resolved.length > 1) {
+        resolved.pop();
+      }
+      continue;
+    }
+    resolved.push(part);
+  }
+  return resolved.join("/") || "/";
+}
+function isWithinRoot(path, root) {
+  const normalizedPath = normalizePath(path);
+  const normalizedRoot = normalizePath(root);
+  if (normalizedPath === normalizedRoot) return true;
+  return normalizedPath.startsWith(normalizedRoot + "/");
+}
+function matchPathPattern(path, pattern) {
+  const normalizedPath = normalizePath(path);
+  const normalizedPattern = normalizePath(pattern);
+  if (normalizedPattern === "*") return true;
+  if (normalizedPattern === normalizedPath) return true;
+  const patternParts = normalizedPattern.split("/");
+  const pathParts = normalizedPath.split("/");
+  return matchParts(pathParts, 0, patternParts, 0);
+}
+function matchParts(pathParts, pi, patternParts, qi) {
+  while (pi < pathParts.length && qi < patternParts.length) {
+    const pattern = patternParts[qi];
+    if (pattern === "**") {
+      if (qi === patternParts.length - 1) return true;
+      for (let i = pi; i <= pathParts.length; i++) {
+        if (matchParts(pathParts, i, patternParts, qi + 1)) {
+          return true;
+        }
+      }
+      return false;
+    }
+    if (pattern === "*") {
+      pi++;
+      qi++;
+      continue;
+    }
+    if (pattern.includes("*")) {
+      if (!matchSegmentGlob(pathParts[pi], pattern)) {
+        return false;
+      }
+      pi++;
+      qi++;
+      continue;
+    }
+    if (pattern !== pathParts[pi]) {
+      return false;
+    }
+    pi++;
+    qi++;
+  }
+  while (qi < patternParts.length && patternParts[qi] === "**") {
+    qi++;
+  }
+  return pi === pathParts.length && qi === patternParts.length;
+}
+function isPathAllowed(path, constraints) {
+  if (constraints.rootDirectory) {
+    if (!isWithinRoot(path, constraints.rootDirectory)) {
+      return false;
+    }
+  }
+  if (constraints.denied && constraints.denied.length > 0) {
+    for (const pattern of constraints.denied) {
+      if (matchPathPattern(path, pattern)) {
+        return false;
+      }
+    }
+  }
+  if (constraints.allowed && constraints.allowed.length > 0) {
+    let matchesAllowed = false;
+    for (const pattern of constraints.allowed) {
+      if (matchPathPattern(path, pattern)) {
+        matchesAllowed = true;
+        break;
+      }
+    }
+    if (!matchesAllowed) return false;
+  }
+  return true;
+}
+function matchSegmentGlob(segment, pattern) {
+  const startsWithStar = pattern.startsWith("*");
+  const endsWithStar = pattern.endsWith("*");
+  if (pattern === "*") return true;
+  if (startsWithStar && endsWithStar) {
+    const infix = pattern.slice(1, -1);
+    return segment.toLowerCase().includes(infix.toLowerCase());
+  }
+  if (startsWithStar) {
+    const suffix = pattern.slice(1);
+    return segment.toLowerCase().endsWith(suffix.toLowerCase());
+  }
+  if (endsWithStar) {
+    const prefix = pattern.slice(0, -1);
+    return segment.toLowerCase().startsWith(prefix.toLowerCase());
+  }
+  const starIdx = pattern.indexOf("*");
+  if (starIdx !== -1) {
+    const prefix = pattern.slice(0, starIdx);
+    const suffix = pattern.slice(starIdx + 1);
+    const seg = segment.toLowerCase();
+    return seg.startsWith(prefix.toLowerCase()) && seg.endsWith(suffix.toLowerCase()) && seg.length >= prefix.length + suffix.length;
+  }
+  return segment === pattern;
+}
+function extractPathArguments(args) {
+  const paths = [];
+  for (const value of Object.values(args)) {
+    if (typeof value === "string" && (value.includes("/") || value.includes("\\"))) {
+      paths.push(value);
+    }
+  }
+  return paths;
+}
+
+// src/command-matcher.ts
+var COMMAND_FIELDS = /* @__PURE__ */ new Set([
+  "command",
+  "cmd",
+  "query",
+  "code",
+  "script",
+  "shell",
+  "exec",
+  "sql",
+  "expression"
+]);
+function extractCommandArguments(args) {
+  const commands = [];
+  for (const [key, value] of Object.entries(args)) {
+    if (typeof value !== "string") continue;
+    if (COMMAND_FIELDS.has(key.toLowerCase())) {
+      commands.push(value);
+    }
+  }
+  return commands;
+}
+function matchCommandPattern(command, pattern) {
+  if (pattern === "*") return true;
+  const normalizedCommand = command.trim().toLowerCase();
+  const normalizedPattern = pattern.trim().toLowerCase();
+  if (normalizedPattern === normalizedCommand) return true;
+  const startsWithStar = normalizedPattern.startsWith("*");
+  const endsWithStar = normalizedPattern.endsWith("*");
+  if (startsWithStar && endsWithStar) {
+    const infix = normalizedPattern.slice(1, -1);
+    return infix.length > 0 && normalizedCommand.includes(infix);
+  }
+  if (endsWithStar) {
+    const prefix = normalizedPattern.slice(0, -1);
+    return normalizedCommand.startsWith(prefix);
+  }
+  if (startsWithStar) {
+    const suffix = normalizedPattern.slice(1);
+    return normalizedCommand.endsWith(suffix);
+  }
+  const commandName = normalizedCommand.split(/\s+/)[0] ?? "";
+  return commandName === normalizedPattern;
+}
+function isCommandAllowed(command, constraints) {
+  if (constraints.denied && constraints.denied.length > 0) {
+    for (const pattern of constraints.denied) {
+      if (matchCommandPattern(command, pattern)) {
+        return false;
+      }
+    }
+  }
+  if (constraints.allowed && constraints.allowed.length > 0) {
+    let matchesAllowed = false;
+    for (const pattern of constraints.allowed) {
+      if (matchCommandPattern(command, pattern)) {
+        matchesAllowed = true;
+        break;
+      }
+    }
+    if (!matchesAllowed) return false;
+  }
+  return true;
+}
+
+// src/matcher.ts
+function ruleMatchesRequest(rule, request) {
+  if (!rule.enabled) return false;
+  if (rule.permission !== request.requiredPermission) return false;
+  if (!toolPatternMatches(rule.toolPattern, request.toolName)) return false;
+  if (!trustLevelMeetsMinimum(request.context.trustLevel, rule.minimumTrustLevel)) {
+    return false;
+  }
+  if (rule.argumentConstraints) {
+    if (!argumentConstraintsMatch(rule.argumentConstraints, request.arguments)) {
+      return false;
+    }
+  }
+  if (rule.pathConstraints) {
+    const satisfied = pathConstraintsMatch(rule.pathConstraints, request.arguments);
+    if (rule.effect === "DENY") {
+      if (satisfied) return false;
+    } else {
+      if (!satisfied) return false;
+    }
+  }
+  if (rule.commandConstraints) {
+    const satisfied = commandConstraintsMatch(rule.commandConstraints, request.arguments);
+    if (rule.effect === "DENY") {
+      if (satisfied) return false;
+    } else {
+      if (!satisfied) return false;
+    }
+  }
+  return true;
+}
+function toolPatternMatches(pattern, toolName) {
+  if (pattern === "*") return true;
+  const startsWithStar = pattern.startsWith("*");
+  const endsWithStar = pattern.endsWith("*");
+  if (startsWithStar && endsWithStar) {
+    const infix = pattern.slice(1, -1);
+    return infix.length > 0 && toolName.includes(infix);
+  }
+  if (endsWithStar) {
+    const prefix = pattern.slice(0, -1);
+    return toolName.startsWith(prefix);
+  }
+  if (startsWithStar) {
+    const suffix = pattern.slice(1);
+    return toolName.endsWith(suffix);
+  }
+  return pattern === toolName;
+}
+var TRUST_LEVEL_ORDER = {
+  [TrustLevel.UNTRUSTED]: 0,
+  [TrustLevel.VERIFIED]: 1,
+  [TrustLevel.TRUSTED]: 2
+};
+function trustLevelMeetsMinimum(actual, minimum) {
+  return (TRUST_LEVEL_ORDER[actual] ?? -1) >= (TRUST_LEVEL_ORDER[minimum] ?? Infinity);
+}
+function argumentConstraintsMatch(constraints, args) {
+  for (const [key, constraint] of Object.entries(constraints)) {
+    if (!(key in args)) return false;
+    const argValue = args[key];
+    if (typeof constraint === "string") {
+      if (constraint === "*") continue;
+      if (typeof argValue === "string") {
+        if (argValue !== constraint) return false;
+      } else {
+        return false;
+      }
+      continue;
+    }
+    if (typeof constraint === "object" && constraint !== null && !Array.isArray(constraint)) {
+      const ops = constraint;
+      const strValue = typeof argValue === "string" ? argValue : void 0;
+      const numValue = typeof argValue === "number" ? argValue : void 0;
+      if ("$contains" in ops && typeof ops.$contains === "string") {
+        if (!strValue || !strValue.includes(ops.$contains)) return false;
+      }
+      if ("$notContains" in ops && typeof ops.$notContains === "string") {
+        if (strValue && strValue.includes(ops.$notContains)) return false;
+      }
+      if ("$startsWith" in ops && typeof ops.$startsWith === "string") {
+        if (!strValue || !strValue.startsWith(ops.$startsWith)) return false;
+      }
+      if ("$endsWith" in ops && typeof ops.$endsWith === "string") {
+        if (!strValue || !strValue.endsWith(ops.$endsWith)) return false;
+      }
+      if ("$in" in ops && Array.isArray(ops.$in)) {
+        if (!ops.$in.includes(argValue)) return false;
+      }
+      if ("$notIn" in ops && Array.isArray(ops.$notIn)) {
+        if (ops.$notIn.includes(argValue)) return false;
+      }
+      if ("$gt" in ops && typeof ops.$gt === "number") {
+        if (numValue === void 0 || numValue <= ops.$gt) return false;
+      }
+      if ("$lt" in ops && typeof ops.$lt === "number") {
+        if (numValue === void 0 || numValue >= ops.$lt) return false;
+      }
+      if ("$gte" in ops && typeof ops.$gte === "number") {
+        if (numValue === void 0 || numValue < ops.$gte) return false;
+      }
+      if ("$lte" in ops && typeof ops.$lte === "number") {
+        if (numValue === void 0 || numValue > ops.$lte) return false;
+      }
+      continue;
+    }
+  }
+  return true;
+}
+function pathConstraintsMatch(constraints, args) {
+  const paths = extractPathArguments(args);
+  if (paths.length === 0) return true;
+  return paths.every((path) => isPathAllowed(path, constraints));
+}
+function commandConstraintsMatch(constraints, args) {
+  const commands = extractCommandArguments(args);
+  if (commands.length === 0) return true;
+  return commands.every((cmd) => isCommandAllowed(cmd, constraints));
+}
+
+// src/evaluator.ts
+function evaluatePolicy(policySet, request) {
+  const startTime = performance.now();
+  const sortedRules = [...policySet.rules].sort(
+    (a, b) => a.priority - b.priority
+  );
+  for (const rule of sortedRules) {
+    if (ruleMatchesRequest(rule, request)) {
+      const endTime2 = performance.now();
+      return {
+        effect: rule.effect,
+        matchedRule: rule,
+        reason: `Matched rule "${rule.id}": ${rule.description}`,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        evaluationTimeMs: endTime2 - startTime
+      };
+    }
+  }
+  const endTime = performance.now();
+  return {
+    effect: DEFAULT_POLICY_EFFECT,
+    matchedRule: null,
+    reason: "No matching policy rule found. Default action: DENY.",
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    evaluationTimeMs: endTime - startTime,
+    metadata: {
+      evaluatedRules: sortedRules.length,
+      ruleIds: sortedRules.map((r) => r.id),
+      requestContext: {
+        tool: request.toolName,
+        arguments: Object.keys(request.arguments ?? {})
+      }
+    }
+  };
+}
+function validatePolicyRule(input) {
+  const errors = [];
+  const warnings = [];
+  const result = PolicyRuleSchema.safeParse(input);
+  if (!result.success) {
+    return {
+      valid: false,
+      errors: result.error.errors.map(
+        (e) => `${e.path.join(".")}: ${e.message}`
+      ),
+      warnings: []
+    };
+  }
+  const rule = result.data;
+  if (rule.toolPattern === "*" && rule.effect === "ALLOW") {
+    warnings.push(UNSAFE_CONFIGURATION_WARNINGS.WILDCARD_ALLOW);
+  }
+  if (rule.minimumTrustLevel === "TRUSTED") {
+    warnings.push(UNSAFE_CONFIGURATION_WARNINGS.TRUSTED_LEVEL_EXTERNAL);
+  }
+  if (rule.permission === "EXECUTE") {
+    warnings.push(UNSAFE_CONFIGURATION_WARNINGS.EXECUTE_WITHOUT_REVIEW);
+  }
+  return { valid: true, errors, warnings };
+}
+function validatePolicySet(input) {
+  const errors = [];
+  const warnings = [];
+  const result = PolicySetSchema.safeParse(input);
+  if (!result.success) {
+    return {
+      valid: false,
+      errors: result.error.errors.map(
+        (e) => `${e.path.join(".")}: ${e.message}`
+      ),
+      warnings: []
+    };
+  }
+  const policySet = result.data;
+  if (policySet.rules.length > MAX_RULES_PER_POLICY_SET) {
+    errors.push(
+      `Policy set exceeds maximum of ${MAX_RULES_PER_POLICY_SET} rules`
+    );
+  }
+  const ruleIds = /* @__PURE__ */ new Set();
+  for (const rule of policySet.rules) {
+    if (ruleIds.has(rule.id)) {
+      errors.push(`Duplicate rule ID: "${rule.id}"`);
+    }
+    ruleIds.add(rule.id);
+  }
+  for (const rule of policySet.rules) {
+    const ruleResult = validatePolicyRule(rule);
+    warnings.push(...ruleResult.warnings);
+  }
+  const hasDenyRule = policySet.rules.some((r) => r.effect === "DENY");
+  if (!hasDenyRule && policySet.rules.length > 0) {
+    warnings.push(
+      "Policy set contains only ALLOW rules. The default-deny fallback is the only protection."
+    );
+  }
+  return {
+    valid: errors.length === 0,
+    errors,
+    warnings
+  };
+}
+function analyzeSecurityWarnings(policySet) {
+  const warnings = [];
+  for (const rule of policySet.rules) {
+    warnings.push(...analyzeRuleWarnings(rule));
+  }
+  const allowRules = policySet.rules.filter(
+    (r) => r.effect === "ALLOW" && r.enabled
+  );
+  const wildcardAllows = allowRules.filter((r) => r.toolPattern === "*");
+  if (wildcardAllows.length > 0) {
+    warnings.push({
+      level: "CRITICAL",
+      code: "WILDCARD_ALLOW",
+      message: UNSAFE_CONFIGURATION_WARNINGS.WILDCARD_ALLOW,
+      recommendation: "Replace wildcard ALLOW rules with specific tool patterns."
+    });
+  }
+  return warnings;
+}
+function analyzeRuleWarnings(rule) {
+  const warnings = [];
+  if (rule.effect === "ALLOW" && rule.minimumTrustLevel === "UNTRUSTED") {
+    warnings.push({
+      level: "CRITICAL",
+      code: "ALLOW_UNTRUSTED",
+      message: `Rule "${rule.id}" allows execution for UNTRUSTED requests. Unverified LLM requests can execute tools.`,
+      ruleId: rule.id,
+      recommendation: "Set minimumTrustLevel to VERIFIED or higher for ALLOW rules."
+    });
+  }
+  if (rule.effect === "ALLOW" && rule.permission === "EXECUTE") {
+    warnings.push({
+      level: "WARNING",
+      code: "ALLOW_EXECUTE",
+      message: UNSAFE_CONFIGURATION_WARNINGS.EXECUTE_WITHOUT_REVIEW,
+      ruleId: rule.id,
+      recommendation: "Ensure EXECUTE permissions are intentional and scoped to specific tools."
+    });
+  }
+  return warnings;
+}
+function createDefaultDenyPolicySet() {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  return {
+    id: "default-deny",
+    name: "Default Deny All",
+    description: "Denies all tool executions. Add explicit ALLOW rules to grant access to specific tools.",
+    version: 1,
+    rules: [
+      {
+        id: "deny-all-execute",
+        description: "Explicitly deny all tool executions",
+        effect: PolicyEffect.DENY,
+        priority: 1e4,
+        toolPattern: "*",
+        permission: Permission.EXECUTE,
+        minimumTrustLevel: TrustLevel.UNTRUSTED,
+        enabled: true,
+        createdAt: now,
+        updatedAt: now
+      },
+      {
+        id: "deny-all-write",
+        description: "Explicitly deny all write operations",
+        effect: PolicyEffect.DENY,
+        priority: 1e4,
+        toolPattern: "*",
+        permission: Permission.WRITE,
+        minimumTrustLevel: TrustLevel.UNTRUSTED,
+        enabled: true,
+        createdAt: now,
+        updatedAt: now
+      },
+      {
+        id: "deny-all-read",
+        description: "Explicitly deny all read operations",
+        effect: PolicyEffect.DENY,
+        priority: 1e4,
+        toolPattern: "*",
+        permission: Permission.READ,
+        minimumTrustLevel: TrustLevel.UNTRUSTED,
+        enabled: true,
+        createdAt: now,
+        updatedAt: now
+      }
+    ],
+    createdAt: now,
+    updatedAt: now
+  };
+}
+function createPermissivePolicySet() {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  return {
+    id: "permissive",
+    name: "Permissive (Allow All)",
+    description: "Allows all tool executions. SolonGate still provides input validation, rate limiting, and audit logging.",
+    version: 1,
+    rules: [
+      {
+        id: "allow-all-execute",
+        description: "Allow all tool executions",
+        effect: PolicyEffect.ALLOW,
+        priority: 1e3,
+        toolPattern: "*",
+        permission: Permission.EXECUTE,
+        minimumTrustLevel: TrustLevel.UNTRUSTED,
+        enabled: true,
+        createdAt: now,
+        updatedAt: now
+      },
+      {
+        id: "allow-all-read",
+        description: "Allow all read operations",
+        effect: PolicyEffect.ALLOW,
+        priority: 1e3,
+        toolPattern: "*",
+        permission: Permission.READ,
+        minimumTrustLevel: TrustLevel.UNTRUSTED,
+        enabled: true,
+        createdAt: now,
+        updatedAt: now
+      },
+      {
+        id: "allow-all-write",
+        description: "Allow all write operations",
+        effect: PolicyEffect.ALLOW,
+        priority: 1e3,
+        toolPattern: "*",
+        permission: Permission.WRITE,
+        minimumTrustLevel: TrustLevel.UNTRUSTED,
+        enabled: true,
+        createdAt: now,
+        updatedAt: now
+      }
+    ],
+    createdAt: now,
+    updatedAt: now
+  };
+}
+function createReadOnlyPolicySet(toolPattern) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  return {
+    id: `read-only-${toolPattern}`,
+    name: `Read-Only: ${toolPattern}`,
+    description: `Allows read access to tools matching "${toolPattern}". Denies write and execute.`,
+    version: 1,
+    rules: [
+      {
+        id: `allow-read-${toolPattern}`,
+        description: `Allow read access to ${toolPattern}`,
+        effect: PolicyEffect.ALLOW,
+        priority: 100,
+        toolPattern,
+        permission: Permission.READ,
+        minimumTrustLevel: TrustLevel.VERIFIED,
+        enabled: true,
+        createdAt: now,
+        updatedAt: now
+      }
+    ],
+    createdAt: now,
+    updatedAt: now
+  };
+}
+function createSandboxedPolicySet(rootDir) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  return {
+    id: `sandbox-${rootDir.replace(/\//g, "-")}`,
+    name: `Sandbox: ${rootDir}`,
+    description: `Allows operations within ${rootDir}. Blocks dangerous commands and sensitive file access.`,
+    version: 1,
+    rules: [
+      {
+        id: "deny-dangerous-commands",
+        description: "Block dangerous shell commands",
+        effect: PolicyEffect.DENY,
+        priority: 50,
+        toolPattern: "*",
+        permission: Permission.EXECUTE,
+        minimumTrustLevel: TrustLevel.UNTRUSTED,
+        commandConstraints: {
+          denied: [
+            "rm -rf *",
+            "rm -r /*",
+            "mkfs*",
+            "dd if=*",
+            "curl*|*bash*",
+            "wget*|*sh*",
+            "shutdown*",
+            "reboot*",
+            "chmod*777*"
+          ]
+        },
+        enabled: true,
+        createdAt: now,
+        updatedAt: now
+      },
+      {
+        id: "deny-sensitive-paths",
+        description: "Block access to sensitive files",
+        effect: PolicyEffect.DENY,
+        priority: 51,
+        toolPattern: "*",
+        permission: Permission.EXECUTE,
+        minimumTrustLevel: TrustLevel.UNTRUSTED,
+        pathConstraints: {
+          denied: [
+            "**/.env*",
+            "**/.ssh/**",
+            "**/.aws/**",
+            "**/credentials*",
+            "**/*.pem",
+            "**/*.key"
+          ]
+        },
+        enabled: true,
+        createdAt: now,
+        updatedAt: now
+      },
+      {
+        id: "allow-sandboxed-files",
+        description: `Allow file operations within ${rootDir}`,
+        effect: PolicyEffect.ALLOW,
+        priority: 100,
+        toolPattern: "file_*",
+        permission: Permission.EXECUTE,
+        minimumTrustLevel: TrustLevel.UNTRUSTED,
+        pathConstraints: {
+          rootDirectory: rootDir,
+          allowed: [`${rootDir}/**`]
+        },
+        enabled: true,
+        createdAt: now,
+        updatedAt: now
+      },
+      {
+        id: "allow-all-execute",
+        description: "Allow all other tool executions",
+        effect: PolicyEffect.ALLOW,
+        priority: 1e3,
+        toolPattern: "*",
+        permission: Permission.EXECUTE,
+        minimumTrustLevel: TrustLevel.UNTRUSTED,
+        enabled: true,
+        createdAt: now,
+        updatedAt: now
+      }
+    ],
+    createdAt: now,
+    updatedAt: now
+  };
+}
+
+// src/engine.ts
+var PolicyEngine = class {
+  policySet;
+  timeoutMs;
+  store;
+  constructor(options) {
+    this.policySet = options?.policySet ?? createDefaultDenyPolicySet();
+    this.timeoutMs = options?.timeoutMs ?? POLICY_EVALUATION_TIMEOUT_MS;
+    this.store = options?.store ?? null;
+  }
+  /**
+   * Evaluates an execution request against the current policy set.
+   * Never throws for denials - denial is a normal outcome, not an error.
+   */
+  evaluate(request) {
+    const startTime = performance.now();
+    const decision = evaluatePolicy(this.policySet, request);
+    const elapsed = performance.now() - startTime;
+    if (elapsed > this.timeoutMs) {
+      console.warn(
+        `[SolonGate] Policy evaluation took ${elapsed.toFixed(1)}ms (limit: ${this.timeoutMs}ms) for tool "${request.toolName}"`
+      );
+    }
+    return decision;
+  }
+  /**
+   * Loads a new policy set, replacing the current one.
+   * Validates before accepting. Auto-saves version when store is present.
+   */
+  loadPolicySet(policySet, options) {
+    const validation = validatePolicySet(policySet);
+    if (!validation.valid) {
+      return validation;
+    }
+    this.policySet = policySet;
+    if (this.store) {
+      this.store.saveVersion(
+        policySet,
+        options?.reason ?? "Policy updated",
+        options?.createdBy ?? "system"
+      );
+    }
+    return validation;
+  }
+  /**
+   * Rolls back to a previous policy version.
+   * Only available when a PolicyStore is configured.
+   */
+  rollback(version) {
+    if (!this.store) {
+      throw new Error("PolicyStore not configured - cannot rollback");
+    }
+    const policyVersion = this.store.rollback(this.policySet.id, version);
+    this.policySet = policyVersion.policySet;
+    return policyVersion;
+  }
+  getPolicySet() {
+    return this.policySet;
+  }
+  getSecurityWarnings() {
+    return analyzeSecurityWarnings(this.policySet);
+  }
+  getStore() {
+    return this.store;
+  }
+  reset() {
+    this.policySet = createDefaultDenyPolicySet();
+  }
+};
+var PolicyStore = class {
+  versions = /* @__PURE__ */ new Map();
+  /**
+   * Saves a new version of a policy set.
+   * The version number auto-increments.
+   */
+  saveVersion(policySet, reason, createdBy) {
+    const id = policySet.id;
+    const history = this.versions.get(id) ?? [];
+    const latestVersion = history.length > 0 ? history[history.length - 1].version : 0;
+    const version = {
+      version: latestVersion + 1,
+      policySet: Object.freeze({ ...policySet }),
+      hash: this.computeHash(policySet),
+      reason,
+      createdBy,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    const newHistory = [...history, version];
+    this.versions.set(id, newHistory);
+    return version;
+  }
+  /**
+   * Gets a specific version of a policy set.
+   */
+  getVersion(id, version) {
+    const history = this.versions.get(id);
+    if (!history) return null;
+    return history.find((v) => v.version === version) ?? null;
+  }
+  /**
+   * Gets the latest version of a policy set.
+   */
+  getLatest(id) {
+    const history = this.versions.get(id);
+    if (!history || history.length === 0) return null;
+    return history[history.length - 1];
+  }
+  /**
+   * Gets the full version history of a policy set.
+   */
+  getHistory(id) {
+    return this.versions.get(id) ?? [];
+  }
+  /**
+   * Rolls back to a previous version by creating a new version
+   * with the same content as the target version.
+   */
+  rollback(id, toVersion) {
+    const target = this.getVersion(id, toVersion);
+    if (!target) {
+      throw new Error(`Version ${toVersion} not found for policy "${id}"`);
+    }
+    return this.saveVersion(
+      target.policySet,
+      `Rollback to version ${toVersion}`,
+      "system"
+    );
+  }
+  /**
+   * Computes a diff between two policy versions.
+   */
+  diff(v1, v2) {
+    const oldRulesMap = new Map(v1.policySet.rules.map((r) => [r.id, r]));
+    const newRulesMap = new Map(v2.policySet.rules.map((r) => [r.id, r]));
+    const added = [];
+    const removed = [];
+    const modified = [];
+    for (const [id, newRule] of newRulesMap) {
+      const oldRule = oldRulesMap.get(id);
+      if (!oldRule) {
+        added.push(newRule);
+      } else if (JSON.stringify(oldRule) !== JSON.stringify(newRule)) {
+        modified.push({ old: oldRule, new: newRule });
+      }
+    }
+    for (const [id, oldRule] of oldRulesMap) {
+      if (!newRulesMap.has(id)) {
+        removed.push(oldRule);
+      }
+    }
+    return { added, removed, modified };
+  }
+  /**
+   * Computes SHA256 hash of a policy set for integrity verification.
+   */
+  computeHash(policySet) {
+    const serialized = JSON.stringify(policySet, Object.keys(policySet).sort());
+    return createHash("sha256").update(serialized).digest("hex");
+  }
+};
+
+export { PolicyEngine, PolicyStore, analyzeSecurityWarnings, createDefaultDenyPolicySet, createPermissivePolicySet, createReadOnlyPolicySet, createSandboxedPolicySet, evaluatePolicy, extractCommandArguments, extractPathArguments, isCommandAllowed, isPathAllowed, isWithinRoot, matchCommandPattern, matchPathPattern, normalizePath, ruleMatchesRequest, toolPatternMatches, trustLevelMeetsMinimum, validatePolicyRule, validatePolicySet };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/path-matcher.ts","../src/command-matcher.ts","../src/matcher.ts","../src/evaluator.ts","../src/validator.ts","../src/warnings.ts","../src/defaults.ts","../src/engine.ts","../src/policy-store.ts"],"names":["endTime","UNSAFE_CONFIGURATION_WARNINGS","TrustLevel"],"mappings":";;;;;;AAQO,SAAS,cAAc,IAAA,EAAsB;AAElD,EAAA,IAAI,UAAA,GAAa,IAAA,CAAK,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA;AAGxC,EAAA,IAAI,WAAW,MAAA,GAAS,CAAA,IAAK,UAAA,CAAW,QAAA,CAAS,GAAG,CAAA,EAAG;AACrD,IAAA,UAAA,GAAa,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAAA,EACrC;AAGA,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA;AAClC,EAAA,MAAM,WAAqB,EAAC;AAE5B,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,IAAI,IAAA,KAAS,GAAA,IAAO,IAAA,KAAS,EAAA,EAAI;AAC/B,MAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG,QAAA,CAAS,KAAK,EAAE,CAAA;AAC3C,MAAA;AAAA,IACF;AACA,IAAA,IAAI,SAAS,IAAA,EAAM;AACjB,MAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,QAAA,QAAA,CAAS,GAAA,EAAI;AAAA,MACf;AACA,MAAA;AAAA,IACF;AACA,IAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAAA,EACpB;AAEA,EAAA,OAAO,QAAA,CAAS,IAAA,CAAK,GAAG,CAAA,IAAK,GAAA;AAC/B;AAMO,SAAS,YAAA,CAAa,MAAc,IAAA,EAAuB;AAChE,EAAA,MAAM,cAAA,GAAiB,cAAc,IAAI,CAAA;AACzC,EAAA,MAAM,cAAA,GAAiB,cAAc,IAAI,CAAA;AAGzC,EAAA,IAAI,cAAA,KAAmB,gBAAgB,OAAO,IAAA;AAC9C,EAAA,OAAO,cAAA,CAAe,UAAA,CAAW,cAAA,GAAiB,GAAG,CAAA;AACvD;AAWO,SAAS,gBAAA,CAAiB,MAAc,OAAA,EAA0B;AACvE,EAAA,MAAM,cAAA,GAAiB,cAAc,IAAI,CAAA;AACzC,EAAA,MAAM,iBAAA,GAAoB,cAAc,OAAO,CAAA;AAE/C,EAAA,IAAI,iBAAA,KAAsB,KAAK,OAAO,IAAA;AACtC,EAAA,IAAI,iBAAA,KAAsB,gBAAgB,OAAO,IAAA;AAEjD,EAAA,MAAM,YAAA,GAAe,iBAAA,CAAkB,KAAA,CAAM,GAAG,CAAA;AAChD,EAAA,MAAM,SAAA,GAAY,cAAA,CAAe,KAAA,CAAM,GAAG,CAAA;AAE1C,EAAA,OAAO,UAAA,CAAW,SAAA,EAAW,CAAA,EAAG,YAAA,EAAc,CAAC,CAAA;AACjD;AAEA,SAAS,UAAA,CACP,SAAA,EACA,EAAA,EACA,YAAA,EACA,EAAA,EACS;AACT,EAAA,OAAO,EAAA,GAAK,SAAA,CAAU,MAAA,IAAU,EAAA,GAAK,aAAa,MAAA,EAAQ;AACxD,IAAA,MAAM,OAAA,GAAU,aAAa,EAAE,CAAA;AAE/B,IAAA,IAAI,YAAY,IAAA,EAAM;AAEpB,MAAA,IAAI,EAAA,KAAO,YAAA,CAAa,MAAA,GAAS,CAAA,EAAG,OAAO,IAAA;AAG3C,MAAA,KAAA,IAAS,CAAA,GAAI,EAAA,EAAI,CAAA,IAAK,SAAA,CAAU,QAAQ,CAAA,EAAA,EAAK;AAC3C,QAAA,IAAI,WAAW,SAAA,EAAW,CAAA,EAAG,YAAA,EAAc,EAAA,GAAK,CAAC,CAAA,EAAG;AAClD,UAAA,OAAO,IAAA;AAAA,QACT;AAAA,MACF;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,IAAI,YAAY,GAAA,EAAK;AAEnB,MAAA,EAAA,EAAA;AACA,MAAA,EAAA,EAAA;AACA,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,GAAG,CAAA,EAAG;AACzB,MAAA,IAAI,CAAC,gBAAA,CAAiB,SAAA,CAAU,EAAE,CAAA,EAAI,OAAO,CAAA,EAAG;AAC9C,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,EAAA,EAAA;AACA,MAAA,EAAA,EAAA;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,OAAA,KAAY,SAAA,CAAU,EAAE,CAAA,EAAG;AAC7B,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,EAAA,EAAA;AACA,IAAA,EAAA,EAAA;AAAA,EACF;AAGA,EAAA,OAAO,KAAK,YAAA,CAAa,MAAA,IAAU,YAAA,CAAa,EAAE,MAAM,IAAA,EAAM;AAC5D,IAAA,EAAA,EAAA;AAAA,EACF;AAEA,EAAA,OAAO,EAAA,KAAO,SAAA,CAAU,MAAA,IAAU,EAAA,KAAO,YAAA,CAAa,MAAA;AACxD;AAWO,SAAS,aAAA,CACd,MACA,WAAA,EACS;AAET,EAAA,IAAI,YAAY,aAAA,EAAe;AAC7B,IAAA,IAAI,CAAC,YAAA,CAAa,IAAA,EAAM,WAAA,CAAY,aAAa,CAAA,EAAG;AAClD,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAGA,EAAA,IAAI,WAAA,CAAY,MAAA,IAAU,WAAA,CAAY,MAAA,CAAO,SAAS,CAAA,EAAG;AACvD,IAAA,KAAA,MAAW,OAAA,IAAW,YAAY,MAAA,EAAQ;AACxC,MAAA,IAAI,gBAAA,CAAiB,IAAA,EAAM,OAAO,CAAA,EAAG;AACnC,QAAA,OAAO,KAAA;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAGA,EAAA,IAAI,WAAA,CAAY,OAAA,IAAW,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA,EAAG;AACzD,IAAA,IAAI,cAAA,GAAiB,KAAA;AACrB,IAAA,KAAA,MAAW,OAAA,IAAW,YAAY,OAAA,EAAS;AACzC,MAAA,IAAI,gBAAA,CAAiB,IAAA,EAAM,OAAO,CAAA,EAAG;AACnC,QAAA,cAAA,GAAiB,IAAA;AACjB,QAAA;AAAA,MACF;AAAA,IACF;AACA,IAAA,IAAI,CAAC,gBAAgB,OAAO,KAAA;AAAA,EAC9B;AAEA,EAAA,OAAO,IAAA;AACT;AAMA,SAAS,gBAAA,CAAiB,SAAiB,OAAA,EAA0B;AACnE,EAAA,MAAM,cAAA,GAAiB,OAAA,CAAQ,UAAA,CAAW,GAAG,CAAA;AAC7C,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,QAAA,CAAS,GAAG,CAAA;AAEzC,EAAA,IAAI,OAAA,KAAY,KAAK,OAAO,IAAA;AAE5B,EAAA,IAAI,kBAAkB,YAAA,EAAc;AAElC,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACjC,IAAA,OAAO,QAAQ,WAAA,EAAY,CAAE,QAAA,CAAS,KAAA,CAAM,aAAa,CAAA;AAAA,EAC3D;AACA,EAAA,IAAI,cAAA,EAAgB;AAElB,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,KAAA,CAAM,CAAC,CAAA;AAC9B,IAAA,OAAO,QAAQ,WAAA,EAAY,CAAE,QAAA,CAAS,MAAA,CAAO,aAAa,CAAA;AAAA,EAC5D;AACA,EAAA,IAAI,YAAA,EAAc;AAEhB,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAClC,IAAA,OAAO,QAAQ,WAAA,EAAY,CAAE,UAAA,CAAW,MAAA,CAAO,aAAa,CAAA;AAAA,EAC9D;AAGA,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AACnC,EAAA,IAAI,YAAY,EAAA,EAAI;AAClB,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA;AACvC,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,KAAA,CAAM,OAAA,GAAU,CAAC,CAAA;AACxC,IAAA,MAAM,GAAA,GAAM,QAAQ,WAAA,EAAY;AAChC,IAAA,OAAO,IAAI,UAAA,CAAW,MAAA,CAAO,WAAA,EAAa,KAAK,GAAA,CAAI,QAAA,CAAS,MAAA,CAAO,WAAA,EAAa,CAAA,IAAK,GAAA,CAAI,MAAA,IAAU,MAAA,CAAO,SAAS,MAAA,CAAO,MAAA;AAAA,EAC5H;AAEA,EAAA,OAAO,OAAA,KAAY,OAAA;AACrB;AAMO,SAAS,qBACd,IAAA,EACU;AACV,EAAA,MAAM,QAAkB,EAAC;AAEzB,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA,EAAG;AACvC,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,KAAa,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,IAAK,KAAA,CAAM,QAAA,CAAS,IAAI,CAAA,CAAA,EAAI;AAC9E,MAAA,KAAA,CAAM,KAAK,KAAK,CAAA;AAAA,IAClB;AAAA,EACF;AAEA,EAAA,OAAO,KAAA;AACT;;;AC1NA,IAAM,cAAA,uBAAqB,GAAA,CAAI;AAAA,EAC7B,SAAA;AAAA,EACA,KAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,KAAA;AAAA,EACA;AACF,CAAC,CAAA;AAMM,SAAS,wBACd,IAAA,EACU;AACV,EAAA,MAAM,WAAqB,EAAC;AAE5B,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAA,EAAG;AAC/C,IAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAG/B,IAAA,IAAI,cAAA,CAAe,GAAA,CAAI,GAAA,CAAI,WAAA,EAAa,CAAA,EAAG;AACzC,MAAA,QAAA,CAAS,KAAK,KAAK,CAAA;AAAA,IACrB;AAAA,EACF;AAEA,EAAA,OAAO,QAAA;AACT;AAYO,SAAS,mBAAA,CAAoB,SAAiB,OAAA,EAA0B;AAC7E,EAAA,IAAI,OAAA,KAAY,KAAK,OAAO,IAAA;AAE5B,EAAA,MAAM,iBAAA,GAAoB,OAAA,CAAQ,IAAA,EAAK,CAAE,WAAA,EAAY;AACrD,EAAA,MAAM,iBAAA,GAAoB,OAAA,CAAQ,IAAA,EAAK,CAAE,WAAA,EAAY;AAErD,EAAA,IAAI,iBAAA,KAAsB,mBAAmB,OAAO,IAAA;AAEpD,EAAA,MAAM,cAAA,GAAiB,iBAAA,CAAkB,UAAA,CAAW,GAAG,CAAA;AACvD,EAAA,MAAM,YAAA,GAAe,iBAAA,CAAkB,QAAA,CAAS,GAAG,CAAA;AAEnD,EAAA,IAAI,kBAAkB,YAAA,EAAc;AAClC,IAAA,MAAM,KAAA,GAAQ,iBAAA,CAAkB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC3C,IAAA,OAAO,KAAA,CAAM,MAAA,GAAS,CAAA,IAAK,iBAAA,CAAkB,SAAS,KAAK,CAAA;AAAA,EAC7D;AACA,EAAA,IAAI,YAAA,EAAc;AAChB,IAAA,MAAM,MAAA,GAAS,iBAAA,CAAkB,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC5C,IAAA,OAAO,iBAAA,CAAkB,WAAW,MAAM,CAAA;AAAA,EAC5C;AACA,EAAA,IAAI,cAAA,EAAgB;AAClB,IAAA,MAAM,MAAA,GAAS,iBAAA,CAAkB,KAAA,CAAM,CAAC,CAAA;AACxC,IAAA,OAAO,iBAAA,CAAkB,SAAS,MAAM,CAAA;AAAA,EAC1C;AAGA,EAAA,MAAM,cAAc,iBAAA,CAAkB,KAAA,CAAM,KAAK,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA;AACzD,EAAA,OAAO,WAAA,KAAgB,iBAAA;AACzB;AAUO,SAAS,gBAAA,CACd,SACA,WAAA,EACS;AAET,EAAA,IAAI,WAAA,CAAY,MAAA,IAAU,WAAA,CAAY,MAAA,CAAO,SAAS,CAAA,EAAG;AACvD,IAAA,KAAA,MAAW,OAAA,IAAW,YAAY,MAAA,EAAQ;AACxC,MAAA,IAAI,mBAAA,CAAoB,OAAA,EAAS,OAAO,CAAA,EAAG;AACzC,QAAA,OAAO,KAAA;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAGA,EAAA,IAAI,WAAA,CAAY,OAAA,IAAW,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA,EAAG;AACzD,IAAA,IAAI,cAAA,GAAiB,KAAA;AACrB,IAAA,KAAA,MAAW,OAAA,IAAW,YAAY,OAAA,EAAS;AACzC,MAAA,IAAI,mBAAA,CAAoB,OAAA,EAAS,OAAO,CAAA,EAAG;AACzC,QAAA,cAAA,GAAiB,IAAA;AACjB,QAAA;AAAA,MACF;AAAA,IACF;AACA,IAAA,IAAI,CAAC,gBAAgB,OAAO,KAAA;AAAA,EAC9B;AAEA,EAAA,OAAO,IAAA;AACT;;;ACzGO,SAAS,kBAAA,CACd,MACA,OAAA,EACS;AACT,EAAA,IAAI,CAAC,IAAA,CAAK,OAAA,EAAS,OAAO,KAAA;AAC1B,EAAA,IAAI,IAAA,CAAK,UAAA,KAAe,OAAA,CAAQ,kBAAA,EAAoB,OAAO,KAAA;AAC3D,EAAA,IAAI,CAAC,kBAAA,CAAmB,IAAA,CAAK,aAAa,OAAA,CAAQ,QAAQ,GAAG,OAAO,KAAA;AACpE,EAAA,IAAI,CAAC,sBAAA,CAAuB,OAAA,CAAQ,QAAQ,UAAA,EAAY,IAAA,CAAK,iBAAiB,CAAA,EAAG;AAC/E,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,KAAK,mBAAA,EAAqB;AAC5B,IAAA,IAAI,CAAC,wBAAA,CAAyB,IAAA,CAAK,mBAAA,EAAqB,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC1E,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,IAAI,KAAK,eAAA,EAAiB;AACxB,IAAA,MAAM,SAAA,GAAY,oBAAA,CAAqB,IAAA,CAAK,eAAA,EAAiB,QAAQ,SAAS,CAAA;AAG9E,IAAA,IAAI,IAAA,CAAK,WAAW,MAAA,EAAQ;AAC1B,MAAA,IAAI,WAAW,OAAO,KAAA;AAAA,IACxB,CAAA,MAAO;AACL,MAAA,IAAI,CAAC,WAAW,OAAO,KAAA;AAAA,IACzB;AAAA,EACF;AACA,EAAA,IAAI,KAAK,kBAAA,EAAoB;AAC3B,IAAA,MAAM,SAAA,GAAY,uBAAA,CAAwB,IAAA,CAAK,kBAAA,EAAoB,QAAQ,SAAS,CAAA;AAGpF,IAAA,IAAI,IAAA,CAAK,WAAW,MAAA,EAAQ;AAC1B,MAAA,IAAI,WAAW,OAAO,KAAA;AAAA,IACxB,CAAA,MAAO;AACL,MAAA,IAAI,CAAC,WAAW,OAAO,KAAA;AAAA,IACzB;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAWO,SAAS,kBAAA,CAAmB,SAAiB,QAAA,EAA2B;AAC7E,EAAA,IAAI,OAAA,KAAY,KAAK,OAAO,IAAA;AAE5B,EAAA,MAAM,cAAA,GAAiB,OAAA,CAAQ,UAAA,CAAW,GAAG,CAAA;AAC7C,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,QAAA,CAAS,GAAG,CAAA;AAEzC,EAAA,IAAI,kBAAkB,YAAA,EAAc;AAElC,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACjC,IAAA,OAAO,KAAA,CAAM,MAAA,GAAS,CAAA,IAAK,QAAA,CAAS,SAAS,KAAK,CAAA;AAAA,EACpD;AACA,EAAA,IAAI,YAAA,EAAc;AAEhB,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAClC,IAAA,OAAO,QAAA,CAAS,WAAW,MAAM,CAAA;AAAA,EACnC;AACA,EAAA,IAAI,cAAA,EAAgB;AAElB,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,KAAA,CAAM,CAAC,CAAA;AAC9B,IAAA,OAAO,QAAA,CAAS,SAAS,MAAM,CAAA;AAAA,EACjC;AAEA,EAAA,OAAO,OAAA,KAAY,QAAA;AACrB;AAEA,IAAM,iBAAA,GAA4C;AAAA,EAChD,CAAC,UAAA,CAAW,SAAS,GAAG,CAAA;AAAA,EACxB,CAAC,UAAA,CAAW,QAAQ,GAAG,CAAA;AAAA,EACvB,CAAC,UAAA,CAAW,OAAO,GAAG;AACxB,CAAA;AAEO,SAAS,sBAAA,CACd,QACA,OAAA,EACS;AACT,EAAA,OAAA,CAAQ,kBAAkB,MAAM,CAAA,IAAK,EAAA,MAAQ,iBAAA,CAAkB,OAAO,CAAA,IAAK,QAAA,CAAA;AAC7E;AAiBA,SAAS,wBAAA,CACP,aACA,IAAA,EACS;AACT,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,UAAU,KAAK,MAAA,CAAO,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC3D,IAAA,IAAI,EAAE,GAAA,IAAO,IAAA,CAAA,EAAO,OAAO,KAAA;AAC3B,IAAA,MAAM,QAAA,GAAW,KAAK,GAAG,CAAA;AAGzB,IAAA,IAAI,OAAO,eAAe,QAAA,EAAU;AAClC,MAAA,IAAI,eAAe,GAAA,EAAK;AACxB,MAAA,IAAI,OAAO,aAAa,QAAA,EAAU;AAChC,QAAA,IAAI,QAAA,KAAa,YAAY,OAAO,KAAA;AAAA,MACtC,CAAA,MAAO;AACL,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,OAAO,eAAe,QAAA,IAAY,UAAA,KAAe,QAAQ,CAAC,KAAA,CAAM,OAAA,CAAQ,UAAU,CAAA,EAAG;AACvF,MAAA,MAAM,GAAA,GAAM,UAAA;AACZ,MAAA,MAAM,QAAA,GAAW,OAAO,QAAA,KAAa,QAAA,GAAW,QAAA,GAAW,MAAA;AAC3D,MAAA,MAAM,QAAA,GAAW,OAAO,QAAA,KAAa,QAAA,GAAW,QAAA,GAAW,MAAA;AAE3D,MAAA,IAAI,WAAA,IAAe,GAAA,IAAO,OAAO,GAAA,CAAI,cAAc,QAAA,EAAU;AAC3D,QAAA,IAAI,CAAC,YAAY,CAAC,QAAA,CAAS,SAAS,GAAA,CAAI,SAAS,GAAG,OAAO,KAAA;AAAA,MAC7D;AACA,MAAA,IAAI,cAAA,IAAkB,GAAA,IAAO,OAAO,GAAA,CAAI,iBAAiB,QAAA,EAAU;AACjE,QAAA,IAAI,YAAY,QAAA,CAAS,QAAA,CAAS,GAAA,CAAI,YAAY,GAAG,OAAO,KAAA;AAAA,MAC9D;AACA,MAAA,IAAI,aAAA,IAAiB,GAAA,IAAO,OAAO,GAAA,CAAI,gBAAgB,QAAA,EAAU;AAC/D,QAAA,IAAI,CAAC,YAAY,CAAC,QAAA,CAAS,WAAW,GAAA,CAAI,WAAW,GAAG,OAAO,KAAA;AAAA,MACjE;AACA,MAAA,IAAI,WAAA,IAAe,GAAA,IAAO,OAAO,GAAA,CAAI,cAAc,QAAA,EAAU;AAC3D,QAAA,IAAI,CAAC,YAAY,CAAC,QAAA,CAAS,SAAS,GAAA,CAAI,SAAS,GAAG,OAAO,KAAA;AAAA,MAC7D;AACA,MAAA,IAAI,SAAS,GAAA,IAAO,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,EAAG;AAC1C,QAAA,IAAI,CAAC,GAAA,CAAI,GAAA,CAAI,QAAA,CAAS,QAAQ,GAAG,OAAO,KAAA;AAAA,MAC1C;AACA,MAAA,IAAI,YAAY,GAAA,IAAO,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,EAAG;AAChD,QAAA,IAAI,GAAA,CAAI,MAAA,CAAO,QAAA,CAAS,QAAQ,GAAG,OAAO,KAAA;AAAA,MAC5C;AACA,MAAA,IAAI,KAAA,IAAS,GAAA,IAAO,OAAO,GAAA,CAAI,QAAQ,QAAA,EAAU;AAC/C,QAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,IAAY,GAAA,CAAI,KAAK,OAAO,KAAA;AAAA,MAC5D;AACA,MAAA,IAAI,KAAA,IAAS,GAAA,IAAO,OAAO,GAAA,CAAI,QAAQ,QAAA,EAAU;AAC/C,QAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,IAAY,GAAA,CAAI,KAAK,OAAO,KAAA;AAAA,MAC5D;AACA,MAAA,IAAI,MAAA,IAAU,GAAA,IAAO,OAAO,GAAA,CAAI,SAAS,QAAA,EAAU;AACjD,QAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,GAAW,GAAA,CAAI,MAAM,OAAO,KAAA;AAAA,MAC5D;AACA,MAAA,IAAI,MAAA,IAAU,GAAA,IAAO,OAAO,GAAA,CAAI,SAAS,QAAA,EAAU;AACjD,QAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,GAAW,GAAA,CAAI,MAAM,OAAO,KAAA;AAAA,MAC5D;AAEA,MAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,oBAAA,CACP,aACA,IAAA,EACS;AACT,EAAA,MAAM,KAAA,GAAQ,qBAAqB,IAAI,CAAA;AAGvC,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAG/B,EAAA,OAAO,MAAM,KAAA,CAAM,CAAC,SAAS,aAAA,CAAc,IAAA,EAAM,WAAW,CAAC,CAAA;AAC/D;AAEA,SAAS,uBAAA,CACP,aACA,IAAA,EACS;AACT,EAAA,MAAM,QAAA,GAAW,wBAAwB,IAAI,CAAA;AAG7C,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAGlC,EAAA,OAAO,SAAS,KAAA,CAAM,CAAC,QAAQ,gBAAA,CAAiB,GAAA,EAAK,WAAW,CAAC,CAAA;AACnE;;;AC/KO,SAAS,cAAA,CACd,WACA,OAAA,EACgB;AAChB,EAAA,MAAM,SAAA,GAAY,YAAY,GAAA,EAAI;AAElC,EAAA,MAAM,WAAA,GAAc,CAAC,GAAG,SAAA,CAAU,KAAK,CAAA,CAAE,IAAA;AAAA,IACvC,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,WAAW,CAAA,CAAE;AAAA,GAC3B;AAEA,EAAA,KAAA,MAAW,QAAQ,WAAA,EAAa;AAC9B,IAAA,IAAI,kBAAA,CAAmB,IAAA,EAAM,OAAO,CAAA,EAAG;AACrC,MAAA,MAAMA,QAAAA,GAAU,YAAY,GAAA,EAAI;AAChC,MAAA,OAAO;AAAA,QACL,QAAQ,IAAA,CAAK,MAAA;AAAA,QACb,WAAA,EAAa,IAAA;AAAA,QACb,QAAQ,CAAA,cAAA,EAAiB,IAAA,CAAK,EAAE,CAAA,GAAA,EAAM,KAAK,WAAW,CAAA,CAAA;AAAA,QACtD,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,QAClC,kBAAkBA,QAAAA,GAAU;AAAA,OAC9B;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,YAAY,GAAA,EAAI;AAChC,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,qBAAA;AAAA,IACR,WAAA,EAAa,IAAA;AAAA,IACb,MAAA,EAAQ,sDAAA;AAAA,IACR,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,IAClC,kBAAkB,OAAA,GAAU,SAAA;AAAA,IAC5B,QAAA,EAAU;AAAA,MACR,gBAAgB,WAAA,CAAY,MAAA;AAAA,MAC5B,SAAS,WAAA,CAAY,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,EAAE,CAAA;AAAA,MACpC,cAAA,EAAgB;AAAA,QACd,MAAM,OAAA,CAAQ,QAAA;AAAA,QACd,WAAW,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,SAAA,IAAa,EAAE;AAAA;AAChD;AACF,GACF;AACF;AC/CO,SAAS,mBAAmB,KAAA,EAAkC;AACnE,EAAA,MAAM,SAAmB,EAAC;AAC1B,EAAA,MAAM,WAAqB,EAAC;AAE5B,EAAA,MAAM,MAAA,GAAS,gBAAA,CAAiB,SAAA,CAAU,KAAK,CAAA;AAC/C,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,MAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,GAAA;AAAA,QAC1B,CAAC,CAAA,KAAM,CAAA,EAAG,CAAA,CAAE,IAAA,CAAK,KAAK,GAAG,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA;AAAA,OAC1C;AAAA,MACA,UAAU;AAAC,KACb;AAAA,EACF;AAEA,EAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AAEpB,EAAA,IAAI,IAAA,CAAK,WAAA,KAAgB,GAAA,IAAO,IAAA,CAAK,WAAW,OAAA,EAAS;AACvD,IAAA,QAAA,CAAS,IAAA,CAAK,8BAA8B,cAAc,CAAA;AAAA,EAC5D;AAEA,EAAA,IAAI,IAAA,CAAK,sBAAsB,SAAA,EAAW;AACxC,IAAA,QAAA,CAAS,IAAA,CAAK,8BAA8B,sBAAsB,CAAA;AAAA,EACpE;AAEA,EAAA,IAAI,IAAA,CAAK,eAAe,SAAA,EAAW;AACjC,IAAA,QAAA,CAAS,IAAA,CAAK,8BAA8B,sBAAsB,CAAA;AAAA,EACpE;AAEA,EAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,MAAA,EAAQ,QAAA,EAAS;AACzC;AAEO,SAAS,kBAAkB,KAAA,EAAkC;AAClE,EAAA,MAAM,SAAmB,EAAC;AAC1B,EAAA,MAAM,WAAqB,EAAC;AAE5B,EAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,SAAA,CAAU,KAAK,CAAA;AAC9C,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,MAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,GAAA;AAAA,QAC1B,CAAC,CAAA,KAAM,CAAA,EAAG,CAAA,CAAE,IAAA,CAAK,KAAK,GAAG,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA;AAAA,OAC1C;AAAA,MACA,UAAU;AAAC,KACb;AAAA,EACF;AAEA,EAAA,MAAM,YAAY,MAAA,CAAO,IAAA;AAEzB,EAAA,IAAI,SAAA,CAAU,KAAA,CAAM,MAAA,GAAS,wBAAA,EAA0B;AACrD,IAAA,MAAA,CAAO,IAAA;AAAA,MACL,iCAAiC,wBAAwB,CAAA,MAAA;AAAA,KAC3D;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAY;AAChC,EAAA,KAAA,MAAW,IAAA,IAAQ,UAAU,KAAA,EAAO;AAClC,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,EAAE,CAAA,EAAG;AACxB,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,oBAAA,EAAuB,IAAA,CAAK,EAAE,CAAA,CAAA,CAAG,CAAA;AAAA,IAC/C;AACA,IAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,EAAE,CAAA;AAAA,EACrB;AAEA,EAAA,KAAA,MAAW,IAAA,IAAQ,UAAU,KAAA,EAAO;AAClC,IAAA,MAAM,UAAA,GAAa,mBAAmB,IAAI,CAAA;AAC1C,IAAA,QAAA,CAAS,IAAA,CAAK,GAAG,UAAA,CAAW,QAAQ,CAAA;AAAA,EACtC;AAEA,EAAA,MAAM,WAAA,GAAc,UAAU,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,MAAM,CAAA;AACnE,EAAA,IAAI,CAAC,WAAA,IAAe,SAAA,CAAU,KAAA,CAAM,SAAS,CAAA,EAAG;AAC9C,IAAA,QAAA,CAAS,IAAA;AAAA,MACP;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,OAAO,MAAA,KAAW,CAAA;AAAA,IACzB,MAAA;AAAA,IACA;AAAA,GACF;AACF;AChFO,SAAS,wBACd,SAAA,EAC4B;AAC5B,EAAA,MAAM,WAA8B,EAAC;AAErC,EAAA,KAAA,MAAW,IAAA,IAAQ,UAAU,KAAA,EAAO;AAClC,IAAA,QAAA,CAAS,IAAA,CAAK,GAAG,mBAAA,CAAoB,IAAI,CAAC,CAAA;AAAA,EAC5C;AAEA,EAAA,MAAM,UAAA,GAAa,UAAU,KAAA,CAAM,MAAA;AAAA,IACjC,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,KAAW,WAAW,CAAA,CAAE;AAAA,GACnC;AACA,EAAA,MAAM,iBAAiB,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,gBAAgB,GAAG,CAAA;AAErE,EAAA,IAAI,cAAA,CAAe,SAAS,CAAA,EAAG;AAC7B,IAAA,QAAA,CAAS,IAAA,CAAK;AAAA,MACZ,KAAA,EAAO,UAAA;AAAA,MACP,IAAA,EAAM,gBAAA;AAAA,MACN,SAASC,6BAAAA,CAA8B,cAAA;AAAA,MACvC,cAAA,EACE;AAAA,KACH,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,QAAA;AACT;AAEA,SAAS,oBAAoB,IAAA,EAAqC;AAChE,EAAA,MAAM,WAA8B,EAAC;AAErC,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,OAAA,IAAW,IAAA,CAAK,sBAAsB,WAAA,EAAa;AACrE,IAAA,QAAA,CAAS,IAAA,CAAK;AAAA,MACZ,KAAA,EAAO,UAAA;AAAA,MACP,IAAA,EAAM,iBAAA;AAAA,MACN,OAAA,EAAS,CAAA,MAAA,EAAS,IAAA,CAAK,EAAE,CAAA,qFAAA,CAAA;AAAA,MACzB,QAAQ,IAAA,CAAK,EAAA;AAAA,MACb,cAAA,EACE;AAAA,KACH,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,OAAA,IAAW,IAAA,CAAK,eAAe,SAAA,EAAW;AAC5D,IAAA,QAAA,CAAS,IAAA,CAAK;AAAA,MACZ,KAAA,EAAO,SAAA;AAAA,MACP,IAAA,EAAM,eAAA;AAAA,MACN,SAASA,6BAAAA,CAA8B,sBAAA;AAAA,MACvC,QAAQ,IAAA,CAAK,EAAA;AAAA,MACb,cAAA,EACE;AAAA,KACH,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,QAAA;AACT;AC1DO,SAAS,0BAAA,GAAwC;AACtD,EAAA,MAAM,GAAA,GAAA,iBAAM,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAEnC,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,cAAA;AAAA,IACJ,IAAA,EAAM,kBAAA;AAAA,IACN,WAAA,EACE,yFAAA;AAAA,IACF,OAAA,EAAS,CAAA;AAAA,IACT,KAAA,EAAO;AAAA,MACL;AAAA,QACE,EAAA,EAAI,kBAAA;AAAA,QACJ,WAAA,EAAa,qCAAA;AAAA,QACb,QAAQ,YAAA,CAAa,IAAA;AAAA,QACrB,QAAA,EAAU,GAAA;AAAA,QACV,WAAA,EAAa,GAAA;AAAA,QACb,YAAY,UAAA,CAAW,OAAA;AAAA,QACvB,mBAAmBC,UAAAA,CAAW,SAAA;AAAA,QAC9B,OAAA,EAAS,IAAA;AAAA,QACT,SAAA,EAAW,GAAA;AAAA,QACX,SAAA,EAAW;AAAA,OACb;AAAA,MACA;AAAA,QACE,EAAA,EAAI,gBAAA;AAAA,QACJ,WAAA,EAAa,sCAAA;AAAA,QACb,QAAQ,YAAA,CAAa,IAAA;AAAA,QACrB,QAAA,EAAU,GAAA;AAAA,QACV,WAAA,EAAa,GAAA;AAAA,QACb,YAAY,UAAA,CAAW,KAAA;AAAA,QACvB,mBAAmBA,UAAAA,CAAW,SAAA;AAAA,QAC9B,OAAA,EAAS,IAAA;AAAA,QACT,SAAA,EAAW,GAAA;AAAA,QACX,SAAA,EAAW;AAAA,OACb;AAAA,MACA;AAAA,QACE,EAAA,EAAI,eAAA;AAAA,QACJ,WAAA,EAAa,qCAAA;AAAA,QACb,QAAQ,YAAA,CAAa,IAAA;AAAA,QACrB,QAAA,EAAU,GAAA;AAAA,QACV,WAAA,EAAa,GAAA;AAAA,QACb,YAAY,UAAA,CAAW,IAAA;AAAA,QACvB,mBAAmBA,UAAAA,CAAW,SAAA;AAAA,QAC9B,OAAA,EAAS,IAAA;AAAA,QACT,SAAA,EAAW,GAAA;AAAA,QACX,SAAA,EAAW;AAAA;AACb,KACF;AAAA,IACA,SAAA,EAAW,GAAA;AAAA,IACX,SAAA,EAAW;AAAA,GACb;AACF;AAOO,SAAS,yBAAA,GAAuC;AACrD,EAAA,MAAM,GAAA,GAAA,iBAAM,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAEnC,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,YAAA;AAAA,IACJ,IAAA,EAAM,wBAAA;AAAA,IACN,WAAA,EAAa,0GAAA;AAAA,IACb,OAAA,EAAS,CAAA;AAAA,IACT,KAAA,EAAO;AAAA,MACL;AAAA,QACE,EAAA,EAAI,mBAAA;AAAA,QACJ,WAAA,EAAa,2BAAA;AAAA,QACb,QAAQ,YAAA,CAAa,KAAA;AAAA,QACrB,QAAA,EAAU,GAAA;AAAA,QACV,WAAA,EAAa,GAAA;AAAA,QACb,YAAY,UAAA,CAAW,OAAA;AAAA,QACvB,mBAAmBA,UAAAA,CAAW,SAAA;AAAA,QAC9B,OAAA,EAAS,IAAA;AAAA,QACT,SAAA,EAAW,GAAA;AAAA,QACX,SAAA,EAAW;AAAA,OACb;AAAA,MACA;AAAA,QACE,EAAA,EAAI,gBAAA;AAAA,QACJ,WAAA,EAAa,2BAAA;AAAA,QACb,QAAQ,YAAA,CAAa,KAAA;AAAA,QACrB,QAAA,EAAU,GAAA;AAAA,QACV,WAAA,EAAa,GAAA;AAAA,QACb,YAAY,UAAA,CAAW,IAAA;AAAA,QACvB,mBAAmBA,UAAAA,CAAW,SAAA;AAAA,QAC9B,OAAA,EAAS,IAAA;AAAA,QACT,SAAA,EAAW,GAAA;AAAA,QACX,SAAA,EAAW;AAAA,OACb;AAAA,MACA;AAAA,QACE,EAAA,EAAI,iBAAA;AAAA,QACJ,WAAA,EAAa,4BAAA;AAAA,QACb,QAAQ,YAAA,CAAa,KAAA;AAAA,QACrB,QAAA,EAAU,GAAA;AAAA,QACV,WAAA,EAAa,GAAA;AAAA,QACb,YAAY,UAAA,CAAW,KAAA;AAAA,QACvB,mBAAmBA,UAAAA,CAAW,SAAA;AAAA,QAC9B,OAAA,EAAS,IAAA;AAAA,QACT,SAAA,EAAW,GAAA;AAAA,QACX,SAAA,EAAW;AAAA;AACb,KACF;AAAA,IACA,SAAA,EAAW,GAAA;AAAA,IACX,SAAA,EAAW;AAAA,GACb;AACF;AAMO,SAAS,wBAAwB,WAAA,EAAgC;AACtE,EAAA,MAAM,GAAA,GAAA,iBAAM,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAEnC,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,aAAa,WAAW,CAAA,CAAA;AAAA,IAC5B,IAAA,EAAM,cAAc,WAAW,CAAA,CAAA;AAAA,IAC/B,WAAA,EAAa,yCAAyC,WAAW,CAAA,4BAAA,CAAA;AAAA,IACjE,OAAA,EAAS,CAAA;AAAA,IACT,KAAA,EAAO;AAAA,MACL;AAAA,QACE,EAAA,EAAI,cAAc,WAAW,CAAA,CAAA;AAAA,QAC7B,WAAA,EAAa,wBAAwB,WAAW,CAAA,CAAA;AAAA,QAChD,QAAQ,YAAA,CAAa,KAAA;AAAA,QACrB,QAAA,EAAU,GAAA;AAAA,QACV,WAAA;AAAA,QACA,YAAY,UAAA,CAAW,IAAA;AAAA,QACvB,mBAAmBA,UAAAA,CAAW,QAAA;AAAA,QAC9B,OAAA,EAAS,IAAA;AAAA,QACT,SAAA,EAAW,GAAA;AAAA,QACX,SAAA,EAAW;AAAA;AACb,KACF;AAAA,IACA,SAAA,EAAW,GAAA;AAAA,IACX,SAAA,EAAW;AAAA,GACb;AACF;AAOO,SAAS,yBAAyB,OAAA,EAA4B;AACnE,EAAA,MAAM,GAAA,GAAA,iBAAM,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAEnC,EAAA,OAAO;AAAA,IACL,IAAI,CAAA,QAAA,EAAW,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAC,CAAA,CAAA;AAAA,IAC1C,IAAA,EAAM,YAAY,OAAO,CAAA,CAAA;AAAA,IACzB,WAAA,EAAa,4BAA4B,OAAO,CAAA,sDAAA,CAAA;AAAA,IAChD,OAAA,EAAS,CAAA;AAAA,IACT,KAAA,EAAO;AAAA,MACL;AAAA,QACE,EAAA,EAAI,yBAAA;AAAA,QACJ,WAAA,EAAa,gCAAA;AAAA,QACb,QAAQ,YAAA,CAAa,IAAA;AAAA,QACrB,QAAA,EAAU,EAAA;AAAA,QACV,WAAA,EAAa,GAAA;AAAA,QACb,YAAY,UAAA,CAAW,OAAA;AAAA,QACvB,mBAAmBA,UAAAA,CAAW,SAAA;AAAA,QAC9B,kBAAA,EAAoB;AAAA,UAClB,MAAA,EAAQ;AAAA,YACN,UAAA;AAAA,YAAY,UAAA;AAAA,YAAY,OAAA;AAAA,YAAS,SAAA;AAAA,YACjC,cAAA;AAAA,YAAgB,YAAA;AAAA,YAChB,WAAA;AAAA,YAAa,SAAA;AAAA,YAAW;AAAA;AAC1B,SACF;AAAA,QACA,OAAA,EAAS,IAAA;AAAA,QACT,SAAA,EAAW,GAAA;AAAA,QACX,SAAA,EAAW;AAAA,OACb;AAAA,MACA;AAAA,QACE,EAAA,EAAI,sBAAA;AAAA,QACJ,WAAA,EAAa,iCAAA;AAAA,QACb,QAAQ,YAAA,CAAa,IAAA;AAAA,QACrB,QAAA,EAAU,EAAA;AAAA,QACV,WAAA,EAAa,GAAA;AAAA,QACb,YAAY,UAAA,CAAW,OAAA;AAAA,QACvB,mBAAmBA,UAAAA,CAAW,SAAA;AAAA,QAC9B,eAAA,EAAiB;AAAA,UACf,MAAA,EAAQ;AAAA,YACN,UAAA;AAAA,YAAY,YAAA;AAAA,YAAc,YAAA;AAAA,YAC1B,iBAAA;AAAA,YAAmB,UAAA;AAAA,YAAY;AAAA;AACjC,SACF;AAAA,QACA,OAAA,EAAS,IAAA;AAAA,QACT,SAAA,EAAW,GAAA;AAAA,QACX,SAAA,EAAW;AAAA,OACb;AAAA,MACA;AAAA,QACE,EAAA,EAAI,uBAAA;AAAA,QACJ,WAAA,EAAa,gCAAgC,OAAO,CAAA,CAAA;AAAA,QACpD,QAAQ,YAAA,CAAa,KAAA;AAAA,QACrB,QAAA,EAAU,GAAA;AAAA,QACV,WAAA,EAAa,QAAA;AAAA,QACb,YAAY,UAAA,CAAW,OAAA;AAAA,QACvB,mBAAmBA,UAAAA,CAAW,SAAA;AAAA,QAC9B,eAAA,EAAiB;AAAA,UACf,aAAA,EAAe,OAAA;AAAA,UACf,OAAA,EAAS,CAAC,CAAA,EAAG,OAAO,CAAA,GAAA,CAAK;AAAA,SAC3B;AAAA,QACA,OAAA,EAAS,IAAA;AAAA,QACT,SAAA,EAAW,GAAA;AAAA,QACX,SAAA,EAAW;AAAA,OACb;AAAA,MACA;AAAA,QACE,EAAA,EAAI,mBAAA;AAAA,QACJ,WAAA,EAAa,iCAAA;AAAA,QACb,QAAQ,YAAA,CAAa,KAAA;AAAA,QACrB,QAAA,EAAU,GAAA;AAAA,QACV,WAAA,EAAa,GAAA;AAAA,QACb,YAAY,UAAA,CAAW,OAAA;AAAA,QACvB,mBAAmBA,UAAAA,CAAW,SAAA;AAAA,QAC9B,OAAA,EAAS,IAAA;AAAA,QACT,SAAA,EAAW,GAAA;AAAA,QACX,SAAA,EAAW;AAAA;AACb,KACF;AAAA,IACA,SAAA,EAAW,GAAA;AAAA,IACX,SAAA,EAAW;AAAA,GACb;AACF;;;AChNO,IAAM,eAAN,MAAmB;AAAA,EAChB,SAAA;AAAA,EACS,SAAA;AAAA,EACA,KAAA;AAAA,EAEjB,YAAY,OAAA,EAIT;AACD,IAAA,IAAA,CAAK,SAAA,GAAY,OAAA,EAAS,SAAA,IAAa,0BAAA,EAA2B;AAClE,IAAA,IAAA,CAAK,SAAA,GAAY,SAAS,SAAA,IAAa,4BAAA;AACvC,IAAA,IAAA,CAAK,KAAA,GAAQ,SAAS,KAAA,IAAS,IAAA;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,SAAS,OAAA,EAA2C;AAClD,IAAA,MAAM,SAAA,GAAY,YAAY,GAAA,EAAI;AAClC,IAAA,MAAM,QAAA,GAAW,cAAA,CAAe,IAAA,CAAK,SAAA,EAAW,OAAO,CAAA;AACvD,IAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AAEpC,IAAA,IAAI,OAAA,GAAU,KAAK,SAAA,EAAW;AAC5B,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,mCAAA,EAAsC,OAAA,CAAQ,OAAA,CAAQ,CAAC,CAAC,cAC7C,IAAA,CAAK,SAAS,CAAA,cAAA,EAAiB,OAAA,CAAQ,QAAQ,CAAA,CAAA;AAAA,OAC5D;AAAA,IACF;AAEA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAA,CACE,WACA,OAAA,EACkB;AAClB,IAAA,MAAM,UAAA,GAAa,kBAAkB,SAAS,CAAA;AAC9C,IAAA,IAAI,CAAC,WAAW,KAAA,EAAO;AACrB,MAAA,OAAO,UAAA;AAAA,IACT;AACA,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAEjB,IAAA,IAAI,KAAK,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,KAAA,CAAM,WAAA;AAAA,QACT,SAAA;AAAA,QACA,SAAS,MAAA,IAAU,gBAAA;AAAA,QACnB,SAAS,SAAA,IAAa;AAAA,OACxB;AAAA,IACF;AAEA,IAAA,OAAO,UAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,SAAS,OAAA,EAAgC;AACvC,IAAA,IAAI,CAAC,KAAK,KAAA,EAAO;AACf,MAAA,MAAM,IAAI,MAAM,8CAA8C,CAAA;AAAA,IAChE;AAEA,IAAA,MAAM,gBAAgB,IAAA,CAAK,KAAA,CAAM,SAAS,IAAA,CAAK,SAAA,CAAU,IAAI,OAAO,CAAA;AACpE,IAAA,IAAA,CAAK,YAAY,aAAA,CAAc,SAAA;AAC/B,IAAA,OAAO,aAAA;AAAA,EACT;AAAA,EAEA,YAAA,GAAoC;AAClC,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACd;AAAA,EAEA,mBAAA,GAAkD;AAChD,IAAA,OAAO,uBAAA,CAAwB,KAAK,SAAS,CAAA;AAAA,EAC/C;AAAA,EAEA,QAAA,GAA+B;AAC7B,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACd;AAAA,EAEA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,YAAY,0BAAA,EAA2B;AAAA,EAC9C;AACF;AC3EO,IAAM,cAAN,MAAkB;AAAA,EACN,QAAA,uBAAe,GAAA,EAA6B;AAAA;AAAA;AAAA;AAAA;AAAA,EAM7D,WAAA,CACE,SAAA,EACA,MAAA,EACA,SAAA,EACe;AACf,IAAA,MAAM,KAAK,SAAA,CAAU,EAAA;AACrB,IAAA,MAAM,UAAU,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,EAAE,KAAK,EAAC;AAE1C,IAAA,MAAM,aAAA,GAAgB,QAAQ,MAAA,GAAS,CAAA,GAAI,QAAQ,OAAA,CAAQ,MAAA,GAAS,CAAC,CAAA,CAAG,OAAA,GAAU,CAAA;AAElF,IAAA,MAAM,OAAA,GAAyB;AAAA,MAC7B,SAAS,aAAA,GAAgB,CAAA;AAAA,MACzB,WAAW,MAAA,CAAO,MAAA,CAAO,EAAE,GAAG,WAAW,CAAA;AAAA,MACzC,IAAA,EAAM,IAAA,CAAK,WAAA,CAAY,SAAS,CAAA;AAAA,MAChC,MAAA;AAAA,MACA,SAAA;AAAA,MACA,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,KACpC;AAEA,IAAA,MAAM,UAAA,GAAa,CAAC,GAAG,OAAA,EAAS,OAAO,CAAA;AACvC,IAAA,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,EAAA,EAAI,UAAU,CAAA;AAEhC,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,UAAA,CAAW,IAAY,OAAA,EAAuC;AAC5D,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,EAAE,CAAA;AACpC,IAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,IAAA,OAAO,QAAQ,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,OAAA,KAAY,OAAO,CAAA,IAAK,IAAA;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA,EAKA,UAAU,EAAA,EAAkC;AAC1C,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,EAAE,CAAA;AACpC,IAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,MAAA,KAAW,GAAG,OAAO,IAAA;AAC7C,IAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAA,GAAS,CAAC,CAAA;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA,EAKA,WAAW,EAAA,EAAsC;AAC/C,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,EAAE,KAAK,EAAC;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAA,CAAS,IAAY,SAAA,EAAkC;AACrD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,UAAA,CAAW,EAAA,EAAI,SAAS,CAAA;AAC5C,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,SAAS,CAAA,uBAAA,EAA0B,EAAE,CAAA,CAAA,CAAG,CAAA;AAAA,IACrE;AAEA,IAAA,OAAO,IAAA,CAAK,WAAA;AAAA,MACV,MAAA,CAAO,SAAA;AAAA,MACP,uBAAuB,SAAS,CAAA,CAAA;AAAA,MAChC;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,IAAA,CAAK,IAAmB,EAAA,EAA+B;AACrD,IAAA,MAAM,WAAA,GAAc,IAAI,GAAA,CAAI,EAAA,CAAG,UAAU,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,EAAA,EAAI,CAAC,CAAC,CAAC,CAAA;AACpE,IAAA,MAAM,WAAA,GAAc,IAAI,GAAA,CAAI,EAAA,CAAG,UAAU,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,EAAA,EAAI,CAAC,CAAC,CAAC,CAAA;AAEpE,IAAA,MAAM,QAAsB,EAAC;AAC7B,IAAA,MAAM,UAAwB,EAAC;AAC/B,IAAA,MAAM,WAAmD,EAAC;AAG1D,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,OAAO,CAAA,IAAK,WAAA,EAAa;AACvC,MAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,CAAI,EAAE,CAAA;AAClC,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,KAAA,CAAM,KAAK,OAAO,CAAA;AAAA,MACpB,CAAA,MAAA,IAAW,KAAK,SAAA,CAAU,OAAO,MAAM,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA,EAAG;AAC9D,QAAA,QAAA,CAAS,KAAK,EAAE,GAAA,EAAK,OAAA,EAAS,GAAA,EAAK,SAAS,CAAA;AAAA,MAC9C;AAAA,IACF;AAGA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,OAAO,CAAA,IAAK,WAAA,EAAa;AACvC,MAAA,IAAI,CAAC,WAAA,CAAY,GAAA,CAAI,EAAE,CAAA,EAAG;AACxB,QAAA,OAAA,CAAQ,KAAK,OAAO,CAAA;AAAA,MACtB;AAAA,IACF;AAEA,IAAA,OAAO,EAAE,KAAA,EAAO,OAAA,EAAS,QAAA,EAAS;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,YAAY,SAAA,EAA8B;AACxC,IAAA,MAAM,UAAA,GAAa,KAAK,SAAA,CAAU,SAAA,EAAW,OAAO,IAAA,CAAK,SAAS,CAAA,CAAE,IAAA,EAAM,CAAA;AAC1E,IAAA,OAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,UAAU,CAAA,CAAE,OAAO,KAAK,CAAA;AAAA,EAC7D;AACF","file":"index.js","sourcesContent":["import type { PolicyRule } from '@solongate/core';\n\ntype PathConstraints = NonNullable<PolicyRule['pathConstraints']>;\n\n/**\n * Normalizes a file path for consistent matching.\n * Resolves . and .. segments, normalizes separators.\n */\nexport function normalizePath(path: string): string {\n  // Normalize separators to forward slash\n  let normalized = path.replace(/\\\\/g, '/');\n\n  // Remove trailing slash (except for root)\n  if (normalized.length > 1 && normalized.endsWith('/')) {\n    normalized = normalized.slice(0, -1);\n  }\n\n  // Resolve . and .. segments\n  const parts = normalized.split('/');\n  const resolved: string[] = [];\n\n  for (const part of parts) {\n    if (part === '.' || part === '') {\n      if (resolved.length === 0) resolved.push('');\n      continue;\n    }\n    if (part === '..') {\n      if (resolved.length > 1) {\n        resolved.pop();\n      }\n      continue;\n    }\n    resolved.push(part);\n  }\n\n  return resolved.join('/') || '/';\n}\n\n/**\n * Checks if a path is within a root directory (sandbox boundary).\n * Prevents escaping via .., symlinks, etc.\n */\nexport function isWithinRoot(path: string, root: string): boolean {\n  const normalizedPath = normalizePath(path);\n  const normalizedRoot = normalizePath(root);\n\n  // Path must start with root\n  if (normalizedPath === normalizedRoot) return true;\n  return normalizedPath.startsWith(normalizedRoot + '/');\n}\n\n/**\n * Glob-style path pattern matching.\n * Supports:\n * - * matches any single path segment (not /)\n * - ** matches any number of path segments\n * - Exact match\n *\n * Does NOT support regex (ReDoS prevention).\n */\nexport function matchPathPattern(path: string, pattern: string): boolean {\n  const normalizedPath = normalizePath(path);\n  const normalizedPattern = normalizePath(pattern);\n\n  if (normalizedPattern === '*') return true;\n  if (normalizedPattern === normalizedPath) return true;\n\n  const patternParts = normalizedPattern.split('/');\n  const pathParts = normalizedPath.split('/');\n\n  return matchParts(pathParts, 0, patternParts, 0);\n}\n\nfunction matchParts(\n  pathParts: string[],\n  pi: number,\n  patternParts: string[],\n  qi: number,\n): boolean {\n  while (pi < pathParts.length && qi < patternParts.length) {\n    const pattern = patternParts[qi]!;\n\n    if (pattern === '**') {\n      // ** can match zero or more path segments\n      if (qi === patternParts.length - 1) return true;\n\n      // Try matching ** against 0, 1, 2, ... path segments\n      for (let i = pi; i <= pathParts.length; i++) {\n        if (matchParts(pathParts, i, patternParts, qi + 1)) {\n          return true;\n        }\n      }\n      return false;\n    }\n\n    if (pattern === '*') {\n      // * matches exactly one path segment\n      pi++;\n      qi++;\n      continue;\n    }\n\n    // Support intra-segment globs: *.txt, file.*, test-*-data, etc.\n    if (pattern.includes('*')) {\n      if (!matchSegmentGlob(pathParts[pi]!, pattern)) {\n        return false;\n      }\n      pi++;\n      qi++;\n      continue;\n    }\n\n    if (pattern !== pathParts[pi]) {\n      return false;\n    }\n\n    pi++;\n    qi++;\n  }\n\n  // Skip trailing ** patterns\n  while (qi < patternParts.length && patternParts[qi] === '**') {\n    qi++;\n  }\n\n  return pi === pathParts.length && qi === patternParts.length;\n}\n\n/**\n * Checks if a path is allowed by the given constraints.\n *\n * Evaluation order:\n * 1. If rootDirectory is set, path must be within it\n * 2. If denied list exists, path must NOT match any denied pattern\n * 3. If allowed list exists, path must match at least one allowed pattern\n * 4. If neither list exists, path is allowed (constraints are optional)\n */\nexport function isPathAllowed(\n  path: string,\n  constraints: PathConstraints,\n): boolean {\n  // 1. Root directory check (sandbox)\n  if (constraints.rootDirectory) {\n    if (!isWithinRoot(path, constraints.rootDirectory)) {\n      return false;\n    }\n  }\n\n  // 2. Denied list - any match means denied\n  if (constraints.denied && constraints.denied.length > 0) {\n    for (const pattern of constraints.denied) {\n      if (matchPathPattern(path, pattern)) {\n        return false;\n      }\n    }\n  }\n\n  // 3. Allowed list - must match at least one\n  if (constraints.allowed && constraints.allowed.length > 0) {\n    let matchesAllowed = false;\n    for (const pattern of constraints.allowed) {\n      if (matchPathPattern(path, pattern)) {\n        matchesAllowed = true;\n        break;\n      }\n    }\n    if (!matchesAllowed) return false;\n  }\n\n  return true;\n}\n\n/**\n * Matches a single path segment against a glob pattern containing *.\n * Examples: *.txt matches safe.txt, file.* matches file.js, *secret* matches my-secret-key\n */\nfunction matchSegmentGlob(segment: string, pattern: string): boolean {\n  const startsWithStar = pattern.startsWith('*');\n  const endsWithStar = pattern.endsWith('*');\n\n  if (pattern === '*') return true;\n\n  if (startsWithStar && endsWithStar) {\n    // *infix* — contains\n    const infix = pattern.slice(1, -1);\n    return segment.toLowerCase().includes(infix.toLowerCase());\n  }\n  if (startsWithStar) {\n    // *suffix — ends with\n    const suffix = pattern.slice(1);\n    return segment.toLowerCase().endsWith(suffix.toLowerCase());\n  }\n  if (endsWithStar) {\n    // prefix* — starts with\n    const prefix = pattern.slice(0, -1);\n    return segment.toLowerCase().startsWith(prefix.toLowerCase());\n  }\n\n  // Single * in middle: split on * and check prefix+suffix\n  const starIdx = pattern.indexOf('*');\n  if (starIdx !== -1) {\n    const prefix = pattern.slice(0, starIdx);\n    const suffix = pattern.slice(starIdx + 1);\n    const seg = segment.toLowerCase();\n    return seg.startsWith(prefix.toLowerCase()) && seg.endsWith(suffix.toLowerCase()) && seg.length >= prefix.length + suffix.length;\n  }\n\n  return segment === pattern;\n}\n\n/**\n * Extracts path-like arguments from tool call arguments.\n * Heuristic: any string argument containing / or \\ is treated as a path.\n */\nexport function extractPathArguments(\n  args: Readonly<Record<string, unknown>>,\n): string[] {\n  const paths: string[] = [];\n\n  for (const value of Object.values(args)) {\n    if (typeof value === 'string' && (value.includes('/') || value.includes('\\\\'))) {\n      paths.push(value);\n    }\n  }\n\n  return paths;\n}\n","import type { PolicyRule } from '@solongate/core';\n\ntype CommandConstraints = NonNullable<PolicyRule['commandConstraints']>;\n\n/**\n * Known argument field names that typically contain commands or shell-like content.\n * Used to extract commands from tool call arguments for constraint matching.\n */\nconst COMMAND_FIELDS = new Set([\n  'command',\n  'cmd',\n  'query',\n  'code',\n  'script',\n  'shell',\n  'exec',\n  'sql',\n  'expression',\n]);\n\n/**\n * Extracts command-like arguments from tool call arguments.\n * Looks for known field names and string values that look like commands.\n */\nexport function extractCommandArguments(\n  args: Readonly<Record<string, unknown>>,\n): string[] {\n  const commands: string[] = [];\n\n  for (const [key, value] of Object.entries(args)) {\n    if (typeof value !== 'string') continue;\n\n    // Check known command field names\n    if (COMMAND_FIELDS.has(key.toLowerCase())) {\n      commands.push(value);\n    }\n  }\n\n  return commands;\n}\n\n/**\n * Glob-style command pattern matching.\n * Matches against the command string (first word) or full command line.\n *\n * Patterns:\n *   'ls'       → exact match on command name\n *   'git*'     → command starts with 'git'\n *   '*sql*'    → command contains 'sql'\n *   'rm -rf *' → full command line starts with 'rm -rf '\n */\nexport function matchCommandPattern(command: string, pattern: string): boolean {\n  if (pattern === '*') return true;\n\n  const normalizedCommand = command.trim().toLowerCase();\n  const normalizedPattern = pattern.trim().toLowerCase();\n\n  if (normalizedPattern === normalizedCommand) return true;\n\n  const startsWithStar = normalizedPattern.startsWith('*');\n  const endsWithStar = normalizedPattern.endsWith('*');\n\n  if (startsWithStar && endsWithStar) {\n    const infix = normalizedPattern.slice(1, -1);\n    return infix.length > 0 && normalizedCommand.includes(infix);\n  }\n  if (endsWithStar) {\n    const prefix = normalizedPattern.slice(0, -1);\n    return normalizedCommand.startsWith(prefix);\n  }\n  if (startsWithStar) {\n    const suffix = normalizedPattern.slice(1);\n    return normalizedCommand.endsWith(suffix);\n  }\n\n  // Also try matching just the command name (first word)\n  const commandName = normalizedCommand.split(/\\s+/)[0] ?? '';\n  return commandName === normalizedPattern;\n}\n\n/**\n * Checks if a command is allowed by the given constraints.\n *\n * Evaluation order:\n * 1. If denied list exists, command must NOT match any denied pattern\n * 2. If allowed list exists, command must match at least one allowed pattern\n * 3. If neither list exists, command is allowed (constraints are optional)\n */\nexport function isCommandAllowed(\n  command: string,\n  constraints: CommandConstraints,\n): boolean {\n  // 1. Denied list — any match means denied\n  if (constraints.denied && constraints.denied.length > 0) {\n    for (const pattern of constraints.denied) {\n      if (matchCommandPattern(command, pattern)) {\n        return false;\n      }\n    }\n  }\n\n  // 2. Allowed list — must match at least one\n  if (constraints.allowed && constraints.allowed.length > 0) {\n    let matchesAllowed = false;\n    for (const pattern of constraints.allowed) {\n      if (matchCommandPattern(command, pattern)) {\n        matchesAllowed = true;\n        break;\n      }\n    }\n    if (!matchesAllowed) return false;\n  }\n\n  return true;\n}\n","import type { PolicyRule, ExecutionRequest } from '@solongate/core';\nimport { TrustLevel } from '@solongate/core';\nimport { isPathAllowed, extractPathArguments } from './path-matcher.js';\nimport { isCommandAllowed, extractCommandArguments } from './command-matcher.js';\n\n/**\n * Pure function: determines if a policy rule matches an execution request.\n * No side effects. No I/O. Fully deterministic.\n */\nexport function ruleMatchesRequest(\n  rule: PolicyRule,\n  request: ExecutionRequest,\n): boolean {\n  if (!rule.enabled) return false;\n  if (rule.permission !== request.requiredPermission) return false;\n  if (!toolPatternMatches(rule.toolPattern, request.toolName)) return false;\n  if (!trustLevelMeetsMinimum(request.context.trustLevel, rule.minimumTrustLevel)) {\n    return false;\n  }\n  if (rule.argumentConstraints) {\n    if (!argumentConstraintsMatch(rule.argumentConstraints, request.arguments)) {\n      return false;\n    }\n  }\n  if (rule.pathConstraints) {\n    const satisfied = pathConstraintsMatch(rule.pathConstraints, request.arguments);\n    // For DENY rules: match when constraints are VIOLATED (path is dangerous)\n    // For ALLOW rules: match when constraints are SATISFIED (path is safe)\n    if (rule.effect === 'DENY') {\n      if (satisfied) return false; // path is safe → don't deny\n    } else {\n      if (!satisfied) return false; // path is dangerous → don't allow\n    }\n  }\n  if (rule.commandConstraints) {\n    const satisfied = commandConstraintsMatch(rule.commandConstraints, request.arguments);\n    // For DENY rules: match when constraints are VIOLATED (command is dangerous)\n    // For ALLOW rules: match when constraints are SATISFIED (command is safe)\n    if (rule.effect === 'DENY') {\n      if (satisfied) return false; // command is safe → don't deny\n    } else {\n      if (!satisfied) return false; // command is dangerous → don't allow\n    }\n  }\n  return true;\n}\n\n/**\n * Glob-style tool name pattern matching.\n * Supports:\n *   '*'        → match all\n *   'prefix*'  → starts with prefix\n *   '*suffix'  → ends with suffix\n *   '*infix*'  → contains infix\n * Does NOT support regex (ReDoS prevention).\n */\nexport function toolPatternMatches(pattern: string, toolName: string): boolean {\n  if (pattern === '*') return true;\n\n  const startsWithStar = pattern.startsWith('*');\n  const endsWithStar = pattern.endsWith('*');\n\n  if (startsWithStar && endsWithStar) {\n    // *infix* → contains\n    const infix = pattern.slice(1, -1);\n    return infix.length > 0 && toolName.includes(infix);\n  }\n  if (endsWithStar) {\n    // prefix* → starts with\n    const prefix = pattern.slice(0, -1);\n    return toolName.startsWith(prefix);\n  }\n  if (startsWithStar) {\n    // *suffix → ends with\n    const suffix = pattern.slice(1);\n    return toolName.endsWith(suffix);\n  }\n\n  return pattern === toolName;\n}\n\nconst TRUST_LEVEL_ORDER: Record<string, number> = {\n  [TrustLevel.UNTRUSTED]: 0,\n  [TrustLevel.VERIFIED]: 1,\n  [TrustLevel.TRUSTED]: 2,\n};\n\nexport function trustLevelMeetsMinimum(\n  actual: TrustLevel,\n  minimum: TrustLevel,\n): boolean {\n  return (TRUST_LEVEL_ORDER[actual] ?? -1) >= (TRUST_LEVEL_ORDER[minimum] ?? Infinity);\n}\n\n/**\n * Condition operators for argument constraints.\n * When constraint value is a plain string → exact match (or '*' for any).\n * When constraint value is an object → operator-based matching:\n *   { $contains: \"str\" }      — value includes substring\n *   { $notContains: \"str\" }   — value does NOT include substring\n *   { $startsWith: \"str\" }    — value starts with prefix\n *   { $endsWith: \"str\" }      — value ends with suffix\n *   { $in: [\"a\",\"b\"] }        — value is one of the listed values\n *   { $notIn: [\"a\",\"b\"] }     — value is NOT one of the listed values\n *   { $gt: 5 }                — numeric greater than\n *   { $lt: 5 }                — numeric less than\n *   { $gte: 5 }               — numeric greater than or equal\n *   { $lte: 5 }               — numeric less than or equal\n */\nfunction argumentConstraintsMatch(\n  constraints: Record<string, unknown>,\n  args: Readonly<Record<string, unknown>>,\n): boolean {\n  for (const [key, constraint] of Object.entries(constraints)) {\n    if (!(key in args)) return false;\n    const argValue = args[key];\n\n    // Plain string: exact match (backward compatible)\n    if (typeof constraint === 'string') {\n      if (constraint === '*') continue;\n      if (typeof argValue === 'string') {\n        if (argValue !== constraint) return false;\n      } else {\n        return false;\n      }\n      continue;\n    }\n\n    // Object with operators\n    if (typeof constraint === 'object' && constraint !== null && !Array.isArray(constraint)) {\n      const ops = constraint as Record<string, unknown>;\n      const strValue = typeof argValue === 'string' ? argValue : undefined;\n      const numValue = typeof argValue === 'number' ? argValue : undefined;\n\n      if ('$contains' in ops && typeof ops.$contains === 'string') {\n        if (!strValue || !strValue.includes(ops.$contains)) return false;\n      }\n      if ('$notContains' in ops && typeof ops.$notContains === 'string') {\n        if (strValue && strValue.includes(ops.$notContains)) return false;\n      }\n      if ('$startsWith' in ops && typeof ops.$startsWith === 'string') {\n        if (!strValue || !strValue.startsWith(ops.$startsWith)) return false;\n      }\n      if ('$endsWith' in ops && typeof ops.$endsWith === 'string') {\n        if (!strValue || !strValue.endsWith(ops.$endsWith)) return false;\n      }\n      if ('$in' in ops && Array.isArray(ops.$in)) {\n        if (!ops.$in.includes(argValue)) return false;\n      }\n      if ('$notIn' in ops && Array.isArray(ops.$notIn)) {\n        if (ops.$notIn.includes(argValue)) return false;\n      }\n      if ('$gt' in ops && typeof ops.$gt === 'number') {\n        if (numValue === undefined || numValue <= ops.$gt) return false;\n      }\n      if ('$lt' in ops && typeof ops.$lt === 'number') {\n        if (numValue === undefined || numValue >= ops.$lt) return false;\n      }\n      if ('$gte' in ops && typeof ops.$gte === 'number') {\n        if (numValue === undefined || numValue < ops.$gte) return false;\n      }\n      if ('$lte' in ops && typeof ops.$lte === 'number') {\n        if (numValue === undefined || numValue > ops.$lte) return false;\n      }\n\n      continue;\n    }\n  }\n  return true;\n}\n\nfunction pathConstraintsMatch(\n  constraints: NonNullable<PolicyRule['pathConstraints']>,\n  args: Readonly<Record<string, unknown>>,\n): boolean {\n  const paths = extractPathArguments(args);\n\n  // If no path arguments found, constraints don't apply\n  if (paths.length === 0) return true;\n\n  // ALL path arguments must satisfy constraints\n  return paths.every((path) => isPathAllowed(path, constraints));\n}\n\nfunction commandConstraintsMatch(\n  constraints: NonNullable<PolicyRule['commandConstraints']>,\n  args: Readonly<Record<string, unknown>>,\n): boolean {\n  const commands = extractCommandArguments(args);\n\n  // If no command arguments found, constraints don't apply\n  if (commands.length === 0) return true;\n\n  // ALL command arguments must satisfy constraints\n  return commands.every((cmd) => isCommandAllowed(cmd, constraints));\n}\n","import type {\n  PolicySet,\n  PolicyDecision,\n  ExecutionRequest,\n  PolicyEffect,\n} from '@solongate/core';\nimport { DEFAULT_POLICY_EFFECT } from '@solongate/core';\nimport { ruleMatchesRequest } from './matcher.js';\n\n/**\n * Evaluates a policy set against an execution request.\n *\n * Pure function: no side effects, no I/O, fully deterministic.\n *\n * Algorithm:\n * 1. Sort rules by priority (ascending - lower number = higher priority)\n * 2. Find the first matching rule\n * 3. If a rule matches, return its effect\n * 4. If no rule matches, return DENY (default-deny)\n */\nexport function evaluatePolicy(\n  policySet: PolicySet,\n  request: ExecutionRequest,\n): PolicyDecision {\n  const startTime = performance.now();\n\n  const sortedRules = [...policySet.rules].sort(\n    (a, b) => a.priority - b.priority,\n  );\n\n  for (const rule of sortedRules) {\n    if (ruleMatchesRequest(rule, request)) {\n      const endTime = performance.now();\n      return {\n        effect: rule.effect,\n        matchedRule: rule,\n        reason: `Matched rule \"${rule.id}\": ${rule.description}`,\n        timestamp: new Date().toISOString(),\n        evaluationTimeMs: endTime - startTime,\n      };\n    }\n  }\n\n  const endTime = performance.now();\n  return {\n    effect: DEFAULT_POLICY_EFFECT as PolicyEffect,\n    matchedRule: null,\n    reason: 'No matching policy rule found. Default action: DENY.',\n    timestamp: new Date().toISOString(),\n    evaluationTimeMs: endTime - startTime,\n    metadata: {\n      evaluatedRules: sortedRules.length,\n      ruleIds: sortedRules.map((r) => r.id),\n      requestContext: {\n        tool: request.toolName,\n        arguments: Object.keys(request.arguments ?? {}),\n      },\n    },\n  };\n}\n","import { PolicyRuleSchema, PolicySetSchema } from '@solongate/core';\nimport {\n  MAX_RULES_PER_POLICY_SET,\n  UNSAFE_CONFIGURATION_WARNINGS,\n} from '@solongate/core';\n\nexport interface ValidationResult {\n  readonly valid: boolean;\n  readonly errors: readonly string[];\n  readonly warnings: readonly string[];\n}\n\nexport function validatePolicyRule(input: unknown): ValidationResult {\n  const errors: string[] = [];\n  const warnings: string[] = [];\n\n  const result = PolicyRuleSchema.safeParse(input);\n  if (!result.success) {\n    return {\n      valid: false,\n      errors: result.error.errors.map(\n        (e) => `${e.path.join('.')}: ${e.message}`,\n      ),\n      warnings: [],\n    };\n  }\n\n  const rule = result.data;\n\n  if (rule.toolPattern === '*' && rule.effect === 'ALLOW') {\n    warnings.push(UNSAFE_CONFIGURATION_WARNINGS.WILDCARD_ALLOW);\n  }\n\n  if (rule.minimumTrustLevel === 'TRUSTED') {\n    warnings.push(UNSAFE_CONFIGURATION_WARNINGS.TRUSTED_LEVEL_EXTERNAL);\n  }\n\n  if (rule.permission === 'EXECUTE') {\n    warnings.push(UNSAFE_CONFIGURATION_WARNINGS.EXECUTE_WITHOUT_REVIEW);\n  }\n\n  return { valid: true, errors, warnings };\n}\n\nexport function validatePolicySet(input: unknown): ValidationResult {\n  const errors: string[] = [];\n  const warnings: string[] = [];\n\n  const result = PolicySetSchema.safeParse(input);\n  if (!result.success) {\n    return {\n      valid: false,\n      errors: result.error.errors.map(\n        (e) => `${e.path.join('.')}: ${e.message}`,\n      ),\n      warnings: [],\n    };\n  }\n\n  const policySet = result.data;\n\n  if (policySet.rules.length > MAX_RULES_PER_POLICY_SET) {\n    errors.push(\n      `Policy set exceeds maximum of ${MAX_RULES_PER_POLICY_SET} rules`,\n    );\n  }\n\n  const ruleIds = new Set<string>();\n  for (const rule of policySet.rules) {\n    if (ruleIds.has(rule.id)) {\n      errors.push(`Duplicate rule ID: \"${rule.id}\"`);\n    }\n    ruleIds.add(rule.id);\n  }\n\n  for (const rule of policySet.rules) {\n    const ruleResult = validatePolicyRule(rule);\n    warnings.push(...ruleResult.warnings);\n  }\n\n  const hasDenyRule = policySet.rules.some((r) => r.effect === 'DENY');\n  if (!hasDenyRule && policySet.rules.length > 0) {\n    warnings.push(\n      'Policy set contains only ALLOW rules. The default-deny fallback is the only protection.',\n    );\n  }\n\n  return {\n    valid: errors.length === 0,\n    errors,\n    warnings,\n  };\n}\n","import type { PolicyRule, PolicySet } from '@solongate/core';\nimport { UNSAFE_CONFIGURATION_WARNINGS } from '@solongate/core';\n\nexport interface SecurityWarning {\n  readonly level: 'WARNING' | 'CRITICAL';\n  readonly code: string;\n  readonly message: string;\n  readonly ruleId?: string;\n  readonly recommendation: string;\n}\n\n/** Analyzes a policy set and returns security warnings. Pure function. */\nexport function analyzeSecurityWarnings(\n  policySet: PolicySet,\n): readonly SecurityWarning[] {\n  const warnings: SecurityWarning[] = [];\n\n  for (const rule of policySet.rules) {\n    warnings.push(...analyzeRuleWarnings(rule));\n  }\n\n  const allowRules = policySet.rules.filter(\n    (r) => r.effect === 'ALLOW' && r.enabled,\n  );\n  const wildcardAllows = allowRules.filter((r) => r.toolPattern === '*');\n\n  if (wildcardAllows.length > 0) {\n    warnings.push({\n      level: 'CRITICAL',\n      code: 'WILDCARD_ALLOW',\n      message: UNSAFE_CONFIGURATION_WARNINGS.WILDCARD_ALLOW,\n      recommendation:\n        'Replace wildcard ALLOW rules with specific tool patterns.',\n    });\n  }\n\n  return warnings;\n}\n\nfunction analyzeRuleWarnings(rule: PolicyRule): SecurityWarning[] {\n  const warnings: SecurityWarning[] = [];\n\n  if (rule.effect === 'ALLOW' && rule.minimumTrustLevel === 'UNTRUSTED') {\n    warnings.push({\n      level: 'CRITICAL',\n      code: 'ALLOW_UNTRUSTED',\n      message: `Rule \"${rule.id}\" allows execution for UNTRUSTED requests. Unverified LLM requests can execute tools.`,\n      ruleId: rule.id,\n      recommendation:\n        'Set minimumTrustLevel to VERIFIED or higher for ALLOW rules.',\n    });\n  }\n\n  if (rule.effect === 'ALLOW' && rule.permission === 'EXECUTE') {\n    warnings.push({\n      level: 'WARNING',\n      code: 'ALLOW_EXECUTE',\n      message: UNSAFE_CONFIGURATION_WARNINGS.EXECUTE_WITHOUT_REVIEW,\n      ruleId: rule.id,\n      recommendation:\n        'Ensure EXECUTE permissions are intentional and scoped to specific tools.',\n    });\n  }\n\n  return warnings;\n}\n","import type { PolicySet } from '@solongate/core';\nimport { PolicyEffect, Permission, TrustLevel } from '@solongate/core';\n\n/**\n * Creates the default \"deny all\" policy set.\n * This is the starting policy for any new SolonGate deployment.\n */\nexport function createDefaultDenyPolicySet(): PolicySet {\n  const now = new Date().toISOString();\n\n  return {\n    id: 'default-deny',\n    name: 'Default Deny All',\n    description:\n      'Denies all tool executions. Add explicit ALLOW rules to grant access to specific tools.',\n    version: 1,\n    rules: [\n      {\n        id: 'deny-all-execute',\n        description: 'Explicitly deny all tool executions',\n        effect: PolicyEffect.DENY,\n        priority: 10000,\n        toolPattern: '*',\n        permission: Permission.EXECUTE,\n        minimumTrustLevel: TrustLevel.UNTRUSTED,\n        enabled: true,\n        createdAt: now,\n        updatedAt: now,\n      },\n      {\n        id: 'deny-all-write',\n        description: 'Explicitly deny all write operations',\n        effect: PolicyEffect.DENY,\n        priority: 10000,\n        toolPattern: '*',\n        permission: Permission.WRITE,\n        minimumTrustLevel: TrustLevel.UNTRUSTED,\n        enabled: true,\n        createdAt: now,\n        updatedAt: now,\n      },\n      {\n        id: 'deny-all-read',\n        description: 'Explicitly deny all read operations',\n        effect: PolicyEffect.DENY,\n        priority: 10000,\n        toolPattern: '*',\n        permission: Permission.READ,\n        minimumTrustLevel: TrustLevel.UNTRUSTED,\n        enabled: true,\n        createdAt: now,\n        updatedAt: now,\n      },\n    ],\n    createdAt: now,\n    updatedAt: now,\n  };\n}\n\n/**\n * Creates a permissive \"allow all\" policy set.\n * Allows all tool executions — useful for development or when\n * using SolonGate only for monitoring and audit logging.\n */\nexport function createPermissivePolicySet(): PolicySet {\n  const now = new Date().toISOString();\n\n  return {\n    id: 'permissive',\n    name: 'Permissive (Allow All)',\n    description: 'Allows all tool executions. SolonGate still provides input validation, rate limiting, and audit logging.',\n    version: 1,\n    rules: [\n      {\n        id: 'allow-all-execute',\n        description: 'Allow all tool executions',\n        effect: PolicyEffect.ALLOW,\n        priority: 1000,\n        toolPattern: '*',\n        permission: Permission.EXECUTE,\n        minimumTrustLevel: TrustLevel.UNTRUSTED,\n        enabled: true,\n        createdAt: now,\n        updatedAt: now,\n      },\n      {\n        id: 'allow-all-read',\n        description: 'Allow all read operations',\n        effect: PolicyEffect.ALLOW,\n        priority: 1000,\n        toolPattern: '*',\n        permission: Permission.READ,\n        minimumTrustLevel: TrustLevel.UNTRUSTED,\n        enabled: true,\n        createdAt: now,\n        updatedAt: now,\n      },\n      {\n        id: 'allow-all-write',\n        description: 'Allow all write operations',\n        effect: PolicyEffect.ALLOW,\n        priority: 1000,\n        toolPattern: '*',\n        permission: Permission.WRITE,\n        minimumTrustLevel: TrustLevel.UNTRUSTED,\n        enabled: true,\n        createdAt: now,\n        updatedAt: now,\n      },\n    ],\n    createdAt: now,\n    updatedAt: now,\n  };\n}\n\n/**\n * Creates a read-only policy set for a specific tool pattern.\n * Allows reads for VERIFIED requests only.\n */\nexport function createReadOnlyPolicySet(toolPattern: string): PolicySet {\n  const now = new Date().toISOString();\n\n  return {\n    id: `read-only-${toolPattern}`,\n    name: `Read-Only: ${toolPattern}`,\n    description: `Allows read access to tools matching \"${toolPattern}\". Denies write and execute.`,\n    version: 1,\n    rules: [\n      {\n        id: `allow-read-${toolPattern}`,\n        description: `Allow read access to ${toolPattern}`,\n        effect: PolicyEffect.ALLOW,\n        priority: 100,\n        toolPattern,\n        permission: Permission.READ,\n        minimumTrustLevel: TrustLevel.VERIFIED,\n        enabled: true,\n        createdAt: now,\n        updatedAt: now,\n      },\n    ],\n    createdAt: now,\n    updatedAt: now,\n  };\n}\n\n/**\n * Creates a sandboxed policy set for a given root directory.\n * Allows file operations within rootDir, blocks dangerous commands,\n * denies access to sensitive files.\n */\nexport function createSandboxedPolicySet(rootDir: string): PolicySet {\n  const now = new Date().toISOString();\n\n  return {\n    id: `sandbox-${rootDir.replace(/\\//g, '-')}`,\n    name: `Sandbox: ${rootDir}`,\n    description: `Allows operations within ${rootDir}. Blocks dangerous commands and sensitive file access.`,\n    version: 1,\n    rules: [\n      {\n        id: 'deny-dangerous-commands',\n        description: 'Block dangerous shell commands',\n        effect: PolicyEffect.DENY,\n        priority: 50,\n        toolPattern: '*',\n        permission: Permission.EXECUTE,\n        minimumTrustLevel: TrustLevel.UNTRUSTED,\n        commandConstraints: {\n          denied: [\n            'rm -rf *', 'rm -r /*', 'mkfs*', 'dd if=*',\n            'curl*|*bash*', 'wget*|*sh*',\n            'shutdown*', 'reboot*', 'chmod*777*',\n          ],\n        },\n        enabled: true,\n        createdAt: now,\n        updatedAt: now,\n      },\n      {\n        id: 'deny-sensitive-paths',\n        description: 'Block access to sensitive files',\n        effect: PolicyEffect.DENY,\n        priority: 51,\n        toolPattern: '*',\n        permission: Permission.EXECUTE,\n        minimumTrustLevel: TrustLevel.UNTRUSTED,\n        pathConstraints: {\n          denied: [\n            '**/.env*', '**/.ssh/**', '**/.aws/**',\n            '**/credentials*', '**/*.pem', '**/*.key',\n          ],\n        },\n        enabled: true,\n        createdAt: now,\n        updatedAt: now,\n      },\n      {\n        id: 'allow-sandboxed-files',\n        description: `Allow file operations within ${rootDir}`,\n        effect: PolicyEffect.ALLOW,\n        priority: 100,\n        toolPattern: 'file_*',\n        permission: Permission.EXECUTE,\n        minimumTrustLevel: TrustLevel.UNTRUSTED,\n        pathConstraints: {\n          rootDirectory: rootDir,\n          allowed: [`${rootDir}/**`],\n        },\n        enabled: true,\n        createdAt: now,\n        updatedAt: now,\n      },\n      {\n        id: 'allow-all-execute',\n        description: 'Allow all other tool executions',\n        effect: PolicyEffect.ALLOW,\n        priority: 1000,\n        toolPattern: '*',\n        permission: Permission.EXECUTE,\n        minimumTrustLevel: TrustLevel.UNTRUSTED,\n        enabled: true,\n        createdAt: now,\n        updatedAt: now,\n      },\n    ],\n    createdAt: now,\n    updatedAt: now,\n  };\n}\n","import type {\n  PolicySet,\n  PolicyDecision,\n  ExecutionRequest,\n} from '@solongate/core';\nimport { POLICY_EVALUATION_TIMEOUT_MS } from '@solongate/core';\nimport { evaluatePolicy } from './evaluator.js';\nimport { validatePolicySet, type ValidationResult } from './validator.js';\nimport { analyzeSecurityWarnings, type SecurityWarning } from './warnings.js';\nimport { createDefaultDenyPolicySet } from './defaults.js';\nimport { PolicyStore, type PolicyVersion } from './policy-store.js';\n\n/**\n * PolicyEngine is the primary interface for policy evaluation.\n *\n * Wraps pure evaluation functions with:\n * - Policy set management (load, validate, swap)\n * - Timeout protection\n * - Warning aggregation\n * - Optional versioned policy store\n */\nexport class PolicyEngine {\n  private policySet: PolicySet;\n  private readonly timeoutMs: number;\n  private readonly store: PolicyStore | null;\n\n  constructor(options?: {\n    policySet?: PolicySet;\n    timeoutMs?: number;\n    store?: PolicyStore;\n  }) {\n    this.policySet = options?.policySet ?? createDefaultDenyPolicySet();\n    this.timeoutMs = options?.timeoutMs ?? POLICY_EVALUATION_TIMEOUT_MS;\n    this.store = options?.store ?? null;\n  }\n\n  /**\n   * Evaluates an execution request against the current policy set.\n   * Never throws for denials - denial is a normal outcome, not an error.\n   */\n  evaluate(request: ExecutionRequest): PolicyDecision {\n    const startTime = performance.now();\n    const decision = evaluatePolicy(this.policySet, request);\n    const elapsed = performance.now() - startTime;\n\n    if (elapsed > this.timeoutMs) {\n      console.warn(\n        `[SolonGate] Policy evaluation took ${elapsed.toFixed(1)}ms ` +\n        `(limit: ${this.timeoutMs}ms) for tool \"${request.toolName}\"`,\n      );\n    }\n\n    return decision;\n  }\n\n  /**\n   * Loads a new policy set, replacing the current one.\n   * Validates before accepting. Auto-saves version when store is present.\n   */\n  loadPolicySet(\n    policySet: PolicySet,\n    options?: { reason?: string; createdBy?: string },\n  ): ValidationResult {\n    const validation = validatePolicySet(policySet);\n    if (!validation.valid) {\n      return validation;\n    }\n    this.policySet = policySet;\n\n    if (this.store) {\n      this.store.saveVersion(\n        policySet,\n        options?.reason ?? 'Policy updated',\n        options?.createdBy ?? 'system',\n      );\n    }\n\n    return validation;\n  }\n\n  /**\n   * Rolls back to a previous policy version.\n   * Only available when a PolicyStore is configured.\n   */\n  rollback(version: number): PolicyVersion {\n    if (!this.store) {\n      throw new Error('PolicyStore not configured - cannot rollback');\n    }\n\n    const policyVersion = this.store.rollback(this.policySet.id, version);\n    this.policySet = policyVersion.policySet;\n    return policyVersion;\n  }\n\n  getPolicySet(): Readonly<PolicySet> {\n    return this.policySet;\n  }\n\n  getSecurityWarnings(): readonly SecurityWarning[] {\n    return analyzeSecurityWarnings(this.policySet);\n  }\n\n  getStore(): PolicyStore | null {\n    return this.store;\n  }\n\n  reset(): void {\n    this.policySet = createDefaultDenyPolicySet();\n  }\n}\n","import type { PolicySet, PolicyRule } from '@solongate/core';\nimport { createHash } from 'node:crypto';\n\n/**\n * A versioned snapshot of a policy set.\n * Immutable once created - modifications create new versions.\n */\nexport interface PolicyVersion {\n  readonly version: number;\n  readonly policySet: PolicySet;\n  readonly hash: string;\n  readonly reason: string;\n  readonly createdBy: string;\n  readonly createdAt: string;\n}\n\n/**\n * Diff between two policy versions.\n */\nexport interface PolicyDiff {\n  readonly added: readonly PolicyRule[];\n  readonly removed: readonly PolicyRule[];\n  readonly modified: readonly { readonly old: PolicyRule; readonly new: PolicyRule }[];\n}\n\n/**\n * In-memory versioned policy store.\n * Stores complete history of policy changes with cryptographic hashes.\n *\n * Security properties:\n * - Immutable versions: once saved, a version cannot be modified\n * - Hash chain: each version includes SHA256 of the policy content\n * - Full history: no version is ever deleted\n */\nexport class PolicyStore {\n  private readonly versions = new Map<string, PolicyVersion[]>();\n\n  /**\n   * Saves a new version of a policy set.\n   * The version number auto-increments.\n   */\n  saveVersion(\n    policySet: PolicySet,\n    reason: string,\n    createdBy: string,\n  ): PolicyVersion {\n    const id = policySet.id;\n    const history = this.versions.get(id) ?? [];\n\n    const latestVersion = history.length > 0 ? history[history.length - 1]!.version : 0;\n\n    const version: PolicyVersion = {\n      version: latestVersion + 1,\n      policySet: Object.freeze({ ...policySet }),\n      hash: this.computeHash(policySet),\n      reason,\n      createdBy,\n      createdAt: new Date().toISOString(),\n    };\n\n    const newHistory = [...history, version];\n    this.versions.set(id, newHistory);\n\n    return version;\n  }\n\n  /**\n   * Gets a specific version of a policy set.\n   */\n  getVersion(id: string, version: number): PolicyVersion | null {\n    const history = this.versions.get(id);\n    if (!history) return null;\n    return history.find((v) => v.version === version) ?? null;\n  }\n\n  /**\n   * Gets the latest version of a policy set.\n   */\n  getLatest(id: string): PolicyVersion | null {\n    const history = this.versions.get(id);\n    if (!history || history.length === 0) return null;\n    return history[history.length - 1]!;\n  }\n\n  /**\n   * Gets the full version history of a policy set.\n   */\n  getHistory(id: string): readonly PolicyVersion[] {\n    return this.versions.get(id) ?? [];\n  }\n\n  /**\n   * Rolls back to a previous version by creating a new version\n   * with the same content as the target version.\n   */\n  rollback(id: string, toVersion: number): PolicyVersion {\n    const target = this.getVersion(id, toVersion);\n    if (!target) {\n      throw new Error(`Version ${toVersion} not found for policy \"${id}\"`);\n    }\n\n    return this.saveVersion(\n      target.policySet,\n      `Rollback to version ${toVersion}`,\n      'system',\n    );\n  }\n\n  /**\n   * Computes a diff between two policy versions.\n   */\n  diff(v1: PolicyVersion, v2: PolicyVersion): PolicyDiff {\n    const oldRulesMap = new Map(v1.policySet.rules.map((r) => [r.id, r]));\n    const newRulesMap = new Map(v2.policySet.rules.map((r) => [r.id, r]));\n\n    const added: PolicyRule[] = [];\n    const removed: PolicyRule[] = [];\n    const modified: { old: PolicyRule; new: PolicyRule }[] = [];\n\n    // Find added and modified rules\n    for (const [id, newRule] of newRulesMap) {\n      const oldRule = oldRulesMap.get(id);\n      if (!oldRule) {\n        added.push(newRule);\n      } else if (JSON.stringify(oldRule) !== JSON.stringify(newRule)) {\n        modified.push({ old: oldRule, new: newRule });\n      }\n    }\n\n    // Find removed rules\n    for (const [id, oldRule] of oldRulesMap) {\n      if (!newRulesMap.has(id)) {\n        removed.push(oldRule);\n      }\n    }\n\n    return { added, removed, modified };\n  }\n\n  /**\n   * Computes SHA256 hash of a policy set for integrity verification.\n   */\n  computeHash(policySet: PolicySet): string {\n    const serialized = JSON.stringify(policySet, Object.keys(policySet).sort());\n    return createHash('sha256').update(serialized).digest('hex');\n  }\n}\n"]}

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@solongate/policy-engine",
+  "version": "0.1.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": ["dist"],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist .turbo"
+  },
+  "dependencies": {
+    "@solongate/core": "workspace:*",
+    "zod": "^3.25.0"
+  },
+  "devDependencies": {
+    "@solongate/tsconfig": "workspace:*",
+    "tsup": "^8.3.0",
+    "typescript": "^5.7.0",
+    "vitest": "^2.1.0"
+  }
+}