@sonisoft/now-sdk-ext-core 6.0.0 → 6.1.0

package/README.md

@@ -444,6 +444,52 @@ console.log('Return value:', result.result);
 - **`CMDBRelationships`** - Query direct relationships and traverse CI graphs (BFS)
 - **`InstanceDiscovery`** - List tables, scoped apps, store apps, and plugins
 
+### Permission policy
+
+Core can refuse operations that would change a ServiceNow instance. **It is inert until
+an application installs a policy**, so importing this library changes nothing — the
+`nex` CLI and the MCP server install one at startup because those are the surfaces an
+AI agent drives.
+
+```typescript
+import { installPolicy, denyLayer, grantLayer } from '@sonisoft/now-sdk-ext-core';
+
+installPolicy([
+    denyLayer('lockdown', ['write']),                  // highest priority
+    grantLayer('default', ['write', 'execute']),       // lowest
+]);
+```
+
+Two verbs — `write` and `execute` — plus a `target` of `instance`, `local` or `session`.
+Only `instance` is gated, so a tool that overwrites a local file is not refused as an
+instance write. Layers are consulted in order and the first to answer `grant` or `deny`
+decides; `abstain` passes the question down.
+
+Reads are never gated.
+
+> **This is a guardrail, not a security boundary.** Anything holding the credential can
+> reach the instance directly — by calling the SDK, or with curl. What it buys is that
+> inadvertent mutation stops being silent, and that an environment variable can deny in
+> a way the calling code cannot override.
+
+#### Script scanning, and what it cannot see
+
+Background scripts are parsed to decide whether they need `write` on top of `execute`.
+Anything unresolvable — computed member access like `gr['inse'+'rt']()`, `eval`, or a
+parse failure — escalates to `write` rather than passing.
+
+**A `write`-free result means "nothing obviously writes", not "this cannot write."**
+These are invisible to any static scan:
+
+- Script Includes — `new global.MyUtil().doThing()`, where the write is in another file
+- `gs.eval(...)`
+- `sn_ws.RESTMessageV2` calling out to anything
+- `workflow.startFlow()`, `gs.getUser().setPreference()`
+- a `GlideRecord` reached through a variable the scan never resolves
+
+That is why `execute` is required regardless of what the scan concludes: permitting a
+script to run at all is the real decision.
+
 ### Logging & Real-time Events
 
 - **`SyslogReader`** - Log querying, formatting, export, and real-time tailing

package/dist/comm/http/HTTPRequest.d.ts

@@ -1,3 +1,4 @@
+import { Requirement } from "../../policy/PolicyTypes.js";
 export interface HTTPRequest {
     path: string;
     headers: object | null;
@@ -6,4 +7,15 @@ export interface HTTPRequest {
     method?: string | null;
     fields?: object | null;
     json?: object | null;
+    /**
+     * What permission this request needs, when the HTTP verb would get it wrong.
+     *
+     * Leave unset almost always: GET is assumed to read, everything else to write, and
+     * that is right for all but two call sites in this library — `SyslogReader` POSTs
+     * to read, and `ATFTestExecutor` POSTs to run tests. Set it there.
+     *
+     * This can correct a wrong default but can never lower a floor rule; see
+     * `policy/internal/Classify.ts`.
+     */
+    requires?: Requirement;
 }

package/dist/comm/http/RequestHandler.d.ts

@@ -46,6 +46,19 @@ export declare class RequestHandler implements IRequestHandler {
      * own.
      */
     private toThrowable;
+    /**
+     * Refuses the request when policy does not permit what it would do.
+     *
+     * No-op until an application installs a policy, so embedding this library is
+     * unaffected. The `nex` CLI and the MCP server install a deny-by-default policy at
+     * startup, because those are the surfaces an agent drives.
+     *
+     * Allowed mutations are logged at info with the deciding layer. That log is the
+     * only thing that surfaces a missing floor rule — a mutating endpoint nobody
+     * classified shows up as a write that was permitted for the wrong reason — and it
+     * is what answers "why was this refused" when someone asks.
+     */
+    private assertPermitted;
     private assertSessionMatchesBoundInstance;
     isValidXmlString(xmlString: any): boolean;
     private doRequest;

package/dist/comm/http/RequestHandler.js

@@ -4,6 +4,9 @@ import { makeRequest } from "@servicenow/sdk-cli-core/dist/http/index.js";
 import { DOMParser } from '@xmldom/xmldom';
 import { StaleInstanceError } from '../../exception/StaleInstanceError.js';
 import { stripSecretsFromError, redactValue } from '../../util/redact.js';
+import { checkRequirement } from '../../policy/Policy.js';
+import { policyRefusal } from '../../policy/PolicyRefusal.js';
+import { classify } from '../../policy/internal/Classify.js';
 //axios.defaults.withCredentials = true;
 export class RequestHandler {
     _logger = new Logger("RequestHandler");
@@ -96,6 +99,45 @@ export class RequestHandler {
         }
         return new Error(described);
     }
+    /**
+     * Refuses the request when policy does not permit what it would do.
+     *
+     * No-op until an application installs a policy, so embedding this library is
+     * unaffected. The `nex` CLI and the MCP server install a deny-by-default policy at
+     * startup, because those are the surfaces an agent drives.
+     *
+     * Allowed mutations are logged at info with the deciding layer. That log is the
+     * only thing that surfaces a missing floor rule — a mutating endpoint nobody
+     * classified shows up as a write that was permitted for the wrong reason — and it
+     * is what answers "why was this refused" when someone asks.
+     */
+    assertPermitted(request) {
+        const requirement = classify(request);
+        if (requirement.verbs.length === 0) {
+            return;
+        }
+        const decision = checkRequirement(requirement);
+        const path = typeof request.path === "string" ? request.path.split("?")[0] : "(unknown)";
+        if (!decision.allowed) {
+            this._logger.warn("Refused by policy", {
+                path,
+                method: request.method ?? "get",
+                verbs: decision.verbs,
+                decidingLayer: decision.decidingLayer,
+                floor: requirement.reasons,
+            });
+            throw policyRefusal(decision);
+        }
+        if (decision.decidingLayer !== "no-policy") {
+            this._logger.info("Permitted by policy", {
+                path,
+                method: request.method ?? "get",
+                verbs: decision.verbs,
+                grantedBy: decision.decidingLayer,
+                floor: requirement.reasons,
+            });
+        }
+    }
     assertSessionMatchesBoundInstance() {
         const bound = this._boundInstanceId;
         const forSession = this._sessionInstanceId;
@@ -301,6 +343,11 @@ export class RequestHandler {
         // destination host from auth.instanceUrl, so a mismatch here does not send a
         // bad cookie to the right host — it sends a valid session to the wrong one.
         this.assertSessionMatchesBoundInstance();
+        // Same reasoning, same place: this is the one point every request passes
+        // through — both SessionManager-managed handlers and the ~21 managers that
+        // construct their own ServiceNowRequest. A second chokepoint elsewhere would
+        // only be a second thing to keep in sync.
+        this.assertPermitted(request);
         const config = {
             auth: this._session,
         };

package/dist/comm/http/RequestHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"RequestHandler.js","sourceRoot":"","sources":["../../../src/comm/http/RequestHandler.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAK9C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,6CAA6C,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEvE,wCAAwC;AAExC,MAAM,OAAO,cAAc;IAEvB,OAAO,GAAU,IAAI,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC9C,yCAAyC;IACzC,2BAA2B;IAC3B,QAAQ,CAAW;IAEnB,YAAY,CAAc;IAC1B,YAAY,CAAwB;IAEpC,QAAQ,CAAM;IAEd,+EAA+E;IACvE,gBAAgB,CAAqB;IAE7C,gGAAgG;IACxF,kBAAkB,CAAqB;IAE/C;;;OAGG;IACH,YAAmB,WAAkC;QACjD,sDAAsD;QACvD,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAE/B,gDAAgD;QAChD,2DAA2D;QAC3D,oCAAoC;QACpC,mCAAmC;QACnC,6BAA6B;QAC7B,2EAA2E;QAC3E,QAAQ;QAER,6CAA6C;IAEhD,CAAC;IAIK,UAAU,CAAC,OAAY,EAAE,QAA8B;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,4EAA4E;QAC5E,6EAA6E;QAC7E,8DAA8D;QAC9D,IAAI,CAAC,kBAAkB,GAAG,QAAQ,EAAE,aAAa,EAAE,EAAE,CAAC;QAEtD,6EAA6E;QAC7E,8EAA8E;QAC9E,6DAA6D;QAC7D,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAClE,IAAI,CAAC,OAAO,CAAC,IAAI,CACb,yGAAyG,EACzG,EAAE,yBAAyB,EAAE,QAAQ,EAAE,CAC1C,CAAC;QACN,CAAC;IACL,CAAC;IAEM,YAAY,CAAC,QAA6B;QAC7C,IAAI,CAAC,gBAAgB,GAAG,QAAQ,EAAE,aAAa,EAAE,EAAE,CAAC;IACxD,CAAC;IAED;;;;;;;;;;;;OAYG;IACH;;;;;;;;OAQG;IACK,WAAW,CAAC,EAAW;QAC3B,IAAI,EAAE,YAAY,KAAK,EAAE,CAAC;YACtB,OAAO,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,0EAA0E;QAC1E,0EAA0E;QAC1E,oEAAoE;QACpE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YACzB,OAAO,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC;QACD,+EAA+E;QAC/E,yEAAyE;QACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAW,CAAC;QAC9D,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACD,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACL,0EAA0E;YAC1E,8CAA8C;YAC9C,SAAS,GAAG,QAAQ,CAAC;QACzB,CAAC;QACD,OAAO,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IAEO,iCAAiC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAE3C,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAClD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,8DAA8D,EAAE;gBAC/E,eAAe,EAAE,KAAK;gBACtB,iBAAiB,EAAE,UAAU;aAChC,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,kBAAkB,CACxB,4CAA4C,KAAK,yCAAyC,UAAU,GAAG,EACvG,qFAAqF;gBACjF,+DAA+D,CACtE,CAAC;QACN,CAAC;IACL,CAAC;IAED,mFAAmF;IAEnF,6CAA6C;IAC7C,4FAA4F;IAC5F,iEAAiE;IACjE,QAAQ;IACR,+DAA+D;IAC/D,8CAA8C;IAC9C,IAAI;IAGJ,gBAAgB,CAAC,SAAS;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;YAEpE,2BAA2B;YAC3B,MAAM,WAAW,GAAG,MAAM,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;YAC/D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,kDAAkD;gBAClD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,6DAA6D;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,8CAA8C;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEK,KAAK,CAAC,SAAS,CAAI,OAAoB;QAC3C,IAAI,QAAQ,GAAmB,IAAI,CAAC;QACrC,MAAM,EAAC,MAAM,EAAC,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAC,MAAM,EAAC,MAAM,EAAC,CAAC,CAAC;QAC/D,mFAAmF;QAClF,eAAe;QACf,2BAA2B;QAC3B,iBAAiB;QACjB,uCAAuC;QACvC,IAAI;QAEJ,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,kBAAkB,GAAkB,IAAI,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAEX,IAAI,CAAC;gBACD,kBAAkB,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC3C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACT,kBAAkB,GAAG,IAAI,CAAC;gBAC1B,mEAAmE;gBACnE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAC,KAAK,EAAC,CAAC,EAAC,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/E,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3F,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,IAAI,CAAC,MAAM,GAAG,SAAS,GAAG,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC5J,CAAC;aAAI,CAAC;YACF,IAAG,CAAC;gBACA,kBAAkB,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC3C,CAAC;YAAA,OAAM,CAAC,EAAC,CAAC;gBACN,kBAAkB,GAAG,IAAI,CAAC;gBAC1B,mEAAmE;gBACnE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAC,KAAK,EAAC,CAAC,EAAC,CAAC,CAAC;YAClE,CAAC;QACL,CAAC;QACD,kDAAkD;QAClD,sDAAsD;QAKtD,IAAG,kBAAkB,EAAC,CAAC;YAEnB,oDAAoD;YACpD,wCAAwC;YAExC,IAAI,IAAI,GAAG,IAAI,CAAC;YAChB,IAAG,CAAC;gBAEA,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAE1C,CAAC;YAAA,OAAM,EAAE,EAAC,CAAC;gBACP,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAC,KAAK,EAAC,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAAC,CAAC,CAAC;gBACvG,IAAI,GAAG,kBAAkB,CAAC;YAC9B,CAAC;YACD,QAAQ,GAAG,IAAI,YAAY,CAAI,IAAI,CAAC,CAAC;YACrC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;YACrB,QAAQ,CAAC,IAAI,GAAG,kBAAkB,CAAC;QACvC,CAAC;aAAI,CAAC;YACF,QAAQ,GAAG,IAAI,YAAY,CAAI,IAAI,CAAC,CAAC;QAEzC,CAAC;QAED,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC9B,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACtC,QAAQ,CAAC,OAAO,GAAG,EAAE,CAAC;QACtB,QAAQ,CAAC,OAAO,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAChC,IAAG,GAAG,KAAK,YAAY,EAAC,CAAC;gBACrB,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;iBAAI,CAAC;gBACF,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAClC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,kCAAkC;QAGlC,OAAO,QAAQ,CAAC;IACpB,CAAC;IAGM,KAAK,CAAC,IAAI,CAAI,OAAoB;QACrC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;QACxB,uDAAuD;QACvD,2EAA2E;QAC3E,MAAM,QAAQ,GAAoB,IAAI,CAAC;QACxC,IAAG,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAI,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,QAAQ,CAAC,CAAC;YAEhE,IAAG,CAAC;gBACA,IAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,EAAE,CAAC;oBACtC,MAAM,KAAK,GAAa,QAAQ,CAAC,IAAI,CAAC;oBACtC,QAAQ,CAAC,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC;gBACxC,CAAC;YACL,CAAC;YAAA,OAAM,EAAE,EAAC,CAAC;gBACP,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAC,KAAK,EAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAC,CAAC,CAAC;YAC/G,CAAC;YAED,OAAO,QAAQ,CAAC;QACjB,CAAC;QAAA,OAAM,EAAE,EAAC,CAAC;YAEV,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAC,KAAK,EAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAC,CAAC,CAAC;YACnG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,GAAG,CAAI,OAAoB;QACpC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;QACvB,MAAM,QAAQ,GAAoB,IAAI,CAAC;QACvC,IAAG,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAI,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,QAAQ,CAAC,CAAC;YAC3D,IAAG,CAAC;gBACA,IAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,EAAE,CAAC;oBACtC,MAAM,KAAK,GAAa,QAAQ,CAAC,IAAI,CAAC;oBACtC,QAAQ,CAAC,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC;gBACxC,CAAC;YACL,CAAC;YAAA,OAAM,EAAE,EAAC,CAAC;gBACP,kBAAkB;YACtB,CAAC;YAED,OAAO,QAAQ,CAAC;QACrB,CAAC;QAAA,OAAM,EAAE,EAAC,CAAC;YACV,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAC,KAAK,EAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAC,CAAC,CAAC;YAClG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,GAAG,CAAI,OAAoB;QACpC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;QACvB,MAAM,QAAQ,GAAoB,IAAI,CAAC;QACvC,IAAG,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAI,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,QAAQ,CAAC,CAAC;YAEhE,IAAG,CAAC;gBACA,IAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,EAAE,CAAC;oBACtC,MAAM,KAAK,GAAa,QAAQ,CAAC,IAAI,CAAC;oBACtC,QAAQ,CAAC,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC;gBACxC,CAAC;YACL,CAAC;YAAA,OAAM,EAAE,EAAC,CAAC;gBACP,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAC,KAAK,EAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAC,CAAC,CAAC;YAC/G,CAAC;YAED,OAAO,QAAQ,CAAC;QACjB,CAAC;QAAA,OAAM,EAAE,EAAC,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAC,KAAK,EAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAC,CAAC,CAAC;YAClG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAChC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,MAAM,CAAI,OAAoB;QACvC,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;QAC1B,MAAM,QAAQ,GAAoB,IAAI,CAAC;QACvC,IAAG,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAI,OAAO,CAAC,CAAC;YAEnD,IAAG,CAAC;gBACA,IAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,EAAE,CAAC;oBACtC,MAAM,KAAK,GAAa,QAAQ,CAAC,IAAI,CAAC;oBACtC,QAAQ,CAAC,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC;gBAAY,CAAC;YACzD,CAAC;YAAA,OAAM,EAAE,EAAC,CAAC;gBACP,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAC,KAAK,EAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAC,CAAC,CAAC;YAC/G,CAAC;YAED,OAAO,QAAQ,CAAC;QACjB,CAAC;QAAA,OAAM,EAAE,EAAC,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAC,KAAK,EAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAC,CAAC,CAAC;YACrG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAChC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,OAAoB;QAE/C,wEAAwE;QACxE,6EAA6E;QAC7E,4EAA4E;QAC5E,IAAI,CAAC,iCAAiC,EAAE,CAAC;QAEzC,MAAM,MAAM,GAAG;YACX,IAAI,EAAE,IAAI,CAAC,QAAQ;SACf,CAAC;QAET,IAAG,OAAO,CAAC,IAAI,EAAC,CAAC;YACb,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC/B,CAAC;QAED,IAAG,OAAO,CAAC,MAAM,EAAC,CAAC;YACf,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QACnC,CAAC;QAED,IAAG,OAAO,CAAC,IAAI,EAAC,CAAC;YACb,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC/B,CAAC;QAED,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAC9B,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAEjC,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC3B,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAE/B,OAAO,EAAC,MAAM,EAAE,MAAM,EAAC,CAAC;IAC5B,CAAC;IAEO,cAAc,CAAC,QAAe;QAElC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAGrC,KAAI,MAAM,IAAI,IAAI,QAAQ,EAAC,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;QAAA,CAAC;IAC9B,CAAC;CAKJ"}
+{"version":3,"file":"RequestHandler.js","sourceRoot":"","sources":["../../../src/comm/http/RequestHandler.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAK9C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,6CAA6C,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAE1D,wCAAwC;AAExC,MAAM,OAAO,cAAc;IAEvB,OAAO,GAAU,IAAI,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC9C,yCAAyC;IACzC,2BAA2B;IAC3B,QAAQ,CAAW;IAEnB,YAAY,CAAc;IAC1B,YAAY,CAAwB;IAEpC,QAAQ,CAAM;IAEd,+EAA+E;IACvE,gBAAgB,CAAqB;IAE7C,gGAAgG;IACxF,kBAAkB,CAAqB;IAE/C;;;OAGG;IACH,YAAmB,WAAkC;QACjD,sDAAsD;QACvD,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAE/B,gDAAgD;QAChD,2DAA2D;QAC3D,oCAAoC;QACpC,mCAAmC;QACnC,6BAA6B;QAC7B,2EAA2E;QAC3E,QAAQ;QAER,6CAA6C;IAEhD,CAAC;IAIK,UAAU,CAAC,OAAY,EAAE,QAA8B;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,4EAA4E;QAC5E,6EAA6E;QAC7E,8DAA8D;QAC9D,IAAI,CAAC,kBAAkB,GAAG,QAAQ,EAAE,aAAa,EAAE,EAAE,CAAC;QAEtD,6EAA6E;QAC7E,8EAA8E;QAC9E,6DAA6D;QAC7D,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAClE,IAAI,CAAC,OAAO,CAAC,IAAI,CACb,yGAAyG,EACzG,EAAE,yBAAyB,EAAE,QAAQ,EAAE,CAC1C,CAAC;QACN,CAAC;IACL,CAAC;IAEM,YAAY,CAAC,QAA6B;QAC7C,IAAI,CAAC,gBAAgB,GAAG,QAAQ,EAAE,aAAa,EAAE,EAAE,CAAC;IACxD,CAAC;IAED;;;;;;;;;;;;OAYG;IACH;;;;;;;;OAQG;IACK,WAAW,CAAC,EAAW;QAC3B,IAAI,EAAE,YAAY,KAAK,EAAE,CAAC;YACtB,OAAO,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,0EAA0E;QAC1E,0EAA0E;QAC1E,oEAAoE;QACpE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YACzB,OAAO,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC;QACD,+EAA+E;QAC/E,yEAAyE;QACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAW,CAAC;QAC9D,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACD,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACL,0EAA0E;YAC1E,8CAA8C;YAC9C,SAAS,GAAG,QAAQ,CAAC;QACzB,CAAC;QACD,OAAO,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;;;;OAWG;IACK,eAAe,CAAC,OAAoB;QACxC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAEzF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE;gBACnC,IAAI;gBACJ,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;gBAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,KAAK,EAAE,WAAW,CAAC,OAAO;aAC7B,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAED,IAAI,QAAQ,CAAC,aAAa,KAAK,WAAW,EAAE,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBACrC,IAAI;gBACJ,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;gBAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,SAAS,EAAE,QAAQ,CAAC,aAAa;gBACjC,KAAK,EAAE,WAAW,CAAC,OAAO;aAC7B,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAEO,iCAAiC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAE3C,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAClD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,8DAA8D,EAAE;gBAC/E,eAAe,EAAE,KAAK;gBACtB,iBAAiB,EAAE,UAAU;aAChC,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,kBAAkB,CACxB,4CAA4C,KAAK,yCAAyC,UAAU,GAAG,EACvG,qFAAqF;gBACjF,+DAA+D,CACtE,CAAC;QACN,CAAC;IACL,CAAC;IAED,mFAAmF;IAEnF,6CAA6C;IAC7C,4FAA4F;IAC5F,iEAAiE;IACjE,QAAQ;IACR,+DAA+D;IAC/D,8CAA8C;IAC9C,IAAI;IAGJ,gBAAgB,CAAC,SAAS;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;YAEpE,2BAA2B;YAC3B,MAAM,WAAW,GAAG,MAAM,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;YAC/D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,kDAAkD;gBAClD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,6DAA6D;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,8CAA8C;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEK,KAAK,CAAC,SAAS,CAAI,OAAoB;QAC3C,IAAI,QAAQ,GAAmB,IAAI,CAAC;QACrC,MAAM,EAAC,MAAM,EAAC,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAC,MAAM,EAAC,MAAM,EAAC,CAAC,CAAC;QAC/D,mFAAmF;QAClF,eAAe;QACf,2BAA2B;QAC3B,iBAAiB;QACjB,uCAAuC;QACvC,IAAI;QAEJ,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,kBAAkB,GAAkB,IAAI,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAEX,IAAI,CAAC;gBACD,kBAAkB,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC3C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACT,kBAAkB,GAAG,IAAI,CAAC;gBAC1B,mEAAmE;gBACnE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAC,KAAK,EAAC,CAAC,EAAC,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/E,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3F,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,IAAI,CAAC,MAAM,GAAG,SAAS,GAAG,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC5J,CAAC;aAAI,CAAC;YACF,IAAG,CAAC;gBACA,kBAAkB,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC3C,CAAC;YAAA,OAAM,CAAC,EAAC,CAAC;gBACN,kBAAkB,GAAG,IAAI,CAAC;gBAC1B,mEAAmE;gBACnE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAC,KAAK,EAAC,CAAC,EAAC,CAAC,CAAC;YAClE,CAAC;QACL,CAAC;QACD,kDAAkD;QAClD,sDAAsD;QAKtD,IAAG,kBAAkB,EAAC,CAAC;YAEnB,oDAAoD;YACpD,wCAAwC;YAExC,IAAI,IAAI,GAAG,IAAI,CAAC;YAChB,IAAG,CAAC;gBAEA,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAE1C,CAAC;YAAA,OAAM,EAAE,EAAC,CAAC;gBACP,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAC,KAAK,EAAC,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAAC,CAAC,CAAC;gBACvG,IAAI,GAAG,kBAAkB,CAAC;YAC9B,CAAC;YACD,QAAQ,GAAG,IAAI,YAAY,CAAI,IAAI,CAAC,CAAC;YACrC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;YACrB,QAAQ,CAAC,IAAI,GAAG,kBAAkB,CAAC;QACvC,CAAC;aAAI,CAAC;YACF,QAAQ,GAAG,IAAI,YAAY,CAAI,IAAI,CAAC,CAAC;QAEzC,CAAC;QAED,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC9B,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACtC,QAAQ,CAAC,OAAO,GAAG,EAAE,CAAC;QACtB,QAAQ,CAAC,OAAO,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAChC,IAAG,GAAG,KAAK,YAAY,EAAC,CAAC;gBACrB,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;iBAAI,CAAC;gBACF,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAClC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,kCAAkC;QAGlC,OAAO,QAAQ,CAAC;IACpB,CAAC;IAGM,KAAK,CAAC,IAAI,CAAI,OAAoB;QACrC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;QACxB,uDAAuD;QACvD,2EAA2E;QAC3E,MAAM,QAAQ,GAAoB,IAAI,CAAC;QACxC,IAAG,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAI,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,QAAQ,CAAC,CAAC;YAEhE,IAAG,CAAC;gBACA,IAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,EAAE,CAAC;oBACtC,MAAM,KAAK,GAAa,QAAQ,CAAC,IAAI,CAAC;oBACtC,QAAQ,CAAC,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC;gBACxC,CAAC;YACL,CAAC;YAAA,OAAM,EAAE,EAAC,CAAC;gBACP,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAC,KAAK,EAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAC,CAAC,CAAC;YAC/G,CAAC;YAED,OAAO,QAAQ,CAAC;QACjB,CAAC;QAAA,OAAM,EAAE,EAAC,CAAC;YAEV,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAC,KAAK,EAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAC,CAAC,CAAC;YACnG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,GAAG,CAAI,OAAoB;QACpC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;QACvB,MAAM,QAAQ,GAAoB,IAAI,CAAC;QACvC,IAAG,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAI,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,QAAQ,CAAC,CAAC;YAC3D,IAAG,CAAC;gBACA,IAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,EAAE,CAAC;oBACtC,MAAM,KAAK,GAAa,QAAQ,CAAC,IAAI,CAAC;oBACtC,QAAQ,CAAC,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC;gBACxC,CAAC;YACL,CAAC;YAAA,OAAM,EAAE,EAAC,CAAC;gBACP,kBAAkB;YACtB,CAAC;YAED,OAAO,QAAQ,CAAC;QACrB,CAAC;QAAA,OAAM,EAAE,EAAC,CAAC;YACV,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAC,KAAK,EAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAC,CAAC,CAAC;YAClG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,GAAG,CAAI,OAAoB;QACpC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;QACvB,MAAM,QAAQ,GAAoB,IAAI,CAAC;QACvC,IAAG,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAI,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,QAAQ,CAAC,CAAC;YAEhE,IAAG,CAAC;gBACA,IAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,EAAE,CAAC;oBACtC,MAAM,KAAK,GAAa,QAAQ,CAAC,IAAI,CAAC;oBACtC,QAAQ,CAAC,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC;gBACxC,CAAC;YACL,CAAC;YAAA,OAAM,EAAE,EAAC,CAAC;gBACP,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAC,KAAK,EAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAC,CAAC,CAAC;YAC/G,CAAC;YAED,OAAO,QAAQ,CAAC;QACjB,CAAC;QAAA,OAAM,EAAE,EAAC,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAC,KAAK,EAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAC,CAAC,CAAC;YAClG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAChC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,MAAM,CAAI,OAAoB;QACvC,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;QAC1B,MAAM,QAAQ,GAAoB,IAAI,CAAC;QACvC,IAAG,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAI,OAAO,CAAC,CAAC;YAEnD,IAAG,CAAC;gBACA,IAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,EAAE,CAAC;oBACtC,MAAM,KAAK,GAAa,QAAQ,CAAC,IAAI,CAAC;oBACtC,QAAQ,CAAC,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC;gBAAY,CAAC;YACzD,CAAC;YAAA,OAAM,EAAE,EAAC,CAAC;gBACP,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAC,KAAK,EAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAC,CAAC,CAAC;YAC/G,CAAC;YAED,OAAO,QAAQ,CAAC;QACjB,CAAC;QAAA,OAAM,EAAE,EAAC,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAC,KAAK,EAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAC,CAAC,CAAC;YACrG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAChC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,OAAoB;QAE/C,wEAAwE;QACxE,6EAA6E;QAC7E,4EAA4E;QAC5E,IAAI,CAAC,iCAAiC,EAAE,CAAC;QAEzC,yEAAyE;QACzE,2EAA2E;QAC3E,6EAA6E;QAC7E,0CAA0C;QAC1C,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAE9B,MAAM,MAAM,GAAG;YACX,IAAI,EAAE,IAAI,CAAC,QAAQ;SACf,CAAC;QAET,IAAG,OAAO,CAAC,IAAI,EAAC,CAAC;YACb,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC/B,CAAC;QAED,IAAG,OAAO,CAAC,MAAM,EAAC,CAAC;YACf,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QACnC,CAAC;QAED,IAAG,OAAO,CAAC,IAAI,EAAC,CAAC;YACb,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC/B,CAAC;QAED,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAC9B,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAEjC,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC3B,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAE/B,OAAO,EAAC,MAAM,EAAE,MAAM,EAAC,CAAC;IAC5B,CAAC;IAEO,cAAc,CAAC,QAAe;QAElC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAGrC,KAAI,MAAM,IAAI,IAAI,QAAQ,EAAC,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;QAAA,CAAC;IAC9B,CAAC;CAKJ"}

package/dist/comm/http/ServiceNowProcessorRequest.d.ts

@@ -1,10 +1,16 @@
 import { IHttpResponse } from "./IHttpResponse.js";
 import { ServiceNowInstance } from "../../sn/ServiceNowInstance.js";
+import { Requirement } from "../../policy/PolicyTypes.js";
 export declare class ServiceNowProcessorRequest {
     private static _logger;
     _instance: ServiceNowInstance;
     constructor(instance: ServiceNowInstance);
     private _headers;
-    execute(processor: string, processorMethod: string, scope: string, processorArgs: object): Promise<string>;
-    doXmlHttpRequest(processor: string, processorMethod: string, scope: string, processorArgs: object): Promise<IHttpResponse<unknown>>;
+    /**
+     * @param requires What this processor call needs. Defaults to `write`, because
+     * /xmlhttp.do is a POST and most processors mutate. Two callers legitimately differ
+     * and say so: SyslogReader reads, ATFTestExecutor executes.
+     */
+    execute(processor: string, processorMethod: string, scope: string, processorArgs: object, requires?: Requirement): Promise<string>;
+    doXmlHttpRequest(processor: string, processorMethod: string, scope: string, processorArgs: object, requires?: Requirement): Promise<IHttpResponse<unknown>>;
 }

package/dist/comm/http/ServiceNowProcessorRequest.js

@@ -12,9 +12,14 @@ export class ServiceNowProcessorRequest {
     _headers = {
         "Content-Type": "application/x-www-form-urlencoded"
     };
-    async execute(processor, processorMethod, scope, processorArgs) {
+    /**
+     * @param requires What this processor call needs. Defaults to `write`, because
+     * /xmlhttp.do is a POST and most processors mutate. Two callers legitimately differ
+     * and say so: SyslogReader reads, ATFTestExecutor executes.
+     */
+    async execute(processor, processorMethod, scope, processorArgs, requires) {
         let retVal = null;
-        let resp = await this.doXmlHttpRequest(processor, processorMethod, scope, processorArgs);
+        let resp = await this.doXmlHttpRequest(processor, processorMethod, scope, processorArgs, requires);
         if (resp.status == 200) {
             let data = resp.data;
             if (typeof data != 'undefined' && data && data.indexOf('answer=') != -1) {
@@ -28,7 +33,7 @@ export class ServiceNowProcessorRequest {
         }
         return retVal;
     }
-    async doXmlHttpRequest(processor, processorMethod, scope, processorArgs) {
+    async doXmlHttpRequest(processor, processorMethod, scope, processorArgs, requires) {
         let resp = null;
         try {
             let dataObj = {};
@@ -40,7 +45,7 @@ export class ServiceNowProcessorRequest {
             }
             //let data = qs.stringify(dataObj);
             let req = new ServiceNowRequest(this._instance);
-            let request = { method: 'POST', path: XMLHTTP_PROCESSOR_ENDPOINT, headers: this._headers, query: null, fields: dataObj, body: null };
+            let request = { method: 'POST', path: XMLHTTP_PROCESSOR_ENDPOINT, headers: this._headers, query: null, fields: dataObj, body: null, requires: requires };
             resp = await req.post(request);
         }
         catch (err) {

package/dist/comm/http/ServiceNowProcessorRequest.js.map

@@ -1 +1 @@
-{"version":3,"file":"ServiceNowProcessorRequest.js","sourceRoot":"","sources":["../../../src/comm/http/ServiceNowProcessorRequest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAKhC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,OAAO,0BAA0B;IAE3B,MAAM,CAAC,OAAO,GAAW,IAAI,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAE1E,SAAS,CAAoB;IAE7B,YAAmB,QAA2B;QAC1C,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC9B,CAAC;IAGO,QAAQ,GAAU;QACtB,cAAc,EAAC,mCAAmC;KACrD,CAAC;IAEK,KAAK,CAAC,OAAO,CAAC,SAAgB,EAAE,eAAsB,EAAE,KAAY,EAAE,aAAoB;QAC7F,IAAI,MAAM,GAAU,IAAI,CAAC;QACzB,IAAI,IAAI,GAA2B,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QACjH,IAAG,IAAI,CAAC,MAAM,IAAI,GAAG,EAAC,CAAC;YACnB,IAAI,IAAI,GAAU,IAAI,CAAC,IAAc,CAAC;YACtC,IAAG,OAAO,IAAI,IAAI,WAAW,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAC,CAAC;gBAEpE,IAAI,MAAM,GAAU,IAAI,MAAM,EAAE,CAAC;gBACjC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,EAAE,MAAM;oBAC1C,IAAI,MAAM,GAAU,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;oBACxC,MAAM,GAAG,MAAM,CAAC;oBAChB,sBAAsB;gBAC1B,CAAC,CAAC,CAAC;YAEP,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,SAAgB,EAAE,eAAsB,EAAE,KAAY,EAAE,aAAoB;QAC/F,IAAI,IAAI,GAA0B,IAAI,CAAC;QAEvC,IAAG,CAAC;YACA,IAAI,OAAO,GAAyB,EAAE,CAAC;YACvC,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;YACtC,OAAO,CAAC,YAAY,GAAG,eAAe,CAAC;YACvC,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC;YAE9B,KAAI,IAAI,IAAI,IAAI,aAAa,EAAC,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACxC,CAAC;YAED,mCAAmC;YAEnC,IAAI,GAAG,GAAqB,IAAI,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAClE,IAAI,OAAO,GAAe,EAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAC,OAAO,EAAE,IAAI,EAAC,IAAI,EAAC,CAAC;YAC7I,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QAAA,OAAM,GAAG,EAAC,CAAC;YACR,6EAA6E;YAC7E,iEAAiE;YACjE,0BAA0B,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE;gBACjE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC;aAC1B,CAAC,CAAC;QACP,CAAC;QAGD,OAAO,IAAI,CAAC;IAChB,CAAC"}
+{"version":3,"file":"ServiceNowProcessorRequest.js","sourceRoot":"","sources":["../../../src/comm/http/ServiceNowProcessorRequest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAMhC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,OAAO,0BAA0B;IAE3B,MAAM,CAAC,OAAO,GAAW,IAAI,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAE1E,SAAS,CAAoB;IAE7B,YAAmB,QAA2B;QAC1C,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC9B,CAAC;IAGO,QAAQ,GAAU;QACtB,cAAc,EAAC,mCAAmC;KACrD,CAAC;IAEF;;;;OAIG;IACI,KAAK,CAAC,OAAO,CAAC,SAAgB,EAAE,eAAsB,EAAE,KAAY,EAAE,aAAoB,EAAE,QAAqB;QACpH,IAAI,MAAM,GAAU,IAAI,CAAC;QACzB,IAAI,IAAI,GAA2B,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC3H,IAAG,IAAI,CAAC,MAAM,IAAI,GAAG,EAAC,CAAC;YACnB,IAAI,IAAI,GAAU,IAAI,CAAC,IAAc,CAAC;YACtC,IAAG,OAAO,IAAI,IAAI,WAAW,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAC,CAAC;gBAEpE,IAAI,MAAM,GAAU,IAAI,MAAM,EAAE,CAAC;gBACjC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,EAAE,MAAM;oBAC1C,IAAI,MAAM,GAAU,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;oBACxC,MAAM,GAAG,MAAM,CAAC;oBAChB,sBAAsB;gBAC1B,CAAC,CAAC,CAAC;YAEP,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,SAAgB,EAAE,eAAsB,EAAE,KAAY,EAAE,aAAoB,EAAE,QAAqB;QACtH,IAAI,IAAI,GAA0B,IAAI,CAAC;QAEvC,IAAG,CAAC;YACA,IAAI,OAAO,GAAyB,EAAE,CAAC;YACvC,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;YACtC,OAAO,CAAC,YAAY,GAAG,eAAe,CAAC;YACvC,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC;YAE9B,KAAI,IAAI,IAAI,IAAI,aAAa,EAAC,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACxC,CAAC;YAED,mCAAmC;YAEnC,IAAI,GAAG,GAAqB,IAAI,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAClE,IAAI,OAAO,GAAe,EAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAC,OAAO,EAAE,IAAI,EAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAC,CAAC;YACjK,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QAAA,OAAM,GAAG,EAAC,CAAC;YACR,6EAA6E;YAC7E,iEAAiE;YACjE,0BAA0B,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE;gBACjE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC;aAC1B,CAAC,CAAC;QACP,CAAC;QAGD,OAAO,IAAI,CAAC;IAChB,CAAC"}

package/dist/index.d.ts

@@ -10,6 +10,11 @@ export * from './exception/InvalidParameterException.js';
 export * from './exception/PathException.js';
 export * from './exception/StaleInstanceError.js';
 export * from './model/types.js';
+export * from './policy/Policy.js';
+export * from './policy/PolicyEnv.js';
+export * from './policy/PolicyRefusal.js';
+export * from './policy/PolicyTypes.js';
+export * from './policy/ScanScript.js';
 export * from './sn/Application.js';
 export * from './sn/BackgroundScriptExecutor.js';
 export * from './sn/IServiceNowInstance.js';

package/dist/index.js

@@ -10,6 +10,11 @@ export * from './exception/InvalidParameterException.js';
 export * from './exception/PathException.js';
 export * from './exception/StaleInstanceError.js';
 export * from './model/types.js';
+export * from './policy/Policy.js';
+export * from './policy/PolicyEnv.js';
+export * from './policy/PolicyRefusal.js';
+export * from './policy/PolicyTypes.js';
+export * from './policy/ScanScript.js';
 export * from './sn/Application.js';
 export * from './sn/BackgroundScriptExecutor.js';
 export * from './sn/IServiceNowInstance.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,wCAAwC,CAAC;AACvD,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kCAAkC,CAAC;AACjD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mCAAmC,CAAC;AAClD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sCAAsC,CAAC;AACrD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,kCAAkC,CAAC;AACjD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mCAAmC,CAAC;AAClD,cAAc,kCAAkC,CAAC;AACjD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,wCAAwC,CAAC;AACvD,cAAc,wCAAwC,CAAC;AACvD,cAAc,qCAAqC,CAAC;AACpD,cAAc,uCAAuC,CAAC;AACtD,cAAc,yCAAyC,CAAC;AACxD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,qBAAqB,CAAC;AACpC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,sCAAsC,CAAC;AACrD,cAAc,qCAAqC,CAAC;AACpD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,oCAAoC,CAAC;AACnD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,yBAAyB,CAAC;AACxC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC;AACpD,cAAc,mCAAmC,CAAC;AAClD,cAAc,qCAAqC,CAAC;AACpD,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAClD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC;AACpD,cAAc,kCAAkC,CAAC;AACjD,cAAc,mCAAmC,CAAC;AAClD,cAAc,yCAAyC,CAAC;AACxD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAClD,cAAc,0BAA0B,CAAC;AACzC,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kCAAkC,CAAC;AACjD,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AAExC,0EAA0E;AAC1E,4EAA4E;AAC5E,gEAAgE;AAChE,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,wCAAwC,CAAC;AACvD,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kCAAkC,CAAC;AACjD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mCAAmC,CAAC;AAClD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sCAAsC,CAAC;AACrD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,kCAAkC,CAAC;AACjD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mCAAmC,CAAC;AAClD,cAAc,kCAAkC,CAAC;AACjD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,wCAAwC,CAAC;AACvD,cAAc,wCAAwC,CAAC;AACvD,cAAc,qCAAqC,CAAC;AACpD,cAAc,uCAAuC,CAAC;AACtD,cAAc,yCAAyC,CAAC;AACxD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,qBAAqB,CAAC;AACpC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,sCAAsC,CAAC;AACrD,cAAc,qCAAqC,CAAC;AACpD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,oCAAoC,CAAC;AACnD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,yBAAyB,CAAC;AACxC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC;AACpD,cAAc,mCAAmC,CAAC;AAClD,cAAc,qCAAqC,CAAC;AACpD,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAClD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC;AACpD,cAAc,kCAAkC,CAAC;AACjD,cAAc,mCAAmC,CAAC;AAClD,cAAc,yCAAyC,CAAC;AACxD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAClD,cAAc,0BAA0B,CAAC;AACzC,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kCAAkC,CAAC;AACjD,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AAExC,0EAA0E;AAC1E,4EAA4E;AAC5E,gEAAgE;AAChE,cAAc,gBAAgB,CAAC"}

package/dist/policy/Policy.d.ts

@@ -0,0 +1,40 @@
+import { Decision, PolicyLayer, Requirement, Target, Verb } from "./PolicyTypes.js";
+/** True once an application has installed a policy. Until then, everything is allowed. */
+export declare function isPolicyInstalled(): boolean;
+/**
+ * Installs the process policy. Call once, from the application that owns the entry
+ * point — never from a library.
+ *
+ * Layers are supplied in priority order (highest first).
+ */
+export declare function installPolicy(orderedLayers: readonly PolicyLayer[]): void;
+/** Removes the policy, returning to the permissive default. Test seam. */
+export declare function resetPolicyForTests(): void;
+/** The layers currently installed, highest priority first. Diagnostics and `nex policy status`. */
+export declare function currentLayers(): readonly PolicyLayer[];
+/**
+ * Decides whether an operation may proceed.
+ *
+ * Only `target: "instance"` is gated. A local file write or a session-preference change
+ * is not what this exists to prevent, and refusing them would produce false refusals on
+ * operations that never touch instance data (`script-sync pull` being the clearest).
+ */
+export declare function checkRequirement(requirement: Requirement): Decision;
+export declare function setRemediationWriter(writer: (verbs: readonly Verb[], missing: Verb, layer: string) => string): void;
+/**
+ * A layer that denies the listed verbs outright.
+ *
+ * Placed at the top of the ladder so nothing below can grant past it. This is the layer
+ * that makes pointing the tool at production meaningful.
+ *
+ * The guarantee has a precise limit, and the docs must state it: this only holds when
+ * the variable is set somewhere the agent cannot write — a shell profile, a systemd
+ * unit, a container environment. A project-local `.mcp.json` is a file in the workspace,
+ * and an agent with file-write access can edit it.
+ */
+export declare function denyLayer(name: string, denied: readonly Verb[]): PolicyLayer;
+/** A layer that grants the listed verbs and abstains on the rest. */
+export declare function grantLayer(name: string, granted: readonly Verb[]): PolicyLayer;
+/** Convenience for tests and for embedders that want the old unrestricted behaviour. */
+export declare function allowAllLayer(): PolicyLayer;
+export type { Decision, PolicyLayer, Requirement, Target, Verb };

package/dist/policy/Policy.js

@@ -0,0 +1,161 @@
+/**
+ * Process-wide permission policy.
+ *
+ * INERT UNTIL CONFIGURED. With no policy installed every check allows, so importing
+ * this library changes nothing for existing consumers — `new TableAPIRequest(i).post()`
+ * behaves exactly as it did. The applications that are actually driven by agents (the
+ * `nex` CLI and the MCP server) install a policy in their entrypoints.
+ *
+ * That split is deliberate. The risk being managed is "an agent drives the CLI or the
+ * MCP server", not "a program imports this library"; gating here by default would break
+ * every embedder to mitigate a risk they do not have.
+ *
+ * Those applications currently install a ladder whose LAST layer grants both verbs, so
+ * changes are permitted unless something above revokes them — `NEX_POLICY_DENY`, or a
+ * CLI deny flag. Flipping to deny-by-default is deleting that trailing layer; nothing
+ * in this file assumes either direction.
+ */
+/**
+ * Layers in priority order. The FIRST layer to answer anything other than `abstain`
+ * decides.
+ *
+ * Ordered layers rather than an escalating if-chain because not every source is a
+ * grant: `--read-only` (NEX-76) REVOKES, and an escalate-only model cannot express a
+ * source that lowers permission. Getting this shape right now is what lets NEX-76 add
+ * `ApprovalToken` and `--approve-all` later without a rewrite.
+ *
+ * Index 0 is the only layer an agent cannot reach — see `denyFromEnvironment`.
+ */
+const DEFAULT_LAYER = "default";
+let layers = [];
+let installed = false;
+/** True once an application has installed a policy. Until then, everything is allowed. */
+export function isPolicyInstalled() {
+    return installed;
+}
+/**
+ * Installs the process policy. Call once, from the application that owns the entry
+ * point — never from a library.
+ *
+ * Layers are supplied in priority order (highest first).
+ */
+export function installPolicy(orderedLayers) {
+    layers = [...orderedLayers];
+    installed = true;
+}
+/** Removes the policy, returning to the permissive default. Test seam. */
+export function resetPolicyForTests() {
+    layers = [];
+    installed = false;
+}
+/** The layers currently installed, highest priority first. Diagnostics and `nex policy status`. */
+export function currentLayers() {
+    return layers;
+}
+/**
+ * Resolves a single verb against the ladder.
+ *
+ * Returns the deciding layer's name alongside the answer so refusals can say which one
+ * spoke. Without that, a precedence bug is invisible: the user sees "refused" and has
+ * no way to tell whether the environment denied it or nothing granted it.
+ */
+function resolveVerb(verb) {
+    for (const layer of layers) {
+        const answer = layer.answer(verb);
+        if (answer === "grant") {
+            return { granted: true, decidingLayer: layer.name };
+        }
+        if (answer === "deny") {
+            return { granted: false, decidingLayer: layer.name };
+        }
+    }
+    return { granted: false, decidingLayer: DEFAULT_LAYER };
+}
+/**
+ * Decides whether an operation may proceed.
+ *
+ * Only `target: "instance"` is gated. A local file write or a session-preference change
+ * is not what this exists to prevent, and refusing them would produce false refusals on
+ * operations that never touch instance data (`script-sync pull` being the clearest).
+ */
+export function checkRequirement(requirement) {
+    if (!installed || requirement.verbs.length === 0 || requirement.target !== "instance") {
+        return {
+            allowed: true,
+            verbs: requirement.verbs,
+            decidingLayer: installed ? "not-gated" : "no-policy",
+        };
+    }
+    // Every required verb must be granted. A script needing execute AND write is not
+    // satisfied by execute alone.
+    for (const verb of requirement.verbs) {
+        const { granted, decidingLayer } = resolveVerb(verb);
+        if (!granted) {
+            return {
+                allowed: false,
+                verbs: requirement.verbs,
+                decidingLayer,
+                remediation: remediationFor(requirement.verbs, verb, decidingLayer),
+            };
+        }
+    }
+    // Report EVERY layer that granted, not just the first verb's.
+    //
+    // A requirement like ["execute", "write"] can be satisfied by two different layers
+    // — execute from the environment, write from the default — and naming only the
+    // first makes the audit log quietly wrong about how a mutation was permitted. That
+    // log is the thing meant to surface a missing floor rule, so it has to be accurate.
+    const granting = [...new Set(requirement.verbs.map((v) => resolveVerb(v).decidingLayer))];
+    return {
+        allowed: true,
+        verbs: requirement.verbs,
+        decidingLayer: granting.join(" + "),
+    };
+}
+/**
+ * How the application explains a refusal.
+ *
+ * Set by the CLI to name its flags. Left unset by the MCP server, whose caller is the
+ * model — naming the parameter there would advertise the escape hatch.
+ */
+let remediationWriter;
+export function setRemediationWriter(writer) {
+    remediationWriter = writer;
+}
+function remediationFor(verbs, missing, layer) {
+    if (remediationWriter) {
+        return remediationWriter(verbs, missing, layer);
+    }
+    return `This operation requires ${missing} permission on the instance, which has not been granted.`;
+}
+/**
+ * A layer that denies the listed verbs outright.
+ *
+ * Placed at the top of the ladder so nothing below can grant past it. This is the layer
+ * that makes pointing the tool at production meaningful.
+ *
+ * The guarantee has a precise limit, and the docs must state it: this only holds when
+ * the variable is set somewhere the agent cannot write — a shell profile, a systemd
+ * unit, a container environment. A project-local `.mcp.json` is a file in the workspace,
+ * and an agent with file-write access can edit it.
+ */
+export function denyLayer(name, denied) {
+    const set = new Set(denied);
+    return {
+        name,
+        answer: (verb) => (set.has(verb) ? "deny" : "abstain"),
+    };
+}
+/** A layer that grants the listed verbs and abstains on the rest. */
+export function grantLayer(name, granted) {
+    const set = new Set(granted);
+    return {
+        name,
+        answer: (verb) => (set.has(verb) ? "grant" : "abstain"),
+    };
+}
+/** Convenience for tests and for embedders that want the old unrestricted behaviour. */
+export function allowAllLayer() {
+    return grantLayer("allow-all", ["write", "execute"]);
+}
+//# sourceMappingURL=Policy.js.map

package/dist/policy/Policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Policy.js","sourceRoot":"","sources":["../../src/policy/Policy.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,aAAa,GAAG,SAAS,CAAC;AAEhC,IAAI,MAAM,GAA2B,EAAE,CAAC;AACxC,IAAI,SAAS,GAAG,KAAK,CAAC;AAEtB,0FAA0F;AAC1F,MAAM,UAAU,iBAAiB;IAC7B,OAAO,SAAS,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,aAAqC;IAC/D,MAAM,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC;IAC5B,SAAS,GAAG,IAAI,CAAC;AACrB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,mBAAmB;IAC/B,MAAM,GAAG,EAAE,CAAC;IACZ,SAAS,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,aAAa;IACzB,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,IAAU;IAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,MAAM,GAAgB,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACrB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QACxD,CAAC;QACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QACzD,CAAC;IACL,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAwB;IACrD,IAAI,CAAC,SAAS,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACpF,OAAO;YACH,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW;SACvD,CAAC;IACN,CAAC;IAED,iFAAiF;IACjF,8BAA8B;IAC9B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,aAAa;gBACb,WAAW,EAAE,cAAc,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,CAAC;aACtE,CAAC;QACN,CAAC;IACL,CAAC;IAED,8DAA8D;IAC9D,EAAE;IACF,mFAAmF;IACnF,+EAA+E;IAC/E,mFAAmF;IACnF,oFAAoF;IACpF,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAC1F,OAAO;QACH,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,WAAW,CAAC,KAAK;QACxB,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;KACtC,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACH,IAAI,iBAAiG,CAAC;AAEtG,MAAM,UAAU,oBAAoB,CAChC,MAAwE;IAExE,iBAAiB,GAAG,MAAM,CAAC;AAC/B,CAAC;AAED,SAAS,cAAc,CAAC,KAAsB,EAAE,OAAa,EAAE,KAAa;IACxE,IAAI,iBAAiB,EAAE,CAAC;QACpB,OAAO,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,2BAA2B,OAAO,0DAA0D,CAAC;AACxG,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,MAAuB;IAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO;QACH,IAAI;QACJ,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;KACzD,CAAC;AACN,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,OAAwB;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO;QACH,IAAI;QACJ,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;KAC1D,CAAC;AACN,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,aAAa;IACzB,OAAO,UAAU,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/dist/policy/PolicyEnv.d.ts

@@ -0,0 +1,46 @@
+import { PolicyLayer, Verb } from "./PolicyTypes.js";
+/**
+ * Environment-variable policy layers.
+ *
+ * `NEX_POLICY_DENY` sits at the top of the ladder and cannot be granted past.
+ * `NEX_POLICY_ALLOW` sits near the bottom and exists for backward compatibility, so an
+ * existing CI job can restore its previous behaviour with one variable rather than
+ * editing every command line.
+ *
+ * Named `NEX_POLICY_*` rather than `NEX_ALLOW_WRITE` because `write` and `execute`
+ * collide with ServiceNow ACL vocabulary, and a reader should not have to work out
+ * whether this is about ACLs.
+ */
+export declare const DENY_ENV = "NEX_POLICY_DENY";
+export declare const ALLOW_ENV = "NEX_POLICY_ALLOW";
+export interface ParsedVerbs {
+    readonly verbs: readonly Verb[];
+    /** Tokens that were not recognised. Non-empty means the value was malformed. */
+    readonly unknown: readonly string[];
+}
+/**
+ * Parses a comma-separated verb list.
+ *
+ * `all` expands to every verb. Unrecognised tokens are REPORTED rather than dropped, so
+ * the caller can fail closed — see `denyFromEnvironment`.
+ */
+export declare function parseVerbList(raw: string | undefined): ParsedVerbs;
+/**
+ * The deny layer, built from `NEX_POLICY_DENY`.
+ *
+ * FAILS CLOSED on a malformed value. `NEX_POLICY_DENY=wrtie` denies everything and
+ * warns, rather than silently denying nothing — a typo in the variable that is supposed
+ * to protect production must not quietly disable the protection. That is the whole
+ * reason this function reports `unknown` instead of filtering it away.
+ *
+ * Returns `undefined` when the variable is unset, so the layer is simply absent.
+ */
+export declare function denyFromEnvironment(env?: NodeJS.ProcessEnv, warn?: (message: string) => void): PolicyLayer | undefined;
+/**
+ * The backward-compatibility grant layer, built from `NEX_POLICY_ALLOW`.
+ *
+ * Unrecognised tokens here are dropped with a warning rather than failing closed: this
+ * variable only ever *grants*, so a typo already fails safe — the operation is refused
+ * and the operator sees why.
+ */
+export declare function allowFromEnvironment(env?: NodeJS.ProcessEnv, warn?: (message: string) => void): PolicyLayer | undefined;