@stratusagent/permissions 0.10.0 → 0.11.0

package/dist/whitelist.d.ts

@@ -1,26 +1,51 @@
 import { type CommandScope } from './commands.ts';
+import { type OriginScope } from './origins.ts';
 /**
  * What one agent may run unattended, beyond the built-in safe list.
  *
  * Per agent, because "always allow" is an answer about one identity's work
  * — a scope somebody granted Ava in a repository of theirs is not a scope
- * Juno inherits.
+ * Juno inherits, and neither is a site.
  */
 export interface CommandWhitelistStore {
     scopesFor(agentId: string): Promise<CommandScope[]>;
     remember(agentId: string, scope: CommandScope): Promise<void>;
 }
+/**
+ * Which origins one agent may act on unattended — `commandFor`'s half of
+ * the same file, for `originFor`.
+ *
+ * A separate interface rather than two more methods on the one above,
+ * because they are separate answers: a host that judges commands need not
+ * judge browser actions, and `createFileCommandWhitelist` returns one
+ * object satisfying both because there is one file and an operator should
+ * have one place to look.
+ */
+export interface OriginWhitelistStore {
+    originsFor(agentId: string): Promise<OriginScope[]>;
+    rememberOrigin(agentId: string, scope: OriginScope): Promise<void>;
+}
 /** `<id>.whitelist.json`, beside the agent's soul in ~/.stratus/agents. */
 export declare const whitelistPathFor: (directory: string, agentId: string) => string;
 /**
- * The persistent half of the three-tier resolution, on disk.
+ * Thrown by `remember` for an agent whose whitelist exists but could not be
+ * read. The policy catches it by type: the answer still holds for the
+ * session, and the log says why it was not saved.
+ */
+export declare class WhitelistUnreadableError extends Error {
+    constructor(file: string, reason: string);
+}
+/**
+ * The persistent tier of the scope resolution, on disk — both kinds of
+ * grant, in one file per agent.
  *
  * Written `0600` with an explicit `chmod`, like every other file in
- * `~/.stratus` that decides something: this one lists commands that run
- * with nobody watching, so another account on the machine appending a line
- * to it is the whole permission engine defeated. `writeFile`'s mode only
- * applies when it creates the file, so an upgrade over a looser install
- * would otherwise keep the old permissions.
+ * `~/.stratus` that decides something: this one lists commands that run,
+ * and sites that get clicked on, with nobody watching — so another account
+ * on the machine appending a line to it is the whole permission engine
+ * defeated. `writeFile`'s mode only applies when it creates the file, so
+ * an upgrade over a looser install would otherwise keep the old
+ * permissions.
  *
  * Scopes are cached in memory once read. A daemon therefore does not notice
  * a hand-edited file until it restarts — which is the right way round for a
@@ -29,5 +54,11 @@ export declare const whitelistPathFor: (directory: string, agentId: string) => s
  */
 export declare const createFileCommandWhitelist: (options: {
     directory: string;
-}) => CommandWhitelistStore;
+    /**
+     * Where to say that a whitelist exists but could not be read. Once per
+     * agent per process; a host that omits it gets the same behavior with
+     * no line about it.
+     */
+    warn?: (line: string) => void;
+}) => CommandWhitelistStore & OriginWhitelistStore;
 //# sourceMappingURL=whitelist.d.ts.map

package/dist/whitelist.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"whitelist.d.ts","sourceRoot":"","sources":["../src/whitelist.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgC,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAEhF;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACpD,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AASD,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,GAAI,WAAW,MAAM,EAAE,SAAS,MAAM,KAAG,MACnB,CAAC;AAEpD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,KAAG,qBA+C3E,CAAC"}
+{"version":3,"file":"whitelist.d.ts","sourceRoot":"","sources":["../src/whitelist.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgC,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EAAqC,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACpD,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACpD,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpE;AAgCD,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,GAAI,WAAW,MAAM,EAAE,SAAS,MAAM,KAAG,MACnB,CAAC;AAEpD;;;;GAIG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAIzC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B,KAAG,qBAAqB,GAAG,oBAmJ3B,CAAC"}

package/dist/whitelist.js

@@ -1,18 +1,32 @@
 import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { parseCommandScope, sameScope } from "./commands.js";
+import { parseOriginScope, sameOriginScope } from "./origins.js";
 const WHITELIST_VERSION = 1;
 /** `<id>.whitelist.json`, beside the agent's soul in ~/.stratus/agents. */
 export const whitelistPathFor = (directory, agentId) => path.join(directory, `${agentId}.whitelist.json`);
 /**
- * The persistent half of the three-tier resolution, on disk.
+ * Thrown by `remember` for an agent whose whitelist exists but could not be
+ * read. The policy catches it by type: the answer still holds for the
+ * session, and the log says why it was not saved.
+ */
+export class WhitelistUnreadableError extends Error {
+    constructor(file, reason) {
+        super(`${file} could not be read (${reason}), so nothing is written over it. Fix the file and restart the daemon.`);
+        this.name = 'WhitelistUnreadableError';
+    }
+}
+/**
+ * The persistent tier of the scope resolution, on disk — both kinds of
+ * grant, in one file per agent.
  *
  * Written `0600` with an explicit `chmod`, like every other file in
- * `~/.stratus` that decides something: this one lists commands that run
- * with nobody watching, so another account on the machine appending a line
- * to it is the whole permission engine defeated. `writeFile`'s mode only
- * applies when it creates the file, so an upgrade over a looser install
- * would otherwise keep the old permissions.
+ * `~/.stratus` that decides something: this one lists commands that run,
+ * and sites that get clicked on, with nobody watching — so another account
+ * on the machine appending a line to it is the whole permission engine
+ * defeated. `writeFile`'s mode only applies when it creates the file, so
+ * an upgrade over a looser install would otherwise keep the old
+ * permissions.
  *
  * Scopes are cached in memory once read. A daemon therefore does not notice
  * a hand-edited file until it restarts — which is the right way round for a
@@ -20,49 +34,142 @@ export const whitelistPathFor = (directory, agentId) => path.join(directory, `${
  * store makes.
  */
 export const createFileCommandWhitelist = (options) => {
+    /**
+     * One read per agent per process, shared by everyone who asks — as a
+     * promise, so two sessions asking for the same agent at once share the
+     * read in flight rather than each missing an empty cache, each failing,
+     * and each warning.
+     *
+     * Both grant lists come out of one read, because they come out of one
+     * file: reading it twice would give a shell call and a browser call
+     * different views of a file somebody edited between them.
+     */
     const cache = new Map();
-    const read = async (agentId) => {
+    /** Files that exist and could not be read, by agent — never written over. */
+    const unreadable = new Map();
+    const read = (agentId) => {
         const cached = cache.get(agentId);
         if (cached) {
             return cached;
         }
+        const reading = readFresh(agentId);
+        cache.set(agentId, reading);
+        return reading;
+    };
+    const readFresh = async (agentId) => {
         let scopes = [];
+        let origins = [];
+        // The agent id is a validated invariant by the time it reaches any
+        // path join (see 03) — it is a single path segment or it was refused
+        // at the parse boundary, so this does not re-check it.
+        const file = whitelistPathFor(options.directory, agentId);
         try {
-            // The agent id is a validated invariant by the time it reaches any
-            // path join (see 03) — it is a single path segment or it was refused
-            // at the parse boundary, so this does not re-check it.
-            const raw = await readFile(whitelistPathFor(options.directory, agentId), 'utf8');
+            const raw = await readFile(file, 'utf8');
             const parsed = JSON.parse(raw);
             scopes = Array.isArray(parsed.scopes)
                 ? parsed.scopes.map(parseCommandScope).filter((scope) => scope !== undefined)
                 : [];
+            origins = Array.isArray(parsed.origins)
+                ? parsed.origins.map(parseOriginScope).filter((scope) => scope !== undefined)
+                : [];
         }
-        catch {
-            // No whitelist, or one that will not parse. Both mean the same thing
-            // to a caller — no stored scopes — and neither is worth failing a
+        catch (error) {
+            // No whitelist means no stored scopes, and is not worth failing a
             // turn over: the fallback is asking a human, which is where an agent
-            // with no whitelist starts anyway.
+            // with no whitelist starts anyway. A whitelist that exists and will
+            // not read is the same to this call and not the same to the file:
+            // one hand-edited comma made a grant list read as empty with no line
+            // about it, and the next "always" wrote a single new scope over
+            // every grant it held. So it is said once, and `remember` refuses.
             scopes = [];
+            origins = [];
+            if (error.code !== 'ENOENT') {
+                const reason = error instanceof Error ? error.message : String(error);
+                unreadable.set(agentId, reason);
+                options.warn?.(`${file} could not be read (${reason}); its scopes are ignored and "always" answers for ${agentId} `
+                    + 'are not saved over it until it is fixed and the daemon restarted.');
+            }
+        }
+        return { scopes, origins };
+    };
+    /**
+     * Both lists, always — a write of one carries the other through
+     * untouched. Persisting only the half that changed would drop the other
+     * half of a file this daemon had read and understood, which is the same
+     * data loss the unreadable-file guard above exists to prevent.
+     */
+    const save = async (agentId, grants) => {
+        cache.set(agentId, Promise.resolve(grants));
+        await mkdir(options.directory, { recursive: true });
+        const file = {
+            version: WHITELIST_VERSION,
+            scopes: grants.scopes,
+            ...(grants.origins.length > 0 ? { origins: grants.origins } : {}),
+        };
+        const target = whitelistPathFor(options.directory, agentId);
+        await writeFile(target, `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600 });
+        await chmod(target, 0o600);
+    };
+    /**
+     * Read-modify-write runs one at a time per agent.
+     *
+     * Every grant is "read what is there, add one, write it all back", and
+     * the read yields — so two answers settling together both saw the file
+     * before either changed it, and the second write drops the first grant.
+     * It bites hardest across the two kinds now that one file holds both: a
+     * shell "always" and a browser "always" resolved in the same moment, and
+     * whichever landed second silently deleted the other agent's site grant.
+     * Serializing also means only one `writeFile` is ever open on the file,
+     * so two overlapping writes cannot leave a mixed one behind.
+     *
+     * A queue, like the browser pool's admission: the work is short, and the
+     * alternative (reserving and unwinding) is the same serialization with
+     * more ways to leak a reservation. The tail swallows failures, so one
+     * grant that throws does not reject every grant queued behind it — the
+     * caller still sees its own rejection, because that is `queued`.
+     */
+    const writes = new Map();
+    const serialized = (agentId, work) => {
+        const queued = (writes.get(agentId) ?? Promise.resolve()).then(work, work);
+        writes.set(agentId, queued.then(() => undefined, () => undefined));
+        return queued;
+    };
+    /** Nothing is written over a grant list nobody could read. */
+    const refuseIfUnreadable = (agentId) => {
+        const reason = unreadable.get(agentId);
+        if (reason !== undefined) {
+            throw new WhitelistUnreadableError(whitelistPathFor(options.directory, agentId), reason);
         }
-        cache.set(agentId, scopes);
-        return scopes;
     };
     return {
         async scopesFor(agentId) {
-            return [...(await read(agentId))];
+            return [...(await read(agentId)).scopes];
         },
         async remember(agentId, scope) {
-            const scopes = await read(agentId);
-            if (scopes.some((existing) => sameScope(existing, scope))) {
-                return;
-            }
-            const updated = [...scopes, scope];
-            cache.set(agentId, updated);
-            await mkdir(options.directory, { recursive: true });
-            const file = { version: WHITELIST_VERSION, scopes: updated };
-            const target = whitelistPathFor(options.directory, agentId);
-            await writeFile(target, `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600 });
-            await chmod(target, 0o600);
+            // The read is inside the queue, not before it: a grant that started
+            // from a snapshot taken before the one ahead of it saved would write
+            // that one back out of existence, which is the whole race.
+            return serialized(agentId, async () => {
+                const grants = await read(agentId);
+                refuseIfUnreadable(agentId);
+                if (grants.scopes.some((existing) => sameScope(existing, scope))) {
+                    return;
+                }
+                await save(agentId, { ...grants, scopes: [...grants.scopes, scope] });
+            });
+        },
+        async originsFor(agentId) {
+            return [...(await read(agentId)).origins];
+        },
+        async rememberOrigin(agentId, scope) {
+            return serialized(agentId, async () => {
+                const grants = await read(agentId);
+                refuseIfUnreadable(agentId);
+                if (grants.origins.some((existing) => sameOriginScope(existing, scope))) {
+                    return;
+                }
+                await save(agentId, { ...grants, origins: [...grants.origins, scope] });
+            });
         },
     };
 };

package/dist/whitelist.js.map

@@ -1 +1 @@
-{"version":3,"file":"whitelist.js","sourceRoot":"","sources":["../src/whitelist.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAqB,MAAM,eAAe,CAAC;AAmBhF,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,SAAiB,EAAE,OAAe,EAAU,EAAE,CAC7E,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,OAAO,iBAAiB,CAAC,CAAC;AAEpD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAA8B,EAAyB,EAAE;IAClG,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEhD,MAAM,IAAI,GAAG,KAAK,EAAE,OAAe,EAA2B,EAAE;QAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,MAAM,GAAmB,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,mEAAmE;YACnE,qEAAqE;YACrE,uDAAuD;YACvD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;YACjF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;YACzD,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;gBACnC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAyB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;gBACpG,CAAC,CAAC,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,kEAAkE;YAClE,qEAAqE;YACrE,mCAAmC;YACnC,MAAM,GAAG,EAAE,CAAC;QACd,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,OAAO;YACrB,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK;YAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,CAAC;YACnC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5B,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,MAAM,IAAI,GAAkB,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC5E,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC5D,MAAM,SAAS,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,MAAM,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"whitelist.js","sourceRoot":"","sources":["../src/whitelist.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAqB,MAAM,eAAe,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAoB,MAAM,cAAc,CAAC;AAmDnF,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAQ5B,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,SAAiB,EAAE,OAAe,EAAU,EAAE,CAC7E,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,OAAO,iBAAiB,CAAC,CAAC;AAEpD;;;;GAIG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,IAAY,EAAE,MAAc;QACtC,KAAK,CAAC,GAAG,IAAI,uBAAuB,MAAM,wEAAwE,CAAC,CAAC;QACpH,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAQ1C,EAAgD,EAAE;IACjD;;;;;;;;;OASG;IACH,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,6EAA6E;IAC7E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE7C,MAAM,IAAI,GAAG,CAAC,OAAe,EAAmB,EAAE;QAChD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5B,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,EAAE,OAAe,EAAmB,EAAE;QAC3D,IAAI,MAAM,GAAmB,EAAE,CAAC;QAChC,IAAI,OAAO,GAAkB,EAAE,CAAC;QAChC,mEAAmE;QACnE,qEAAqE;QACrE,uDAAuD;QACvD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;YACzD,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;gBACnC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAyB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;gBACpG,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;gBACrC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAwB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;gBACnG,CAAC,CAAC,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kEAAkE;YAClE,qEAAqE;YACrE,oEAAoE;YACpE,kEAAkE;YAClE,qEAAqE;YACrE,gEAAgE;YAChE,mEAAmE;YACnE,MAAM,GAAG,EAAE,CAAC;YACZ,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACtE,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAChC,OAAO,CAAC,IAAI,EAAE,CACZ,GAAG,IAAI,uBAAuB,MAAM,sDAAsD,OAAO,GAAG;sBAChG,mEAAmE,CACxE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC7B,CAAC,CAAC;IAEF;;;;;OAKG;IACH,MAAM,IAAI,GAAG,KAAK,EAAE,OAAe,EAAE,MAAc,EAAiB,EAAE;QACpE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,IAAI,GAAkB;YAC1B,OAAO,EAAE,iBAAiB;YAC1B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC;QACF,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,SAAS,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,MAAM,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC;IAEF;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEnD,MAAM,UAAU,GAAG,CAAI,OAAe,EAAE,IAAsB,EAAc,EAAE;QAC5E,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3E,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACnE,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,8DAA8D;IAC9D,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAQ,EAAE;QACnD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,wBAAwB,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,OAAO;YACrB,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK;YAC3B,oEAAoE;YACpE,qEAAqE;YACrE,2DAA2D;YAC3D,OAAO,UAAU,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;gBACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;gBACnC,kBAAkB,CAAC,OAAO,CAAC,CAAC;gBAC5B,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;oBACjE,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YACxE,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,OAAO;YACtB,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK;YACjC,OAAO,UAAU,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;gBACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;gBACnC,kBAAkB,CAAC,OAAO,CAAC,CAAC;gBAC5B,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;oBACxE,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1E,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stratusagent/permissions",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -17,7 +17,7 @@
     "node": ">=22.13 <23 || >=23.4"
   },
   "dependencies": {
-    "@stratusagent/core": "0.10.0"
+    "@stratusagent/core": "0.11.0"
   },
   "devDependencies": {
     "@types/node": "^24.6.0",