@vainplex/openclaw-governance 0.1.0

package/dist/src/builtin-policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtin-policies.d.ts","sourceRoot":"","sources":["../../src/builtin-policies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAwJhE,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,qBAAqB,GAC5B,MAAM,EAAE,CAgBV"}

package/dist/src/builtin-policies.js

@@ -0,0 +1,152 @@
+function resolveNightMode(config) {
+    if (!config)
+        return null;
+    const after = typeof config === "object" ? config.after ?? "23:00" : "23:00";
+    const before = typeof config === "object" ? config.before ?? "08:00" : "08:00";
+    return {
+        id: "builtin-night-mode",
+        name: "Night Mode",
+        version: "1.0.0",
+        description: `Restricts non-critical operations between ${after} and ${before}`,
+        scope: { hooks: ["before_tool_call", "message_sending"] },
+        priority: 100,
+        rules: [
+            {
+                id: "allow-critical-at-night",
+                description: "Always allow read-only tools at night",
+                conditions: [
+                    { type: "time", after, before },
+                    { type: "tool", name: ["read", "memory_search", "memory_get", "web_search"] },
+                ],
+                effect: { action: "allow" },
+            },
+            {
+                id: "deny-non-critical-at-night",
+                description: "Deny all other tools at night",
+                conditions: [
+                    { type: "time", after, before },
+                    {
+                        type: "not",
+                        condition: {
+                            type: "tool",
+                            name: ["read", "memory_search", "memory_get", "web_search"],
+                        },
+                    },
+                ],
+                effect: {
+                    action: "deny",
+                    reason: `Night mode active (${after}-${before}). Only critical operations allowed.`,
+                },
+            },
+        ],
+    };
+}
+function resolveCredentialGuard(enabled) {
+    if (!enabled)
+        return null;
+    return {
+        id: "builtin-credential-guard",
+        name: "Credential Guard",
+        version: "1.0.0",
+        description: "Prevents access to credential files and secrets",
+        scope: { hooks: ["before_tool_call"] },
+        priority: 200,
+        rules: [
+            {
+                id: "block-credential-read",
+                conditions: [
+                    { type: "tool", name: ["read", "exec", "write", "edit"] },
+                    {
+                        type: "any",
+                        conditions: [
+                            { type: "tool", params: { file_path: { matches: "\\.(env|pem|key)$" } } },
+                            { type: "tool", params: { path: { matches: "\\.(env|pem|key)$" } } },
+                            { type: "tool", params: { command: { matches: "(cat|less|head|tail).*\\.(env|pem|key)" } } },
+                            { type: "tool", params: { file_path: { contains: "credentials" } } },
+                            { type: "tool", params: { path: { contains: "credentials" } } },
+                            { type: "tool", params: { file_path: { contains: "secrets" } } },
+                            { type: "tool", params: { path: { contains: "secrets" } } },
+                        ],
+                    },
+                ],
+                effect: {
+                    action: "deny",
+                    reason: "Credential Guard: Access to credential files is restricted",
+                },
+            },
+        ],
+    };
+}
+function resolveProductionSafeguard(enabled) {
+    if (!enabled)
+        return null;
+    return {
+        id: "builtin-production-safeguard",
+        name: "Production Safeguard",
+        version: "1.0.0",
+        description: "Restricts production-impacting operations",
+        scope: { hooks: ["before_tool_call"] },
+        priority: 150,
+        rules: [
+            {
+                id: "block-production-ops",
+                conditions: [
+                    {
+                        type: "any",
+                        conditions: [
+                            { type: "tool", name: "exec", params: { command: { matches: "(docker push|docker-compose.*prod|deploy|systemctl.*(restart|stop))" } } },
+                            { type: "tool", name: "exec", params: { command: { matches: "git push.*(main|master|prod)" } } },
+                            { type: "tool", name: "gateway" },
+                        ],
+                    },
+                ],
+                effect: {
+                    action: "deny",
+                    reason: "Production Safeguard: This operation requires explicit approval",
+                },
+            },
+        ],
+    };
+}
+function resolveRateLimiter(config) {
+    if (!config)
+        return null;
+    const maxPerMinute = typeof config === "object" ? config.maxPerMinute ?? 15 : 15;
+    return {
+        id: "builtin-rate-limiter",
+        name: "Rate Limiter",
+        version: "1.0.0",
+        description: `Limits agents to ${maxPerMinute} tool calls per minute`,
+        scope: { hooks: ["before_tool_call"] },
+        priority: 50,
+        rules: [
+            {
+                id: "rate-limit-exceeded",
+                conditions: [
+                    { type: "frequency", maxCount: maxPerMinute, windowSeconds: 60, scope: "agent" },
+                ],
+                effect: {
+                    action: "deny",
+                    reason: `Rate limit exceeded (${maxPerMinute}/min)`,
+                },
+            },
+        ],
+    };
+}
+export function getBuiltinPolicies(config) {
+    const policies = [];
+    const nightMode = resolveNightMode(config.nightMode);
+    if (nightMode)
+        policies.push(nightMode);
+    const credGuard = resolveCredentialGuard(config.credentialGuard);
+    if (credGuard)
+        policies.push(credGuard);
+    const prodSafe = resolveProductionSafeguard(config.productionSafeguard);
+    if (prodSafe)
+        policies.push(prodSafe);
+    const rateLimiter = resolveRateLimiter(config.rateLimiter);
+    if (rateLimiter)
+        policies.push(rateLimiter);
+    return policies;
+}
+//# sourceMappingURL=builtin-policies.js.map

package/dist/src/builtin-policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtin-policies.js","sourceRoot":"","sources":["../../src/builtin-policies.ts"],"names":[],"mappings":"AAEA,SAAS,gBAAgB,CACvB,MAA0C;IAE1C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7E,MAAM,MAAM,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAE/E,OAAO;QACL,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,6CAA6C,KAAK,QAAQ,MAAM,EAAE;QAC/E,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,EAAE;QACzD,QAAQ,EAAE,GAAG;QACb,KAAK,EAAE;YACL;gBACE,EAAE,EAAE,yBAAyB;gBAC7B,WAAW,EAAE,uCAAuC;gBACpD,UAAU,EAAE;oBACV,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;oBAC/B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,CAAC,EAAE;iBAC9E;gBACD,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;aAC5B;YACD;gBACE,EAAE,EAAE,4BAA4B;gBAChC,WAAW,EAAE,+BAA+B;gBAC5C,UAAU,EAAE;oBACV,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;oBAC/B;wBACE,IAAI,EAAE,KAAK;wBACX,SAAS,EAAE;4BACT,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,CAAC,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,CAAC;yBAC5D;qBACF;iBACF;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,sBAAsB,KAAK,IAAI,MAAM,sCAAsC;iBACpF;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAA4B;IAE5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO;QACL,EAAE,EAAE,0BAA0B;QAC9B,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,iDAAiD;QAC9D,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,kBAAkB,CAAC,EAAE;QACtC,QAAQ,EAAE,GAAG;QACb,KAAK,EAAE;YACL;gBACE,EAAE,EAAE,uBAAuB;gBAC3B,UAAU,EAAE;oBACV,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE;oBACzD;wBACE,IAAI,EAAE,KAAK;wBACX,UAAU,EAAE;4BACV,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,EAAE;4BACzE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,EAAE;4BACpE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,EAAE,EAAE;4BAC5F,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,EAAE;4BACpE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,EAAE;4BAC/D,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE;4BAChE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE;yBAC5D;qBACF;iBACF;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,4DAA4D;iBACrE;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,OAA4B;IAE5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO;QACL,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,2CAA2C;QACxD,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,kBAAkB,CAAC,EAAE;QACtC,QAAQ,EAAE,GAAG;QACb,KAAK,EAAE;YACL;gBACE,EAAE,EAAE,sBAAsB;gBAC1B,UAAU,EAAE;oBACV;wBACE,IAAI,EAAE,KAAK;wBACX,UAAU,EAAE;4BACV,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,qEAAqE,EAAE,EAAE,EAAE;4BACvI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,EAAE;4BAChG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;yBAClC;qBACF;iBACF;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,iEAAiE;iBAC1E;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,MAA4C;IAE5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,YAAY,GAChB,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE9D,OAAO;QACL,EAAE,EAAE,sBAAsB;QAC1B,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,oBAAoB,YAAY,wBAAwB;QACrE,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,kBAAkB,CAAC,EAAE;QACtC,QAAQ,EAAE,EAAE;QACZ,KAAK,EAAE;YACL;gBACE,EAAE,EAAE,qBAAqB;gBACzB,UAAU,EAAE;oBACV,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;iBACjF;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,wBAAwB,YAAY,OAAO;iBACpD;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,MAA6B;IAE7B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAExC,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjE,IAAI,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAExC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACxE,IAAI,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEtC,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3D,IAAI,WAAW;QAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAE5C,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/src/conditions/context.d.ts

@@ -0,0 +1,3 @@
+import type { Condition, ConditionDeps, EvaluationContext } from "../types.js";
+export declare function evaluateContextCondition(condition: Condition, ctx: EvaluationContext, deps: ConditionDeps): boolean;
+//# sourceMappingURL=context.d.ts.map

package/dist/src/conditions/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/conditions/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,SAAS,EACT,aAAa,EAEb,iBAAiB,EAClB,MAAM,aAAa,CAAC;AAyDrB,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,aAAa,GAClB,OAAO,CAST"}

package/dist/src/conditions/context.js

@@ -0,0 +1,60 @@
+import { globToRegex } from "../util.js";
+function matchesAny(patterns, texts, regexCache) {
+    const list = Array.isArray(patterns) ? patterns : [patterns];
+    return list.some((pattern) => {
+        const re = regexCache.get(pattern);
+        if (re)
+            return texts.some((t) => re.test(t));
+        try {
+            const compiled = new RegExp(pattern);
+            return texts.some((t) => compiled.test(t));
+        }
+        catch {
+            return texts.some((t) => t.includes(pattern));
+        }
+    });
+}
+function checkConversation(c, ctx, deps) {
+    if (c.conversationContains === undefined)
+        return true;
+    const convo = ctx.conversationContext ?? [];
+    if (convo.length === 0)
+        return false;
+    return matchesAny(c.conversationContains, convo, deps.regexCache);
+}
+function checkMessage(c, ctx, deps) {
+    if (c.messageContains === undefined)
+        return true;
+    if (!ctx.messageContent)
+        return false;
+    return matchesAny(c.messageContains, [ctx.messageContent], deps.regexCache);
+}
+function checkMetadata(c, ctx) {
+    if (c.hasMetadata === undefined)
+        return true;
+    const meta = ctx.metadata ?? {};
+    const keys = Array.isArray(c.hasMetadata) ? c.hasMetadata : [c.hasMetadata];
+    return keys.every((k) => k in meta);
+}
+function checkChannel(c, ctx) {
+    if (c.channel === undefined)
+        return true;
+    const channels = Array.isArray(c.channel) ? c.channel : [c.channel];
+    return !!ctx.channel && channels.includes(ctx.channel);
+}
+function checkSessionKey(c, ctx) {
+    if (c.sessionKey === undefined)
+        return true;
+    if (!ctx.sessionKey)
+        return false;
+    return globToRegex(c.sessionKey).test(ctx.sessionKey);
+}
+export function evaluateContextCondition(condition, ctx, deps) {
+    const c = condition;
+    return (checkConversation(c, ctx, deps) &&
+        checkMessage(c, ctx, deps) &&
+        checkMetadata(c, ctx) &&
+        checkChannel(c, ctx) &&
+        checkSessionKey(c, ctx));
+}
+//# sourceMappingURL=context.js.map

package/dist/src/conditions/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../../src/conditions/context.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,SAAS,UAAU,CACjB,QAA2B,EAC3B,KAAe,EACf,UAA+B;IAE/B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;YACrC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CACxB,CAAmB,EAAE,GAAsB,EAAE,IAAmB;IAEhE,IAAI,CAAC,CAAC,oBAAoB,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,KAAK,GAAG,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,UAAU,CAAC,CAAC,CAAC,oBAAoB,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,YAAY,CACnB,CAAmB,EAAE,GAAsB,EAAE,IAAmB;IAEhE,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,GAAG,CAAC,cAAc;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,UAAU,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,CAAmB,EAAE,GAAsB;IAChE,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,YAAY,CAAC,CAAmB,EAAE,GAAsB;IAC/D,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACpE,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,eAAe,CAAC,CAAmB,EAAE,GAAsB;IAClE,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAClC,OAAO,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,SAAoB,EACpB,GAAsB,EACtB,IAAmB;IAEnB,MAAM,CAAC,GAAG,SAA6B,CAAC;IACxC,OAAO,CACL,iBAAiB,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC;QAC/B,YAAY,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC;QAC1B,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC;QACrB,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC;QACpB,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CACxB,CAAC;AACJ,CAAC"}

package/dist/src/conditions/index.d.ts

@@ -0,0 +1,4 @@
+import type { Condition, ConditionDeps, ConditionEvaluatorMap, EvaluationContext } from "../types.js";
+export declare function createConditionEvaluators(): ConditionEvaluatorMap;
+export declare function evaluateConditions(conditions: Condition[], ctx: EvaluationContext, deps: ConditionDeps, evaluators: ConditionEvaluatorMap): boolean;
+//# sourceMappingURL=index.d.ts.map

package/dist/src/conditions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/conditions/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,SAAS,EACT,aAAa,EAEb,qBAAqB,EACrB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AAarB,wBAAgB,yBAAyB,IAAI,qBAAqB,CAcjE;AAED,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,SAAS,EAAE,EACvB,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,aAAa,EACnB,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAMT"}

package/dist/src/conditions/index.js

@@ -0,0 +1,28 @@
+import { evaluateToolCondition } from "./tool.js";
+import { evaluateTimeCondition } from "./time.js";
+import { evaluateContextCondition } from "./context.js";
+import { evaluateAgentCondition, evaluateCompositeCondition, evaluateFrequencyCondition, evaluateNegationCondition, evaluateRiskCondition, setEvaluatorMap, } from "./simple.js";
+export function createConditionEvaluators() {
+    const map = {
+        tool: evaluateToolCondition,
+        time: evaluateTimeCondition,
+        context: evaluateContextCondition,
+        agent: evaluateAgentCondition,
+        risk: evaluateRiskCondition,
+        frequency: evaluateFrequencyCondition,
+        any: evaluateCompositeCondition,
+        not: evaluateNegationCondition,
+    };
+    // Wire up the evaluator map for recursive conditions (any, not)
+    setEvaluatorMap(map);
+    return map;
+}
+export function evaluateConditions(conditions, ctx, deps, evaluators) {
+    return conditions.every((cond) => {
+        const evaluator = evaluators[cond.type];
+        if (!evaluator)
+            return false;
+        return evaluator(cond, ctx, deps);
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/src/conditions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/conditions/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,EACzB,qBAAqB,EACrB,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,MAAM,UAAU,yBAAyB;IACvC,MAAM,GAAG,GAA0B;QACjC,IAAI,EAAE,qBAA6C;QACnD,IAAI,EAAE,qBAA6C;QACnD,OAAO,EAAE,wBAAgD;QACzD,KAAK,EAAE,sBAA8C;QACrD,IAAI,EAAE,qBAA6C;QACnD,SAAS,EAAE,0BAAkD;QAC7D,GAAG,EAAE,0BAAkD;QACvD,GAAG,EAAE,yBAAiD;KACvD,CAAC;IACF,gEAAgE;IAChE,eAAe,CAAC,GAAG,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,UAAuB,EACvB,GAAsB,EACtB,IAAmB,EACnB,UAAiC;IAEjC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/B,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,OAAO,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/conditions/simple.d.ts

@@ -0,0 +1,10 @@
+import type { Condition, ConditionDeps, ConditionEvaluatorMap, EvaluationContext, TrustTier } from "../types.js";
+export declare function evaluateAgentCondition(condition: Condition, ctx: EvaluationContext, _deps: ConditionDeps): boolean;
+export declare function evaluateRiskCondition(condition: Condition, _ctx: EvaluationContext, deps: ConditionDeps): boolean;
+export declare function evaluateFrequencyCondition(condition: Condition, ctx: EvaluationContext, deps: ConditionDeps): boolean;
+export declare function setEvaluatorMap(evaluators: ConditionEvaluatorMap): void;
+export declare function evaluateCompositeCondition(condition: Condition, ctx: EvaluationContext, deps: ConditionDeps): boolean;
+export declare function evaluateNegationCondition(condition: Condition, ctx: EvaluationContext, deps: ConditionDeps): boolean;
+export declare function isTierAtLeast(tier: TrustTier, min: TrustTier): boolean;
+export declare function isTierAtMost(tier: TrustTier, max: TrustTier): boolean;
+//# sourceMappingURL=simple.d.ts.map

package/dist/src/conditions/simple.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"simple.d.ts","sourceRoot":"","sources":["../../../src/conditions/simple.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGV,SAAS,EACT,aAAa,EACb,qBAAqB,EACrB,iBAAiB,EAKjB,SAAS,EACV,MAAM,aAAa,CAAC;AA0BrB,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE,aAAa,GACnB,OAAO,CAoBT;AAWD,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,iBAAiB,EACvB,IAAI,EAAE,aAAa,GAClB,OAAO,CAeT;AAID,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,aAAa,GAClB,OAAO,CAUT;AAMD,wBAAgB,eAAe,CAAC,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAEvE;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,aAAa,GAClB,OAAO,CAQT;AAID,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,aAAa,GAClB,OAAO,CAMT;AAID,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAEtE;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAErE"}

package/dist/src/conditions/simple.js

@@ -0,0 +1,94 @@
+import { globToRegex, tierOrdinal } from "../util.js";
+// ── Agent Condition ──
+function matchAgentId(pattern, agentId) {
+    const patterns = Array.isArray(pattern) ? pattern : [pattern];
+    return patterns.some((p) => {
+        if (p.includes("*") || p.includes("?")) {
+            return globToRegex(p).test(agentId);
+        }
+        return p === agentId;
+    });
+}
+function matchTrustTier(expected, actual) {
+    const tiers = Array.isArray(expected) ? expected : [expected];
+    return tiers.includes(actual);
+}
+export function evaluateAgentCondition(condition, ctx, _deps) {
+    const c = condition;
+    if (c.id !== undefined && !matchAgentId(c.id, ctx.agentId)) {
+        return false;
+    }
+    if (c.trustTier !== undefined && !matchTrustTier(c.trustTier, ctx.trust.tier)) {
+        return false;
+    }
+    if (c.minScore !== undefined && ctx.trust.score < c.minScore) {
+        return false;
+    }
+    if (c.maxScore !== undefined && ctx.trust.score > c.maxScore) {
+        return false;
+    }
+    return true;
+}
+// ── Risk Condition ──
+const RISK_ORDINAL = {
+    low: 0,
+    medium: 1,
+    high: 2,
+    critical: 3,
+};
+export function evaluateRiskCondition(condition, _ctx, deps) {
+    const c = condition;
+    const currentOrd = RISK_ORDINAL[deps.risk.level];
+    if (c.minRisk !== undefined) {
+        const minOrd = RISK_ORDINAL[c.minRisk];
+        if (currentOrd < minOrd)
+            return false;
+    }
+    if (c.maxRisk !== undefined) {
+        const maxOrd = RISK_ORDINAL[c.maxRisk];
+        if (currentOrd > maxOrd)
+            return false;
+    }
+    return true;
+}
+// ── Frequency Condition ──
+export function evaluateFrequencyCondition(condition, ctx, deps) {
+    const c = condition;
+    const scope = c.scope ?? "agent";
+    const count = deps.frequencyTracker.count(c.windowSeconds, scope, ctx.agentId, ctx.sessionKey);
+    return count >= c.maxCount;
+}
+// ── Composite Condition (any = OR) ──
+let _evaluators;
+export function setEvaluatorMap(evaluators) {
+    _evaluators = evaluators;
+}
+export function evaluateCompositeCondition(condition, ctx, deps) {
+    const c = condition;
+    if (!_evaluators)
+        return false;
+    return c.conditions.some((sub) => {
+        const evaluator = _evaluators?.[sub.type];
+        if (!evaluator)
+            return false;
+        return evaluator(sub, ctx, deps);
+    });
+}
+// ── Negation Condition ──
+export function evaluateNegationCondition(condition, ctx, deps) {
+    const c = condition;
+    if (!_evaluators)
+        return true;
+    const evaluator = _evaluators[c.condition.type];
+    if (!evaluator)
+        return true;
+    return !evaluator(c.condition, ctx, deps);
+}
+// ── Trust tier comparison helpers (exported for rules) ──
+export function isTierAtLeast(tier, min) {
+    return tierOrdinal(tier) >= tierOrdinal(min);
+}
+export function isTierAtMost(tier, max) {
+    return tierOrdinal(tier) <= tierOrdinal(max);
+}
+//# sourceMappingURL=simple.js.map

package/dist/src/conditions/simple.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"simple.js","sourceRoot":"","sources":["../../../src/conditions/simple.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAwB;AAExB,SAAS,YAAY,CACnB,OAA0B,EAC1B,OAAe;IAEf,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACzB,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,CAAC,KAAK,OAAO,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CACrB,QAAiC,EACjC,MAAiB;IAEjB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC9D,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,SAAoB,EACpB,GAAsB,EACtB,KAAoB;IAEpB,MAAM,CAAC,GAAG,SAA2B,CAAC;IAEtC,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uBAAuB;AAEvB,MAAM,YAAY,GAA8B;IAC9C,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,MAAM,UAAU,qBAAqB,CACnC,SAAoB,EACpB,IAAuB,EACvB,IAAmB;IAEnB,MAAM,CAAC,GAAG,SAA0B,CAAC;IACrC,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAEjD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,UAAU,GAAG,MAAM;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IAED,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,UAAU,GAAG,MAAM;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4BAA4B;AAE5B,MAAM,UAAU,0BAA0B,CACxC,SAAoB,EACpB,GAAsB,EACtB,IAAmB;IAEnB,MAAM,CAAC,GAAG,SAA+B,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CACvC,CAAC,CAAC,aAAa,EACf,KAAK,EACL,GAAG,CAAC,OAAO,EACX,GAAG,CAAC,UAAU,CACf,CAAC;IACF,OAAO,KAAK,IAAI,CAAC,CAAC,QAAQ,CAAC;AAC7B,CAAC;AAED,uCAAuC;AAEvC,IAAI,WAA8C,CAAC;AAEnD,MAAM,UAAU,eAAe,CAAC,UAAiC;IAC/D,WAAW,GAAG,UAAU,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,SAAoB,EACpB,GAAsB,EACtB,IAAmB;IAEnB,MAAM,CAAC,GAAG,SAA+B,CAAC;IAC1C,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QAC/B,MAAM,SAAS,GAAG,WAAW,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,2BAA2B;AAE3B,MAAM,UAAU,yBAAyB,CACvC,SAAoB,EACpB,GAAsB,EACtB,IAAmB;IAEnB,MAAM,CAAC,GAAG,SAA8B,CAAC;IACzC,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,2DAA2D;AAE3D,MAAM,UAAU,aAAa,CAAC,IAAe,EAAE,GAAc;IAC3D,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAe,EAAE,GAAc;IAC1D,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC;AAC/C,CAAC"}

package/dist/src/conditions/time.d.ts

@@ -0,0 +1,3 @@
+import type { Condition, ConditionDeps, EvaluationContext } from "../types.js";
+export declare function evaluateTimeCondition(condition: Condition, ctx: EvaluationContext, deps: ConditionDeps): boolean;
+//# sourceMappingURL=time.d.ts.map

package/dist/src/conditions/time.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.d.ts","sourceRoot":"","sources":["../../../src/conditions/time.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,SAAS,EACT,aAAa,EACb,iBAAiB,EAElB,MAAM,aAAa,CAAC;AA6CrB,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,aAAa,GAClB,OAAO,CAST"}

package/dist/src/conditions/time.js

@@ -0,0 +1,48 @@
+import { isInTimeRange, parseTimeToMinutes } from "../util.js";
+function evaluateNamedWindow(c, ctx, deps) {
+    const win = deps.timeWindows[c.window];
+    if (!win)
+        return false;
+    const current = ctx.time.hour * 60 + ctx.time.minute;
+    const start = parseTimeToMinutes(win.start);
+    const end = parseTimeToMinutes(win.end);
+    if (start < 0 || end < 0)
+        return false;
+    if (!isInTimeRange(current, start, end))
+        return false;
+    if (win.days && win.days.length > 0 && !win.days.includes(ctx.time.dayOfWeek)) {
+        return false;
+    }
+    return true;
+}
+function evaluateInlineRange(c, ctx) {
+    const current = ctx.time.hour * 60 + ctx.time.minute;
+    if (c.after !== undefined && c.before !== undefined) {
+        const a = parseTimeToMinutes(c.after);
+        const b = parseTimeToMinutes(c.before);
+        if (a < 0 || b < 0)
+            return false;
+        return isInTimeRange(current, a, b);
+    }
+    if (c.after !== undefined) {
+        const a = parseTimeToMinutes(c.after);
+        return a >= 0 && current >= a;
+    }
+    if (c.before !== undefined) {
+        const b = parseTimeToMinutes(c.before);
+        return b >= 0 && current < b;
+    }
+    return true;
+}
+export function evaluateTimeCondition(condition, ctx, deps) {
+    const c = condition;
+    if (c.window)
+        return evaluateNamedWindow(c, ctx, deps);
+    if (!evaluateInlineRange(c, ctx))
+        return false;
+    if (c.days && c.days.length > 0 && !c.days.includes(ctx.time.dayOfWeek)) {
+        return false;
+    }
+    return true;
+}
+//# sourceMappingURL=time.js.map

package/dist/src/conditions/time.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.js","sourceRoot":"","sources":["../../../src/conditions/time.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE/D,SAAS,mBAAmB,CAC1B,CAAgB,EAChB,GAAsB,EACtB,IAAmB;IAEnB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAO,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAEvB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;IACrD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,KAAK,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAC1B,CAAgB,EAChB,GAAsB;IAEtB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;IAErD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACjC,OAAO,aAAa,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,SAAoB,EACpB,GAAsB,EACtB,IAAmB;IAEnB,MAAM,CAAC,GAAG,SAA0B,CAAC;IAErC,IAAI,CAAC,CAAC,MAAM;QAAE,OAAO,mBAAmB,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,mBAAmB,CAAC,CAAC,EAAE,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/conditions/tool.d.ts

@@ -0,0 +1,3 @@
+import type { Condition, ConditionDeps, EvaluationContext } from "../types.js";
+export declare function evaluateToolCondition(condition: Condition, ctx: EvaluationContext, deps: ConditionDeps): boolean;
+//# sourceMappingURL=tool.d.ts.map

package/dist/src/conditions/tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool.d.ts","sourceRoot":"","sources":["../../../src/conditions/tool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,SAAS,EACT,aAAa,EACb,iBAAiB,EAGlB,MAAM,aAAa,CAAC;AA2DrB,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,aAAa,GAClB,OAAO,CAYT"}

package/dist/src/conditions/tool.js

@@ -0,0 +1,57 @@
+import { globToRegex } from "../util.js";
+function matchToolName(pattern, toolName) {
+    if (!toolName)
+        return false;
+    const patterns = Array.isArray(pattern) ? pattern : [pattern];
+    return patterns.some((p) => {
+        if (p.includes("*") || p.includes("?")) {
+            return globToRegex(p).test(toolName);
+        }
+        return p === toolName;
+    });
+}
+function matchParam(matcher, value, regexCache) {
+    if ("equals" in matcher) {
+        return value === matcher.equals;
+    }
+    if ("contains" in matcher) {
+        return typeof value === "string" && value.includes(matcher.contains);
+    }
+    if ("matches" in matcher) {
+        if (typeof value !== "string")
+            return false;
+        const cached = regexCache.get(matcher.matches);
+        if (cached)
+            return cached.test(value);
+        try {
+            const re = new RegExp(matcher.matches);
+            return re.test(value);
+        }
+        catch {
+            return false;
+        }
+    }
+    if ("startsWith" in matcher) {
+        return typeof value === "string" && value.startsWith(matcher.startsWith);
+    }
+    if ("in" in matcher) {
+        return matcher.in.includes(value);
+    }
+    return false;
+}
+function matchParams(params, toolParams, regexCache) {
+    if (!toolParams)
+        return false;
+    return Object.entries(params).every(([key, matcher]) => matchParam(matcher, toolParams[key], regexCache));
+}
+export function evaluateToolCondition(condition, ctx, deps) {
+    const c = condition;
+    if (c.name !== undefined && !matchToolName(c.name, ctx.toolName)) {
+        return false;
+    }
+    if (c.params && !matchParams(c.params, ctx.toolParams, deps.regexCache)) {
+        return false;
+    }
+    return true;
+}
+//# sourceMappingURL=tool.js.map

package/dist/src/conditions/tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool.js","sourceRoot":"","sources":["../../../src/conditions/tool.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,SAAS,aAAa,CACpB,OAA0B,EAC1B,QAA4B;IAE5B,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACzB,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,CAAC,KAAK,QAAQ,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CACjB,OAAqB,EACrB,KAAc,EACd,UAA+B;IAE/B,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;QACxB,OAAO,KAAK,KAAK,OAAO,CAAC,MAAM,CAAC;IAClC,CAAC;IACD,IAAI,UAAU,IAAI,OAAO,EAAE,CAAC;QAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,YAAY,IAAI,OAAO,EAAE,CAAC;QAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC;QACpB,OAAO,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAwB,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAClB,MAAoC,EACpC,UAA+C,EAC/C,UAA+B;IAE/B,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,CACrD,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,SAAoB,EACpB,GAAsB,EACtB,IAAmB;IAEnB,MAAM,CAAC,GAAG,SAA0B,CAAC;IAErC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/config.d.ts

@@ -0,0 +1,3 @@
+import type { GovernanceConfig } from "./types.js";
+export declare function resolveConfig(raw?: Record<string, unknown>): GovernanceConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/src/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAIV,gBAAgB,EAKjB,MAAM,YAAY,CAAC;AA2EpB,wBAAgB,aAAa,CAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,gBAAgB,CA+BlB"}

package/dist/src/config.js

@@ -0,0 +1,80 @@
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function resolveTrust(raw) {
+    const r = isRecord(raw) ? raw : {};
+    const decay = isRecord(r["decay"]) ? r["decay"] : {};
+    return {
+        enabled: typeof r["enabled"] === "boolean" ? r["enabled"] : true,
+        defaults: isRecord(r["defaults"])
+            ? Object.fromEntries(Object.entries(r["defaults"]).filter((e) => typeof e[1] === "number"))
+            : { main: 60, "*": 10 },
+        persistIntervalSeconds: typeof r["persistIntervalSeconds"] === "number"
+            ? r["persistIntervalSeconds"]
+            : 60,
+        decay: {
+            enabled: typeof decay["enabled"] === "boolean" ? decay["enabled"] : true,
+            inactivityDays: typeof decay["inactivityDays"] === "number"
+                ? decay["inactivityDays"]
+                : 30,
+            rate: typeof decay["rate"] === "number" ? decay["rate"] : 0.95,
+        },
+        weights: isRecord(r["weights"])
+            ? r["weights"]
+            : undefined,
+        maxHistoryPerAgent: typeof r["maxHistoryPerAgent"] === "number"
+            ? r["maxHistoryPerAgent"]
+            : 100,
+    };
+}
+function resolveAudit(raw) {
+    const r = isRecord(raw) ? raw : {};
+    return {
+        enabled: typeof r["enabled"] === "boolean" ? r["enabled"] : true,
+        retentionDays: typeof r["retentionDays"] === "number" ? r["retentionDays"] : 90,
+        redactPatterns: Array.isArray(r["redactPatterns"])
+            ? r["redactPatterns"].filter((p) => typeof p === "string")
+            : [],
+        level: r["level"] === "minimal" || r["level"] === "standard" || r["level"] === "verbose"
+            ? r["level"]
+            : "standard",
+    };
+}
+function resolvePerformance(raw) {
+    const r = isRecord(raw) ? raw : {};
+    return {
+        maxEvalUs: typeof r["maxEvalUs"] === "number" ? r["maxEvalUs"] : 5000,
+        maxContextMessages: typeof r["maxContextMessages"] === "number"
+            ? r["maxContextMessages"]
+            : 10,
+        frequencyBufferSize: typeof r["frequencyBufferSize"] === "number"
+            ? r["frequencyBufferSize"]
+            : 1000,
+    };
+}
+export function resolveConfig(raw) {
+    const r = raw ?? {};
+    const failMode = r["failMode"];
+    const resolvedFailMode = failMode === "open" || failMode === "closed" ? failMode : "open";
+    return {
+        enabled: typeof r["enabled"] === "boolean" ? r["enabled"] : true,
+        timezone: typeof r["timezone"] === "string" ? r["timezone"] : "UTC",
+        failMode: resolvedFailMode,
+        policies: Array.isArray(r["policies"])
+            ? r["policies"]
+            : [],
+        timeWindows: isRecord(r["timeWindows"])
+            ? r["timeWindows"]
+            : {},
+        trust: resolveTrust(r["trust"]),
+        audit: resolveAudit(r["audit"]),
+        toolRiskOverrides: isRecord(r["toolRiskOverrides"])
+            ? Object.fromEntries(Object.entries(r["toolRiskOverrides"]).filter((e) => typeof e[1] === "number"))
+            : {},
+        builtinPolicies: isRecord(r["builtinPolicies"])
+            ? r["builtinPolicies"]
+            : {},
+        performance: resolvePerformance(r["performance"]),
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/src/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAWA,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAErD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;QAChE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAClC,CAAC,CAAC,EAAyB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CACvD,CACF;YACH,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QACzB,sBAAsB,EACpB,OAAO,CAAC,CAAC,wBAAwB,CAAC,KAAK,QAAQ;YAC7C,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC;YAC7B,CAAC,CAAC,EAAE;QACR,KAAK,EAAE;YACL,OAAO,EAAE,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;YACxE,cAAc,EACZ,OAAO,KAAK,CAAC,gBAAgB,CAAC,KAAK,QAAQ;gBACzC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBACzB,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;SAC/D;QACD,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC,CAAE,CAAC,CAAC,SAAS,CAA4B;YAC1C,CAAC,CAAC,SAAS;QACb,kBAAkB,EAChB,OAAO,CAAC,CAAC,oBAAoB,CAAC,KAAK,QAAQ;YACzC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;YACzB,CAAC,CAAC,GAAG;KACV,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACnC,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;QAChE,aAAa,EACX,OAAO,CAAC,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE;QAClE,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;YAChD,CAAC,CAAE,CAAC,CAAC,gBAAgB,CAAc,CAAC,MAAM,CACtC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C;YACH,CAAC,CAAC,EAAE;QACN,KAAK,EACH,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS;YAC/E,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACZ,CAAC,CAAC,UAAU;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACnC,OAAO;QACL,SAAS,EACP,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;QAC5D,kBAAkB,EAChB,OAAO,CAAC,CAAC,oBAAoB,CAAC,KAAK,QAAQ;YACzC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;YACzB,CAAC,CAAC,EAAE;QACR,mBAAmB,EACjB,OAAO,CAAC,CAAC,qBAAqB,CAAC,KAAK,QAAQ;YAC1C,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC;YAC1B,CAAC,CAAC,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,GAA6B;IAE7B,MAAM,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC;IAEpB,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IAC/B,MAAM,gBAAgB,GACpB,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IAEnE,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;QAChE,QAAQ,EAAE,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK;QACnE,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACpC,CAAC,CAAE,CAAC,CAAC,UAAU,CAAc;YAC7B,CAAC,CAAC,EAAE;QACN,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;YACrC,CAAC,CAAE,CAAC,CAAC,aAAa,CAAgC;YAClD,CAAC,CAAC,EAAE;QACN,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/B,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/B,iBAAiB,EAAE,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;YACjD,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAC3C,CAAC,CAAC,EAAyB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CACvD,CACF;YACH,CAAC,CAAC,EAAE;QACN,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAC7C,CAAC,CAAE,CAAC,CAAC,iBAAiB,CAA2B;YACjD,CAAC,CAAC,EAAE;QACN,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;KAClD,CAAC;AACJ,CAAC"}