@weave_protocol/adapter-msaf 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @weave_protocol/adapter-msaf — public API
+ *
+ * Primary export: WardMiddleware class.
+ * Plus: types, policy loader, evaluator.
+ */
+export { WardMiddleware } from './middleware.js';
+export { TOOL_MAPPINGS, WardDeniedError, } from './types.js';
+export type { ToolMapping, MsafToolCall, MsafMiddlewareResult, MiddlewareOptions, } from './types.js';
+export { resolveWardForCwd, loadWardFromSource, evaluateCall, } from './policy.js';
+export type { ResolvedWard } from './policy.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EACL,aAAa,EACb,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,WAAW,EACX,YAAY,EACZ,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,10 @@
+/**
+ * @weave_protocol/adapter-msaf — public API
+ *
+ * Primary export: WardMiddleware class.
+ * Plus: types, policy loader, evaluator.
+ */
+export { WardMiddleware } from './middleware.js';
+export { TOOL_MAPPINGS, WardDeniedError, } from './types.js';
+export { resolveWardForCwd, loadWardFromSource, evaluateCall, } from './policy.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EACL,aAAa,EACb,eAAe,GAChB,MAAM,YAAY,CAAC;AAOpB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,GACb,MAAM,aAAa,CAAC"}

package/dist/middleware.d.ts

@@ -0,0 +1,96 @@
+/**
+ * WARD middleware for the Microsoft Agent Framework.
+ *
+ * MSAF exposes three middleware types; we provide adapters for two of them:
+ *
+ *   1. Function middleware — gates individual tool calls. This is the primary
+ *      WARD enforcement layer. Use `.functionMiddleware()`.
+ *
+ *   2. Agent middleware — gates whole agent turns. Wraps the entire run.
+ *      Use `.agentMiddleware()`. Less granular than function middleware but
+ *      useful for behavioral-limit checks (max iterations, max cost) and
+ *      for adding session-scoped logging.
+ *
+ * The user is responsible for registering the returned function with their
+ * MSAF agent / chat client. We don't reach into MSAF's internals.
+ *
+ * Why we don't ship a direct MSAF SDK dependency:
+ *   MSAF's primary surface is .NET. The Node/TS bindings are evolving and
+ *   we don't want to pin a specific 1.0.0-rc version. Instead, we expose
+ *   middleware FUNCTIONS that match MSAF's documented `pre_invoke` and
+ *   `agent_middleware` signatures. The user wires them in.
+ */
+import { type WardPolicy } from '@weave_protocol/ward';
+import { type MsafToolCall, type MsafMiddlewareResult, type MiddlewareOptions } from './types.js';
+/**
+ * The primary entry point. Construct one, register the returned middleware
+ * functions with your MSAF agent.
+ *
+ * @example
+ * ```typescript
+ * import { WardMiddleware } from '@weave_protocol/adapter-msaf';
+ *
+ * const ward = new WardMiddleware({ wardPath: './WARD.md' });
+ *
+ * // For per-tool gating (primary use):
+ * agent.useFunctionMiddleware(ward.functionMiddleware());
+ *
+ * // For turn-level gating (optional, complementary):
+ * agent.useAgentMiddleware(ward.agentMiddleware());
+ * ```
+ */
+export declare class WardMiddleware {
+    private resolved;
+    private readonly failClosed;
+    private readonly toolMappings;
+    private readonly onAllow?;
+    private readonly onDeny?;
+    constructor(opts?: MiddlewareOptions);
+    /**
+     * Returns true if a WARD policy is loaded.
+     */
+    isLoaded(): boolean;
+    /**
+     * The active WARD policy source path (or '<inline>'), if loaded.
+     */
+    getPolicySource(): string | null;
+    /**
+     * The parsed WARD policy object, if loaded.
+     */
+    getPolicy(): WardPolicy | null;
+    /**
+     * Evaluate a tool call against the loaded policy. Pure function — does
+     * not throw. Useful for testing and for users who want to run the check
+     * manually without going through middleware.
+     */
+    evaluate(call: MsafToolCall): MsafMiddlewareResult;
+    /**
+     * Returns a function middleware compatible with MSAF's function-middleware
+     * pre_invoke shape. The returned function:
+     *   - calls next() if the call is allowed
+     *   - throws WardDeniedError if the call is denied or requires approval
+     *
+     * Usage:
+     *   agent.useFunctionMiddleware(ward.functionMiddleware());
+     */
+    functionMiddleware(): (call: MsafToolCall, next: () => Promise<unknown>) => Promise<unknown>;
+    /**
+     * Returns an agent middleware compatible with MSAF's agent middleware
+     * shape. This fires once per turn before any LLM call.
+     *
+     * The agent middleware is informational only by default — it doesn't gate
+     * individual tool calls (that's what functionMiddleware is for). It exists
+     * so users who want a turn-level hook (for logging or session tracking)
+     * can register one. To enforce behavioral limits (cost, iterations) at the
+     * turn level, subclass or wrap this.
+     */
+    agentMiddleware(): (ctx: {
+        turnIndex?: number;
+    }, next: () => Promise<unknown>) => Promise<unknown>;
+    /**
+     * Backward-compatible: alias for functionMiddleware().
+     * MSAF's terminology evolved; we keep both spellings.
+     */
+    middleware(): ReturnType<WardMiddleware['functionMiddleware']>;
+}
+//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EACL,KAAK,UAAU,EAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAGvB,MAAM,YAAY,CAAC;AAOpB;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAsB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAU;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA8B;IAC3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAA+B;IACxD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA8B;gBAE1C,IAAI,GAAE,iBAAsB;IA6BxC;;OAEG;IACH,QAAQ,IAAI,OAAO;IAInB;;OAEG;IACH,eAAe,IAAI,MAAM,GAAG,IAAI;IAIhC;;OAEG;IACH,SAAS,IAAI,UAAU,GAAG,IAAI;IAI9B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,oBAAoB;IAQlD;;;;;;;;OAQG;IACH,kBAAkB,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC;IA2B5F;;;;;;;;;OASG;IACH,eAAe,IAAI,CAAC,GAAG,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC;IAQlG;;;OAGG;IACH,UAAU,IAAI,UAAU,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC;CAG/D"}

package/dist/middleware.js

@@ -0,0 +1,164 @@
+/**
+ * WARD middleware for the Microsoft Agent Framework.
+ *
+ * MSAF exposes three middleware types; we provide adapters for two of them:
+ *
+ *   1. Function middleware — gates individual tool calls. This is the primary
+ *      WARD enforcement layer. Use `.functionMiddleware()`.
+ *
+ *   2. Agent middleware — gates whole agent turns. Wraps the entire run.
+ *      Use `.agentMiddleware()`. Less granular than function middleware but
+ *      useful for behavioral-limit checks (max iterations, max cost) and
+ *      for adding session-scoped logging.
+ *
+ * The user is responsible for registering the returned function with their
+ * MSAF agent / chat client. We don't reach into MSAF's internals.
+ *
+ * Why we don't ship a direct MSAF SDK dependency:
+ *   MSAF's primary surface is .NET. The Node/TS bindings are evolving and
+ *   we don't want to pin a specific 1.0.0-rc version. Instead, we expose
+ *   middleware FUNCTIONS that match MSAF's documented `pre_invoke` and
+ *   `agent_middleware` signatures. The user wires them in.
+ */
+import { readFileSync, existsSync } from 'node:fs';
+import { WardDeniedError, } from './types.js';
+import { resolveWardForCwd, loadWardFromSource, evaluateCall } from './policy.js';
+// ============================================================================
+// WardMiddleware class
+// ============================================================================
+/**
+ * The primary entry point. Construct one, register the returned middleware
+ * functions with your MSAF agent.
+ *
+ * @example
+ * ```typescript
+ * import { WardMiddleware } from '@weave_protocol/adapter-msaf';
+ *
+ * const ward = new WardMiddleware({ wardPath: './WARD.md' });
+ *
+ * // For per-tool gating (primary use):
+ * agent.useFunctionMiddleware(ward.functionMiddleware());
+ *
+ * // For turn-level gating (optional, complementary):
+ * agent.useAgentMiddleware(ward.agentMiddleware());
+ * ```
+ */
+export class WardMiddleware {
+    resolved;
+    failClosed;
+    toolMappings;
+    onAllow;
+    onDeny;
+    constructor(opts = {}) {
+        this.failClosed = opts.failMode === 'closed';
+        this.toolMappings = opts.toolMappings || {};
+        this.onAllow = opts.onAllow;
+        this.onDeny = opts.onDeny;
+        try {
+            if (opts.wardSource) {
+                this.resolved = loadWardFromSource(opts.wardSource, '<inline>');
+            }
+            else if (opts.wardPath) {
+                if (!existsSync(opts.wardPath)) {
+                    throw new Error(`WARD.md not found at ${opts.wardPath}`);
+                }
+                const src = readFileSync(opts.wardPath, 'utf8');
+                this.resolved = loadWardFromSource(src, opts.wardPath);
+            }
+            else {
+                this.resolved = resolveWardForCwd();
+            }
+        }
+        catch (err) {
+            if (this.failClosed)
+                throw err;
+            // Fail-open: log and continue with no policy (every call allowed)
+            // eslint-disable-next-line no-console
+            console.warn(`[weave-msaf] WARD.md could not be loaded (${err instanceof Error ? err.message : String(err)}). Running in fail-open mode — no enforcement.`);
+            this.resolved = null;
+        }
+    }
+    /**
+     * Returns true if a WARD policy is loaded.
+     */
+    isLoaded() {
+        return this.resolved !== null;
+    }
+    /**
+     * The active WARD policy source path (or '<inline>'), if loaded.
+     */
+    getPolicySource() {
+        return this.resolved?.source ?? null;
+    }
+    /**
+     * The parsed WARD policy object, if loaded.
+     */
+    getPolicy() {
+        return this.resolved?.policy ?? null;
+    }
+    /**
+     * Evaluate a tool call against the loaded policy. Pure function — does
+     * not throw. Useful for testing and for users who want to run the check
+     * manually without going through middleware.
+     */
+    evaluate(call) {
+        if (!this.resolved) {
+            return { decision: 'allow', reasons: ['No WARD.md loaded'] };
+        }
+        const result = evaluateCall(this.resolved.policy, call, this.toolMappings);
+        return { ...result, policySource: this.resolved.source };
+    }
+    /**
+     * Returns a function middleware compatible with MSAF's function-middleware
+     * pre_invoke shape. The returned function:
+     *   - calls next() if the call is allowed
+     *   - throws WardDeniedError if the call is denied or requires approval
+     *
+     * Usage:
+     *   agent.useFunctionMiddleware(ward.functionMiddleware());
+     */
+    functionMiddleware() {
+        return async (call, next) => {
+            const result = this.evaluate(call);
+            if (result.decision === 'allow') {
+                if (this.onAllow)
+                    await this.onAllow(call, result);
+                return next();
+            }
+            // Denied or requires approval
+            if (this.onDeny) {
+                const override = await this.onDeny(call, result);
+                if (override === true) {
+                    // User explicitly overrode the WARD decision
+                    return next();
+                }
+            }
+            throw new WardDeniedError(result.decision === 'deny' ? 'deny' : 'require_approval', result.reasons, call.toolName, result.policySource);
+        };
+    }
+    /**
+     * Returns an agent middleware compatible with MSAF's agent middleware
+     * shape. This fires once per turn before any LLM call.
+     *
+     * The agent middleware is informational only by default — it doesn't gate
+     * individual tool calls (that's what functionMiddleware is for). It exists
+     * so users who want a turn-level hook (for logging or session tracking)
+     * can register one. To enforce behavioral limits (cost, iterations) at the
+     * turn level, subclass or wrap this.
+     */
+    agentMiddleware() {
+        return async (ctx, next) => {
+            // For now, agent middleware is pass-through; future versions can add
+            // iteration-counter / cost-tracking enforcement here.
+            return next();
+        };
+    }
+    /**
+     * Backward-compatible: alias for functionMiddleware().
+     * MSAF's terminology evolved; we keep both spellings.
+     */
+    middleware() {
+        return this.functionMiddleware();
+    }
+}
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAInD,OAAO,EAKL,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,YAAY,EAAqB,MAAM,aAAa,CAAC;AAErG,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,cAAc;IACjB,QAAQ,CAAsB;IACrB,UAAU,CAAU;IACpB,YAAY,CAA8B;IAC1C,OAAO,CAAgC;IACvC,MAAM,CAA+B;IAEtD,YAAY,OAA0B,EAAE;QACtC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC7C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE1B,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,IAAI,CAAC,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAClE,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC/B,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC3D,CAAC;gBACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAChD,IAAI,CAAC,QAAQ,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,GAAG,iBAAiB,EAAE,CAAC;YACtC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,UAAU;gBAAE,MAAM,GAAG,CAAC;YAC/B,kEAAkE;YAClE,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,6CAA6C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gDAAgD,CAC9I,CAAC;YACF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,IAAkB;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC/D,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3E,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC3D,CAAC;IAED;;;;;;;;OAQG;IACH,kBAAkB;QAChB,OAAO,KAAK,EAAE,IAAkB,EAAE,IAA4B,EAAoB,EAAE;YAClF,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAEnC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAChC,IAAI,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACnD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,8BAA8B;YAC9B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACjD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;oBACtB,6CAA6C;oBAC7C,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;YACH,CAAC;YAED,MAAM,IAAI,eAAe,CACvB,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,EACxD,MAAM,CAAC,OAAO,EACd,IAAI,CAAC,QAAQ,EACb,MAAM,CAAC,YAAY,CACpB,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,eAAe;QACb,OAAO,KAAK,EAAE,GAA2B,EAAE,IAA4B,EAAoB,EAAE;YAC3F,qEAAqE;YACrE,sDAAsD;YACtD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC;IACnC,CAAC;CACF"}

package/dist/policy.d.ts

@@ -0,0 +1,25 @@
+/**
+ * WARD policy loading + evaluation for MSAF middleware.
+ *
+ * Unlike the Claude Code / Antigravity adapters which read WARD on every
+ * hook invocation (because they're spawned as subprocesses), MSAF middleware
+ * runs in-process. We load WARD once at middleware construction time and
+ * keep the parsed policy in memory for the lifetime of the agent run.
+ */
+import { type WardPolicy } from '@weave_protocol/ward';
+import { type ToolMapping, type MsafToolCall, type MsafMiddlewareResult } from './types.js';
+export interface ResolvedWard {
+    policy: WardPolicy;
+    source: string;
+}
+/**
+ * Find a WARD.md by walking the resolution order:
+ *   1. $WEAVE_WARD_PATH if set
+ *   2. <cwd>/WARD.md
+ *   3. <cwd>/.weave/WARD.md
+ *   4. <cwd>/.msaf/WARD.md (MSAF convention if user puts config in .msaf/)
+ */
+export declare function resolveWardForCwd(cwd?: string): ResolvedWard | null;
+export declare function loadWardFromSource(source: string, label?: string): ResolvedWard;
+export declare function evaluateCall(policy: WardPolicy, call: MsafToolCall, customMappings?: Record<string, ToolMapping>): MsafMiddlewareResult;
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAKL,KAAK,UAAU,EAEhB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EAC1B,MAAM,YAAY,CAAC;AAMpB,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAsB,GAAG,YAAY,GAAG,IAAI,CAmBlF;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAAa,GAAG,YAAY,CAEnF;AAMD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,YAAY,EAClB,cAAc,GAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAM,GAC/C,oBAAoB,CA6DtB"}

package/dist/policy.js

@@ -0,0 +1,154 @@
+/**
+ * WARD policy loading + evaluation for MSAF middleware.
+ *
+ * Unlike the Claude Code / Antigravity adapters which read WARD on every
+ * hook invocation (because they're spawned as subprocesses), MSAF middleware
+ * runs in-process. We load WARD once at middleware construction time and
+ * keep the parsed policy in memory for the lifetime of the agent run.
+ */
+import { readFileSync, existsSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { parseWard, checkCapability, checkFilesystem, checkNetwork, } from '@weave_protocol/ward';
+import { TOOL_MAPPINGS, } from './types.js';
+/**
+ * Find a WARD.md by walking the resolution order:
+ *   1. $WEAVE_WARD_PATH if set
+ *   2. <cwd>/WARD.md
+ *   3. <cwd>/.weave/WARD.md
+ *   4. <cwd>/.msaf/WARD.md (MSAF convention if user puts config in .msaf/)
+ */
+export function resolveWardForCwd(cwd = process.cwd()) {
+    const candidates = [];
+    if (process.env.WEAVE_WARD_PATH)
+        candidates.push(process.env.WEAVE_WARD_PATH);
+    if (cwd) {
+        candidates.push(join(cwd, 'WARD.md'));
+        candidates.push(join(cwd, '.weave', 'WARD.md'));
+        candidates.push(join(cwd, '.msaf', 'WARD.md'));
+    }
+    for (const path of candidates) {
+        const resolved = resolve(path);
+        if (existsSync(resolved)) {
+            const source = readFileSync(resolved, 'utf8');
+            const policy = parseWard(source);
+            return { policy, source: resolved };
+        }
+    }
+    return null;
+}
+export function loadWardFromSource(source, label = '<inline>') {
+    return { policy: parseWard(source), source: label };
+}
+// ============================================================================
+// Evaluation
+// ============================================================================
+export function evaluateCall(policy, call, customMappings = {}) {
+    const reasons = [];
+    let decision = 'allow';
+    // Merge built-in + custom mappings; custom wins on conflict.
+    const mapping = customMappings[call.toolName] || TOOL_MAPPINGS[call.toolName] || { capability: call.toolName };
+    // 1. Capability check (mapped name + raw name, stricter explicit wins)
+    const capByMapping = checkCapability(policy, mapping.capability);
+    const capByRaw = checkCapability(policy, call.toolName);
+    const cap = mergeCapability(capByMapping, capByRaw);
+    if (cap.decision === 'deny') {
+        return { decision: 'deny', reasons: [cap.reason] };
+    }
+    if (cap.decision === 'require_approval') {
+        decision = 'require_approval';
+        reasons.push(cap.reason);
+    }
+    // 2. Filesystem check
+    if (mapping.pathField && call.args && typeof call.args[mapping.pathField] === 'string') {
+        const path = call.args[mapping.pathField];
+        const fs = checkFilesystem(policy, mapping.fsOp || 'read', path);
+        if (fs.decision === 'deny') {
+            return { decision: 'deny', reasons: [fs.reason] };
+        }
+        if (fs.decision === 'require_approval' && decision !== 'require_approval') {
+            decision = 'require_approval';
+            reasons.push(fs.reason);
+        }
+    }
+    // 3. Network check
+    if (mapping.urlField && call.args && typeof call.args[mapping.urlField] === 'string') {
+        const url = call.args[mapping.urlField];
+        const method = call.args.method || 'GET';
+        const net = checkNetwork(policy, url, method);
+        if (net.decision === 'deny') {
+            return { decision: 'deny', reasons: [net.reason] };
+        }
+        if (net.decision === 'require_approval' && decision !== 'require_approval') {
+            decision = 'require_approval';
+            reasons.push(net.reason);
+        }
+    }
+    // 4. Bash command heuristic
+    if (mapping.commandField && call.args && typeof call.args[mapping.commandField] === 'string') {
+        const command = call.args[mapping.commandField];
+        const bashCheck = scanBashCommand(policy, command);
+        if (bashCheck.decision === 'deny') {
+            return { decision: 'deny', reasons: [bashCheck.reason] };
+        }
+        if (bashCheck.decision === 'require_approval' && decision !== 'require_approval') {
+            decision = 'require_approval';
+            reasons.push(bashCheck.reason);
+        }
+    }
+    return { decision, reasons };
+}
+function isExplicit(reason) {
+    return (reason.includes('is in the allow list') ||
+        reason.includes('is in the deny list') ||
+        reason.includes('requires human approval'));
+}
+function mergeCapability(a, b) {
+    const aExp = isExplicit(a.reason);
+    const bExp = isExplicit(b.reason);
+    if (aExp && !bExp)
+        return a;
+    if (bExp && !aExp)
+        return b;
+    if (a.decision === 'deny' || b.decision === 'deny') {
+        return a.decision === 'deny' ? a : b;
+    }
+    if (a.decision === 'require_approval' || b.decision === 'require_approval') {
+        return a.decision === 'require_approval' ? a : b;
+    }
+    return a;
+}
+function scanBashCommand(policy, command) {
+    const urlMatch = command.match(/https?:\/\/[^\s'"`)]+/);
+    if (urlMatch) {
+        const net = checkNetwork(policy, urlMatch[0], 'GET');
+        if (net.decision === 'deny')
+            return { decision: 'deny', reason: `bash command targets ${urlMatch[0]}: ${net.reason}` };
+        if (net.decision === 'require_approval')
+            return { decision: 'require_approval', reason: `bash command targets ${urlMatch[0]}: ${net.reason}` };
+    }
+    const dangerousPaths = [
+        '~/.ssh',
+        '~/.aws',
+        '~/.config/gcloud',
+        '~/.azure', // Azure credentials (relevant for MSAF users)
+        '/etc/',
+        '/usr/',
+        '/.env',
+    ];
+    for (const danger of dangerousPaths) {
+        if (command.includes(danger)) {
+            let op = 'read';
+            if (/(?:^|[\s;|])rm\s/.test(command))
+                op = 'delete';
+            else if (/>|>>|tee|sed -i/.test(command))
+                op = 'write';
+            const fs = checkFilesystem(policy, op, danger + (danger.endsWith('/') ? '**' : ''));
+            if (fs.decision === 'deny')
+                return { decision: 'deny', reason: `bash touches ${danger}: ${fs.reason}` };
+            if (fs.decision === 'require_approval')
+                return { decision: 'require_approval', reason: `bash touches ${danger}: ${fs.reason}` };
+        }
+    }
+    return { decision: 'allow', reason: '' };
+}
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,SAAS,EACT,eAAe,EACf,eAAe,EACf,YAAY,GAGb,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,aAAa,GAId,MAAM,YAAY,CAAC;AAWpB;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IAC3D,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe;QAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC9E,IAAI,GAAG,EAAE,CAAC;QACR,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;QAChD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YACjC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,KAAK,GAAG,UAAU;IACnE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACtD,CAAC;AAED,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E,MAAM,UAAU,YAAY,CAC1B,MAAkB,EAClB,IAAkB,EAClB,iBAA8C,EAAE;IAEhD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,QAAQ,GAA0C,OAAO,CAAC;IAE9D,6DAA6D;IAC7D,MAAM,OAAO,GACX,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAEjG,uEAAuE;IACvE,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,eAAe,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QACxC,QAAQ,GAAG,kBAAkB,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED,sBAAsB;IACtB,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,QAAQ,EAAE,CAAC;QACvF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAW,CAAC;QACpD,MAAM,EAAE,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,IAAI,MAAM,EAAE,IAAI,CAAC,CAAC;QACjE,IAAI,EAAE,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,EAAE,CAAC,QAAQ,KAAK,kBAAkB,IAAI,QAAQ,KAAK,kBAAkB,EAAE,CAAC;YAC1E,QAAQ,GAAG,kBAAkB,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,mBAAmB;IACnB,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAW,CAAC;QAClD,MAAM,MAAM,GAAI,IAAI,CAAC,IAAI,CAAC,MAAqB,IAAI,KAAK,CAAC;QACzD,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9C,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,kBAAkB,IAAI,QAAQ,KAAK,kBAAkB,EAAE,CAAC;YAC3E,QAAQ,GAAG,kBAAkB,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,IAAI,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC7F,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAW,CAAC;QAC1D,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,SAAS,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,CAAC;QACD,IAAI,SAAS,CAAC,QAAQ,KAAK,kBAAkB,IAAI,QAAQ,KAAK,kBAAkB,EAAE,CAAC;YACjF,QAAQ,GAAG,kBAAkB,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QACvC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QACtC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,CAAsE,EACtE,CAAsE;IAEtE,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAElC,IAAI,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC;IAC5B,IAAI,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC;IAE5B,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACnD,OAAO,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,kBAAkB,IAAI,CAAC,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QAC3E,OAAO,CAAC,CAAC,QAAQ,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,eAAe,CACtB,MAAkB,EAClB,OAAe;IAEf,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACxD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACrD,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QACvH,IAAI,GAAG,CAAC,QAAQ,KAAK,kBAAkB;YAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,wBAAwB,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;IACjJ,CAAC;IAED,MAAM,cAAc,GAAG;QACrB,QAAQ;QACR,QAAQ;QACR,kBAAkB;QAClB,UAAU,EAAmB,8CAA8C;QAC3E,OAAO;QACP,OAAO;QACP,OAAO;KACR,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,IAAI,EAAE,GAAgC,MAAM,CAAC;YAC7C,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,EAAE,GAAG,QAAQ,CAAC;iBAC/C,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,EAAE,GAAG,OAAO,CAAC;YAEvD,MAAM,EAAE,GAAG,eAAe,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACpF,IAAI,EAAE,CAAC,QAAQ,KAAK,MAAM;gBAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,MAAM,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACxG,IAAI,EAAE,CAAC,QAAQ,KAAK,kBAAkB;gBAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,gBAAgB,MAAM,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;QAClI,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAC3C,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Types for the Microsoft Agent Framework adapter.
+ *
+ * MSAF supports three middleware types (per the v1.0 docs):
+ *   1. Agent middleware    — wraps full agent runs (once per turn)
+ *   2. Function middleware — wraps individual tool calls
+ *   3. Chat middleware     — wraps raw model requests
+ *
+ * For WARD enforcement we primarily care about function middleware
+ * (since WARD gates tool calls), but we also expose an agent-middleware
+ * variant for users who want a turn-level gate.
+ */
+/**
+ * A proposed function/tool call that MSAF is about to execute.
+ * Shape mirrors what MSAF's function middleware exposes via its context.
+ */
+export interface MsafToolCall {
+    toolName: string;
+    args: Record<string, unknown>;
+    raw?: unknown;
+}
+/**
+ * Result of a WARD evaluation for an MSAF middleware.
+ */
+export interface MsafMiddlewareResult {
+    decision: 'allow' | 'deny' | 'require_approval';
+    reasons: string[];
+    policySource?: string;
+}
+/**
+ * Standardized error thrown by the middleware when a call is denied.
+ * MSAF middleware short-circuits by throwing (or by not calling next()),
+ * so we provide a typed error so users can catch and handle it.
+ */
+export declare class WardDeniedError extends Error {
+    readonly decision: 'deny' | 'require_approval';
+    readonly reasons: string[];
+    readonly policySource: string | undefined;
+    readonly toolName: string;
+    constructor(decision: 'deny' | 'require_approval', reasons: string[], toolName: string, policySource?: string);
+}
+/**
+ * Mapping from MSAF tool names to their nature.
+ *
+ * MSAF tools are user-defined, but several conventions are widely
+ * established (especially through the Copilot/Claude Code SDK harness
+ * integrations and the local agent runtime which exposes shell/file/
+ * messaging tools). The mappings below cover those well-known names.
+ *
+ * Users can also register custom mappings via MiddlewareOptions.toolMappings.
+ */
+export interface ToolMapping {
+    capability: string;
+    pathField?: string;
+    fsOp?: 'read' | 'write' | 'execute' | 'delete' | 'list';
+    urlField?: string;
+    commandField?: string;
+}
+export declare const TOOL_MAPPINGS: Record<string, ToolMapping>;
+/**
+ * Options when creating a WardMiddleware instance.
+ */
+export interface MiddlewareOptions {
+    /**
+     * Explicit path to a WARD.md file. If omitted, resolves via:
+     *   $WEAVE_WARD_PATH → <cwd>/WARD.md → <cwd>/.weave/WARD.md → <cwd>/.msaf/WARD.md
+     */
+    wardPath?: string;
+    /**
+     * Raw WARD.md content (alternative to wardPath). Useful for tests or
+     * embedding the policy in code.
+     */
+    wardSource?: string;
+    /**
+     * Custom tool name → capability mappings. Merged on top of the built-in
+     * TOOL_MAPPINGS so users can override or add.
+     */
+    toolMappings?: Record<string, ToolMapping>;
+    /**
+     * Fail mode:
+     *   - 'open' (default): if WARD can't be loaded, allow the call and warn
+     *   - 'closed': if WARD can't be loaded, deny the call
+     */
+    failMode?: 'open' | 'closed';
+    /**
+     * Optional callback when a call is allowed. Useful for logging/attestation.
+     */
+    onAllow?: (call: MsafToolCall, result: MsafMiddlewareResult) => void | Promise<void>;
+    /**
+     * Optional callback when a call is denied. Useful for alerting.
+     * If you return false, the call is allowed despite the WARD decision.
+     * (Generally don't do that — but it's available for emergency overrides.)
+     */
+    onDeny?: (call: MsafToolCall, result: MsafMiddlewareResult) => boolean | void | Promise<boolean | void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9B,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,CAAC;IAChD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,SAAgB,QAAQ,EAAE,MAAM,GAAG,kBAAkB,CAAC;IACtD,SAAgB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClC,SAAgB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,SAAgB,QAAQ,EAAE,MAAM,CAAC;gBAG/B,QAAQ,EAAE,MAAM,GAAG,kBAAkB,EACrC,OAAO,EAAE,MAAM,EAAE,EACjB,QAAQ,EAAE,MAAM,EAChB,YAAY,CAAC,EAAE,MAAM;CAWxB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CA4BrD,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE3C;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAE7B;;OAEG;IACH,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,oBAAoB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErF;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,oBAAoB,KAAK,OAAO,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;CACzG"}

package/dist/types.js

@@ -0,0 +1,58 @@
+/**
+ * Types for the Microsoft Agent Framework adapter.
+ *
+ * MSAF supports three middleware types (per the v1.0 docs):
+ *   1. Agent middleware    — wraps full agent runs (once per turn)
+ *   2. Function middleware — wraps individual tool calls
+ *   3. Chat middleware     — wraps raw model requests
+ *
+ * For WARD enforcement we primarily care about function middleware
+ * (since WARD gates tool calls), but we also expose an agent-middleware
+ * variant for users who want a turn-level gate.
+ */
+/**
+ * Standardized error thrown by the middleware when a call is denied.
+ * MSAF middleware short-circuits by throwing (or by not calling next()),
+ * so we provide a typed error so users can catch and handle it.
+ */
+export class WardDeniedError extends Error {
+    decision;
+    reasons;
+    policySource;
+    toolName;
+    constructor(decision, reasons, toolName, policySource) {
+        super(`WARD ${decision === 'deny' ? 'denied' : 'requires approval for'} tool '${toolName}': ${reasons.join(' | ')}`);
+        this.name = 'WardDeniedError';
+        this.decision = decision;
+        this.reasons = reasons;
+        this.policySource = policySource;
+        this.toolName = toolName;
+    }
+}
+export const TOOL_MAPPINGS = {
+    // MSAF local agent runtime tools
+    ShellExec: { capability: 'shell_exec', commandField: 'command' },
+    Bash: { capability: 'shell_exec', commandField: 'command' },
+    FileRead: { capability: 'file_read', pathField: 'path', fsOp: 'read' },
+    FileWrite: { capability: 'file_write', pathField: 'path', fsOp: 'write' },
+    FileEdit: { capability: 'file_write', pathField: 'path', fsOp: 'write' },
+    FileDelete: { capability: 'file_delete', pathField: 'path', fsOp: 'delete' },
+    ListDirectory: { capability: 'file_list', pathField: 'path', fsOp: 'list' },
+    HttpRequest: { capability: 'http_request', urlField: 'url' },
+    WebFetch: { capability: 'http_request', urlField: 'url' },
+    // Copilot SDK integration patterns
+    RunCommand: { capability: 'shell_exec', commandField: 'command' },
+    EditFile: { capability: 'file_write', pathField: 'file_path', fsOp: 'write' },
+    ReadFile: { capability: 'file_read', pathField: 'file_path', fsOp: 'read' },
+    // Claude Code SDK integration (via MSAF) - share with adapter-claudecode names
+    Bash_via_claude: { capability: 'shell_exec', commandField: 'command' },
+    Edit: { capability: 'file_write', pathField: 'file_path', fsOp: 'write' },
+    Write: { capability: 'file_write', pathField: 'file_path', fsOp: 'write' },
+    Read: { capability: 'file_read', pathField: 'file_path', fsOp: 'read' },
+    // Common workflow/automation tools
+    SendEmail: { capability: 'send_email' },
+    PostMessage: { capability: 'send_message' },
+    CreateIssue: { capability: 'create_issue' },
+    Subagent: { capability: 'subagent' },
+};
+//# sourceMappingURL=types.js.map