@xrkseek/harness 0.6.4 → 0.6.5

package/node_modules/@xrkseek/policy/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,uBAAuB,GAExB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,eAAe,EACf,eAAe,GAKhB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,qBAAqB,GAKtB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,kBAAkB,GAInB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,qBAAqB,EACrB,2BAA2B,GAE5B,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,uBAAuB,GAExB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,eAAe,EACf,eAAe,GAKhB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,qBAAqB,GAKtB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,kBAAkB,GAInB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,qBAAqB,EACrB,2BAA2B,GAE5B,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,YAAY,EACZ,kBAAkB,GAEnB,MAAM,gBAAgB,CAAC"}

package/node_modules/@xrkseek/policy/dist/ruleset.d.ts

@@ -11,8 +11,14 @@ export interface PolicyRulesetRuleJson {
         /**
          * Name / id / action / scheme / op lists depending on kind.
          * Ignored for mcp.connect / office.connect deny-all rules.
+         * Optional when `when` is set (deny/ask only).
          */
         readonly names?: readonly string[];
+        /**
+         * Restricted boolean expression over the subject (`name`, `args`, …).
+         * Compiled at load; see `compileWhenExpr`. No second engine — filter only.
+         */
+        readonly when?: string;
     };
 }
 export interface PolicyRulesetJson {

package/node_modules/@xrkseek/policy/dist/ruleset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ruleset.d.ts","sourceRoot":"","sources":["../src/ruleset.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EAEZ,iBAAiB,EACjB,aAAa,EACd,MAAM,YAAY,CAAC;AAepB,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,aAAa,CAAC;AAErB,eAAO,MAAM,sBAAsB,EAAG,CAAU,CAAC;AAEjD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,KAAK,GAAG,YAAY,CAAC;AAE7D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;QACjC;;;WAGG;QACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACpC,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC,CAAC;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACnD;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAoJD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,yBAAyB,CA8C5E;AAED,2DAA2D;AAC3D,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAE1E"}
+{"version":3,"file":"ruleset.d.ts","sourceRoot":"","sources":["../src/ruleset.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,YAAY,EAEZ,iBAAiB,EACjB,aAAa,EACd,MAAM,YAAY,CAAC;AAepB,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,aAAa,CAAC;AAQrB,eAAO,MAAM,sBAAsB,EAAG,CAAU,CAAC;AAEjD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,KAAK,GAAG,YAAY,CAAC;AAE7D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;QACjC;;;;WAIG;QACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACnC;;;WAGG;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC,CAAC;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACnD;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAwND;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,yBAAyB,CA8C5E;AAED,2DAA2D;AAC3D,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAE1E"}

package/node_modules/@xrkseek/policy/dist/ruleset.js

@@ -1,5 +1,6 @@
 import { allowProviderIdsOnly, allowToolNamesOnly, askHostOpenActions, askToolNames, denyHostOpenActions, denyMcpConnect, denyMcpResourceServers, denyOfficeConnect, denyProviderIds, denySidebarEmbedSchemes, denySidebarFsOps, denyToolNames, } from "./rules.js";
 import { createPolicyEngine, } from "./engine.js";
+import { WhenExprError, compileWhenExpr, whenEnvFromSubject, } from "./when-expr.js";
 export const POLICY_RULESET_VERSION = 1;
 export class PolicyRulesetParseError extends Error {
     constructor(message) {
@@ -22,6 +23,46 @@ const ACTIONS = new Set(["deny", "ask", "allow-only"]);
 function isObject(v) {
     return v !== null && typeof v === "object" && !Array.isArray(v);
 }
+function parseWhen(value, ruleId) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string" || !value.trim()) {
+        throw new PolicyRulesetParseError(`rule ${ruleId}: match.when must be a non-empty string`);
+    }
+    try {
+        return compileWhenExpr(value);
+    }
+    catch (err) {
+        if (err instanceof WhenExprError) {
+            throw new PolicyRulesetParseError(`rule ${ruleId}: ${err.message}`);
+        }
+        throw err;
+    }
+}
+function withWhen(rule, when) {
+    if (when === undefined)
+        return rule;
+    return {
+        id: rule.id,
+        match(subject) {
+            if (!when(whenEnvFromSubject(subject)))
+                return undefined;
+            return rule.match(subject);
+        },
+    };
+}
+/** Kind-wide deny/ask used when `when` is set and `names` is omitted. */
+function kindWide(kind, action, opts) {
+    const reason = opts.reason ?? `${action} ${kind} (when)`;
+    return {
+        id: opts.id,
+        match(subject) {
+            if (subject.kind !== kind)
+                return undefined;
+            return { verdict: action, reason, ruleId: opts.id };
+        },
+    };
+}
 function parseNames(value, ruleId) {
     if (!Array.isArray(value) || value.length === 0) {
         throw new PolicyRulesetParseError(`rule ${ruleId}: names must be a non-empty string array`);
@@ -43,8 +84,12 @@ function ruleFromJson(raw, index) {
     if (typeof id !== "string" || !id.trim()) {
         throw new PolicyRulesetParseError(`rules[${index}]: missing string id`);
     }
-    const action = raw.action;
-    if (typeof action !== "string" || !ACTIONS.has(action)) {
+    // Bind as the union instead of `unknown`: a Set membership test does not narrow,
+    // and kindWide() only accepts "deny" | "ask" once "allow-only" has thrown.
+    const action = ACTIONS.has(raw.action)
+        ? raw.action
+        : undefined;
+    if (action === undefined) {
         throw new PolicyRulesetParseError(`rule ${id}: action must be deny|ask|allow-only`);
     }
     const reason = raw.reason === undefined
@@ -65,59 +110,67 @@ function ruleFromJson(raw, index) {
         id,
         ...(reason !== undefined ? { reason } : {}),
     };
+    const when = parseWhen(raw.match.when, id);
+    const finish = (rule) => withWhen(rule, when);
     if (kind === "mcp.connect") {
         if (action !== "deny") {
             throw new PolicyRulesetParseError(`rule ${id}: mcp.connect only supports action deny`);
         }
-        return denyMcpConnect(opts);
+        return finish(denyMcpConnect(opts));
     }
     if (kind === "office.connect") {
         if (action !== "deny") {
             throw new PolicyRulesetParseError(`rule ${id}: office.connect only supports action deny`);
         }
-        return denyOfficeConnect(opts);
+        return finish(denyOfficeConnect(opts));
+    }
+    if (raw.match.names === undefined) {
+        if (when === undefined || action === "allow-only") {
+            throw new PolicyRulesetParseError(`rule ${id}: names must be a non-empty string array`);
+        }
+        return finish(kindWide(kind, action, opts));
     }
     const names = parseNames(raw.match.names, id);
     if (kind === "mcp.resource") {
         if (action !== "deny") {
             throw new PolicyRulesetParseError(`rule ${id}: mcp.resource only supports action deny`);
         }
-        return denyMcpResourceServers(names, opts);
+        return finish(denyMcpResourceServers(names, opts));
     }
     if (kind === "host.open") {
         if (action === "allow-only") {
             throw new PolicyRulesetParseError(`rule ${id}: host.open does not support allow-only (use deny or ask)`);
         }
         if (action === "ask")
-            return askHostOpenActions(names, opts);
-        return denyHostOpenActions(names, opts);
+            return finish(askHostOpenActions(names, opts));
+        return finish(denyHostOpenActions(names, opts));
     }
     if (kind === "sidebar.embed") {
         if (action !== "deny") {
             throw new PolicyRulesetParseError(`rule ${id}: sidebar.embed only supports action deny`);
         }
-        return denySidebarEmbedSchemes(names, opts);
+        return finish(denySidebarEmbedSchemes(names, opts));
     }
     if (kind === "sidebar.fs") {
         if (action !== "deny") {
             throw new PolicyRulesetParseError(`rule ${id}: sidebar.fs only supports action deny`);
         }
-        return denySidebarFsOps(names, opts);
+        return finish(denySidebarFsOps(names, opts));
     }
     if (kind === "tool.call") {
         if (action === "deny")
-            return denyToolNames(names, opts);
+            return finish(denyToolNames(names, opts));
         if (action === "ask")
-            return askToolNames(names, opts);
-        return allowToolNamesOnly(names, opts);
+            return finish(askToolNames(names, opts));
+        return finish(allowToolNamesOnly(names, opts));
     }
     // provider.use
     if (action === "ask") {
         throw new PolicyRulesetParseError(`rule ${id}: provider.use does not support ask (use deny or allow-only)`);
     }
     if (action === "deny")
-        return denyProviderIds(names, opts);
-    return allowProviderIdsOnly(names, opts);
+        return finish(denyProviderIds(names, opts));
+    return finish(allowProviderIdsOnly(names, opts));
 }
 /**
  * Parse a policy ruleset JSON document into engine options.

package/node_modules/@xrkseek/policy/dist/ruleset.js.map

@@ -1 +1 @@
-{"version":3,"file":"ruleset.js","sourceRoot":"","sources":["../src/ruleset.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,kBAAkB,GAEnB,MAAM,aAAa,CAAC;AAErB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAU,CAAC;AAwBjD,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAoB;IACvC,WAAW;IACX,cAAc;IACd,aAAa;IACb,cAAc;IACd,WAAW;IACX,eAAe;IACf,YAAY;IACZ,gBAAgB;CACjB,CAAC,CAAC;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAClE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;AAEzE,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,MAAc;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,MAAM,0CAA0C,CACzD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,MAAM,2CAA2C,CAC1D,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,GAAY,EAAE,KAAa;IAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,uBAAuB,CAAC,SAAS,KAAK,oBAAoB,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;IAClB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,uBAAuB,CAAC,SAAS,KAAK,sBAAsB,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAA0B,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,sCAAsC,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GACV,GAAG,CAAC,MAAM,KAAK,SAAS;QACtB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAC9B,CAAC,CAAC,GAAG,CAAC,MAAM;YACZ,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;YACzE,CAAC,CAAC,EAAE,CAAC;IAEb,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;IAC5B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAyB,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,gDAAgD,CAC3D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG;QACX,EAAE;QACF,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC;IAEF,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,yCAAyC,CACpD,CAAC;QACJ,CAAC;QACD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,4CAA4C,CACvD,CAAC;QACJ,CAAC;QACD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE9C,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,0CAA0C,CACrD,CAAC;QACJ,CAAC;QACD,OAAO,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,2DAA2D,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7D,OAAO,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,2CAA2C,CACtD,CAAC;QACJ,CAAC;QACD,OAAO,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,wCAAwC,CACnD,CAAC;QACJ,CAAC;QACD,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACvD,OAAO,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,eAAe;IACf,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,8DAA8D,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3D,OAAO,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,sBAAsB,EAAE,CAAC;QACxD,MAAM,IAAI,uBAAuB,CAC/B,uBAAuB,MAAM,CAAC,OAAO,CAAC,eAAe,CACtD,CAAC;IACJ,CAAC;IAED,IAAI,QAA+C,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,uBAAuB,CAAC,4BAA4B,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,GAAsD,EAAE,CAAC;QAChE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAsB,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,uBAAuB,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAkB,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,uBAAuB,CAC/B,YAAY,CAAC,0BAA0B,CACxC,CAAC;YACJ,CAAC;YACD,CAAC,CAAC,CAAsB,CAAC,GAAG,CAAkB,CAAC;QACjD,CAAC;QACD,QAAQ,GAAG,CAAC,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;IAC7B,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,uBAAuB,CAAC,wBAAwB,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,OAAO,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;AACvD,CAAC"}
+{"version":3,"file":"ruleset.js","sourceRoot":"","sources":["../src/ruleset.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,kBAAkB,GAEnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,eAAe,EACf,kBAAkB,GAEnB,MAAM,gBAAgB,CAAC;AAExB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAU,CAAC;AA8BjD,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAoB;IACvC,WAAW;IACX,cAAc;IACd,aAAa;IACb,cAAc;IACd,WAAW;IACX,eAAe;IACf,YAAY;IACZ,gBAAgB;CACjB,CAAC,CAAC;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAClE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;AAEzE,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CAChB,KAAc,EACd,MAAc;IAEd,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,MAAM,yCAAyC,CACxD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,uBAAuB,CAAC,QAAQ,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CACf,IAAgB,EAChB,IAA6C;IAE7C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,CAAC,OAAO;YACX,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC;YACzD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,SAAS,QAAQ,CACf,IAAuB,EACvB,MAAsB,EACtB,IAAuD;IAEvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,MAAM,IAAI,IAAI,SAAS,CAAC;IACzD,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,CAAC,OAAO;YACX,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACtD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,MAAc;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,MAAM,0CAA0C,CACzD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,MAAM,2CAA2C,CAC1D,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,GAAY,EAAE,KAAa;IAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,uBAAuB,CAAC,SAAS,KAAK,oBAAoB,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;IAClB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,uBAAuB,CAAC,SAAS,KAAK,sBAAsB,CAAC,CAAC;IAC1E,CAAC;IACD,iFAAiF;IACjF,2EAA2E;IAC3E,MAAM,MAAM,GAAiC,OAAO,CAAC,GAAG,CACtD,GAAG,CAAC,MAA0B,CAC/B;QACC,CAAC,CAAE,GAAG,CAAC,MAA2B;QAClC,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,sCAAsC,CACjD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,GAAG,CAAC,MAAM,KAAK,SAAS;QACtB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAC9B,CAAC,CAAC,GAAG,CAAC,MAAM;YACZ,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;YACzE,CAAC,CAAC,EAAE,CAAC;IAEb,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;IAC5B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAyB,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,gDAAgD,CAC3D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG;QACX,EAAE;QACF,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC;IACF,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,CAAC,IAAgB,EAAc,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEtE,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,yCAAyC,CACpD,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,4CAA4C,CACvD,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAClD,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,0CAA0C,CACrD,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAyB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE9C,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,0CAA0C,CACrD,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,2DAA2D,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,2CAA2C,CACtD,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,wCAAwC,CACnD,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/D,OAAO,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,eAAe;IACf,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,8DAA8D,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,sBAAsB,EAAE,CAAC;QACxD,MAAM,IAAI,uBAAuB,CAC/B,uBAAuB,MAAM,CAAC,OAAO,CAAC,eAAe,CACtD,CAAC;IACJ,CAAC;IAED,IAAI,QAA+C,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,uBAAuB,CAAC,4BAA4B,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,GAAsD,EAAE,CAAC;QAChE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAsB,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,uBAAuB,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAkB,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,uBAAuB,CAC/B,YAAY,CAAC,0BAA0B,CACxC,CAAC;YACJ,CAAC;YACD,CAAC,CAAC,CAAsB,CAAC,GAAG,CAAkB,CAAC;QACjD,CAAC;QACD,QAAQ,GAAG,CAAC,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;IAC7B,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,uBAAuB,CAAC,wBAAwB,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,OAAO,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/node_modules/@xrkseek/policy/dist/schema.d.ts

@@ -76,6 +76,12 @@ export declare const policyRulesetJsonSchema: {
                                 };
                                 readonly minItems: 1;
                             };
+                            readonly when: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                                readonly maxLength: 512;
+                                readonly description: "Optional restricted boolean filter over the subject (name, args, path). Not a second policy engine.";
+                            };
                         };
                     };
                 };

package/node_modules/@xrkseek/policy/dist/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8D1B,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqE1B,CAAC"}

package/node_modules/@xrkseek/policy/dist/schema.js

@@ -57,6 +57,12 @@ export const policyRulesetJsonSchema = {
                                 items: { type: "string", minLength: 1 },
                                 minItems: 1,
                             },
+                            when: {
+                                type: "string",
+                                minLength: 1,
+                                maxLength: 512,
+                                description: "Optional restricted boolean filter over the subject (name, args, path). Not a second policy engine.",
+                            },
                         },
                     },
                 },

package/node_modules/@xrkseek/policy/dist/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,GAAG,EAAE,iDAAiD;IACtD,KAAK,EAAE,eAAe;IACtB,WAAW,EACT,oDAAoD;IACtD,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,SAAS,CAAC;IACrB,oBAAoB,EAAE,KAAK;IAC3B,UAAU,EAAE;QACV,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;QACrB,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,UAAU,EAAE;gBACV,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBAC/C,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBAClD,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBACjD,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBAClD,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBAC/C,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBACnD,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBAChD,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;aACrD;SACF;QACD,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC;gBACnC,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;oBACpC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE;oBAC/C,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,KAAK,EAAE;wBACL,IAAI,EAAE,QAAQ;wBACd,QAAQ,EAAE,CAAC,MAAM,CAAC;wBAClB,oBAAoB,EAAE,KAAK;wBAC3B,UAAU,EAAE;4BACV,IAAI,EAAE;gCACJ,IAAI,EAAE;oCACJ,WAAW;oCACX,cAAc;oCACd,aAAa;oCACb,cAAc;oCACd,WAAW;oCACX,eAAe;oCACf,YAAY;oCACZ,gBAAgB;iCACjB;6BACF;4BACD,KAAK,EAAE;gCACL,IAAI,EAAE,OAAO;gCACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gCACvC,QAAQ,EAAE,CAAC;6BACZ;yBACF;qBACF;iBACF;aACF;SACF;KACF;CACO,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,GAAG,EAAE,iDAAiD;IACtD,KAAK,EAAE,eAAe;IACtB,WAAW,EACT,oDAAoD;IACtD,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,SAAS,CAAC;IACrB,oBAAoB,EAAE,KAAK;IAC3B,UAAU,EAAE;QACV,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;QACrB,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,UAAU,EAAE;gBACV,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBAC/C,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBAClD,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBACjD,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBAClD,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBAC/C,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBACnD,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBAChD,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;aACrD;SACF;QACD,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC;gBACnC,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;oBACpC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE;oBAC/C,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,KAAK,EAAE;wBACL,IAAI,EAAE,QAAQ;wBACd,QAAQ,EAAE,CAAC,MAAM,CAAC;wBAClB,oBAAoB,EAAE,KAAK;wBAC3B,UAAU,EAAE;4BACV,IAAI,EAAE;gCACJ,IAAI,EAAE;oCACJ,WAAW;oCACX,cAAc;oCACd,aAAa;oCACb,cAAc;oCACd,WAAW;oCACX,eAAe;oCACf,YAAY;oCACZ,gBAAgB;iCACjB;6BACF;4BACD,KAAK,EAAE;gCACL,IAAI,EAAE,OAAO;gCACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gCACvC,QAAQ,EAAE,CAAC;6BACZ;4BACD,IAAI,EAAE;gCACJ,IAAI,EAAE,QAAQ;gCACd,SAAS,EAAE,CAAC;gCACZ,SAAS,EAAE,GAAG;gCACd,WAAW,EACT,qGAAqG;6BACxG;yBACF;qBACF;iBACF;aACF;SACF;KACF;CACO,CAAC"}

package/node_modules/@xrkseek/policy/dist/when-expr.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Restricted boolean expressions for policy ruleset `match.when`.
+ *
+ * Hand-rolled — no `eval` / `vm` / Function. Grammar is a boolean subset with
+ * subject bindings and a tiny string/RegExp method whitelist. Unknown
+ * identifiers, assignment, and prototype walks are rejected at compile time.
+ *
+ * Does **not** introduce a second policy engine: ruleset JSON stays the only
+ * surface; `when` is an optional filter on an existing rule.
+ */
+import type { PolicySubject } from "./types.js";
+export declare class WhenExprError extends Error {
+    constructor(message: string);
+}
+/** Max source length (chars). */
+export declare const WHEN_EXPR_MAX_CHARS = 512;
+/** Max AST depth while compiling. */
+export declare const WHEN_EXPR_MAX_DEPTH = 32;
+/** Bindings exposed to `when` (frozen plain data only). */
+export type WhenEnv = Readonly<Record<string, unknown>>;
+/** Compile subject → env once per evaluate. */
+export declare function whenEnvFromSubject(subject: PolicySubject): WhenEnv;
+/**
+ * Compile a `when` source string. Throws {@link WhenExprError} on syntax /
+ * safety violations (fail closed at ruleset load).
+ */
+export declare function compileWhenExpr(source: string): (env: WhenEnv) => boolean;
+/** Evaluate `when` against a subject (compile + run). */
+export declare function evalWhenExpr(source: string, subject: PolicySubject): boolean;
+//# sourceMappingURL=when-expr.d.ts.map

package/node_modules/@xrkseek/policy/dist/when-expr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"when-expr.d.ts","sourceRoot":"","sources":["../src/when-expr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,EAAE,MAAM;CAI5B;AAED,iCAAiC;AACjC,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,qCAAqC;AACrC,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAkBtC,2DAA2D;AAC3D,MAAM,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAExD,+CAA+C;AAC/C,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CA4ClE;AAiBD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAuBzE;AAED,yDAAyD;AACzD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAE5E"}