@zenalexa/unicli 0.216.2 → 1.0.0

package/dist/engine/operation-policy.js

@@ -0,0 +1,360 @@
+/**
+ * User-selectable operation policy.
+ *
+ * Adapter metadata stays open by default. This layer classifies likely side
+ * effects from the command contract and lets users opt into stricter approval
+ * profiles without forcing every adapter author to pre-label privacy.
+ */
+import { AdapterType } from "../types.js";
+import { buildCapabilityApprovalMemory, deriveCapabilityScope, } from "./capability-policy.js";
+export class InvalidPermissionProfileError extends Error {
+    constructor(profile) {
+        super(`invalid permission profile "${profile}"; expected one of: open, confirm, locked`);
+        this.name = "InvalidPermissionProfileError";
+    }
+}
+const OPEN_PROFILES = new Set(["open", "confirm", "locked"]);
+const MESSAGE_TOKENS = new Set([
+    "ask",
+    "dm",
+    "greet",
+    "mail-send",
+    "messages-send",
+    "reply",
+    "reply-dm",
+    "send",
+]);
+const PUBLISH_TOKENS = new Set([
+    "comment",
+    "create-draft",
+    "draft",
+    "post",
+    "publish",
+    "reel",
+    "repost",
+    "story",
+    "tweet",
+]);
+const ACCOUNT_STATE_TOKENS = new Set([
+    "accept",
+    "add-friend",
+    "block",
+    "bookmark",
+    "coin",
+    "follow",
+    "hide-reply",
+    "like",
+    "list-add",
+    "list-remove",
+    "mute",
+    "pin",
+    "rate",
+    "save",
+    "subscribe",
+    "unblock",
+    "unbookmark",
+    "unfollow",
+    "unlike",
+    "unmute",
+    "unsave",
+    "upvote",
+    "vote",
+]);
+const DESTRUCTIVE_EXACT_COMMANDS = new Set([
+    "delete",
+    "delete-stub",
+    "destroy",
+    "empty-trash",
+    "rm",
+    "reset",
+    "trash",
+]);
+const DESTRUCTIVE_PIECES = new Set(["delete", "destroy", "reset", "trash"]);
+const REMOTE_TRANSFORM_TOKENS = new Set([
+    "background",
+    "face-swap",
+    "object-remover",
+    "remove-bg",
+    "restore",
+    "try-on",
+    "upscale",
+]);
+const SERVICE_STATE_TOKENS = new Set([
+    "add",
+    "create",
+    "create-stub",
+    "set",
+    "update",
+]);
+const REMOTE_RESOURCE_TOKENS = new Set([
+    "copy",
+    "create",
+    "issue-create",
+    "mkdir",
+    "move",
+    "mv",
+    "rename",
+]);
+const REMOTE_WEB_STRATEGIES = new Set([
+    "public",
+    "cookie",
+    "header",
+    "intercept",
+    "ui",
+]);
+const LOCAL_APP_TOKENS = new Set([
+    "calendar-create",
+    "click-text",
+    "do-not-disturb",
+    "lock-screen",
+    "model",
+    "new",
+    "notify",
+    "open",
+    "open-app",
+    "press",
+    "reminder-create",
+    "reminders-complete",
+    "screen-lock",
+    "shortcuts-run",
+    "sleep",
+    "type-text",
+    "wallpaper",
+]);
+const LOCAL_FILE_TOKENS = new Set([
+    "clipboard",
+    "convert",
+    "export",
+    "extract-audio",
+    "finder-copy",
+    "finder-move",
+    "finder-new-folder",
+    "gif",
+    "import",
+    "normalize",
+    "print",
+    "resize",
+    "render",
+    "screen-recording",
+    "screenshot",
+    "thumbnail",
+    "trim",
+    "upload",
+]);
+const CONTENT_ARG_NAMES = new Set([
+    "body",
+    "content",
+    "message",
+    "notes",
+    "prompt",
+    "subject",
+    "text",
+    "title",
+    "draft",
+]);
+function commandTokens(site, command) {
+    const raw = `${site}-${command}`.toLowerCase();
+    const pieces = raw.split(/[^a-z0-9]+/).filter(Boolean);
+    return new Set([raw, command.toLowerCase(), ...pieces]);
+}
+function hasAny(tokens, candidates) {
+    for (const candidate of candidates) {
+        if (tokens.has(candidate))
+            return true;
+    }
+    return false;
+}
+function hasContentArg(args = []) {
+    return args.some((arg) => CONTENT_ARG_NAMES.has(arg.name.toLowerCase()));
+}
+function normalizedDescription(input) {
+    return (input.description ?? "").trim().toLowerCase();
+}
+function looksReadOnlyCommand(input) {
+    const description = normalizedDescription(input);
+    if (!/^(dump|fetch|get|inspect|list|read|search|show)\b/.test(description)) {
+        return false;
+    }
+    return !hasContentArg(input.args);
+}
+function isExplicitLocalSurface(surface) {
+    return surface === "desktop" || surface === "system";
+}
+function isRemoteWebSurface(input) {
+    if (input.adapterType === AdapterType.BRIDGE ||
+        input.adapterType === AdapterType.DESKTOP ||
+        input.adapterType === AdapterType.SERVICE ||
+        isExplicitLocalSurface(input.targetSurface)) {
+        return false;
+    }
+    return ((input.targetSurface === undefined && input.adapterType === undefined) ||
+        input.targetSurface === "web" ||
+        input.targetSurface === "mobile" ||
+        input.adapterType === AdapterType.WEB_API ||
+        input.adapterType === AdapterType.BROWSER ||
+        input.browser === true ||
+        (input.strategy !== undefined && REMOTE_WEB_STRATEGIES.has(input.strategy)));
+}
+function hasDestructiveIntent(input, tokens) {
+    const command = input.command.toLowerCase();
+    const description = normalizedDescription(input);
+    return (DESTRUCTIVE_EXACT_COMMANDS.has(command) ||
+        hasAny(tokens, DESTRUCTIVE_EXACT_COMMANDS) ||
+        hasAny(tokens, DESTRUCTIVE_PIECES) ||
+        /^(delete|remove|clear)\b/.test(description));
+}
+function looksMessageCommand(input, tokens) {
+    const description = normalizedDescription(input);
+    return ((hasAny(tokens, MESSAGE_TOKENS) && hasContentArg(input.args)) ||
+        /^(send|greet|batch greet)\b/.test(description));
+}
+function looksPublishCommand(input, tokens) {
+    const description = normalizedDescription(input);
+    return ((hasAny(tokens, PUBLISH_TOKENS) && hasContentArg(input.args)) ||
+        /^(post|publish|repost)\b/.test(description) ||
+        /^create\b.*\b(post|article draft|draft)\b/.test(description) ||
+        /^upload\b.*\bdraft\b/.test(description) ||
+        /^submit\b.*\bvenue\b/.test(description));
+}
+function looksRemoteTransformCommand(input, tokens) {
+    const description = normalizedDescription(input);
+    return (isRemoteWebSurface(input) &&
+        (hasAny(tokens, REMOTE_TRANSFORM_TOKENS) ||
+            /^generate\b.*\bimage\b/.test(description) ||
+            /^submit\b.*\b(ai review|feedback)\b/.test(description)));
+}
+function looksServiceStateMutation(input, tokens) {
+    const description = normalizedDescription(input);
+    return (input.adapterType === AdapterType.SERVICE &&
+        (hasDestructiveIntent(input, tokens) ||
+            hasAny(tokens, SERVICE_STATE_TOKENS) ||
+            /^(add|create|set|update)\b/.test(description)));
+}
+function looksRemoteResourceCommand(input, tokens) {
+    const description = normalizedDescription(input);
+    return (isRemoteWebSurface(input) &&
+        (hasAny(tokens, REMOTE_RESOURCE_TOKENS) ||
+            /^(copy|create|move|rename|save|submit)\b/.test(description)));
+}
+function isTargetSurface(value) {
+    return (value === "web" ||
+        value === "desktop" ||
+        value === "system" ||
+        value === "mobile");
+}
+export function resolvePermissionProfile(value) {
+    const configured = value ?? process.env.UNICLI_PERMISSION_PROFILE;
+    if (configured === undefined || configured.trim() === "")
+        return "open";
+    const raw = configured.trim().toLowerCase();
+    if (OPEN_PROFILES.has(raw)) {
+        return raw;
+    }
+    throw new InvalidPermissionProfileError(configured);
+}
+export function resolveOperationTargetSurface(input) {
+    if (isTargetSurface(input.targetSurface))
+        return input.targetSurface;
+    switch (input.adapterType) {
+        case AdapterType.DESKTOP:
+            return "desktop";
+        case AdapterType.BRIDGE:
+        case AdapterType.SERVICE:
+            return "system";
+        default:
+            return "web";
+    }
+}
+export function resolveOperationAdapterPath(site, command, adapterPath) {
+    return adapterPath ?? `src/adapters/${site}/${command}.yaml`;
+}
+export function inferOperationEffect(input) {
+    const tokens = commandTokens(input.site, input.command);
+    if (looksReadOnlyCommand(input))
+        return "read";
+    if (hasAny(tokens, ACCOUNT_STATE_TOKENS))
+        return "account_state";
+    if (looksMessageCommand(input, tokens))
+        return "send_message";
+    if (looksPublishCommand(input, tokens))
+        return "publish_content";
+    if (looksRemoteTransformCommand(input, tokens))
+        return "remote_transform";
+    if (looksServiceStateMutation(input, tokens))
+        return "service_state";
+    if (hasDestructiveIntent(input, tokens))
+        return "destructive";
+    if (looksRemoteResourceCommand(input, tokens))
+        return "remote_resource";
+    if (hasAny(tokens, LOCAL_APP_TOKENS))
+        return "local_app";
+    if (input.adapterType === AdapterType.DESKTOP ||
+        hasAny(tokens, LOCAL_FILE_TOKENS)) {
+        return "local_file";
+    }
+    return "read";
+}
+export function riskForEffect(effect) {
+    switch (effect) {
+        case "read":
+            return "low";
+        case "account_state":
+        case "remote_transform":
+        case "remote_resource":
+        case "local_app":
+        case "local_file":
+        case "unknown_write":
+            return "medium";
+        case "destructive":
+        case "service_state":
+        case "publish_content":
+        case "send_message":
+            return "high";
+        default:
+            return "none";
+    }
+}
+function approvalRequired(profile, risk) {
+    if (profile === "open")
+        return false;
+    if (profile === "confirm")
+        return risk === "high";
+    return risk === "medium" || risk === "high";
+}
+export function evaluateOperationPolicy(input) {
+    const profile = resolvePermissionProfile(input.profile);
+    const effect = inferOperationEffect(input);
+    const risk = riskForEffect(effect);
+    const approved = input.approved === true || process.env.UNICLI_APPROVE === "1";
+    const approval_required = approvalRequired(profile, risk);
+    const enforcement = approval_required && !approved ? "needs_approval" : "allow";
+    const capability_scope = deriveCapabilityScope(input, effect);
+    const approval_memory = buildCapabilityApprovalMemory({
+        site: input.site,
+        command: input.command,
+        profile,
+        effect,
+        approved,
+        scope: capability_scope,
+    });
+    const reason = effect === "read"
+        ? "classified as read-only by command contract"
+        : `classified as ${effect.replaceAll("_", " ")} with ${risk} risk`;
+    return {
+        profile,
+        effect,
+        risk,
+        capability_scope,
+        approval_memory,
+        approval_required,
+        approved,
+        enforcement,
+        reason,
+        ...(enforcement === "needs_approval"
+            ? {
+                approval_hint: "rerun with --yes, set UNICLI_APPROVE=1, or use --permission-profile open",
+            }
+            : {}),
+    };
+}
+//# sourceMappingURL=operation-policy.js.map

package/dist/engine/operation-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-policy.js","sourceRoot":"","sources":["../../src/engine/operation-policy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAsB,MAAM,aAAa,CAAC;AAC9D,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AA+ChC,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD,YAAY,OAAe;QACzB,KAAK,CACH,+BAA+B,OAAO,2CAA2C,CAClF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEhF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,KAAK;IACL,IAAI;IACJ,OAAO;IACP,WAAW;IACX,eAAe;IACf,OAAO;IACP,UAAU;IACV,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,SAAS;IACT,cAAc;IACd,OAAO;IACP,MAAM;IACN,SAAS;IACT,MAAM;IACN,QAAQ;IACR,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,QAAQ;IACR,YAAY;IACZ,OAAO;IACP,UAAU;IACV,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,UAAU;IACV,aAAa;IACb,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,WAAW;IACX,SAAS;IACT,YAAY;IACZ,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,QAAQ;IACR,aAAa;IACb,SAAS;IACT,aAAa;IACb,IAAI;IACJ,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAE5E,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,YAAY;IACZ,WAAW;IACX,gBAAgB;IAChB,WAAW;IACX,SAAS;IACT,QAAQ;IACR,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,KAAK;IACL,QAAQ;IACR,aAAa;IACb,KAAK;IACL,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,MAAM;IACN,QAAQ;IACR,cAAc;IACd,OAAO;IACP,MAAM;IACN,IAAI;IACJ,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,IAAI;CACL,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,iBAAiB;IACjB,YAAY;IACZ,gBAAgB;IAChB,aAAa;IACb,OAAO;IACP,KAAK;IACL,QAAQ;IACR,MAAM;IACN,UAAU;IACV,OAAO;IACP,iBAAiB;IACjB,oBAAoB;IACpB,aAAa;IACb,eAAe;IACf,OAAO;IACP,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,WAAW;IACX,SAAS;IACT,QAAQ;IACR,eAAe;IACf,aAAa;IACb,aAAa;IACb,mBAAmB;IACnB,KAAK;IACL,QAAQ;IACR,WAAW;IACX,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,kBAAkB;IAClB,YAAY;IACZ,WAAW;IACX,MAAM;IACN,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM;IACN,SAAS;IACT,SAAS;IACT,OAAO;IACP,QAAQ;IACR,SAAS;IACT,MAAM;IACN,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,IAAY,EAAE,OAAe;IAClD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,MAAM,CAAC,MAAmB,EAAE,UAAuB;IAC1D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,OAAqC,EAAE;IAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,qBAAqB,CAAC,KAA2B;IACxD,OAAO,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA2B;IACvD,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,mDAAmD,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAuB;IACrD,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,QAAQ,CAAC;AACvD,CAAC;AAED,SAAS,kBAAkB,CAAC,KAA2B;IACrD,IACE,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,MAAM;QACxC,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;QACzC,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;QACzC,sBAAsB,CAAC,KAAK,CAAC,aAAa,CAAC,EAC3C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC;QACtE,KAAK,CAAC,aAAa,KAAK,KAAK;QAC7B,KAAK,CAAC,aAAa,KAAK,QAAQ;QAChC,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;QACzC,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;QACzC,KAAK,CAAC,OAAO,KAAK,IAAI;QACtB,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAA2B,EAC3B,MAAmB;IAEnB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,CACL,0BAA0B,CAAC,GAAG,CAAC,OAAO,CAAC;QACvC,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC;QAC1C,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC;QAClC,0BAA0B,CAAC,IAAI,CAAC,WAAW,CAAC,CAC7C,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAA2B,EAC3B,MAAmB;IAEnB,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,CACL,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7D,6BAA6B,CAAC,IAAI,CAAC,WAAW,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAA2B,EAC3B,MAAmB;IAEnB,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,CACL,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7D,0BAA0B,CAAC,IAAI,CAAC,WAAW,CAAC;QAC5C,2CAA2C,CAAC,IAAI,CAAC,WAAW,CAAC;QAC7D,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC;QACxC,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,KAA2B,EAC3B,MAAmB;IAEnB,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,CACL,kBAAkB,CAAC,KAAK,CAAC;QACzB,CAAC,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC;YACtC,wBAAwB,CAAC,IAAI,CAAC,WAAW,CAAC;YAC1C,qCAAqC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,KAA2B,EAC3B,MAAmB;IAEnB,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,CACL,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;QACzC,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC;YAClC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC;YACpC,4BAA4B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAClD,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,KAA2B,EAC3B,MAAmB;IAEnB,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,CACL,kBAAkB,CAAC,KAAK,CAAC;QACzB,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC;YACrC,0CAA0C,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAChE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,CACL,KAAK,KAAK,KAAK;QACf,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,QAAQ;QAClB,KAAK,KAAK,QAAQ,CACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,MAAM,UAAU,GAAG,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAClE,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC;IAExE,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,aAAa,CAAC,GAAG,CAAC,GAAwB,CAAC,EAAE,CAAC;QAChD,OAAO,GAAwB,CAAC;IAClC,CAAC;IACD,MAAM,IAAI,6BAA6B,CAAC,UAAU,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAG7C;IACC,IAAI,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC,aAAa,CAAC;IACrE,QAAQ,KAAK,CAAC,WAAW,EAAE,CAAC;QAC1B,KAAK,WAAW,CAAC,OAAO;YACtB,OAAO,SAAS,CAAC;QACnB,KAAK,WAAW,CAAC,MAAM,CAAC;QACxB,KAAK,WAAW,CAAC,OAAO;YACtB,OAAO,QAAQ,CAAC;QAClB;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,IAAY,EACZ,OAAe,EACf,WAAoB;IAEpB,OAAO,WAAW,IAAI,gBAAgB,IAAI,IAAI,OAAO,OAAO,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAA2B;IAE3B,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAExD,IAAI,oBAAoB,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAC/C,IAAI,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC;QAAE,OAAO,eAAe,CAAC;IACjE,IAAI,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC;QAAE,OAAO,cAAc,CAAC;IAC9D,IAAI,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACjE,IAAI,2BAA2B,CAAC,KAAK,EAAE,MAAM,CAAC;QAAE,OAAO,kBAAkB,CAAC;IAC1E,IAAI,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC;QAAE,OAAO,eAAe,CAAC;IACrE,IAAI,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC;QAAE,OAAO,aAAa,CAAC;IAC9D,IAAI,0BAA0B,CAAC,KAAK,EAAE,MAAM,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACxE,IAAI,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC;QAAE,OAAO,WAAW,CAAC;IACzD,IACE,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;QACzC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,EACjC,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAuB;IACnD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,KAAK,CAAC;QACf,KAAK,eAAe,CAAC;QACrB,KAAK,kBAAkB,CAAC;QACxB,KAAK,iBAAiB,CAAC;QACvB,KAAK,WAAW,CAAC;QACjB,KAAK,YAAY,CAAC;QAClB,KAAK,eAAe;YAClB,OAAO,QAAQ,CAAC;QAClB,KAAK,aAAa,CAAC;QACnB,KAAK,eAAe,CAAC;QACrB,KAAK,iBAAiB,CAAC;QACvB,KAAK,cAAc;YACjB,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,OAA0B,EAC1B,IAAmB;IAEnB,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,KAAK,MAAM,CAAC;IAClD,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,MAAM,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,KAA2B;IAE3B,MAAM,OAAO,GAAG,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,QAAQ,GACZ,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,GAAG,CAAC;IAChE,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,WAAW,GACf,iBAAiB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9D,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAG,6BAA6B,CAAC;QACpD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO;QACP,MAAM;QACN,QAAQ;QACR,KAAK,EAAE,gBAAgB;KACxB,CAAC,CAAC;IACH,MAAM,MAAM,GACV,MAAM,KAAK,MAAM;QACf,CAAC,CAAC,6CAA6C;QAC/C,CAAC,CAAC,iBAAiB,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC;IAEvE,OAAO;QACL,OAAO;QACP,MAAM;QACN,IAAI;QACJ,gBAAgB;QAChB,eAAe;QACf,iBAAiB;QACjB,QAAQ;QACR,WAAW;QACX,MAAM;QACN,GAAG,CAAC,WAAW,KAAK,gBAAgB;YAClC,CAAC,CAAC;gBACE,aAAa,EACX,0EAA0E;aAC7E;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC"}

package/dist/engine/session/events.d.ts

@@ -0,0 +1,22 @@
+import type { EvidenceVisibility, PublicRunEvent, RunEvent, RunEventSequence, RunTraceMetadata } from "./types.js";
+export type { EvidenceVisibility, PublicRunEvent, RunEvent, RunEventName, RunEventSequence, RunId, RunTraceMetadata, TraceId, } from "./types.js";
+interface EventOptions {
+    timestamp?: string;
+    visibility?: EvidenceVisibility;
+    data?: Record<string, unknown>;
+    internal?: unknown;
+    secret?: unknown;
+}
+export declare function createRunEventSequence(start?: number): RunEventSequence;
+export declare function createRunStartedEvent(metadata: RunTraceMetadata, sequence: RunEventSequence, options?: EventOptions): RunEvent;
+export declare function createToolCallStartedEvent(metadata: RunTraceMetadata, sequence: RunEventSequence, data?: Record<string, unknown>): RunEvent;
+export declare function createPermissionEvaluatedEvent(metadata: RunTraceMetadata, sequence: RunEventSequence, data: Record<string, unknown>): RunEvent;
+export declare function createEvidenceCapturedEvent(metadata: RunTraceMetadata, sequence: RunEventSequence, options: EventOptions & {
+    evidence_type: string;
+}): RunEvent;
+export declare function createToolCallCompletedEvent(metadata: RunTraceMetadata, sequence: RunEventSequence, data: Record<string, unknown>): RunEvent;
+export declare function createToolCallFailedEvent(metadata: RunTraceMetadata, sequence: RunEventSequence, data: Record<string, unknown>): RunEvent;
+export declare function createRunCompletedEvent(metadata: RunTraceMetadata, sequence: RunEventSequence, data: Record<string, unknown>): RunEvent;
+export declare function createRunFailedEvent(metadata: RunTraceMetadata, sequence: RunEventSequence, data: Record<string, unknown>): RunEvent;
+export declare function projectRunEventForPublicSurface(event: RunEvent): PublicRunEvent;
+//# sourceMappingURL=events.d.ts.map

package/dist/engine/session/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../src/engine/session/events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,gBAAgB,EAChB,KAAK,EACL,gBAAgB,EAChB,OAAO,GACR,MAAM,YAAY,CAAC;AAEpB,UAAU,YAAY;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,sBAAsB,CAAC,KAAK,SAAI,GAAG,gBAAgB,CAQlE;AAuBD,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE,YAAiB,GACzB,QAAQ,CAEV;AAED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,QAAQ,CASV;AAED,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,QAAQ,CAEV;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,YAAY,GAAG;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB,GACA,QAAQ,CAQV;AAED,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,QAAQ,CAEV;AAED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,QAAQ,CAEV;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,QAAQ,CAEV;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,QAAQ,CAEV;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,QAAQ,GACd,cAAc,CAGhB"}

package/dist/engine/session/events.js

@@ -0,0 +1,66 @@
+export function createRunEventSequence(start = 0) {
+    let current = start;
+    return {
+        next: () => {
+            current += 1;
+            return current;
+        },
+    };
+}
+function createEvent(name, metadata, sequence, options = {}) {
+    return {
+        schema_version: "1",
+        name,
+        run_id: metadata.run_id,
+        trace_id: metadata.trace_id,
+        sequence: sequence.next(),
+        timestamp: options.timestamp ?? new Date().toISOString(),
+        visibility: options.visibility ?? "internal",
+        metadata,
+        ...(options.data !== undefined ? { data: options.data } : {}),
+        ...(options.internal !== undefined ? { internal: options.internal } : {}),
+        ...(options.secret !== undefined ? { secret: options.secret } : {}),
+    };
+}
+export function createRunStartedEvent(metadata, sequence, options = {}) {
+    return createEvent("run.started", metadata, sequence, options);
+}
+export function createToolCallStartedEvent(metadata, sequence, data = {}) {
+    return createEvent("tool.call.started", metadata, sequence, {
+        data: {
+            command: metadata.command,
+            adapter_path: metadata.adapter_path,
+            args_hash: metadata.args_hash,
+            ...data,
+        },
+    });
+}
+export function createPermissionEvaluatedEvent(metadata, sequence, data) {
+    return createEvent("permission.evaluated", metadata, sequence, { data });
+}
+export function createEvidenceCapturedEvent(metadata, sequence, options) {
+    return createEvent("evidence.captured", metadata, sequence, {
+        ...options,
+        data: {
+            evidence_type: options.evidence_type,
+            ...options.data,
+        },
+    });
+}
+export function createToolCallCompletedEvent(metadata, sequence, data) {
+    return createEvent("tool.call.completed", metadata, sequence, { data });
+}
+export function createToolCallFailedEvent(metadata, sequence, data) {
+    return createEvent("tool.call.failed", metadata, sequence, { data });
+}
+export function createRunCompletedEvent(metadata, sequence, data) {
+    return createEvent("run.completed", metadata, sequence, { data });
+}
+export function createRunFailedEvent(metadata, sequence, data) {
+    return createEvent("run.failed", metadata, sequence, { data });
+}
+export function projectRunEventForPublicSurface(event) {
+    const { internal: _internal, secret: _secret, ...publicEvent } = event;
+    return publicEvent;
+}
+//# sourceMappingURL=events.js.map

package/dist/engine/session/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../../src/engine/session/events.ts"],"names":[],"mappings":"AA2BA,MAAM,UAAU,sBAAsB,CAAC,KAAK,GAAG,CAAC;IAC9C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,OAAO;QACL,IAAI,EAAE,GAAG,EAAE;YACT,OAAO,IAAI,CAAC,CAAC;YACb,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,IAAsB,EACtB,QAA0B,EAC1B,QAA0B,EAC1B,UAAwB,EAAE;IAE1B,OAAO;QACL,cAAc,EAAE,GAAG;QACnB,IAAI;QACJ,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;QACzB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACxD,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,UAAU;QAC5C,QAAQ;QACR,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAA0B,EAC1B,QAA0B,EAC1B,UAAwB,EAAE;IAE1B,OAAO,WAAW,CAAC,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,QAA0B,EAC1B,QAA0B,EAC1B,OAAgC,EAAE;IAElC,OAAO,WAAW,CAAC,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE;QAC1D,IAAI,EAAE;YACJ,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,GAAG,IAAI;SACR;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,QAA0B,EAC1B,QAA0B,EAC1B,IAA6B;IAE7B,OAAO,WAAW,CAAC,sBAAsB,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,QAA0B,EAC1B,QAA0B,EAC1B,OAEC;IAED,OAAO,WAAW,CAAC,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE;QAC1D,GAAG,OAAO;QACV,IAAI,EAAE;YACJ,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,GAAG,OAAO,CAAC,IAAI;SAChB;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,QAA0B,EAC1B,QAA0B,EAC1B,IAA6B;IAE7B,OAAO,WAAW,CAAC,qBAAqB,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,QAA0B,EAC1B,QAA0B,EAC1B,IAA6B;IAE7B,OAAO,WAAW,CAAC,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,QAA0B,EAC1B,QAA0B,EAC1B,IAA6B;IAE7B,OAAO,WAAW,CAAC,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAA0B,EAC1B,QAA0B,EAC1B,IAA6B;IAE7B,OAAO,WAAW,CAAC,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,KAAe;IAEf,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,GAAG,KAAK,CAAC;IACvE,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/engine/session/run-loop.d.ts

@@ -0,0 +1,11 @@
+import type { Invocation, InvocationResult } from "../kernel/types.js";
+import { type RunStore } from "./store.js";
+import { type RunId } from "./events.js";
+export interface RunRecordingOptions {
+    enabled?: boolean;
+    store?: RunStore;
+    runId?: RunId;
+}
+export declare function isRunRecordingEnabled(enabled?: boolean): boolean;
+export declare function executeWithRunRecording(inv: Invocation, options?: RunRecordingOptions): Promise<InvocationResult>;
+//# sourceMappingURL=run-loop.d.ts.map

package/dist/engine/session/run-loop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-loop.d.ts","sourceRoot":"","sources":["../../../src/engine/session/run-loop.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAQvE,OAAO,EAGL,KAAK,QAAQ,EAEd,MAAM,YAAY,CAAC;AACpB,OAAO,EAWL,KAAK,KAAK,EAEX,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,wBAAgB,qBAAqB,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAGhE;AAgKD,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,UAAU,EACf,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,gBAAgB,CAAC,CAyD3B"}

package/dist/engine/session/run-loop.js

@@ -0,0 +1,173 @@
+import { createHash } from "node:crypto";
+import { execute } from "../kernel/execute.js";
+import { evaluateOperationPolicy, InvalidPermissionProfileError, resolveOperationAdapterPath, resolveOperationTargetSurface, } from "../operation-policy.js";
+import { appendRunEvent, createRunStore, RunStoreError, } from "./store.js";
+import { createPermissionEvaluatedEvent, createEvidenceCapturedEvent, createRunCompletedEvent, createRunEventSequence, createRunFailedEvent, createRunStartedEvent, createToolCallCompletedEvent, createToolCallFailedEvent, createToolCallStartedEvent, } from "./events.js";
+export function isRunRecordingEnabled(enabled) {
+    if (enabled !== undefined)
+        return enabled;
+    return process.env.UNICLI_RECORD_RUN === "1";
+}
+function stableJson(value) {
+    if (Array.isArray(value)) {
+        return `[${value.map(stableJson).join(",")}]`;
+    }
+    if (value && typeof value === "object") {
+        return `{${Object.keys(value)
+            .sort()
+            .map((key) => `${JSON.stringify(key)}:${stableJson(value[key])}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+function hashArgs(args) {
+    return `sha256:${createHash("sha256").update(stableJson(args)).digest("hex")}`;
+}
+function rawPermissionProfile(inv) {
+    const raw = inv.permissionProfile ?? process.env.UNICLI_PERMISSION_PROFILE;
+    return raw && raw.trim().length > 0 ? raw.trim().toLowerCase() : "open";
+}
+function metadataForInvocation(inv, runId) {
+    const adapterPath = resolveOperationAdapterPath(inv.adapter.name, inv.cmdName, inv.command.adapter_path);
+    const targetSurface = resolveOperationTargetSurface({
+        adapterType: inv.adapter.type,
+        targetSurface: inv.command.target_surface,
+    });
+    return {
+        run_id: runId,
+        trace_id: inv.trace_id,
+        command: `${inv.adapter.name}.${inv.cmdName}`,
+        site: inv.adapter.name,
+        cmd: inv.cmdName,
+        adapter_path: adapterPath,
+        permission_profile: rawPermissionProfile(inv),
+        transport_surface: inv.surface,
+        target_surface: targetSurface,
+        args_hash: hashArgs(inv.bag.args),
+        pipeline_steps: inv.command.pipeline?.length ?? 0,
+    };
+}
+function evaluatePermissionForEvent(inv, metadata) {
+    try {
+        const policy = evaluateOperationPolicy({
+            site: inv.adapter.name,
+            command: inv.cmdName,
+            description: inv.command.description,
+            adapterType: inv.adapter.type,
+            targetSurface: metadata.target_surface,
+            strategy: inv.command.strategy ?? inv.adapter.strategy,
+            browser: inv.adapter.browser === true || inv.command.browser === true,
+            args: inv.command.adapterArgs,
+            profile: inv.permissionProfile,
+            approved: inv.approved,
+        });
+        return { ...policy };
+    }
+    catch (err) {
+        if (err instanceof InvalidPermissionProfileError) {
+            return {
+                profile: metadata.permission_profile,
+                effect: "unknown_write",
+                risk: "high",
+                approval_required: true,
+                approved: false,
+                enforcement: "needs_approval",
+                reason: err.message,
+                error: { code: "invalid_input", message: err.message },
+            };
+        }
+        throw err;
+    }
+}
+async function appendAll(store, events, warnings) {
+    for (const event of events) {
+        try {
+            await appendRunEvent(store, event);
+        }
+        catch (err) {
+            const message = err instanceof RunStoreError || err instanceof Error
+                ? err.message
+                : String(err);
+            warnings.push(`[run-record] ${message}`);
+            return;
+        }
+    }
+}
+function successData(result) {
+    return {
+        exit_code: result.exitCode,
+        result_count: result.results.length,
+        duration_ms: result.durationMs,
+        outcome: result.results.length === 0 ? "empty" : "success",
+        envelope: result.envelope,
+    };
+}
+function failureData(result, metadata) {
+    const error = result.error === undefined
+        ? undefined
+        : {
+            ...result.error,
+            adapter_path: result.error.adapter_path ?? metadata.adapter_path,
+        };
+    return {
+        exit_code: result.exitCode,
+        result_count: result.results.length,
+        duration_ms: result.durationMs,
+        error,
+        envelope: result.envelope,
+    };
+}
+function evidenceData(result, metadata) {
+    return {
+        outcome: result.error === undefined
+            ? result.results.length === 0
+                ? "empty"
+                : "success"
+            : "failure",
+        exit_code: result.exitCode,
+        result_count: result.results.length,
+        duration_ms: result.durationMs,
+        adapter_path: metadata.adapter_path,
+        envelope_command: result.envelope.command,
+        has_error: result.error !== undefined,
+    };
+}
+export async function executeWithRunRecording(inv, options = {}) {
+    if (!isRunRecordingEnabled(options.enabled)) {
+        return execute(inv);
+    }
+    const store = options.store ?? createRunStore();
+    const runId = options.runId ?? `run-${inv.trace_id}`;
+    const metadata = metadataForInvocation(inv, runId);
+    const sequence = createRunEventSequence();
+    const warnings = [];
+    await appendAll(store, [
+        createRunStartedEvent(metadata, sequence),
+        createToolCallStartedEvent(metadata, sequence),
+        createPermissionEvaluatedEvent(metadata, sequence, evaluatePermissionForEvent(inv, metadata)),
+    ], warnings);
+    const result = await execute(inv);
+    const terminalEvents = result.error === undefined
+        ? [
+            createToolCallCompletedEvent(metadata, sequence, successData(result)),
+            createEvidenceCapturedEvent(metadata, sequence, {
+                evidence_type: "result-envelope",
+                visibility: "internal",
+                data: evidenceData(result, metadata),
+            }),
+            createRunCompletedEvent(metadata, sequence, successData(result)),
+        ]
+        : [
+            createToolCallFailedEvent(metadata, sequence, failureData(result, metadata)),
+            createEvidenceCapturedEvent(metadata, sequence, {
+                evidence_type: "result-envelope",
+                visibility: "internal",
+                data: evidenceData(result, metadata),
+            }),
+            createRunFailedEvent(metadata, sequence, failureData(result, metadata)),
+        ];
+    await appendAll(store, terminalEvents, warnings);
+    result.warnings.push(...warnings);
+    return result;
+}
+//# sourceMappingURL=run-loop.js.map