@zenalexa/unicli 0.216.3 → 0.217.3

package/dist/engine/operation-policy.js

@@ -0,0 +1,364 @@
+/**
+ * User-selectable operation policy.
+ *
+ * Adapter metadata stays open by default. This layer classifies likely side
+ * effects from the command contract and lets users opt into stricter approval
+ * profiles without forcing every adapter author to pre-label privacy.
+ */
+import { AdapterType } from "../types.js";
+import { buildCapabilityApprovalMemory, deriveCapabilityScope, } from "./capability-policy.js";
+export class InvalidPermissionProfileError extends Error {
+    constructor(profile) {
+        super(`invalid permission profile "${profile}"; expected one of: open, confirm, locked`);
+        this.name = "InvalidPermissionProfileError";
+    }
+}
+const OPEN_PROFILES = new Set(["open", "confirm", "locked"]);
+const MESSAGE_TOKENS = new Set([
+    "ask",
+    "dm",
+    "greet",
+    "mail-send",
+    "messages-send",
+    "reply",
+    "reply-dm",
+    "send",
+]);
+const PUBLISH_TOKENS = new Set([
+    "comment",
+    "create-draft",
+    "draft",
+    "post",
+    "publish",
+    "reel",
+    "repost",
+    "story",
+    "tweet",
+]);
+const ACCOUNT_STATE_TOKENS = new Set([
+    "accept",
+    "add-friend",
+    "block",
+    "bookmark",
+    "coin",
+    "follow",
+    "hide-reply",
+    "like",
+    "list-add",
+    "list-remove",
+    "mute",
+    "pin",
+    "rate",
+    "save",
+    "subscribe",
+    "unblock",
+    "unbookmark",
+    "unfollow",
+    "unlike",
+    "unmute",
+    "unsave",
+    "upvote",
+    "vote",
+]);
+const DESTRUCTIVE_EXACT_COMMANDS = new Set([
+    "delete",
+    "delete-stub",
+    "destroy",
+    "empty-trash",
+    "rm",
+    "reset",
+    "trash",
+]);
+const DESTRUCTIVE_PIECES = new Set(["delete", "destroy", "reset", "trash"]);
+const REMOTE_TRANSFORM_TOKENS = new Set([
+    "background",
+    "face-swap",
+    "object-remover",
+    "remove-bg",
+    "restore",
+    "try-on",
+    "upscale",
+]);
+const SERVICE_STATE_TOKENS = new Set([
+    "add",
+    "create",
+    "create-stub",
+    "set",
+    "update",
+]);
+const REMOTE_RESOURCE_TOKENS = new Set([
+    "copy",
+    "create",
+    "issue-create",
+    "mkdir",
+    "move",
+    "mv",
+    "rename",
+]);
+const REMOTE_WEB_STRATEGIES = new Set([
+    "public",
+    "cookie",
+    "header",
+    "intercept",
+    "ui",
+]);
+const LOCAL_APP_TOKENS = new Set([
+    "calendar-create",
+    "click-text",
+    "do-not-disturb",
+    "lock-screen",
+    "model",
+    "new",
+    "notify",
+    "open",
+    "open-app",
+    "press",
+    "reminder-create",
+    "reminders-complete",
+    "screen-lock",
+    "shortcuts-run",
+    "sleep",
+    "type-text",
+    "wallpaper",
+]);
+const LOCAL_FILE_TOKENS = new Set([
+    "clipboard",
+    "convert",
+    "export",
+    "extract-audio",
+    "finder-copy",
+    "finder-move",
+    "finder-new-folder",
+    "gif",
+    "import",
+    "normalize",
+    "print",
+    "resize",
+    "render",
+    "screen-recording",
+    "screenshot",
+    "thumbnail",
+    "trim",
+    "upload",
+]);
+const CONTENT_ARG_NAMES = new Set([
+    "body",
+    "content",
+    "message",
+    "notes",
+    "prompt",
+    "subject",
+    "text",
+    "title",
+    "draft",
+]);
+function commandTokens(site, command) {
+    const raw = `${site}-${command}`.toLowerCase();
+    const pieces = raw.split(/[^a-z0-9]+/).filter(Boolean);
+    return new Set([raw, command.toLowerCase(), ...pieces]);
+}
+function hasAny(tokens, candidates) {
+    for (const candidate of candidates) {
+        if (tokens.has(candidate))
+            return true;
+    }
+    return false;
+}
+function hasContentArg(args = []) {
+    return args.some((arg) => CONTENT_ARG_NAMES.has(arg.name.toLowerCase()));
+}
+function normalizedDescription(input) {
+    return (input.description ?? "").trim().toLowerCase();
+}
+function looksReadOnlyCommand(input) {
+    const description = normalizedDescription(input);
+    if (!/^(dump|fetch|get|inspect|list|read|search|show)\b/.test(description)) {
+        return false;
+    }
+    return !hasContentArg(input.args);
+}
+function isExplicitLocalSurface(surface) {
+    return surface === "desktop" || surface === "system";
+}
+function isRemoteWebSurface(input) {
+    if (input.adapterType === AdapterType.BRIDGE ||
+        input.adapterType === AdapterType.DESKTOP ||
+        input.adapterType === AdapterType.SERVICE ||
+        isExplicitLocalSurface(input.targetSurface)) {
+        return false;
+    }
+    return ((input.targetSurface === undefined && input.adapterType === undefined) ||
+        input.targetSurface === "web" ||
+        input.targetSurface === "mobile" ||
+        input.adapterType === AdapterType.WEB_API ||
+        input.adapterType === AdapterType.BROWSER ||
+        input.browser === true ||
+        (input.strategy !== undefined && REMOTE_WEB_STRATEGIES.has(input.strategy)));
+}
+function hasDestructiveIntent(input, tokens) {
+    const command = input.command.toLowerCase();
+    const description = normalizedDescription(input);
+    return (DESTRUCTIVE_EXACT_COMMANDS.has(command) ||
+        hasAny(tokens, DESTRUCTIVE_EXACT_COMMANDS) ||
+        hasAny(tokens, DESTRUCTIVE_PIECES) ||
+        /^(delete|remove|clear)\b/.test(description));
+}
+function looksMessageCommand(input, tokens) {
+    const description = normalizedDescription(input);
+    return ((hasAny(tokens, MESSAGE_TOKENS) && hasContentArg(input.args)) ||
+        /^(send|greet|batch greet)\b/.test(description));
+}
+function looksPublishCommand(input, tokens) {
+    const description = normalizedDescription(input);
+    return ((hasAny(tokens, PUBLISH_TOKENS) && hasContentArg(input.args)) ||
+        /^(post|publish|repost)\b/.test(description) ||
+        /^create\b.*\b(post|article draft|draft)\b/.test(description) ||
+        /^upload\b.*\bdraft\b/.test(description) ||
+        /^submit\b.*\bvenue\b/.test(description));
+}
+function looksRemoteTransformCommand(input, tokens) {
+    const description = normalizedDescription(input);
+    return (isRemoteWebSurface(input) &&
+        (hasAny(tokens, REMOTE_TRANSFORM_TOKENS) ||
+            /^generate\b.*\bimage\b/.test(description) ||
+            /^submit\b.*\b(ai review|feedback)\b/.test(description)));
+}
+function looksServiceStateMutation(input, tokens) {
+    const description = normalizedDescription(input);
+    return (input.adapterType === AdapterType.SERVICE &&
+        (hasDestructiveIntent(input, tokens) ||
+            hasAny(tokens, SERVICE_STATE_TOKENS) ||
+            /^(add|create|set|update)\b/.test(description)));
+}
+function looksRemoteResourceCommand(input, tokens) {
+    const description = normalizedDescription(input);
+    return (isRemoteWebSurface(input) &&
+        (hasAny(tokens, REMOTE_RESOURCE_TOKENS) ||
+            /^(copy|create|move|rename|save|submit)\b/.test(description)));
+}
+function isTargetSurface(value) {
+    return (value === "web" ||
+        value === "desktop" ||
+        value === "system" ||
+        value === "mobile");
+}
+export function resolvePermissionProfile(value) {
+    const configured = value ?? process.env.UNICLI_PERMISSION_PROFILE;
+    if (configured === undefined || configured.trim() === "")
+        return "open";
+    const raw = configured.trim().toLowerCase();
+    if (OPEN_PROFILES.has(raw)) {
+        return raw;
+    }
+    throw new InvalidPermissionProfileError(configured);
+}
+export function resolveOperationTargetSurface(input) {
+    if (isTargetSurface(input.targetSurface))
+        return input.targetSurface;
+    switch (input.adapterType) {
+        case AdapterType.DESKTOP:
+            return "desktop";
+        case AdapterType.BRIDGE:
+        case AdapterType.SERVICE:
+            return "system";
+        default:
+            return "web";
+    }
+}
+export function resolveOperationAdapterPath(site, command, adapterPath) {
+    return adapterPath ?? `src/adapters/${site}/${command}.yaml`;
+}
+export function inferOperationEffect(input) {
+    const tokens = commandTokens(input.site, input.command);
+    if (looksReadOnlyCommand(input))
+        return "read";
+    if (hasAny(tokens, ACCOUNT_STATE_TOKENS))
+        return "account_state";
+    if (looksMessageCommand(input, tokens))
+        return "send_message";
+    if (looksPublishCommand(input, tokens))
+        return "publish_content";
+    if (looksRemoteTransformCommand(input, tokens))
+        return "remote_transform";
+    if (looksServiceStateMutation(input, tokens))
+        return "service_state";
+    if (hasDestructiveIntent(input, tokens))
+        return "destructive";
+    if (looksRemoteResourceCommand(input, tokens))
+        return "remote_resource";
+    if (hasAny(tokens, LOCAL_APP_TOKENS))
+        return "local_app";
+    if (input.adapterType === AdapterType.DESKTOP ||
+        hasAny(tokens, LOCAL_FILE_TOKENS)) {
+        return "local_file";
+    }
+    return "read";
+}
+export function riskForEffect(effect) {
+    switch (effect) {
+        case "read":
+            return "low";
+        case "account_state":
+        case "remote_transform":
+        case "remote_resource":
+        case "local_app":
+        case "local_file":
+        case "unknown_write":
+            return "medium";
+        case "destructive":
+        case "service_state":
+        case "publish_content":
+        case "send_message":
+            return "high";
+        default:
+            return "none";
+    }
+}
+function approvalRequired(profile, risk) {
+    if (profile === "open")
+        return false;
+    if (profile === "confirm")
+        return risk === "high";
+    return risk === "medium" || risk === "high";
+}
+export function evaluateOperationPolicy(input) {
+    const profile = resolvePermissionProfile(input.profile);
+    const effect = inferOperationEffect(input);
+    const risk = riskForEffect(effect);
+    const envApproved = process.env.UNICLI_APPROVE === "1";
+    const approvalSource = input.approvalSource ??
+        (input.approved === true ? "invocation" : envApproved ? "env" : "none");
+    const approved = input.approved === true || envApproved || approvalSource === "memory";
+    const approval_required = approvalRequired(profile, risk);
+    const enforcement = approval_required && !approved ? "needs_approval" : "allow";
+    const capability_scope = deriveCapabilityScope(input, effect);
+    const approval_memory = buildCapabilityApprovalMemory({
+        site: input.site,
+        command: input.command,
+        profile,
+        effect,
+        approved,
+        approvalSource,
+        scope: capability_scope,
+    });
+    const reason = effect === "read"
+        ? "classified as read-only by command contract"
+        : `classified as ${effect.replaceAll("_", " ")} with ${risk} risk`;
+    return {
+        profile,
+        effect,
+        risk,
+        capability_scope,
+        approval_memory,
+        approval_required,
+        approved,
+        enforcement,
+        reason,
+        ...(enforcement === "needs_approval"
+            ? {
+                approval_hint: "rerun with --yes, add --remember-approval to persist this command scope, set UNICLI_APPROVE=1, or use --permission-profile open",
+            }
+            : {}),
+    };
+}
+//# sourceMappingURL=operation-policy.js.map

package/dist/engine/operation-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-policy.js","sourceRoot":"","sources":["../../src/engine/operation-policy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAsB,MAAM,aAAa,CAAC;AAC9D,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAuDhC,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD,YAAY,OAAe;QACzB,KAAK,CACH,+BAA+B,OAAO,2CAA2C,CAClF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEhF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,KAAK;IACL,IAAI;IACJ,OAAO;IACP,WAAW;IACX,eAAe;IACf,OAAO;IACP,UAAU;IACV,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,SAAS;IACT,cAAc;IACd,OAAO;IACP,MAAM;IACN,SAAS;IACT,MAAM;IACN,QAAQ;IACR,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,QAAQ;IACR,YAAY;IACZ,OAAO;IACP,UAAU;IACV,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,UAAU;IACV,aAAa;IACb,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,WAAW;IACX,SAAS;IACT,YAAY;IACZ,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,QAAQ;IACR,aAAa;IACb,SAAS;IACT,aAAa;IACb,IAAI;IACJ,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAE5E,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,YAAY;IACZ,WAAW;IACX,gBAAgB;IAChB,WAAW;IACX,SAAS;IACT,QAAQ;IACR,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,KAAK;IACL,QAAQ;IACR,aAAa;IACb,KAAK;IACL,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,MAAM;IACN,QAAQ;IACR,cAAc;IACd,OAAO;IACP,MAAM;IACN,IAAI;IACJ,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,IAAI;CACL,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,iBAAiB;IACjB,YAAY;IACZ,gBAAgB;IAChB,aAAa;IACb,OAAO;IACP,KAAK;IACL,QAAQ;IACR,MAAM;IACN,UAAU;IACV,OAAO;IACP,iBAAiB;IACjB,oBAAoB;IACpB,aAAa;IACb,eAAe;IACf,OAAO;IACP,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,WAAW;IACX,SAAS;IACT,QAAQ;IACR,eAAe;IACf,aAAa;IACb,aAAa;IACb,mBAAmB;IACnB,KAAK;IACL,QAAQ;IACR,WAAW;IACX,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,kBAAkB;IAClB,YAAY;IACZ,WAAW;IACX,MAAM;IACN,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM;IACN,SAAS;IACT,SAAS;IACT,OAAO;IACP,QAAQ;IACR,SAAS;IACT,MAAM;IACN,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,IAAY,EAAE,OAAe;IAClD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,MAAM,CAAC,MAAmB,EAAE,UAAuB;IAC1D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,OAAqC,EAAE;IAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,qBAAqB,CAAC,KAA2B;IACxD,OAAO,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA2B;IACvD,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,mDAAmD,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAuB;IACrD,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,QAAQ,CAAC;AACvD,CAAC;AAED,SAAS,kBAAkB,CAAC,KAA2B;IACrD,IACE,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,MAAM;QACxC,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;QACzC,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;QACzC,sBAAsB,CAAC,KAAK,CAAC,aAAa,CAAC,EAC3C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC;QACtE,KAAK,CAAC,aAAa,KAAK,KAAK;QAC7B,KAAK,CAAC,aAAa,KAAK,QAAQ;QAChC,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;QACzC,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;QACzC,KAAK,CAAC,OAAO,KAAK,IAAI;QACtB,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAA2B,EAC3B,MAAmB;IAEnB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,CACL,0BAA0B,CAAC,GAAG,CAAC,OAAO,CAAC;QACvC,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC;QAC1C,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC;QAClC,0BAA0B,CAAC,IAAI,CAAC,WAAW,CAAC,CAC7C,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAA2B,EAC3B,MAAmB;IAEnB,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,CACL,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7D,6BAA6B,CAAC,IAAI,CAAC,WAAW,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAA2B,EAC3B,MAAmB;IAEnB,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,CACL,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7D,0BAA0B,CAAC,IAAI,CAAC,WAAW,CAAC;QAC5C,2CAA2C,CAAC,IAAI,CAAC,WAAW,CAAC;QAC7D,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC;QACxC,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,KAA2B,EAC3B,MAAmB;IAEnB,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,CACL,kBAAkB,CAAC,KAAK,CAAC;QACzB,CAAC,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC;YACtC,wBAAwB,CAAC,IAAI,CAAC,WAAW,CAAC;YAC1C,qCAAqC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,KAA2B,EAC3B,MAAmB;IAEnB,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,CACL,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;QACzC,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC;YAClC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC;YACpC,4BAA4B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAClD,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,KAA2B,EAC3B,MAAmB;IAEnB,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,CACL,kBAAkB,CAAC,KAAK,CAAC;QACzB,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC;YACrC,0CAA0C,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAChE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,CACL,KAAK,KAAK,KAAK;QACf,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,QAAQ;QAClB,KAAK,KAAK,QAAQ,CACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,MAAM,UAAU,GAAG,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAClE,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC;IAExE,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,aAAa,CAAC,GAAG,CAAC,GAAwB,CAAC,EAAE,CAAC;QAChD,OAAO,GAAwB,CAAC;IAClC,CAAC;IACD,MAAM,IAAI,6BAA6B,CAAC,UAAU,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAG7C;IACC,IAAI,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC,aAAa,CAAC;IACrE,QAAQ,KAAK,CAAC,WAAW,EAAE,CAAC;QAC1B,KAAK,WAAW,CAAC,OAAO;YACtB,OAAO,SAAS,CAAC;QACnB,KAAK,WAAW,CAAC,MAAM,CAAC;QACxB,KAAK,WAAW,CAAC,OAAO;YACtB,OAAO,QAAQ,CAAC;QAClB;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,IAAY,EACZ,OAAe,EACf,WAAoB;IAEpB,OAAO,WAAW,IAAI,gBAAgB,IAAI,IAAI,OAAO,OAAO,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAA2B;IAE3B,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAExD,IAAI,oBAAoB,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAC/C,IAAI,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC;QAAE,OAAO,eAAe,CAAC;IACjE,IAAI,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC;QAAE,OAAO,cAAc,CAAC;IAC9D,IAAI,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACjE,IAAI,2BAA2B,CAAC,KAAK,EAAE,MAAM,CAAC;QAAE,OAAO,kBAAkB,CAAC;IAC1E,IAAI,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC;QAAE,OAAO,eAAe,CAAC;IACrE,IAAI,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC;QAAE,OAAO,aAAa,CAAC;IAC9D,IAAI,0BAA0B,CAAC,KAAK,EAAE,MAAM,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACxE,IAAI,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC;QAAE,OAAO,WAAW,CAAC;IACzD,IACE,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;QACzC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,EACjC,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAuB;IACnD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,KAAK,CAAC;QACf,KAAK,eAAe,CAAC;QACrB,KAAK,kBAAkB,CAAC;QACxB,KAAK,iBAAiB,CAAC;QACvB,KAAK,WAAW,CAAC;QACjB,KAAK,YAAY,CAAC;QAClB,KAAK,eAAe;YAClB,OAAO,QAAQ,CAAC;QAClB,KAAK,aAAa,CAAC;QACnB,KAAK,eAAe,CAAC;QACrB,KAAK,iBAAiB,CAAC;QACvB,KAAK,cAAc;YACjB,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,OAA0B,EAC1B,IAAmB;IAEnB,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,KAAK,MAAM,CAAC;IAClD,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,MAAM,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,KAA2B;IAE3B,MAAM,OAAO,GAAG,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,GAAG,CAAC;IACvD,MAAM,cAAc,GAClB,KAAK,CAAC,cAAc;QACpB,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,QAAQ,GACZ,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,WAAW,IAAI,cAAc,KAAK,QAAQ,CAAC;IACxE,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,WAAW,GACf,iBAAiB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9D,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAG,6BAA6B,CAAC;QACpD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO;QACP,MAAM;QACN,QAAQ;QACR,cAAc;QACd,KAAK,EAAE,gBAAgB;KACxB,CAAC,CAAC;IACH,MAAM,MAAM,GACV,MAAM,KAAK,MAAM;QACf,CAAC,CAAC,6CAA6C;QAC/C,CAAC,CAAC,iBAAiB,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC;IAEvE,OAAO;QACL,OAAO;QACP,MAAM;QACN,IAAI;QACJ,gBAAgB;QAChB,eAAe;QACf,iBAAiB;QACjB,QAAQ;QACR,WAAW;QACX,MAAM;QACN,GAAG,CAAC,WAAW,KAAK,gBAAgB;YAClC,CAAC,CAAC;gBACE,aAAa,EACX,iIAAiI;aACpI;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC"}

package/dist/engine/permission-rules.d.ts

@@ -0,0 +1,43 @@
+import type { CapabilityAccess, CapabilityDimensionName, CapabilityResourceScope } from "./capability-policy.js";
+import type { OperationEffect, OperationPolicy } from "./operation-policy.js";
+export interface PermissionRuleMatchResult {
+    decision: "deny";
+    id: string;
+    reason: string;
+}
+export declare class PermissionRulesConfigError extends Error {
+    readonly code = "invalid_input";
+    readonly suggestion = "fix or remove the permission rules file";
+    constructor(message: string);
+}
+interface PermissionRulesStore {
+    path: string;
+}
+type ResourceBucketName = keyof CapabilityResourceScope;
+export interface RuntimeResourceCheckInput {
+    site?: string;
+    command?: string;
+    effect?: OperationEffect;
+    dimensions?: Partial<Record<CapabilityDimensionName, CapabilityAccess>>;
+    resources?: Partial<Record<ResourceBucketName, string[]>>;
+    resource_summary?: string[];
+}
+export declare function createPermissionRulesStore(options?: {
+    path?: string;
+    homeDir?: string;
+}): PermissionRulesStore;
+export declare function findDenyRuleForPolicy(policy: OperationPolicy, options?: {
+    path?: string;
+    homeDir?: string;
+}): Promise<PermissionRuleMatchResult | undefined>;
+export declare function applyDenyRuleToPolicy(policy: OperationPolicy, rule: PermissionRuleMatchResult): OperationPolicy;
+export declare function findDenyRuleForPolicySync(policy: OperationPolicy, options?: {
+    path?: string;
+    homeDir?: string;
+}): PermissionRuleMatchResult | undefined;
+export declare function findDenyRuleForRuntimeResourceSync(input: RuntimeResourceCheckInput, options?: {
+    path?: string;
+    homeDir?: string;
+}): PermissionRuleMatchResult | undefined;
+export {};
+//# sourceMappingURL=permission-rules.d.ts.map

package/dist/engine/permission-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-rules.d.ts","sourceRoot":"","sources":["../../src/engine/permission-rules.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG9E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,UAAU,6CAA6C;gBAEpD,OAAO,EAAE,MAAM;CAI5B;AAED,UAAU,oBAAoB;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,KAAK,kBAAkB,GAAG,MAAM,uBAAuB,CAAC;AAExD,MAAM,WAAW,yBAAyB;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,UAAU,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACxE,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1D,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AA+DD,wBAAgB,0BAA0B,CAAC,OAAO,CAAC,EAAE;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,oBAAoB,CAavB;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,eAAe,EACvB,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAEhD;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,yBAAyB,GAC9B,eAAe,CAcjB;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,eAAe,EACvB,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5C,yBAAyB,GAAG,SAAS,CAUvC;AAED,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,yBAAyB,EAChC,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5C,yBAAyB,GAAG,SAAS,CAUvC"}