daycare-cli 0.0.0-canary.f57680e

package/dist/engine/permissions/permissionApply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionApply.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionApply.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,MAAM,UAAU,eAAe,CAC7B,WAA+B,EAC/B,QAA4B;IAE5B,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC9C,qBAAqB,CAAC,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;AACH,CAAC"}

package/dist/engine/permissions/permissionApply.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionApply.spec.d.ts.map

package/dist/engine/permissions/permissionApply.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionApply.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionApply.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionApply.spec.js

@@ -0,0 +1,104 @@
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+import { permissionApply } from "./permissionApply.js";
+describe("permissionApply", () => {
+    const basePermissions = () => ({
+        workingDir: "/workspace",
+        writeDirs: [],
+        readDirs: [],
+        network: false,
+        events: false
+    });
+    it("ignores unapproved decisions", () => {
+        const permissions = basePermissions();
+        const decision = {
+            token: "token-1",
+            agentId: "agent-1",
+            approved: false,
+            permissions: [{ permission: "@network", access: { kind: "network" } }]
+        };
+        permissionApply(permissions, decision);
+        expect(permissions.network).toBe(false);
+    });
+    it("applies approved events access", () => {
+        const permissions = basePermissions();
+        const decision = {
+            token: "token-events",
+            agentId: "agent-1",
+            approved: true,
+            permissions: [{ permission: "@events", access: { kind: "events" } }]
+        };
+        permissionApply(permissions, decision);
+        expect(permissions.events).toBe(true);
+    });
+    it("adds approved write paths", () => {
+        const permissions = basePermissions();
+        const target = path.resolve("tmp", "write");
+        const decision = {
+            token: "token-2",
+            agentId: "agent-1",
+            approved: true,
+            permissions: [{ permission: `@write:${target}`, access: { kind: "write", path: target } }]
+        };
+        permissionApply(permissions, decision);
+        expect(permissions.writeDirs).toEqual(expect.arrayContaining([target]));
+        expect(permissions.readDirs).toEqual(expect.arrayContaining([target]));
+    });
+    it("skips relative paths", () => {
+        const permissions = basePermissions();
+        const decision = {
+            token: "token-3",
+            agentId: "agent-1",
+            approved: true,
+            permissions: [{ permission: "@read:relative/path", access: { kind: "read", path: "relative/path" } }]
+        };
+        permissionApply(permissions, decision);
+        expect(permissions.readDirs).toHaveLength(0);
+    });
+    it("rejects paths with null bytes", () => {
+        const permissions = basePermissions();
+        const decision = {
+            token: "token-4",
+            agentId: "agent-1",
+            approved: true,
+            permissions: [
+                {
+                    permission: "@read:/etc/passwd\x00.txt",
+                    access: { kind: "read", path: "/etc/passwd\x00.txt" }
+                }
+            ]
+        };
+        permissionApply(permissions, decision);
+        // Path should be silently rejected
+        expect(permissions.readDirs).toHaveLength(0);
+    });
+    it("rejects paths with control characters", () => {
+        const permissions = basePermissions();
+        const decision = {
+            token: "token-5",
+            agentId: "agent-1",
+            approved: true,
+            permissions: [
+                {
+                    permission: "@write:/home/user\x01file",
+                    access: { kind: "write", path: "/home/user\x01file" }
+                }
+            ]
+        };
+        permissionApply(permissions, decision);
+        expect(permissions.writeDirs).toHaveLength(0);
+    });
+    it("rejects excessively long paths", () => {
+        const permissions = basePermissions();
+        const longPath = "/" + "a".repeat(5000);
+        const decision = {
+            token: "token-6",
+            agentId: "agent-1",
+            approved: true,
+            permissions: [{ permission: `@read:${longPath}`, access: { kind: "read", path: longPath } }]
+        };
+        permissionApply(permissions, decision);
+        expect(permissions.readDirs).toHaveLength(0);
+    });
+});
+//# sourceMappingURL=permissionApply.spec.js.map

package/dist/engine/permissions/permissionApply.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionApply.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionApply.spec.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAI9C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,MAAM,eAAe,GAAG,GAAuB,EAAE,CAAC,CAAC;QACjD,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAuB;YACnC,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;SACvE,CAAC;QAEF,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEvC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAuB;YACnC,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;SACrE,CAAC;QAEF,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEvC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAuB;YACnC,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,UAAU,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;SAC3F,CAAC;QAEF,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEvC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAuB;YACnC,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,CAAC;SACtG,CAAC;QAEF,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEvC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAuB;YACnC,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE;gBACX;oBACE,UAAU,EAAE,2BAA2B;oBACvC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE;iBACtD;aACF;SACF,CAAC;QAEF,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEvC,mCAAmC;QACnC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAuB;YACnC,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE;gBACX;oBACE,UAAU,EAAE,2BAA2B;oBACvC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE;iBACtD;aACF;SACF,CAAC;QAEF,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEvC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAuB;YACnC,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;SAC7F,CAAC;QAEF,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEvC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionBuildCron.d.ts

@@ -0,0 +1,3 @@
+import { type SessionPermissions } from "../permissions.js";
+export declare function permissionBuildCron(defaultPermissions: SessionPermissions, filesPath: string): SessionPermissions;
+//# sourceMappingURL=permissionBuildCron.d.ts.map

package/dist/engine/permissions/permissionBuildCron.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBuildCron.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionBuildCron.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAIlF,wBAAgB,mBAAmB,CACjC,kBAAkB,EAAE,kBAAkB,EACtC,SAAS,EAAE,MAAM,GAChB,kBAAkB,CAcpB"}

package/dist/engine/permissions/permissionBuildCron.js

@@ -0,0 +1,15 @@
+import { normalizePermissions } from "../permissions.js";
+import { permissionEnsureDefaultFile } from "./permissionEnsureDefaultFile.js";
+export function permissionBuildCron(defaultPermissions, filesPath) {
+    const permissions = normalizePermissions({
+        workspaceDir: defaultPermissions.workspaceDir ?? defaultPermissions.workingDir,
+        workingDir: filesPath,
+        writeDirs: defaultPermissions.writeDirs,
+        readDirs: defaultPermissions.readDirs,
+        network: defaultPermissions.network,
+        events: defaultPermissions.events
+    }, defaultPermissions.workingDir);
+    permissionEnsureDefaultFile(permissions, defaultPermissions);
+    return permissions;
+}
+//# sourceMappingURL=permissionBuildCron.js.map

package/dist/engine/permissions/permissionBuildCron.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBuildCron.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionBuildCron.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAA2B,MAAM,mBAAmB,CAAC;AAElF,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAE/E,MAAM,UAAU,mBAAmB,CACjC,kBAAsC,EACtC,SAAiB;IAEjB,MAAM,WAAW,GAAG,oBAAoB,CACtC;QACE,YAAY,EAAE,kBAAkB,CAAC,YAAY,IAAI,kBAAkB,CAAC,UAAU;QAC9E,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,kBAAkB,CAAC,SAAS;QACvC,QAAQ,EAAE,kBAAkB,CAAC,QAAQ;QACrC,OAAO,EAAE,kBAAkB,CAAC,OAAO;QACnC,MAAM,EAAE,kBAAkB,CAAC,MAAM;KAClC,EACD,kBAAkB,CAAC,UAAU,CAC9B,CAAC;IACF,2BAA2B,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAC7D,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/engine/permissions/permissionBuildCron.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionBuildCron.spec.d.ts.map

package/dist/engine/permissions/permissionBuildCron.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBuildCron.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionBuildCron.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionBuildCron.spec.js

@@ -0,0 +1,21 @@
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+import { permissionBuildCron } from "./permissionBuildCron.js";
+describe("permissionBuildCron", () => {
+    it("copies defaults into cron permissions", () => {
+        const defaults = {
+            workingDir: path.resolve("tmp", "workspace"),
+            writeDirs: [path.resolve("tmp", "write")],
+            readDirs: [path.resolve("tmp", "read")],
+            network: true,
+            events: false
+        };
+        const permissions = permissionBuildCron(defaults, path.resolve("tmp", "cron"));
+        expect(permissions.workingDir).toBe(path.resolve("tmp", "cron"));
+        expect(permissions.writeDirs).toEqual(expect.arrayContaining(defaults.writeDirs));
+        expect(permissions.readDirs).toEqual(expect.arrayContaining(defaults.readDirs));
+        expect(permissions.network).toBe(true);
+        expect(permissions.events).toBe(false);
+    });
+});
+//# sourceMappingURL=permissionBuildCron.spec.js.map

package/dist/engine/permissions/permissionBuildCron.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBuildCron.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionBuildCron.spec.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,QAAQ,GAAuB;YACnC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC;YAC5C,SAAS,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACzC,QAAQ,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACvC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,KAAK;SACd,CAAC;QAEF,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QAE/E,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QACjE,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAClF,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChF,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionBuildCronSession.d.ts

@@ -0,0 +1,7 @@
+import type { SessionPermissions } from "@/types";
+/**
+ * Builds cron base permissions and carries forward runtime-granted permissions.
+ * Expects: filesPath is the cron workspace path; current permissions are normalized.
+ */
+export declare function permissionBuildCronSession(currentPermissions: SessionPermissions, defaultPermissions: SessionPermissions, filesPath: string): SessionPermissions;
+//# sourceMappingURL=permissionBuildCronSession.d.ts.map

package/dist/engine/permissions/permissionBuildCronSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBuildCronSession.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionBuildCronSession.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAIlD;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,kBAAkB,EAAE,kBAAkB,EACtC,kBAAkB,EAAE,kBAAkB,EACtC,SAAS,EAAE,MAAM,GAChB,kBAAkB,CAYpB"}

package/dist/engine/permissions/permissionBuildCronSession.js

@@ -0,0 +1,18 @@
+import { permissionBuildCron } from "./permissionBuildCron.js";
+/**
+ * Builds cron base permissions and carries forward runtime-granted permissions.
+ * Expects: filesPath is the cron workspace path; current permissions are normalized.
+ */
+export function permissionBuildCronSession(currentPermissions, defaultPermissions, filesPath) {
+    const cronPermissions = permissionBuildCron(defaultPermissions, filesPath);
+    const writeDirs = new Set([...cronPermissions.writeDirs, ...currentPermissions.writeDirs]);
+    const readDirs = new Set([...cronPermissions.readDirs, ...currentPermissions.readDirs]);
+    return {
+        ...cronPermissions,
+        writeDirs: Array.from(writeDirs.values()),
+        readDirs: Array.from(readDirs.values()),
+        network: cronPermissions.network || currentPermissions.network,
+        events: cronPermissions.events || currentPermissions.events
+    };
+}
+//# sourceMappingURL=permissionBuildCronSession.js.map

package/dist/engine/permissions/permissionBuildCronSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBuildCronSession.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionBuildCronSession.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,kBAAsC,EACtC,kBAAsC,EACtC,SAAiB;IAEjB,MAAM,eAAe,GAAG,mBAAmB,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,eAAe,CAAC,SAAS,EAAE,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,eAAe,CAAC,QAAQ,EAAE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAExF,OAAO;QACL,GAAG,eAAe;QAClB,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACzC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvC,OAAO,EAAE,eAAe,CAAC,OAAO,IAAI,kBAAkB,CAAC,OAAO;QAC9D,MAAM,EAAE,eAAe,CAAC,MAAM,IAAI,kBAAkB,CAAC,MAAM;KAC5D,CAAC;AACJ,CAAC"}

package/dist/engine/permissions/permissionBuildCronSession.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionBuildCronSession.spec.d.ts.map

package/dist/engine/permissions/permissionBuildCronSession.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBuildCronSession.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionBuildCronSession.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionBuildCronSession.spec.js

@@ -0,0 +1,27 @@
+import { describe, expect, it } from "vitest";
+import { permissionBuildCronSession } from "./permissionBuildCronSession.js";
+describe("permissionBuildCronSession", () => {
+    it("keeps runtime grants while enforcing cron workspace", () => {
+        const defaults = {
+            workingDir: "/workspace/daycare",
+            writeDirs: ["/workspace/daycare"],
+            readDirs: ["/workspace/daycare"],
+            network: false,
+            events: false
+        };
+        const current = {
+            workingDir: "/tmp/old-cron",
+            writeDirs: ["/tmp/old-cron", "/tmp/granted-write"],
+            readDirs: ["/tmp/old-cron", "/tmp/granted-read"],
+            network: true,
+            events: true
+        };
+        const result = permissionBuildCronSession(current, defaults, "/tmp/new-cron");
+        expect(result.workingDir).toBe("/tmp/new-cron");
+        expect(result.network).toBe(true);
+        expect(result.events).toBe(true);
+        expect(result.writeDirs).toEqual(expect.arrayContaining(["/workspace/daycare", "/tmp/old-cron", "/tmp/granted-write"]));
+        expect(result.readDirs).toEqual(expect.arrayContaining(["/workspace/daycare", "/tmp/old-cron", "/tmp/granted-read"]));
+    });
+});
+//# sourceMappingURL=permissionBuildCronSession.spec.js.map

package/dist/engine/permissions/permissionBuildCronSession.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBuildCronSession.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionBuildCronSession.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAI9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,QAAQ,GAAuB;YACnC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,CAAC,oBAAoB,CAAC;YACjC,QAAQ,EAAE,CAAC,oBAAoB,CAAC;YAChC,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;QACF,MAAM,OAAO,GAAuB;YAClC,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,CAAC,eAAe,EAAE,oBAAoB,CAAC;YAClD,QAAQ,EAAE,CAAC,eAAe,EAAE,mBAAmB,CAAC;YAChD,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,IAAI;SACb,CAAC;QAEF,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;QAE9E,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAC9B,MAAM,CAAC,eAAe,CAAC,CAAC,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC,CACtF,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAC7B,MAAM,CAAC,eAAe,CAAC,CAAC,oBAAoB,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC,CACrF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionBuildDefault.d.ts

@@ -0,0 +1,3 @@
+import type { SessionPermissions } from "../permissions.js";
+export declare function permissionBuildDefault(workingDir: string, configDir: string): SessionPermissions;
+//# sourceMappingURL=permissionBuildDefault.d.ts.map

package/dist/engine/permissions/permissionBuildDefault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBuildDefault.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionBuildDefault.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,kBAAkB,CAyBpB"}

package/dist/engine/permissions/permissionBuildDefault.js

@@ -0,0 +1,29 @@
+import path from "node:path";
+import { DEFAULT_AGENTS_PATH, DEFAULT_MEMORY_PATH, DEFAULT_SOUL_PATH, DEFAULT_TOOLS_PATH, DEFAULT_USER_PATH } from "../../paths.js";
+export function permissionBuildDefault(workingDir, configDir) {
+    const heartbeatDir = configDir ? path.resolve(configDir, "heartbeat") : null;
+    const skillsDir = configDir ? path.resolve(configDir, "skills") : null;
+    const writeDefaults = [
+        DEFAULT_SOUL_PATH,
+        DEFAULT_USER_PATH,
+        DEFAULT_AGENTS_PATH,
+        DEFAULT_TOOLS_PATH,
+        DEFAULT_MEMORY_PATH
+    ].map((entry) => path.resolve(entry));
+    const writeDirs = [
+        path.resolve(workingDir),
+        ...writeDefaults,
+        ...(heartbeatDir ? [heartbeatDir] : []),
+        ...(skillsDir ? [skillsDir] : [])
+    ];
+    const readDirs = [...writeDirs];
+    return {
+        workspaceDir: path.resolve(workingDir),
+        workingDir: path.resolve(workingDir),
+        writeDirs: Array.from(new Set(writeDirs)),
+        readDirs: Array.from(new Set(readDirs)),
+        network: false,
+        events: false
+    };
+}
+//# sourceMappingURL=permissionBuildDefault.js.map

package/dist/engine/permissions/permissionBuildDefault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBuildDefault.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionBuildDefault.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,UAAU,sBAAsB,CACpC,UAAkB,EAClB,SAAiB;IAEjB,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,MAAM,aAAa,GAAG;QACpB,iBAAiB;QACjB,iBAAiB;QACjB,mBAAmB;QACnB,kBAAkB;QAClB,mBAAmB;KACpB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG;QAChB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACxB,GAAG,aAAa;QAChB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;IAChC,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACtC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACpC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC"}

package/dist/engine/permissions/permissionBuildDefault.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionBuildDefault.spec.d.ts.map

package/dist/engine/permissions/permissionBuildDefault.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBuildDefault.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionBuildDefault.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionBuildDefault.spec.js

@@ -0,0 +1,26 @@
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+import { DEFAULT_AGENTS_PATH, DEFAULT_MEMORY_PATH, DEFAULT_SOUL_PATH, DEFAULT_USER_PATH } from "../../paths.js";
+import { permissionBuildDefault } from "./permissionBuildDefault.js";
+describe("permissionBuildDefault", () => {
+    it("includes default and config directories", () => {
+        const workingDir = path.resolve("tmp", "workspace");
+        const configDir = path.resolve("tmp", "config");
+        const permissions = permissionBuildDefault(workingDir, configDir);
+        expect(permissions.workspaceDir).toBe(path.resolve(workingDir));
+        expect(permissions.workingDir).toBe(path.resolve(workingDir));
+        expect(permissions.writeDirs).toEqual(expect.arrayContaining([
+            path.resolve(workingDir),
+            path.resolve(DEFAULT_SOUL_PATH),
+            path.resolve(DEFAULT_USER_PATH),
+            path.resolve(DEFAULT_AGENTS_PATH),
+            path.resolve(DEFAULT_MEMORY_PATH),
+            path.resolve(configDir, "heartbeat"),
+            path.resolve(configDir, "skills")
+        ]));
+        expect(permissions.readDirs).toEqual(expect.arrayContaining(permissions.writeDirs));
+        expect(permissions.network).toBe(false);
+        expect(permissions.events).toBe(false);
+    });
+});
+//# sourceMappingURL=permissionBuildDefault.spec.js.map

package/dist/engine/permissions/permissionBuildDefault.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBuildDefault.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionBuildDefault.spec.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAEhD,MAAM,WAAW,GAAG,sBAAsB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAElE,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAChE,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,CACnC,MAAM,CAAC,eAAe,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC;SAClC,CAAC,CACH,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;QACpF,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionClone.d.ts

@@ -0,0 +1,7 @@
+import type { SessionPermissions } from "../permissions.js";
+/**
+ * Clones permissions so callers can mutate without affecting defaults.
+ * Expects: permissions.writeDirs/readDirs are treated as mutable arrays.
+ */
+export declare function permissionClone(permissions: SessionPermissions): SessionPermissions;
+//# sourceMappingURL=permissionClone.d.ts.map

package/dist/engine/permissions/permissionClone.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionClone.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionClone.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D;;;GAGG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,kBAAkB,GAAG,kBAAkB,CAMnF"}

package/dist/engine/permissions/permissionClone.js

@@ -0,0 +1,12 @@
+/**
+ * Clones permissions so callers can mutate without affecting defaults.
+ * Expects: permissions.writeDirs/readDirs are treated as mutable arrays.
+ */
+export function permissionClone(permissions) {
+    return {
+        ...permissions,
+        writeDirs: [...permissions.writeDirs],
+        readDirs: [...permissions.readDirs]
+    };
+}
+//# sourceMappingURL=permissionClone.js.map

package/dist/engine/permissions/permissionClone.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionClone.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionClone.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,WAA+B;IAC7D,OAAO;QACL,GAAG,WAAW;QACd,SAAS,EAAE,CAAC,GAAG,WAAW,CAAC,SAAS,CAAC;QACrC,QAAQ,EAAE,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC;KACpC,CAAC;AACJ,CAAC"}

package/dist/engine/permissions/permissionClone.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionClone.spec.d.ts.map

package/dist/engine/permissions/permissionClone.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionClone.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionClone.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionClone.spec.js

@@ -0,0 +1,18 @@
+import { describe, expect, it } from "vitest";
+import { permissionClone } from "./permissionClone.js";
+describe("permissionClone", () => {
+    it("clones arrays while preserving values", () => {
+        const permissions = {
+            workingDir: "/tmp/work",
+            writeDirs: ["/tmp/work"],
+            readDirs: ["/tmp/read"],
+            network: false,
+            events: false
+        };
+        const cloned = permissionClone(permissions);
+        expect(cloned).toEqual(permissions);
+        expect(cloned.writeDirs).not.toBe(permissions.writeDirs);
+        expect(cloned.readDirs).not.toBe(permissions.readDirs);
+    });
+});
+//# sourceMappingURL=permissionClone.spec.js.map

package/dist/engine/permissions/permissionClone.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionClone.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionClone.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,WAAW,GAAuB;YACtC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,CAAC,WAAW,CAAC;YACxB,QAAQ,EAAE,CAAC,WAAW,CAAC;YACvB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;QAEF,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QAE5C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionDescribeDecision.d.ts

@@ -0,0 +1,3 @@
+import type { PermissionAccess } from "@/types";
+export declare function permissionDescribeDecision(access: PermissionAccess): string;
+//# sourceMappingURL=permissionDescribeDecision.d.ts.map

package/dist/engine/permissions/permissionDescribeDecision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionDescribeDecision.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionDescribeDecision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAc3E"}

package/dist/engine/permissions/permissionDescribeDecision.js

@@ -0,0 +1,16 @@
+export function permissionDescribeDecision(access) {
+    if (access.kind === "network") {
+        return "network access";
+    }
+    if (access.kind === "events") {
+        return "events access";
+    }
+    if (access.kind === "workspace") {
+        return "workspace write access";
+    }
+    if (access.kind === "read") {
+        return `read access to ${access.path}`;
+    }
+    return `write access to ${access.path}`;
+}
+//# sourceMappingURL=permissionDescribeDecision.js.map

package/dist/engine/permissions/permissionDescribeDecision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionDescribeDecision.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionDescribeDecision.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,0BAA0B,CAAC,MAAwB;IACjE,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,OAAO,wBAAwB,CAAC;IAClC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,kBAAkB,MAAM,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,mBAAmB,MAAM,CAAC,IAAI,EAAE,CAAC;AAC1C,CAAC"}

package/dist/engine/permissions/permissionDescribeDecision.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionDescribeDecision.spec.d.ts.map

package/dist/engine/permissions/permissionDescribeDecision.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionDescribeDecision.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionDescribeDecision.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionDescribeDecision.spec.js

@@ -0,0 +1,17 @@
+import { describe, expect, it } from "vitest";
+import { permissionDescribeDecision } from "./permissionDescribeDecision.js";
+describe("permissionDescribeDecision", () => {
+    it("describes network access", () => {
+        expect(permissionDescribeDecision({ kind: "network" })).toBe("network access");
+    });
+    it("describes events access", () => {
+        expect(permissionDescribeDecision({ kind: "events" })).toBe("events access");
+    });
+    it("describes workspace access", () => {
+        expect(permissionDescribeDecision({ kind: "workspace" })).toBe("workspace write access");
+    });
+    it("describes read access", () => {
+        expect(permissionDescribeDecision({ kind: "read", path: "/tmp" })).toBe("read access to /tmp");
+    });
+});
+//# sourceMappingURL=permissionDescribeDecision.spec.js.map

package/dist/engine/permissions/permissionDescribeDecision.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionDescribeDecision.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionDescribeDecision.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CACrE,qBAAqB,CACtB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionEnsureDefaultFile.d.ts

@@ -0,0 +1,3 @@
+import type { SessionPermissions } from "../permissions.js";
+export declare function permissionEnsureDefaultFile(permissions: SessionPermissions, defaults: Pick<SessionPermissions, "writeDirs" | "readDirs">): void;
+//# sourceMappingURL=permissionEnsureDefaultFile.d.ts.map

package/dist/engine/permissions/permissionEnsureDefaultFile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionEnsureDefaultFile.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionEnsureDefaultFile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,kBAAkB,EAC/B,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,GAAG,UAAU,CAAC,GAC3D,IAAI,CAKN"}

package/dist/engine/permissions/permissionEnsureDefaultFile.js

@@ -0,0 +1,7 @@
+export function permissionEnsureDefaultFile(permissions, defaults) {
+    const nextWrite = new Set([...permissions.writeDirs, ...defaults.writeDirs]);
+    const nextRead = new Set([...permissions.readDirs, ...defaults.readDirs]);
+    permissions.writeDirs = Array.from(nextWrite.values());
+    permissions.readDirs = Array.from(nextRead.values());
+}
+//# sourceMappingURL=permissionEnsureDefaultFile.js.map

package/dist/engine/permissions/permissionEnsureDefaultFile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionEnsureDefaultFile.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionEnsureDefaultFile.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,2BAA2B,CACzC,WAA+B,EAC/B,QAA4D;IAE5D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,SAAS,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,WAAW,CAAC,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,WAAW,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;AACvD,CAAC"}

package/dist/engine/permissions/permissionEnsureDefaultFile.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionEnsureDefaultFile.spec.d.ts.map

package/dist/engine/permissions/permissionEnsureDefaultFile.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionEnsureDefaultFile.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionEnsureDefaultFile.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionEnsureDefaultFile.spec.js

@@ -0,0 +1,20 @@
+import { describe, expect, it } from "vitest";
+import { permissionEnsureDefaultFile } from "./permissionEnsureDefaultFile.js";
+describe("permissionEnsureDefaultFile", () => {
+    it("merges default read/write directories", () => {
+        const permissions = {
+            workingDir: "/workspace",
+            writeDirs: ["/write"],
+            readDirs: ["/read"],
+            network: false,
+            events: false
+        };
+        permissionEnsureDefaultFile(permissions, {
+            writeDirs: ["/write", "/extra-write"],
+            readDirs: ["/read", "/extra-read"]
+        });
+        expect(permissions.writeDirs).toEqual(expect.arrayContaining(["/write", "/extra-write"]));
+        expect(permissions.readDirs).toEqual(expect.arrayContaining(["/read", "/extra-read"]));
+    });
+});
+//# sourceMappingURL=permissionEnsureDefaultFile.spec.js.map

package/dist/engine/permissions/permissionEnsureDefaultFile.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionEnsureDefaultFile.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionEnsureDefaultFile.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAE/E,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,WAAW,GAAuB;YACtC,UAAU,EAAE,YAAY;YACxB,SAAS,EAAE,CAAC,QAAQ,CAAC;YACrB,QAAQ,EAAE,CAAC,OAAO,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;QAEF,2BAA2B,CAAC,WAAW,EAAE;YACvC,SAAS,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC;YACrC,QAAQ,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC;SACnC,CAAC,CAAC;QAEH,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,CACnC,MAAM,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CACnD,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,OAAO,CAClC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CACjD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionFormatTag.d.ts

@@ -0,0 +1,3 @@
+import type { PermissionAccess } from "@/types";
+export declare function permissionFormatTag(access: PermissionAccess): string;
+//# sourceMappingURL=permissionFormatTag.d.ts.map

package/dist/engine/permissions/permissionFormatTag.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionFormatTag.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionFormatTag.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAWpE"}

package/dist/engine/permissions/permissionFormatTag.js

@@ -0,0 +1,13 @@
+export function permissionFormatTag(access) {
+    if (access.kind === "network") {
+        return "@network";
+    }
+    if (access.kind === "events") {
+        return "@events";
+    }
+    if (access.kind === "workspace") {
+        return "@workspace";
+    }
+    return `@${access.kind}:${access.path}`;
+}
+//# sourceMappingURL=permissionFormatTag.js.map

package/dist/engine/permissions/permissionFormatTag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionFormatTag.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionFormatTag.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,mBAAmB,CAAC,MAAwB;IAC1D,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;AAC1C,CAAC"}

package/dist/engine/permissions/permissionFormatTag.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionFormatTag.spec.d.ts.map

package/dist/engine/permissions/permissionFormatTag.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionFormatTag.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionFormatTag.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionFormatTag.spec.js

@@ -0,0 +1,17 @@
+import { describe, expect, it } from "vitest";
+import { permissionFormatTag } from "./permissionFormatTag.js";
+describe("permissionFormatTag", () => {
+    it("formats network permissions", () => {
+        expect(permissionFormatTag({ kind: "network" })).toBe("@network");
+    });
+    it("formats events permissions", () => {
+        expect(permissionFormatTag({ kind: "events" })).toBe("@events");
+    });
+    it("formats workspace permissions", () => {
+        expect(permissionFormatTag({ kind: "workspace" })).toBe("@workspace");
+    });
+    it("formats path permissions", () => {
+        expect(permissionFormatTag({ kind: "read", path: "/tmp" })).toBe("@read:/tmp");
+    });
+});
+//# sourceMappingURL=permissionFormatTag.spec.js.map

package/dist/engine/permissions/permissionFormatTag.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionFormatTag.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionFormatTag.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionMergeDefault.d.ts

@@ -0,0 +1,3 @@
+import type { SessionPermissions } from "../permissions.js";
+export declare function permissionMergeDefault(permissions: SessionPermissions, defaultPermissions: SessionPermissions): SessionPermissions;
+//# sourceMappingURL=permissionMergeDefault.d.ts.map