daycare-cli 0.0.26 → 0.0.28

package/dist/engine/apps/appManifestValidate.js

@@ -0,0 +1,27 @@
+const APP_NAME_PATTERN = /^[a-z0-9]+(?:[-_][a-z0-9]+)*$/;
+/**
+ * Validates and normalizes an app manifest.
+ * Expects: manifest fields are parsed from APP.md and not nullish.
+ */
+export function appManifestValidate(manifest) {
+    const name = manifest.name.trim();
+    const title = manifest.title.trim();
+    const description = manifest.description.trim();
+    const systemPrompt = manifest.systemPrompt.trim();
+    if (!name || !title || !description || !systemPrompt) {
+        throw new Error("App manifest requires name, title, description, and systemPrompt.");
+    }
+    if (!APP_NAME_PATTERN.test(name)) {
+        throw new Error("App name must be username-style lowercase with optional dash or underscore separators.");
+    }
+    return {
+        name,
+        title,
+        description,
+        ...(manifest.model && manifest.model.trim().length > 0
+            ? { model: manifest.model.trim() }
+            : {}),
+        systemPrompt
+    };
+}
+//# sourceMappingURL=appManifestValidate.js.map

package/dist/engine/apps/appManifestValidate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appManifestValidate.js","sourceRoot":"","sources":["../../../sources/engine/apps/appManifestValidate.ts"],"names":[],"mappings":"AAEA,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AAEzD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAqB;IACvD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC5G,CAAC;IAED,OAAO;QACL,IAAI;QACJ,KAAK;QACL,WAAW;QACX,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YACpD,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE;YAClC,CAAC,CAAC,EAAE,CAAC;QACP,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/engine/apps/appManifestValidate.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=appManifestValidate.spec.d.ts.map

package/dist/engine/apps/appManifestValidate.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appManifestValidate.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appManifestValidate.spec.ts"],"names":[],"mappings":""}

package/dist/engine/apps/appManifestValidate.spec.js

@@ -0,0 +1,30 @@
+import { describe, expect, it } from "vitest";
+import { appManifestValidate } from "./appManifestValidate.js";
+function baseManifest() {
+    return {
+        name: "github-reviewer",
+        title: "GitHub Reviewer",
+        description: "Reviews pull requests",
+        systemPrompt: "You are a focused PR review assistant."
+    };
+}
+describe("appManifestValidate", () => {
+    it("accepts valid manifests", () => {
+        const validated = appManifestValidate(baseManifest());
+        expect(validated.name).toBe("github-reviewer");
+        expect(validated.title).toBe("GitHub Reviewer");
+        expect(validated.description).toBe("Reviews pull requests");
+        expect(validated.systemPrompt).toBe("You are a focused PR review assistant.");
+    });
+    it("rejects missing required fields", () => {
+        const manifest = baseManifest();
+        manifest.systemPrompt = "   ";
+        expect(() => appManifestValidate(manifest)).toThrow("App manifest requires name, title, description, and systemPrompt.");
+    });
+    it("rejects non username-style names", () => {
+        const manifest = baseManifest();
+        manifest.name = "GitHub Reviewer";
+        expect(() => appManifestValidate(manifest)).toThrow("App name must be username-style lowercase with optional dash or underscore separators.");
+    });
+});
+//# sourceMappingURL=appManifestValidate.spec.js.map

package/dist/engine/apps/appManifestValidate.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appManifestValidate.spec.js","sourceRoot":"","sources":["../../../sources/engine/apps/appManifestValidate.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,SAAS,YAAY;IACnB,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,uBAAuB;QACpC,YAAY,EAAE,wCAAwC;KACvD,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,SAAS,GAAG,mBAAmB,CAAC,YAAY,EAAE,CAAC,CAAC;QAEtD,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC/C,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChD,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC5D,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,QAAQ,CAAC,YAAY,GAAG,KAAK,CAAC;QAE9B,MAAM,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CACjD,mEAAmE,CACpE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAElC,MAAM,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CACjD,wFAAwF,CACzF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/apps/appPermissionBuild.d.ts

@@ -0,0 +1,7 @@
+import type { SessionPermissions } from "@/types";
+/**
+ * Builds locked-down session permissions for an app agent.
+ * Expects: workspaceDir is absolute; appId is a validated app id.
+ */
+export declare function appPermissionBuild(workspaceDir: string, appId: string): Promise<SessionPermissions>;
+//# sourceMappingURL=appPermissionBuild.d.ts.map

package/dist/engine/apps/appPermissionBuild.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionBuild.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionBuild.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAKlD;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,CAAC,CAoB7B"}

package/dist/engine/apps/appPermissionBuild.js

@@ -0,0 +1,28 @@
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { permissionAccessApply } from "../permissions/permissionAccessApply.js";
+import { permissionAccessParse } from "../permissions/permissionAccessParse.js";
+import { appPermissionStateRead } from "./appPermissionStateRead.js";
+/**
+ * Builds locked-down session permissions for an app agent.
+ * Expects: workspaceDir is absolute; appId is a validated app id.
+ */
+export async function appPermissionBuild(workspaceDir, appId) {
+    const resolvedWorkspace = path.resolve(workspaceDir);
+    const appDataDir = path.join(resolvedWorkspace, "apps", appId, "data");
+    await fs.mkdir(appDataDir, { recursive: true });
+    const permissions = {
+        workspaceDir: resolvedWorkspace,
+        workingDir: appDataDir,
+        writeDirs: [appDataDir],
+        readDirs: [resolvedWorkspace],
+        network: false,
+        events: false
+    };
+    const sharedPermissions = await appPermissionStateRead(resolvedWorkspace, appId);
+    for (const permission of sharedPermissions) {
+        permissionAccessApply(permissions, permissionAccessParse(permission));
+    }
+    return permissions;
+}
+//# sourceMappingURL=appPermissionBuild.js.map

package/dist/engine/apps/appPermissionBuild.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionBuild.js","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionBuild.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,YAAoB,EACpB,KAAa;IAEb,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACvE,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEhD,MAAM,WAAW,GAAuB;QACtC,YAAY,EAAE,iBAAiB;QAC/B,UAAU,EAAE,UAAU;QACtB,SAAS,EAAE,CAAC,UAAU,CAAC;QACvB,QAAQ,EAAE,CAAC,iBAAiB,CAAC;QAC7B,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;KACd,CAAC;IAEF,MAAM,iBAAiB,GAAG,MAAM,sBAAsB,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IACjF,KAAK,MAAM,UAAU,IAAI,iBAAiB,EAAE,CAAC;QAC3C,qBAAqB,CAAC,WAAW,EAAE,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/engine/apps/appPermissionBuild.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=appPermissionBuild.spec.d.ts.map

package/dist/engine/apps/appPermissionBuild.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionBuild.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionBuild.spec.ts"],"names":[],"mappings":""}

package/dist/engine/apps/appPermissionBuild.spec.js

@@ -0,0 +1,44 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { appPermissionBuild } from "./appPermissionBuild.js";
+import { appPermissionStateWrite } from "./appPermissionStateWrite.js";
+describe("appPermissionBuild", () => {
+    let workspaceDir;
+    beforeEach(async () => {
+        workspaceDir = await fs.mkdtemp(path.join(os.tmpdir(), "daycare-app-permissions-"));
+    });
+    afterEach(async () => {
+        await fs.rm(workspaceDir, { recursive: true, force: true });
+    });
+    it("builds app-scoped permissions and creates data dir", async () => {
+        const permissions = await appPermissionBuild(workspaceDir, "github-reviewer");
+        const expectedDataDir = path.join(workspaceDir, "apps", "github-reviewer", "data");
+        expect(permissions).toEqual({
+            workspaceDir: path.resolve(workspaceDir),
+            workingDir: expectedDataDir,
+            writeDirs: [expectedDataDir],
+            readDirs: [path.resolve(workspaceDir)],
+            network: false,
+            events: false
+        });
+        const stat = await fs.stat(expectedDataDir);
+        expect(stat.isDirectory()).toBe(true);
+    });
+    it("merges shared app permissions persisted in app state", async () => {
+        await appPermissionStateWrite(workspaceDir, "github-reviewer", [
+            "@workspace",
+            "@network",
+            "@read:/tmp/daycare-app-read",
+            "@write:/tmp/daycare-app-write"
+        ]);
+        const permissions = await appPermissionBuild(workspaceDir, "github-reviewer");
+        expect(permissions.network).toBe(true);
+        expect(permissions.readDirs).toContain("/tmp/daycare-app-read");
+        expect(permissions.readDirs).toContain("/tmp/daycare-app-write");
+        expect(permissions.writeDirs).toContain(path.resolve(workspaceDir));
+        expect(permissions.writeDirs).toContain("/tmp/daycare-app-write");
+    });
+});
+//# sourceMappingURL=appPermissionBuild.spec.js.map

package/dist/engine/apps/appPermissionBuild.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionBuild.spec.js","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionBuild.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,IAAI,YAAoB,CAAC;IAEzB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,YAAY,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;QAC9E,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAEnF,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC;YAC1B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;YACxC,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,CAAC,eAAe,CAAC;YAC5B,QAAQ,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACtC,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,uBAAuB,CAAC,YAAY,EAAE,iBAAiB,EAAE;YAC7D,YAAY;YACZ,UAAU;YACV,6BAA6B;YAC7B,+BAA+B;SAChC,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;QAC9E,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAChE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACjE,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACpE,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/apps/appPermissionStateGrant.d.ts

@@ -0,0 +1,7 @@
+import type { PermissionAccess } from "@/types";
+/**
+ * Grants one shared permission tag for an app and persists it in app state.
+ * Expects: workspaceDir/appId point to an installed app workspace.
+ */
+export declare function appPermissionStateGrant(workspaceDir: string, appId: string, access: PermissionAccess): Promise<string[]>;
+//# sourceMappingURL=appPermissionStateGrant.d.ts.map

package/dist/engine/apps/appPermissionStateGrant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionStateGrant.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionStateGrant.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAKhD;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,MAAM,EAAE,CAAC,CAKnB"}

package/dist/engine/apps/appPermissionStateGrant.js

@@ -0,0 +1,14 @@
+import { permissionFormatTag } from "../permissions/permissionFormatTag.js";
+import { appPermissionStateRead } from "./appPermissionStateRead.js";
+import { appPermissionStateWrite } from "./appPermissionStateWrite.js";
+/**
+ * Grants one shared permission tag for an app and persists it in app state.
+ * Expects: workspaceDir/appId point to an installed app workspace.
+ */
+export async function appPermissionStateGrant(workspaceDir, appId, access) {
+    const current = await appPermissionStateRead(workspaceDir, appId);
+    const next = Array.from(new Set([...current, permissionFormatTag(access)]));
+    await appPermissionStateWrite(workspaceDir, appId, next);
+    return next;
+}
+//# sourceMappingURL=appPermissionStateGrant.js.map

package/dist/engine/apps/appPermissionStateGrant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionStateGrant.js","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionStateGrant.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAAoB,EACpB,KAAa,EACb,MAAwB;IAExB,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,uBAAuB,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/engine/apps/appPermissionStateGrant.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=appPermissionStateGrant.spec.d.ts.map

package/dist/engine/apps/appPermissionStateGrant.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionStateGrant.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionStateGrant.spec.ts"],"names":[],"mappings":""}

package/dist/engine/apps/appPermissionStateGrant.spec.js

@@ -0,0 +1,33 @@
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { appPermissionStateGrant } from "./appPermissionStateGrant.js";
+import { appPermissionStatePathBuild } from "./appPermissionStatePathBuild.js";
+import { appPermissionStateRead } from "./appPermissionStateRead.js";
+describe("appPermissionStateGrant", () => {
+    let workspaceDir;
+    beforeEach(async () => {
+        workspaceDir = await fs.mkdtemp(path.join(os.tmpdir(), "daycare-app-state-"));
+    });
+    afterEach(async () => {
+        await fs.rm(workspaceDir, { recursive: true, force: true });
+    });
+    it("persists shared app permissions in app workspace state.json", async () => {
+        await appPermissionStateGrant(workspaceDir, "github-reviewer", { kind: "workspace" });
+        await appPermissionStateGrant(workspaceDir, "github-reviewer", { kind: "network" });
+        await appPermissionStateGrant(workspaceDir, "github-reviewer", {
+            kind: "read",
+            path: "/tmp/daycare-app-read"
+        });
+        await appPermissionStateGrant(workspaceDir, "github-reviewer", {
+            kind: "network"
+        });
+        const statePath = appPermissionStatePathBuild(workspaceDir, "github-reviewer");
+        const stat = await fs.stat(statePath);
+        expect(stat.isFile()).toBe(true);
+        const tags = await appPermissionStateRead(workspaceDir, "github-reviewer");
+        expect(tags).toEqual(["@workspace", "@network", "@read:/tmp/daycare-app-read"]);
+    });
+});
+//# sourceMappingURL=appPermissionStateGrant.spec.js.map

package/dist/engine/apps/appPermissionStateGrant.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionStateGrant.spec.js","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionStateGrant.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAErE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,IAAI,YAAoB,CAAC;IAEzB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,YAAY,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,uBAAuB,CAAC,YAAY,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACtF,MAAM,uBAAuB,CAAC,YAAY,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACpF,MAAM,uBAAuB,CAAC,YAAY,EAAE,iBAAiB,EAAE;YAC7D,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,uBAAuB;SAC9B,CAAC,CAAC;QACH,MAAM,uBAAuB,CAAC,YAAY,EAAE,iBAAiB,EAAE;YAC7D,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,2BAA2B,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEjC,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;QAC3E,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,6BAA6B,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/apps/appPermissionStatePathBuild.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Builds the app permission state file path under the app workspace.
+ * Expects: workspaceDir is absolute; appId is a validated app id.
+ */
+export declare function appPermissionStatePathBuild(workspaceDir: string, appId: string): string;
+//# sourceMappingURL=appPermissionStatePathBuild.d.ts.map

package/dist/engine/apps/appPermissionStatePathBuild.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionStatePathBuild.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionStatePathBuild.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvF"}

package/dist/engine/apps/appPermissionStatePathBuild.js

@@ -0,0 +1,9 @@
+import path from "node:path";
+/**
+ * Builds the app permission state file path under the app workspace.
+ * Expects: workspaceDir is absolute; appId is a validated app id.
+ */
+export function appPermissionStatePathBuild(workspaceDir, appId) {
+    return path.join(path.resolve(workspaceDir), "apps", appId, "state.json");
+}
+//# sourceMappingURL=appPermissionStatePathBuild.js.map

package/dist/engine/apps/appPermissionStatePathBuild.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionStatePathBuild.js","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionStatePathBuild.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,YAAoB,EAAE,KAAa;IAC7E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;AAC5E,CAAC"}

package/dist/engine/apps/appPermissionStateRead.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Reads shared app permission tags from app workspace state.
+ * Expects: workspaceDir is absolute; appId is a validated app id.
+ */
+export declare function appPermissionStateRead(workspaceDir: string, appId: string): Promise<string[]>;
+//# sourceMappingURL=appPermissionStateRead.d.ts.map

package/dist/engine/apps/appPermissionStateRead.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionStateRead.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionStateRead.ts"],"names":[],"mappings":"AAeA;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAsBnG"}

package/dist/engine/apps/appPermissionStateRead.js

@@ -0,0 +1,40 @@
+import { promises as fs } from "node:fs";
+import { z } from "zod";
+import { permissionAccessParse } from "../permissions/permissionAccessParse.js";
+import { permissionFormatTag } from "../permissions/permissionFormatTag.js";
+import { appPermissionStatePathBuild } from "./appPermissionStatePathBuild.js";
+const appPermissionStateSchema = z
+    .object({
+    permissions: z.array(z.string().min(1)).optional(),
+    updatedAt: z.number().int().optional()
+})
+    .strip();
+/**
+ * Reads shared app permission tags from app workspace state.
+ * Expects: workspaceDir is absolute; appId is a validated app id.
+ */
+export async function appPermissionStateRead(workspaceDir, appId) {
+    const filePath = appPermissionStatePathBuild(workspaceDir, appId);
+    let raw = "";
+    try {
+        raw = await fs.readFile(filePath, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return [];
+        }
+        throw error;
+    }
+    const parsed = appPermissionStateSchema.parse(JSON.parse(raw));
+    const next = new Set();
+    for (const permission of parsed.permissions ?? []) {
+        try {
+            next.add(permissionFormatTag(permissionAccessParse(permission)));
+        }
+        catch {
+            // Skip invalid persisted tags to keep startup resilient.
+        }
+    }
+    return [...next];
+}
+//# sourceMappingURL=appPermissionStateRead.js.map

package/dist/engine/apps/appPermissionStateRead.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionStateRead.js","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionStateRead.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAE/E,MAAM,wBAAwB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC;KACD,KAAK,EAAE,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,YAAoB,EAAE,KAAa;IAC9E,MAAM,QAAQ,GAAG,2BAA2B,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAClE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC"}

package/dist/engine/apps/appPermissionStateWrite.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Persists shared app permission tags to app workspace state.
+ * Expects: permission tags are parseable by permissionAccessParse.
+ */
+export declare function appPermissionStateWrite(workspaceDir: string, appId: string, permissions: string[]): Promise<void>;
+//# sourceMappingURL=appPermissionStateWrite.d.ts.map

package/dist/engine/apps/appPermissionStateWrite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionStateWrite.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionStateWrite.ts"],"names":[],"mappings":"AAQA;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EAAE,GACpB,OAAO,CAAC,IAAI,CAAC,CAaf"}

package/dist/engine/apps/appPermissionStateWrite.js

@@ -0,0 +1,32 @@
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { permissionAccessParse } from "../permissions/permissionAccessParse.js";
+import { permissionFormatTag } from "../permissions/permissionFormatTag.js";
+import { atomicWrite } from "../../util/atomicWrite.js";
+import { appPermissionStatePathBuild } from "./appPermissionStatePathBuild.js";
+/**
+ * Persists shared app permission tags to app workspace state.
+ * Expects: permission tags are parseable by permissionAccessParse.
+ */
+export async function appPermissionStateWrite(workspaceDir, appId, permissions) {
+    const filePath = appPermissionStatePathBuild(workspaceDir, appId);
+    const normalized = permissionTagsNormalize(permissions);
+    await fs.mkdir(path.dirname(filePath), { recursive: true });
+    const payload = `${JSON.stringify({
+        permissions: normalized,
+        updatedAt: Date.now()
+    }, null, 2)}\n`;
+    await atomicWrite(filePath, payload);
+}
+function permissionTagsNormalize(permissions) {
+    const next = new Set();
+    for (const permission of permissions) {
+        const trimmed = permission.trim();
+        if (!trimmed) {
+            continue;
+        }
+        next.add(permissionFormatTag(permissionAccessParse(trimmed)));
+    }
+    return [...next];
+}
+//# sourceMappingURL=appPermissionStateWrite.js.map

package/dist/engine/apps/appPermissionStateWrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionStateWrite.js","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionStateWrite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAAoB,EACpB,KAAa,EACb,WAAqB;IAErB,MAAM,QAAQ,GAAG,2BAA2B,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,CAC/B;QACE,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CAAC;IACN,MAAM,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,uBAAuB,CAAC,WAAqB;IACpD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC"}

package/dist/engine/apps/appPermissionsParse.d.ts

@@ -0,0 +1,7 @@
+import type { AppPermissions } from "./appTypes.js";
+/**
+ * Parses PERMISSIONS.md content into an AppPermissions shape.
+ * Expects: markdown contains `## Source Intent` and `## Rules` sections.
+ */
+export declare function appPermissionsParse(content: string): AppPermissions;
+//# sourceMappingURL=appPermissionsParse.d.ts.map

package/dist/engine/apps/appPermissionsParse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionsParse.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionsParse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAW,MAAM,eAAe,CAAC;AAE7D;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAgBnE"}

package/dist/engine/apps/appPermissionsParse.js

@@ -0,0 +1,62 @@
+/**
+ * Parses PERMISSIONS.md content into an AppPermissions shape.
+ * Expects: markdown contains `## Source Intent` and `## Rules` sections.
+ */
+export function appPermissionsParse(content) {
+    const sourceIntent = markdownSectionRead(content, "Source Intent", 2);
+    if (!sourceIntent) {
+        throw new Error("PERMISSIONS.md must include a non-empty `## Source Intent` section.");
+    }
+    const rulesBody = markdownSectionRead(content, "Rules", 2);
+    const allowBody = markdownSectionRead(rulesBody, "Allow", 3);
+    const denyBody = markdownSectionRead(rulesBody, "Deny", 3);
+    return {
+        sourceIntent,
+        rules: {
+            allow: markdownRulesParse(allowBody),
+            deny: markdownRulesParse(denyBody)
+        }
+    };
+}
+function markdownSectionRead(markdown, heading, level) {
+    const lines = markdown.split("\n");
+    const escapedHeading = heading.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const headingPattern = new RegExp(`^${"#".repeat(level)}\\s+${escapedHeading}\\s*$`, "i");
+    const stopPattern = level === 2
+        ? /^##\s+/
+        : /^##\s+|^###\s+/;
+    let collecting = false;
+    const sectionLines = [];
+    for (const line of lines) {
+        if (!collecting) {
+            if (headingPattern.test(line.trim())) {
+                collecting = true;
+            }
+            continue;
+        }
+        if (stopPattern.test(line.trim())) {
+            break;
+        }
+        sectionLines.push(line);
+    }
+    return sectionLines.join("\n").trim();
+}
+function markdownRulesParse(body) {
+    if (!body) {
+        return [];
+    }
+    const rules = [];
+    for (const line of body.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith("- ")) {
+            continue;
+        }
+        const text = trimmed.slice(2).trim();
+        if (!text) {
+            continue;
+        }
+        rules.push({ text });
+    }
+    return rules;
+}
+//# sourceMappingURL=appPermissionsParse.js.map

package/dist/engine/apps/appPermissionsParse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionsParse.js","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionsParse.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3D,OAAO;QACL,YAAY;QACZ,KAAK,EAAE;YACL,KAAK,EAAE,kBAAkB,CAAC,SAAS,CAAC;YACpC,IAAI,EAAE,kBAAkB,CAAC,QAAQ,CAAC;SACnC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAgB,EAChB,OAAe,EACf,KAAY;IAEZ,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,cAAc,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1F,MAAM,WAAW,GAAG,KAAK,KAAK,CAAC;QAC7B,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,gBAAgB,CAAC;IACrB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACrC,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAClC,MAAM;QACR,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/engine/apps/appPermissionsParse.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=appPermissionsParse.spec.d.ts.map

package/dist/engine/apps/appPermissionsParse.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionsParse.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionsParse.spec.ts"],"names":[],"mappings":""}

package/dist/engine/apps/appPermissionsParse.spec.js

@@ -0,0 +1,31 @@
+import { describe, expect, it } from "vitest";
+import { appPermissionsParse } from "./appPermissionsParse.js";
+describe("appPermissionsParse", () => {
+    it("parses source intent and allow/deny rules", () => {
+        const permissions = appPermissionsParse([
+            "## Source Intent",
+            "",
+            "Review pull requests safely.",
+            "",
+            "## Rules",
+            "",
+            "### Allow",
+            "- Read files",
+            "",
+            "### Deny",
+            "- Delete files"
+        ].join("\n"));
+        expect(permissions).toEqual({
+            sourceIntent: "Review pull requests safely.",
+            rules: {
+                allow: [{ text: "Read files" }],
+                deny: [{ text: "Delete files" }]
+            }
+        });
+    });
+    it("throws when source intent is missing", () => {
+        expect(() => appPermissionsParse("## Rules\n\n### Allow\n- Read files\n\n### Deny\n- Delete files"))
+            .toThrow("PERMISSIONS.md must include a non-empty `## Source Intent` section.");
+    });
+});
+//# sourceMappingURL=appPermissionsParse.spec.js.map

package/dist/engine/apps/appPermissionsParse.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionsParse.spec.js","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionsParse.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,WAAW,GAAG,mBAAmB,CACrC;YACE,kBAAkB;YAClB,EAAE;YACF,8BAA8B;YAC9B,EAAE;YACF,UAAU;YACV,EAAE;YACF,WAAW;YACX,cAAc;YACd,EAAE;YACF,UAAU;YACV,gBAAgB;SACjB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QAEF,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC;YAC1B,YAAY,EAAE,8BAA8B;YAC5C,KAAK,EAAE;gBACL,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;gBAC/B,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;aACjC;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,iEAAiE,CAAC,CAAC;aACjG,OAAO,CAAC,qEAAqE,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/apps/appPermissionsSerialize.d.ts

@@ -0,0 +1,7 @@
+import type { AppPermissions } from "./appTypes.js";
+/**
+ * Serializes app permissions back to PERMISSIONS.md markdown format.
+ * Expects: permissions have already been validated and normalized.
+ */
+export declare function appPermissionsSerialize(permissions: AppPermissions): string;
+//# sourceMappingURL=appPermissionsSerialize.d.ts.map

package/dist/engine/apps/appPermissionsSerialize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionsSerialize.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionsSerialize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,cAAc,GAAG,MAAM,CAc3E"}

package/dist/engine/apps/appPermissionsSerialize.js

@@ -0,0 +1,20 @@
+/**
+ * Serializes app permissions back to PERMISSIONS.md markdown format.
+ * Expects: permissions have already been validated and normalized.
+ */
+export function appPermissionsSerialize(permissions) {
+    return [
+        "## Source Intent",
+        "",
+        permissions.sourceIntent.trim(),
+        "",
+        "## Rules",
+        "",
+        "### Allow",
+        ...permissions.rules.allow.map((rule) => `- ${rule.text}`),
+        "",
+        "### Deny",
+        ...permissions.rules.deny.map((rule) => `- ${rule.text}`)
+    ].join("\n").trimEnd();
+}
+//# sourceMappingURL=appPermissionsSerialize.js.map

package/dist/engine/apps/appPermissionsSerialize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionsSerialize.js","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionsSerialize.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAA2B;IACjE,OAAO;QACL,kBAAkB;QAClB,EAAE;QACF,WAAW,CAAC,YAAY,CAAC,IAAI,EAAE;QAC/B,EAAE;QACF,UAAU;QACV,EAAE;QACF,WAAW;QACX,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1D,EAAE;QACF,UAAU;QACV,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;KAC1D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AACzB,CAAC"}

package/dist/engine/apps/appPermissionsSerialize.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=appPermissionsSerialize.spec.d.ts.map

package/dist/engine/apps/appPermissionsSerialize.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionsSerialize.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionsSerialize.spec.ts"],"names":[],"mappings":""}

package/dist/engine/apps/appPermissionsSerialize.spec.js

@@ -0,0 +1,20 @@
+import { describe, expect, it } from "vitest";
+import { appPermissionsSerialize } from "./appPermissionsSerialize.js";
+describe("appPermissionsSerialize", () => {
+    it("serializes source intent and rules into markdown", () => {
+        const output = appPermissionsSerialize({
+            sourceIntent: "Review pull requests safely.",
+            rules: {
+                allow: [{ text: "Read files" }],
+                deny: [{ text: "Delete files" }]
+            }
+        });
+        expect(output).toContain("## Source Intent");
+        expect(output).toContain("Review pull requests safely.");
+        expect(output).toContain("### Allow");
+        expect(output).toContain("- Read files");
+        expect(output).toContain("### Deny");
+        expect(output).toContain("- Delete files");
+    });
+});
+//# sourceMappingURL=appPermissionsSerialize.spec.js.map

package/dist/engine/apps/appPermissionsSerialize.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionsSerialize.spec.js","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionsSerialize.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,YAAY,EAAE,8BAA8B;YAC5C,KAAK,EAAE;gBACL,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;gBAC/B,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;aACjC;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/apps/appPermissionsValidate.d.ts

@@ -0,0 +1,7 @@
+import type { AppPermissions } from "./appTypes.js";
+/**
+ * Validates and normalizes app permissions metadata.
+ * Expects: permissions were parsed from PERMISSIONS.md.
+ */
+export declare function appPermissionsValidate(permissions: AppPermissions): AppPermissions;
+//# sourceMappingURL=appPermissionsValidate.d.ts.map

package/dist/engine/apps/appPermissionsValidate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appPermissionsValidate.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appPermissionsValidate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,eAAe,CAAC;AAEhE;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,cAAc,GAAG,cAAc,CAWlF"}