occ-cloudflare 0.1.0 → 0.2.0

package/dist/index.d.ts

@@ -21,6 +21,18 @@ export interface OCCCloudflareOptions {
     measurement?: string;
     /** Agent identifier for metadata. Default: "cloudflare-worker" */
     agentId?: string;
+    /** Raw policy markdown content. Since Cloudflare Workers cannot use
+     *  node:fs, pass the policy content directly (e.g. from KV, D1, or
+     *  an environment variable). The policy is committed as slot 0 and
+     *  tools not in the allowedTools list will be blocked. */
+    policyContent?: string;
+    /** Pre-built policy binding (alternative to policyContent). */
+    policyBinding?: {
+        digestB64: string;
+        authorProofDigestB64?: string;
+        name?: string;
+        version?: string;
+    };
 }
 export interface ProofLogEntry {
     timestamp: string;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAA6B,KAAK,QAAQ,EAAyB,MAAM,UAAU,CAAC;AAQ3F,MAAM,WAAW,oBAAoB;IACnC,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAAC;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,QAAQ,CAAC;CACnB;AAED,MAAM,WAAW,aAAa,CAAC,CAAC,GAAG,OAAO;IACxC,+BAA+B;IAC/B,MAAM,EAAE,CAAC,CAAC;IACV,2CAA2C;IAC3C,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB;AAyHD;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS;IAAE,OAAO,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;CAAE,EACzE,IAAI,EAAE,CAAC,EACP,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,oBAAoB,GAC7B,CAAC,GAAG;IAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,aAAa,CAAC,CAAA;CAAE,CA0D7D;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1D,OAAO,EAAE,CAAC,EACV,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,oBAAoB,GAC7B,CAAC,CAiEH;AAED;;;GAGG;AACH,wBAAgB,WAAW,IAAI,IAAI,CAElC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAA6B,KAAK,QAAQ,EAAyB,MAAM,UAAU,CAAC;AAQ3F,MAAM,WAAW,oBAAoB;IACnC,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;8DAG0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,aAAa,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACvG;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAAC;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,QAAQ,CAAC;CACnB;AAED,MAAM,WAAW,aAAa,CAAC,CAAC,GAAG,OAAO;IACxC,+BAA+B;IAC/B,MAAM,EAAE,CAAC,CAAC;IACV,2CAA2C;IAC3C,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB;AAuLD;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS;IAAE,OAAO,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;CAAE,EACzE,IAAI,EAAE,CAAC,EACP,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,oBAAoB,GAC7B,CAAC,GAAG;IAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,aAAa,CAAC,CAAA;CAAE,CA8F7D;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1D,OAAO,EAAE,CAAC,EACV,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,oBAAoB,GAC7B,CAAC,CAqGH;AAED;;;GAGG;AACH,wBAAgB,WAAW,IAAI,IAAI,CAElC"}

package/dist/index.js

@@ -54,7 +54,7 @@ class InMemoryHost {
     }
 }
 let signerPromise;
-async function getSigner(measurement) {
+async function getSigner(measurement, opts) {
     if (signerPromise)
         return signerPromise;
     signerPromise = (async () => {
@@ -67,7 +67,49 @@ async function getSigner(measurement) {
             policy: { requireCounter: true, requireTime: true },
         });
         const publicKeyB64 = uint8ToBase64(publicKey);
-        return { constructor, host, publicKeyB64, lastProofHash: undefined };
+        const state = { constructor, host, publicKeyB64, lastProofHash: undefined };
+        // ── Policy enforcement: commit policy as slot 0 ──
+        if (opts?.policyContent) {
+            const policyMd = opts.policyContent;
+            const policyBytes = new TextEncoder().encode(policyMd);
+            const policyDigestB64 = uint8ToBase64(sha256(policyBytes));
+            // Parse allowed tools for enforcement
+            const allowedTools = new Set();
+            const toolSection = policyMd.match(/##\s+Allowed\s+Tools[\s\S]*?(?=\n##|$)/i);
+            if (toolSection) {
+                const toolLines = toolSection[0].split("\n");
+                for (const line of toolLines) {
+                    const match = line.match(/^[-*]\s+(.+)/);
+                    if (match)
+                        allowedTools.add(match[1].trim());
+                }
+            }
+            // Extract name
+            const nameMatch = policyMd.match(/^#\s+Policy:\s*(.+)/m);
+            const name = nameMatch ? nameMatch[1].trim() : undefined;
+            // Commit the policy as a proof (slot 0)
+            const commitInput = {
+                digestB64: policyDigestB64,
+                metadata: { kind: "policy-commitment", policyName: name, adapter: "occ-cloudflare" },
+            };
+            if (state.lastProofHash)
+                commitInput.prevProofHashB64 = state.lastProofHash;
+            const policyProof = await constructor.commitDigest(commitInput);
+            const proofHash = uint8ToBase64(sha256(canonicalize(policyProof)));
+            state.lastProofHash = proofHash;
+            state.policy = {
+                binding: {
+                    digestB64: policyDigestB64,
+                    authorProofDigestB64: proofHash,
+                    name,
+                },
+                allowedTools: allowedTools.size > 0 ? allowedTools : undefined,
+            };
+        }
+        else if (opts?.policyBinding) {
+            state.policy = { binding: opts.policyBinding };
+        }
+        return state;
     })();
     return signerPromise;
 }
@@ -89,6 +131,8 @@ async function signDigest(digestB64, metadata, signer) {
     const commitInput = { digestB64, metadata };
     if (signer.lastProofHash)
         commitInput.prevProofHashB64 = signer.lastProofHash;
+    if (signer.policy?.binding)
+        commitInput.policy = signer.policy.binding;
     const proof = await signer.constructor.commitDigest(commitInput);
     // Chain: store this proof's hash for the next commit
     const proofHash = uint8ToBase64(sha256(canonicalize(proof)));
@@ -116,10 +160,41 @@ export function occWrapTool(tool, name, options) {
     if (!originalExecute) {
         return { ...tool, execute: async () => ({ result: undefined, proofs: [] }) };
     }
+    const policyContent = options?.policyContent;
+    const policyBinding = options?.policyBinding;
     const wrappedExecute = async (...args) => {
         const toolArgs = args[0] ?? {};
-        const signer = await getSigner(measurement);
+        const signer = await getSigner(measurement, { policyContent, policyBinding });
         const proofs = [];
+        // ── Policy enforcement: block tools not in the allowlist ──
+        if (signer.policy?.allowedTools && !signer.policy.allowedTools.has(name)) {
+            const denialDigest = hashPayload({
+                tool: name,
+                args: toolArgs,
+                denied: true,
+                reason: `Tool "${name}" not in policy allowedTools`,
+            });
+            const denialProof = await signDigest(denialDigest, {
+                phase: "pre-execution",
+                tool: name,
+                agentId,
+                denied: true,
+                reason: `Tool "${name}" not in policy allowedTools`,
+            }, signer);
+            proofs.push({
+                timestamp: new Date().toISOString(),
+                phase: "pre-execution",
+                tool: name,
+                agentId,
+                args: toolArgs,
+                proofDigestB64: denialDigest,
+                receipt: denialProof,
+            });
+            return {
+                result: `[OCC] Tool "${name}" blocked by policy. Not in allowed tools list.`,
+                proofs,
+            };
+        }
         // Pre-execution proof
         const preDigest = hashPayload({ tool: name, args: toolArgs });
         const preProof = await signDigest(preDigest, {
@@ -177,6 +252,8 @@ export function occWrapTool(tool, name, options) {
 export function occWrapBinding(binding, name, options) {
     const measurement = options?.measurement ?? "occ-cloudflare:stub";
     const agentId = options?.agentId ?? "cloudflare-worker";
+    const policyContent = options?.policyContent;
+    const policyBinding = options?.policyBinding;
     return new Proxy(binding, {
         get(target, prop) {
             const original = target[prop];
@@ -184,8 +261,37 @@ export function occWrapBinding(binding, name, options) {
                 return original;
             return async (...args) => {
                 const methodName = `${name}.${String(prop)}`;
-                const signer = await getSigner(measurement);
+                const signer = await getSigner(measurement, { policyContent, policyBinding });
                 const proofs = [];
+                // ── Policy enforcement: block tools not in the allowlist ──
+                if (signer.policy?.allowedTools && !signer.policy.allowedTools.has(methodName)) {
+                    const denialDigest = hashPayload({
+                        tool: methodName,
+                        args: args.length === 1 ? args[0] : args,
+                        denied: true,
+                        reason: `Tool "${methodName}" not in policy allowedTools`,
+                    });
+                    const denialProof = await signDigest(denialDigest, {
+                        phase: "pre-execution",
+                        tool: methodName,
+                        agentId,
+                        denied: true,
+                        reason: `Tool "${methodName}" not in policy allowedTools`,
+                    }, signer);
+                    proofs.push({
+                        timestamp: new Date().toISOString(),
+                        phase: "pre-execution",
+                        tool: methodName,
+                        agentId,
+                        args: args.length === 1 ? args[0] : { _args: args },
+                        proofDigestB64: denialDigest,
+                        receipt: denialProof,
+                    });
+                    return {
+                        result: `[OCC] Tool "${methodName}" blocked by policy. Not in allowed tools list.`,
+                        proofs,
+                    };
+                }
                 // Pre-execution proof
                 const preDigest = hashPayload({
                     tool: methodName,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,mCAAmC;AAEnC;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAwC,MAAM,UAAU,CAAC;AAC3F,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAC;AA0CrC,MAAM,YAAY;IACP,eAAe,GAAG,MAAe,CAAC;IAClC,WAAW,CAAa;IACxB,UAAU,CAAa;IACvB,YAAY,CAAS;IAC9B,QAAQ,GAAG,EAAE,CAAC;IAEd,YAAY,UAAsB,EAAE,SAAqB,EAAE,WAAmB;QAC5E,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;QAC9B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,OAAO,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;CACF;AAED,IAAI,aAA+C,CAAC;AAEpD,KAAK,UAAU,SAAS,CAAC,WAAmB;IAC1C,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,aAAa,GAAG,CAAC,KAAK,IAAI,EAAE;QAC1B,gDAAgD;QAChD,MAAM,UAAU,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAEzD,MAAM,IAAI,GAAG,IAAI,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAElE,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC;YAC/C,IAAI;YACJ,MAAM,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;SACpD,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QAC9C,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;IACvE,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,8EAA8E;AAC9E,8DAA8D;AAC9D,8EAA8E;AAE9E,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,WAAW,CAAC,IAAa;IAChC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,SAAiB,EACjB,QAAiC,EACjC,MAAmB;IAEnB,MAAM,WAAW,GAIb,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAE5B,IAAI,MAAM,CAAC,aAAa;QAAE,WAAW,CAAC,gBAAgB,GAAG,MAAM,CAAC,aAAa,CAAC;IAE9E,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAEjE,qDAAqD;IACrD,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,aAAa,GAAG,SAAS,CAAC;IAEjC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CACzB,IAAO,EACP,IAAY,EACZ,OAA8B;IAE9B,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,qBAAqB,CAAC;IAClE,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,mBAAmB,CAAC;IAExD,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC;IACrC,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAS,CAAC;IACtF,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,EAAE,GAAG,IAAW,EAA0B,EAAE;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,sBAAsB;QACtB,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE;YAC3C,KAAK,EAAE,eAAe;YACtB,IAAI,EAAE,IAAI;YACV,OAAO;SACR,EAAE,MAAM,CAAC,CAAC;QAEX,MAAM,CAAC,IAAI,CAAC;YACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,eAAe;YACtB,IAAI,EAAE,IAAI;YACV,OAAO;YACP,IAAI,EAAE,QAAQ;YACd,cAAc,EAAE,SAAS;YACzB,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;QAEH,wBAAwB;QACxB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAEvD,uBAAuB;QACvB,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE;YAC7C,KAAK,EAAE,gBAAgB;YACvB,IAAI,EAAE,IAAI;YACV,OAAO;SACR,EAAE,MAAM,CAAC,CAAC;QAEX,MAAM,CAAC,IAAI,CAAC;YACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,gBAAgB;YACvB,IAAI,EAAE,IAAI;YACV,OAAO;YACP,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM;YACnE,cAAc,EAAE,UAAU;YAC1B,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;QAEH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC,CAAC;IAEF,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,cAAc,EAAS,CAAC;AACrD,CAAC;AAED,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAU,EACV,IAAY,EACZ,OAA8B;IAE9B,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,qBAAqB,CAAC;IAClE,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,mBAAmB,CAAC;IAExD,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE;QACxB,GAAG,CAAC,MAAM,EAAE,IAAqB;YAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAe,CAAC,CAAC;YACzC,IAAI,OAAO,QAAQ,KAAK,UAAU;gBAAE,OAAO,QAAQ,CAAC;YAEpD,OAAO,KAAK,EAAE,GAAG,IAAW,EAA0B,EAAE;gBACtD,MAAM,UAAU,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;gBAC5C,MAAM,MAAM,GAAoB,EAAE,CAAC;gBAEnC,sBAAsB;gBACtB,MAAM,SAAS,GAAG,WAAW,CAAC;oBAC5B,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;iBACzC,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE;oBAC3C,KAAK,EAAE,eAAe;oBACtB,IAAI,EAAE,UAAU;oBAChB,OAAO;iBACR,EAAE,MAAM,CAAC,CAAC;gBAEX,MAAM,CAAC,IAAI,CAAC;oBACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,KAAK,EAAE,eAAe;oBACtB,IAAI,EAAE,UAAU;oBAChB,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE;oBACnD,cAAc,EAAE,SAAS;oBACzB,OAAO,EAAE,QAAQ;iBAClB,CAAC,CAAC;gBAEH,0BAA0B;gBAC1B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAElD,uBAAuB;gBACvB,MAAM,UAAU,GAAG,WAAW,CAAC;oBAC7B,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;oBACxC,MAAM;iBACP,CAAC,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE;oBAC7C,KAAK,EAAE,gBAAgB;oBACvB,IAAI,EAAE,UAAU;oBAChB,OAAO;iBACR,EAAE,MAAM,CAAC,CAAC;gBAEX,MAAM,CAAC,IAAI,CAAC;oBACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,KAAK,EAAE,gBAAgB;oBACvB,IAAI,EAAE,UAAU;oBAChB,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE;oBACnD,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM;oBACnE,cAAc,EAAE,UAAU;oBAC1B,OAAO,EAAE,SAAS;iBACnB,CAAC,CAAC;gBAEH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAC5B,CAAC,CAAC;QACJ,CAAC;KACF,CAAM,CAAC;AACV,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,aAAa,GAAG,SAAS,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,mCAAmC;AAEnC;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAwC,MAAM,UAAU,CAAC;AAC3F,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAwDrC,MAAM,YAAY;IACP,eAAe,GAAG,MAAe,CAAC;IAClC,WAAW,CAAa;IACxB,UAAU,CAAa;IACvB,YAAY,CAAS;IAC9B,QAAQ,GAAG,EAAE,CAAC;IAEd,YAAY,UAAsB,EAAE,SAAqB,EAAE,WAAmB;QAC5E,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;QAC9B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,OAAO,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;CACF;AAED,IAAI,aAA+C,CAAC;AAEpD,KAAK,UAAU,SAAS,CAAC,WAAmB,EAAE,IAG7C;IACC,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,aAAa,GAAG,CAAC,KAAK,IAAI,EAAE;QAC1B,gDAAgD;QAChD,MAAM,UAAU,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAEzD,MAAM,IAAI,GAAG,IAAI,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAElE,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC;YAC/C,IAAI;YACJ,MAAM,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;SACpD,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAgB,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;QAEzF,oDAAoD;QACpD,IAAI,IAAI,EAAE,aAAa,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;YACpC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvD,MAAM,eAAe,GAAG,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;YAE3D,sCAAsC;YACtC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;YACvC,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC9E,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC7C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;oBAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;oBACzC,IAAI,KAAK;wBAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;YAED,eAAe;YACf,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACzD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAEzD,wCAAwC;YACxC,MAAM,WAAW,GAIb;gBACF,SAAS,EAAE,eAAe;gBAC1B,QAAQ,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE;aACrF,CAAC;YACF,IAAI,KAAK,CAAC,aAAa;gBAAE,WAAW,CAAC,gBAAgB,GAAG,KAAK,CAAC,aAAa,CAAC;YAE5E,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YAChE,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YACnE,KAAK,CAAC,aAAa,GAAG,SAAS,CAAC;YAEhC,KAAK,CAAC,MAAM,GAAG;gBACb,OAAO,EAAE;oBACP,SAAS,EAAE,eAAe;oBAC1B,oBAAoB,EAAE,SAAS;oBAC/B,IAAI;iBACL;gBACD,YAAY,EAAE,YAAY,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;aAC/D,CAAC;QACJ,CAAC;aAAM,IAAI,IAAI,EAAE,aAAa,EAAE,CAAC;YAC/B,KAAK,CAAC,MAAM,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;QACjD,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,8EAA8E;AAC9E,8DAA8D;AAC9D,8EAA8E;AAE9E,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,WAAW,CAAC,IAAa;IAChC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,SAAiB,EACjB,QAAiC,EACjC,MAAmB;IAEnB,MAAM,WAAW,GAKb,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAE5B,IAAI,MAAM,CAAC,aAAa;QAAE,WAAW,CAAC,gBAAgB,GAAG,MAAM,CAAC,aAAa,CAAC;IAC9E,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO;QAAE,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IAEvE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAEjE,qDAAqD;IACrD,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,aAAa,GAAG,SAAS,CAAC;IAEjC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CACzB,IAAO,EACP,IAAY,EACZ,OAA8B;IAE9B,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,qBAAqB,CAAC;IAClE,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,mBAAmB,CAAC;IAExD,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC;IACrC,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAS,CAAC;IACtF,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,CAAC;IAC7C,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,CAAC;IAE7C,MAAM,cAAc,GAAG,KAAK,EAAE,GAAG,IAAW,EAA0B,EAAE;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,6DAA6D;QAC7D,IAAI,MAAM,CAAC,MAAM,EAAE,YAAY,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzE,MAAM,YAAY,GAAG,WAAW,CAAC;gBAC/B,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,SAAS,IAAI,8BAA8B;aACpD,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE;gBACjD,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,IAAI;gBACV,OAAO;gBACP,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,SAAS,IAAI,8BAA8B;aACpD,EAAE,MAAM,CAAC,CAAC;YAEX,MAAM,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,IAAI;gBACV,OAAO;gBACP,IAAI,EAAE,QAAQ;gBACd,cAAc,EAAE,YAAY;gBAC5B,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YAEH,OAAO;gBACL,MAAM,EAAE,eAAe,IAAI,iDAAmE;gBAC9F,MAAM;aACP,CAAC;QACJ,CAAC;QAED,sBAAsB;QACtB,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE;YAC3C,KAAK,EAAE,eAAe;YACtB,IAAI,EAAE,IAAI;YACV,OAAO;SACR,EAAE,MAAM,CAAC,CAAC;QAEX,MAAM,CAAC,IAAI,CAAC;YACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,eAAe;YACtB,IAAI,EAAE,IAAI;YACV,OAAO;YACP,IAAI,EAAE,QAAQ;YACd,cAAc,EAAE,SAAS;YACzB,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;QAEH,wBAAwB;QACxB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAEvD,uBAAuB;QACvB,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE;YAC7C,KAAK,EAAE,gBAAgB;YACvB,IAAI,EAAE,IAAI;YACV,OAAO;SACR,EAAE,MAAM,CAAC,CAAC;QAEX,MAAM,CAAC,IAAI,CAAC;YACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,gBAAgB;YACvB,IAAI,EAAE,IAAI;YACV,OAAO;YACP,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM;YACnE,cAAc,EAAE,UAAU;YAC1B,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;QAEH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC,CAAC;IAEF,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,cAAc,EAAS,CAAC;AACrD,CAAC;AAED,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAU,EACV,IAAY,EACZ,OAA8B;IAE9B,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,qBAAqB,CAAC;IAClE,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,mBAAmB,CAAC;IAExD,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,CAAC;IAC7C,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,CAAC;IAE7C,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE;QACxB,GAAG,CAAC,MAAM,EAAE,IAAqB;YAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAe,CAAC,CAAC;YACzC,IAAI,OAAO,QAAQ,KAAK,UAAU;gBAAE,OAAO,QAAQ,CAAC;YAEpD,OAAO,KAAK,EAAE,GAAG,IAAW,EAA0B,EAAE;gBACtD,MAAM,UAAU,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC;gBAC9E,MAAM,MAAM,GAAoB,EAAE,CAAC;gBAEnC,6DAA6D;gBAC7D,IAAI,MAAM,CAAC,MAAM,EAAE,YAAY,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC/E,MAAM,YAAY,GAAG,WAAW,CAAC;wBAC/B,IAAI,EAAE,UAAU;wBAChB,IAAI,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;wBACxC,MAAM,EAAE,IAAI;wBACZ,MAAM,EAAE,SAAS,UAAU,8BAA8B;qBAC1D,CAAC,CAAC;oBAEH,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE;wBACjD,KAAK,EAAE,eAAe;wBACtB,IAAI,EAAE,UAAU;wBAChB,OAAO;wBACP,MAAM,EAAE,IAAI;wBACZ,MAAM,EAAE,SAAS,UAAU,8BAA8B;qBAC1D,EAAE,MAAM,CAAC,CAAC;oBAEX,MAAM,CAAC,IAAI,CAAC;wBACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,KAAK,EAAE,eAAe;wBACtB,IAAI,EAAE,UAAU;wBAChB,OAAO;wBACP,IAAI,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE;wBACnD,cAAc,EAAE,YAAY;wBAC5B,OAAO,EAAE,WAAW;qBACrB,CAAC,CAAC;oBAEH,OAAO;wBACL,MAAM,EAAE,eAAe,UAAU,iDAAmE;wBACpG,MAAM;qBACP,CAAC;gBACJ,CAAC;gBAED,sBAAsB;gBACtB,MAAM,SAAS,GAAG,WAAW,CAAC;oBAC5B,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;iBACzC,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE;oBAC3C,KAAK,EAAE,eAAe;oBACtB,IAAI,EAAE,UAAU;oBAChB,OAAO;iBACR,EAAE,MAAM,CAAC,CAAC;gBAEX,MAAM,CAAC,IAAI,CAAC;oBACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,KAAK,EAAE,eAAe;oBACtB,IAAI,EAAE,UAAU;oBAChB,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE;oBACnD,cAAc,EAAE,SAAS;oBACzB,OAAO,EAAE,QAAQ;iBAClB,CAAC,CAAC;gBAEH,0BAA0B;gBAC1B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAElD,uBAAuB;gBACvB,MAAM,UAAU,GAAG,WAAW,CAAC;oBAC7B,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;oBACxC,MAAM;iBACP,CAAC,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE;oBAC7C,KAAK,EAAE,gBAAgB;oBACvB,IAAI,EAAE,UAAU;oBAChB,OAAO;iBACR,EAAE,MAAM,CAAC,CAAC;gBAEX,MAAM,CAAC,IAAI,CAAC;oBACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,KAAK,EAAE,gBAAgB;oBACvB,IAAI,EAAE,UAAU;oBAChB,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE;oBACnD,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM;oBACnE,cAAc,EAAE,UAAU;oBAC1B,OAAO,EAAE,SAAS;iBACnB,CAAC,CAAC;gBAEH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAC5B,CAAC,CAAC;QACJ,CAAC;KACF,CAAM,CAAC;AACV,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,aAAa,GAAG,SAAS,CAAC;AAC5B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "occ-cloudflare",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "OCC cryptographic proof signing for Cloudflare Workers tool calls",
   "author": "Mike Argento",
   "license": "Apache-2.0",

package/src/index.ts

@@ -32,6 +32,13 @@ export interface OCCCloudflareOptions {
   measurement?: string;
   /** Agent identifier for metadata. Default: "cloudflare-worker" */
   agentId?: string;
+  /** Raw policy markdown content. Since Cloudflare Workers cannot use
+   *  node:fs, pass the policy content directly (e.g. from KV, D1, or
+   *  an environment variable). The policy is committed as slot 0 and
+   *  tools not in the allowedTools list will be blocked. */
+  policyContent?: string;
+  /** Pre-built policy binding (alternative to policyContent). */
+  policyBinding?: { digestB64: string; authorProofDigestB64?: string; name?: string; version?: string };
 }
 
 export interface ProofLogEntry {
@@ -56,11 +63,18 @@ export interface WrappedResult<T = unknown> {
 // In-memory signer (no filesystem, no occ-stub)
 // ---------------------------------------------------------------------------
 
+/** Policy binding state for the signer. */
+interface PolicyState {
+  binding: { digestB64: string; authorProofDigestB64?: string; name?: string; version?: string };
+  allowedTools?: Set<string>;
+}
+
 interface SignerState {
   constructor: Constructor;
   host: InMemoryHost;
   publicKeyB64: string;
   lastProofHash: string | undefined;
+  policy?: PolicyState;
 }
 
 class InMemoryHost implements HostCapabilities {
@@ -106,7 +120,10 @@ class InMemoryHost implements HostCapabilities {
 
 let signerPromise: Promise<SignerState> | undefined;
 
-async function getSigner(measurement: string): Promise<SignerState> {
+async function getSigner(measurement: string, opts?: {
+  policyContent?: string;
+  policyBinding?: { digestB64: string; authorProofDigestB64?: string; name?: string; version?: string };
+}): Promise<SignerState> {
   if (signerPromise) return signerPromise;
 
   signerPromise = (async () => {
@@ -122,7 +139,57 @@ async function getSigner(measurement: string): Promise<SignerState> {
     });
 
     const publicKeyB64 = uint8ToBase64(publicKey);
-    return { constructor, host, publicKeyB64, lastProofHash: undefined };
+    const state: SignerState = { constructor, host, publicKeyB64, lastProofHash: undefined };
+
+    // ── Policy enforcement: commit policy as slot 0 ──
+    if (opts?.policyContent) {
+      const policyMd = opts.policyContent;
+      const policyBytes = new TextEncoder().encode(policyMd);
+      const policyDigestB64 = uint8ToBase64(sha256(policyBytes));
+
+      // Parse allowed tools for enforcement
+      const allowedTools = new Set<string>();
+      const toolSection = policyMd.match(/##\s+Allowed\s+Tools[\s\S]*?(?=\n##|$)/i);
+      if (toolSection) {
+        const toolLines = toolSection[0].split("\n");
+        for (const line of toolLines) {
+          const match = line.match(/^[-*]\s+(.+)/);
+          if (match) allowedTools.add(match[1].trim());
+        }
+      }
+
+      // Extract name
+      const nameMatch = policyMd.match(/^#\s+Policy:\s*(.+)/m);
+      const name = nameMatch ? nameMatch[1].trim() : undefined;
+
+      // Commit the policy as a proof (slot 0)
+      const commitInput: {
+        digestB64: string;
+        metadata?: Record<string, unknown>;
+        prevProofHashB64?: string;
+      } = {
+        digestB64: policyDigestB64,
+        metadata: { kind: "policy-commitment", policyName: name, adapter: "occ-cloudflare" },
+      };
+      if (state.lastProofHash) commitInput.prevProofHashB64 = state.lastProofHash;
+
+      const policyProof = await constructor.commitDigest(commitInput);
+      const proofHash = uint8ToBase64(sha256(canonicalize(policyProof)));
+      state.lastProofHash = proofHash;
+
+      state.policy = {
+        binding: {
+          digestB64: policyDigestB64,
+          authorProofDigestB64: proofHash,
+          name,
+        },
+        allowedTools: allowedTools.size > 0 ? allowedTools : undefined,
+      };
+    } else if (opts?.policyBinding) {
+      state.policy = { binding: opts.policyBinding };
+    }
+
+    return state;
   })();
 
   return signerPromise;
@@ -154,9 +221,11 @@ async function signDigest(
     digestB64: string;
     metadata?: Record<string, unknown>;
     prevProofHashB64?: string;
+    policy?: { digestB64: string; authorProofDigestB64?: string; name?: string; version?: string };
   } = { digestB64, metadata };
 
   if (signer.lastProofHash) commitInput.prevProofHashB64 = signer.lastProofHash;
+  if (signer.policy?.binding) commitInput.policy = signer.policy.binding;
 
   const proof = await signer.constructor.commitDigest(commitInput);
 
@@ -195,11 +264,47 @@ export function occWrapTool<T extends { execute?: (...args: any[]) => any }>(
     return { ...tool, execute: async () => ({ result: undefined, proofs: [] }) } as any;
   }
 
+  const policyContent = options?.policyContent;
+  const policyBinding = options?.policyBinding;
+
   const wrappedExecute = async (...args: any[]): Promise<WrappedResult> => {
     const toolArgs = args[0] ?? {};
-    const signer = await getSigner(measurement);
+    const signer = await getSigner(measurement, { policyContent, policyBinding });
     const proofs: ProofLogEntry[] = [];
 
+    // ── Policy enforcement: block tools not in the allowlist ──
+    if (signer.policy?.allowedTools && !signer.policy.allowedTools.has(name)) {
+      const denialDigest = hashPayload({
+        tool: name,
+        args: toolArgs,
+        denied: true,
+        reason: `Tool "${name}" not in policy allowedTools`,
+      });
+
+      const denialProof = await signDigest(denialDigest, {
+        phase: "pre-execution",
+        tool: name,
+        agentId,
+        denied: true,
+        reason: `Tool "${name}" not in policy allowedTools`,
+      }, signer);
+
+      proofs.push({
+        timestamp: new Date().toISOString(),
+        phase: "pre-execution",
+        tool: name,
+        agentId,
+        args: toolArgs,
+        proofDigestB64: denialDigest,
+        receipt: denialProof,
+      });
+
+      return {
+        result: `[OCC] Tool "${name}" blocked by policy. Not in allowed tools list.` as unknown as any,
+        proofs,
+      };
+    }
+
     // Pre-execution proof
     const preDigest = hashPayload({ tool: name, args: toolArgs });
     const preProof = await signDigest(preDigest, {
@@ -270,6 +375,9 @@ export function occWrapBinding<B extends Record<string, any>>(
   const measurement = options?.measurement ?? "occ-cloudflare:stub";
   const agentId = options?.agentId ?? "cloudflare-worker";
 
+  const policyContent = options?.policyContent;
+  const policyBinding = options?.policyBinding;
+
   return new Proxy(binding, {
     get(target, prop: string | symbol) {
       const original = target[prop as keyof B];
@@ -277,9 +385,42 @@ export function occWrapBinding<B extends Record<string, any>>(
 
       return async (...args: any[]): Promise<WrappedResult> => {
         const methodName = `${name}.${String(prop)}`;
-        const signer = await getSigner(measurement);
+        const signer = await getSigner(measurement, { policyContent, policyBinding });
         const proofs: ProofLogEntry[] = [];
 
+        // ── Policy enforcement: block tools not in the allowlist ──
+        if (signer.policy?.allowedTools && !signer.policy.allowedTools.has(methodName)) {
+          const denialDigest = hashPayload({
+            tool: methodName,
+            args: args.length === 1 ? args[0] : args,
+            denied: true,
+            reason: `Tool "${methodName}" not in policy allowedTools`,
+          });
+
+          const denialProof = await signDigest(denialDigest, {
+            phase: "pre-execution",
+            tool: methodName,
+            agentId,
+            denied: true,
+            reason: `Tool "${methodName}" not in policy allowedTools`,
+          }, signer);
+
+          proofs.push({
+            timestamp: new Date().toISOString(),
+            phase: "pre-execution",
+            tool: methodName,
+            agentId,
+            args: args.length === 1 ? args[0] : { _args: args },
+            proofDigestB64: denialDigest,
+            receipt: denialProof,
+          });
+
+          return {
+            result: `[OCC] Tool "${methodName}" blocked by policy. Not in allowed tools list.` as unknown as any,
+            proofs,
+          };
+        }
+
         // Pre-execution proof
         const preDigest = hashPayload({
           tool: methodName,