p-spore 0.1.0

package/dist/policy/approval-service.js

@@ -0,0 +1,349 @@
+import { createHash, randomUUID } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { appendJsonLine, atomicWriteJson } from "../storage/atomic.js";
+export class ApprovalService {
+    #pendingPath;
+    #auditPath;
+    #grantsPath;
+    #timeoutMs;
+    #clock;
+    #idFactory;
+    #onRequested;
+    #onResolved;
+    #pending = new Map();
+    #resolved = new Set();
+    #jobGrants = new Map();
+    #mutation = Promise.resolve();
+    constructor(options) {
+        this.#pendingPath = options.pendingPath;
+        this.#auditPath = options.auditPath;
+        this.#grantsPath = options.grantsPath ?? join(dirname(options.pendingPath), "job-grants.json");
+        this.#timeoutMs = options.timeoutMs;
+        this.#clock = options.clock ?? (() => new Date());
+        this.#idFactory = options.idFactory ?? randomUUID;
+        this.#onRequested = options.onRequested;
+        this.#onResolved = options.onResolved;
+    }
+    async initialize() {
+        const grants = await readJobGrants(this.#grantsPath);
+        this.#jobGrants.clear();
+        for (const grant of grants) {
+            const key = jobGrantKey(grant.jobId, grant);
+            if (this.#jobGrants.has(key))
+                throw new Error(`Duplicate durable job grant: ${grant.jobId}/${grant.capability}`);
+            this.#jobGrants.set(key, grant);
+        }
+        const recovered = await readPending(this.#pendingPath);
+        for (const request of recovered) {
+            await this.#audit(request, { interrupted: true });
+            notifyObserver(() => this.#onResolved?.(request, { interrupted: true }));
+        }
+        await atomicWriteJson(this.#pendingPath, { version: 1, approvals: [] }, 0o600);
+        await this.#persistJobGrants();
+    }
+    async request(input) {
+        const requestedAt = this.#clock();
+        const request = {
+            ...input,
+            id: this.#idFactory(),
+            requestedAt: requestedAt.toISOString(),
+            expiresAt: new Date(requestedAt.getTime() + this.#timeoutMs).toISOString(),
+        };
+        let resolveWaiter;
+        const waiter = new Promise((resolve) => {
+            resolveWaiter = resolve;
+        });
+        await this.#serialize(async () => {
+            const timer = setTimeout(() => void this.#expire(request.id), this.#timeoutMs);
+            timer.unref();
+            this.#pending.set(request.id, { request, resolve: resolveWaiter, timer });
+            try {
+                await this.#persist();
+            }
+            catch (error) {
+                clearTimeout(timer);
+                this.#pending.delete(request.id);
+                throw error;
+            }
+            notifyObserver(() => this.#onRequested?.(request));
+        });
+        return waiter;
+    }
+    async resolve(id, resolution) {
+        return this.#serialize(async () => {
+            const pending = this.#pending.get(id);
+            if (!pending)
+                return { status: this.#resolved.has(id) ? "already_resolved" : "not_found" };
+            if (!pending.request.allowedScopes.includes(resolution.scope))
+                return { status: "invalid_scope" };
+            clearTimeout(pending.timer);
+            this.#pending.delete(id);
+            this.#resolved.add(id);
+            try {
+                await this.#persist();
+                await this.#audit(pending.request, resolution);
+                if (resolution.approved && resolution.scope === "job") {
+                    if (!pending.request.jobId)
+                        throw new Error("Job-scoped approval is missing jobId");
+                    const grant = {
+                        version: 1,
+                        id: this.#idFactory(),
+                        jobId: pending.request.jobId,
+                        capability: pending.request.capability,
+                        ...(pending.request.canonicalTarget === undefined
+                            ? {}
+                            : { canonicalTarget: pending.request.canonicalTarget }),
+                        actor: resolution.actor,
+                        createdAt: this.#clock().toISOString(),
+                    };
+                    const key = jobGrantKey(grant.jobId, grant);
+                    const previous = this.#jobGrants.get(key);
+                    this.#jobGrants.set(key, grant);
+                    try {
+                        await this.#persistJobGrants();
+                    }
+                    catch (error) {
+                        if (previous)
+                            this.#jobGrants.set(key, previous);
+                        else
+                            this.#jobGrants.delete(key);
+                        throw error;
+                    }
+                }
+                notifyObserver(() => this.#onResolved?.(pending.request, resolution));
+                pending.resolve(resolution);
+            }
+            catch (error) {
+                const failed = {
+                    approved: false,
+                    scope: "once",
+                    actor: "approval-persistence-failed",
+                };
+                notifyObserver(() => this.#onResolved?.(pending.request, failed));
+                pending.resolve(failed);
+                throw error;
+            }
+            return { status: "resolved" };
+        });
+    }
+    list() {
+        return [...this.#pending.values()].map((pending) => structuredClone(pending.request));
+    }
+    listJobGrants() {
+        return [...this.#jobGrants.values()].map((grant) => structuredClone(grant));
+    }
+    hasJobGrant(jobId, evaluation) {
+        return this.#jobGrants.has(jobGrantKey(jobId, evaluation));
+    }
+    async cancelSession(sessionId) {
+        const ids = this.list()
+            .filter((request) => request.sessionId === sessionId)
+            .map((request) => request.id);
+        for (const id of ids) {
+            await this.resolve(id, { approved: false, scope: "once", actor: "session-abort" });
+        }
+    }
+    async close() {
+        for (const request of this.list()) {
+            await this.resolve(request.id, { approved: false, scope: "once", actor: "daemon-shutdown" });
+        }
+    }
+    async #expire(id) {
+        await this.resolve(id, { approved: false, scope: "once", actor: "approval-timeout" });
+    }
+    async #persist() {
+        await atomicWriteJson(this.#pendingPath, { version: 1, approvals: this.list() }, 0o600);
+    }
+    async #persistJobGrants() {
+        await atomicWriteJson(this.#grantsPath, { version: 1, grants: this.listJobGrants() }, 0o600);
+    }
+    async #audit(request, resolution) {
+        const command = request.display.command ?? "";
+        await appendJsonLine(this.#auditPath, {
+            version: 1,
+            id: this.#idFactory(),
+            approvalId: request.id,
+            sessionId: request.sessionId,
+            runId: request.runId ?? null,
+            jobId: request.jobId ?? null,
+            capability: request.capability,
+            canonicalTarget: request.canonicalTarget ?? null,
+            commandHash: command ? createHash("sha256").update(command).digest("hex") : null,
+            resolution,
+            ts: this.#clock().toISOString(),
+        }, 0o600);
+    }
+    #serialize(operation) {
+        const result = this.#mutation.then(operation, operation);
+        this.#mutation = result.then(() => undefined, () => undefined);
+        return result;
+    }
+}
+export class PolicyToolGate {
+    #policy;
+    #approvals;
+    #sessionGrants = new Set();
+    constructor(policy, approvals) {
+        this.#policy = policy;
+        this.#approvals = approvals;
+    }
+    async authorize(request) {
+        const evaluation = await this.#policy.evaluate(request);
+        if (request.deniedCapabilities?.includes(evaluation.capability)) {
+            return { decision: "deny", reason: "Denied by parent agent permission ceiling", terminate: false };
+        }
+        if (evaluation.decision === "deny") {
+            return { decision: "deny", reason: "Denied by pSpore policy", terminate: false };
+        }
+        if (evaluation.decision === "allow")
+            return { decision: "allow" };
+        const grantKey = policyGrantKey(request.sessionId, evaluation);
+        if (this.#sessionGrants.has(grantKey))
+            return { decision: "allow" };
+        if (request.jobId && this.#approvals.hasJobGrant(request.jobId, evaluation))
+            return { decision: "allow" };
+        const allowedScopes = normalizeAllowedScopes(request.allowedApprovalScopes, request.jobId);
+        const resolution = await this.#approvals.request({
+            sessionId: request.sessionId,
+            agentPath: [...(request.agentPath ?? ["main"])],
+            toolCallId: request.toolCallId,
+            ...(request.runId === undefined ? {} : { runId: request.runId }),
+            ...(request.jobId === undefined ? {} : { jobId: request.jobId }),
+            capability: evaluation.capability,
+            ...(evaluation.canonicalTarget ? { canonicalTarget: evaluation.canonicalTarget } : {}),
+            display: {
+                summary: evaluation.summary,
+                ...(evaluation.command ? { command: evaluation.command } : {}),
+                ...(evaluation.cwd ? { cwd: evaluation.cwd } : {}),
+            },
+            riskReasons: evaluation.riskReasons,
+            allowedScopes,
+        });
+        if (!resolution.approved) {
+            return { decision: "deny", reason: `Approval denied by ${resolution.actor}`, terminate: false };
+        }
+        if (resolution.scope === "session")
+            this.#sessionGrants.add(grantKey);
+        return { decision: "allow" };
+    }
+}
+function policyGrantKey(sessionId, evaluation) {
+    return `${sessionId}\0${evaluation.capability}\0${evaluation.canonicalTarget ?? ""}`;
+}
+function jobGrantKey(jobId, evaluation) {
+    return `${jobId}\0${evaluation.capability}\0${evaluation.canonicalTarget ?? ""}`;
+}
+function normalizeAllowedScopes(requested, jobId) {
+    const scopes = requested ?? ["once", "session"];
+    const allowed = new Set(["once"]);
+    for (const scope of scopes) {
+        if (scope === "once" || scope === "session" || (scope === "job" && jobId !== undefined))
+            allowed.add(scope);
+    }
+    return [...allowed];
+}
+async function readPending(path) {
+    try {
+        const value = JSON.parse(await readFile(path, "utf8"));
+        if (!isRecord(value) || value["version"] !== 1 || !Array.isArray(value["approvals"]))
+            return [];
+        return value["approvals"].filter(isApprovalRequest);
+    }
+    catch (error) {
+        if (isNodeError(error) && error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+}
+async function readJobGrants(path) {
+    try {
+        const value = JSON.parse(await readFile(path, "utf8"));
+        if (!isRecord(value) || value["version"] !== 1 || !Array.isArray(value["grants"])) {
+            throw new Error(`Invalid durable job grant store: ${path}`);
+        }
+        return value["grants"].map((grant, index) => parseJobGrant(grant, `${path}.grants[${index}]`));
+    }
+    catch (error) {
+        if (isNodeError(error) && error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+}
+function parseJobGrant(value, path) {
+    if (!isRecord(value))
+        throw new Error(`${path} must be an object`);
+    const allowed = new Set(["version", "id", "jobId", "capability", "canonicalTarget", "actor", "createdAt"]);
+    const unknown = Object.keys(value).filter((key) => !allowed.has(key));
+    if (unknown.length > 0)
+        throw new Error(`${path} contains unknown keys: ${unknown.join(", ")}`);
+    if (value["version"] !== 1)
+        throw new Error(`${path}.version must be 1`);
+    const capability = value["capability"];
+    if (!isCapability(capability))
+        throw new Error(`${path}.capability is invalid`);
+    const canonicalTarget = value["canonicalTarget"];
+    if (canonicalTarget !== undefined && typeof canonicalTarget !== "string") {
+        throw new Error(`${path}.canonicalTarget must be a string`);
+    }
+    const grant = {
+        version: 1,
+        id: requiredString(value["id"], `${path}.id`),
+        jobId: requiredString(value["jobId"], `${path}.jobId`),
+        capability,
+        actor: requiredString(value["actor"], `${path}.actor`),
+        createdAt: requiredString(value["createdAt"], `${path}.createdAt`),
+    };
+    return canonicalTarget === undefined ? grant : { ...grant, canonicalTarget };
+}
+function isApprovalRequest(value) {
+    if (!isRecord(value))
+        return false;
+    return (typeof value["id"] === "string" &&
+        typeof value["sessionId"] === "string" &&
+        typeof value["toolCallId"] === "string" &&
+        typeof value["capability"] === "string" &&
+        typeof value["requestedAt"] === "string" &&
+        typeof value["expiresAt"] === "string");
+}
+const CAPABILITIES = new Set([
+    "fs.read",
+    "fs.write",
+    "fs.delete",
+    "process.exec",
+    "process.signal",
+    "process.pty",
+    "network.connect",
+    "network.publish",
+    "privilege.escalate",
+    "schedule.read",
+    "schedule.write",
+    "agent.spawn",
+    "agent.message",
+    "memory.read",
+    "memory.write",
+    "external.side_effect",
+]);
+function isCapability(value) {
+    return typeof value === "string" && CAPABILITIES.has(value);
+}
+function requiredString(value, path) {
+    if (typeof value !== "string" || value.length === 0)
+        throw new Error(`${path} must be a non-empty string`);
+    return value;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNodeError(error) {
+    return error instanceof Error && "code" in error;
+}
+function notifyObserver(observer) {
+    try {
+        observer();
+    }
+    catch {
+        // Observers cannot change approval persistence or the first-resolution result.
+    }
+}
+//# sourceMappingURL=approval-service.js.map

package/dist/policy/approval-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-service.js","sourceRoot":"","sources":["../../src/policy/approval-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG1C,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AA0DvE,MAAM,OAAO,eAAe;IACjB,YAAY,CAAS;IACrB,UAAU,CAAS;IACnB,WAAW,CAAS;IACpB,UAAU,CAAS;IACnB,MAAM,CAAa;IACnB,UAAU,CAAe;IACzB,YAAY,CAAmD;IAC/D,WAAW,CAAmD;IAC9D,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC9C,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAClD,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAE9B,YAAY,OAA+B;QACzC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAC/F,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC;QAClD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;YACjH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvD,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,eAAe,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAC/E,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAgE;QAC5E,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,OAAO,GAAoB;YAC/B,GAAG,KAAK;YACR,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE;YACrB,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;YACtC,SAAS,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;SAC3E,CAAC;QACF,IAAI,aAAwD,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,EAAE;YACzD,aAAa,GAAG,OAAO,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAC/E,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACjC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,OAAO,CACX,EAAU,EACV,UAA8B;QAE9B,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YAChC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtC,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3F,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YAClG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACtB,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;gBAC/C,IAAI,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;oBACtD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK;wBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;oBACpF,MAAM,KAAK,GAAa;wBACtB,OAAO,EAAE,CAAC;wBACV,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE;wBACrB,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK;wBAC5B,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU;wBACtC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS;4BAC/C,CAAC,CAAC,EAAE;4BACJ,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;wBACzD,KAAK,EAAE,UAAU,CAAC,KAAK;wBACvB,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;qBACvC,CAAC;oBACF,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;oBAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC1C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBAChC,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBACjC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,QAAQ;4BAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;;4BAC5C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBACjC,MAAM,KAAK,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;gBACtE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC9B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GAAuB;oBACjC,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,MAAM;oBACb,KAAK,EAAE,6BAA6B;iBACrC,CAAC;gBACF,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;gBAClE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACxB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,aAAa;QACX,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,WAAW,CAAC,KAAa,EAAE,UAAoE;QAC7F,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;aACpB,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;aACpD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,eAAe,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1F,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/F,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAwB,EAAE,UAAsD;QAC3F,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QAC9C,MAAM,cAAc,CAClB,IAAI,CAAC,UAAU,EACf;YACE,OAAO,EAAE,CAAC;YACV,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE;YACrB,UAAU,EAAE,OAAO,CAAC,EAAE;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;YAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;YAChD,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;YAChF,UAAU;YACV,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;SAChC,EACD,KAAK,CACN,CAAC;IACJ,CAAC;IAED,UAAU,CAAI,SAA2B;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACzD,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAC1B,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,MAAM,OAAO,cAAc;IAChB,OAAO,CAAe;IACtB,UAAU,CAAkB;IAC5B,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IAE5C,YAAY,MAAoB,EAAE,SAA0B;QAC1D,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAiC;QAC/C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,kBAAkB,EAAE,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,2CAA2C,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACrG,CAAC;QACD,IAAI,UAAU,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACnF,CAAC;QACD,IAAI,UAAU,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAElE,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC/D,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACpE,IAAI,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAE1G,MAAM,aAAa,GAAG,sBAAsB,CAAC,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAE3F,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAC/C,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAChE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAChE,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,OAAO,EAAE;gBACP,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD;YACD,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,aAAa;SACd,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAClG,CAAC;QACD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;CACF;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,UAA4B;IACrE,OAAO,GAAG,SAAS,KAAK,UAAU,CAAC,UAAU,KAAK,UAAU,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;AACvF,CAAC;AAED,SAAS,WAAW,CAClB,KAAa,EACb,UAAoE;IAEpE,OAAO,GAAG,KAAK,KAAK,UAAU,CAAC,UAAU,KAAK,UAAU,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,sBAAsB,CAC7B,SAA+C,EAC/C,KAAyB;IAEzB,MAAM,MAAM,GAAG,SAAS,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,SAAS,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QAChG,OAAO,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAC7D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,IAAI,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAC7D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,IAAY;IACjD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAC3G,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChG,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC;IAChF,MAAM,eAAe,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACjD,IAAI,eAAe,KAAK,SAAS,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,mCAAmC,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,KAAK,GAAa;QACtB,OAAO,EAAE,CAAC;QACV,EAAE,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,KAAK,CAAC;QAC7C,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC;QACtD,UAAU;QACV,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC;QACtD,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,YAAY,CAAC;KACnE,CAAC;IACF,OAAO,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,CACL,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ;QAC/B,OAAO,KAAK,CAAC,WAAW,CAAC,KAAK,QAAQ;QACtC,OAAO,KAAK,CAAC,YAAY,CAAC,KAAK,QAAQ;QACvC,OAAO,KAAK,CAAC,YAAY,CAAC,KAAK,QAAQ;QACvC,OAAO,KAAK,CAAC,aAAa,CAAC,KAAK,QAAQ;QACxC,OAAO,KAAK,CAAC,WAAW,CAAC,KAAK,QAAQ,CACvC,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAa;IACvC,SAAS;IACT,UAAU;IACV,WAAW;IACX,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,iBAAiB;IACjB,iBAAiB;IACjB,oBAAoB;IACpB,eAAe;IACf,gBAAgB;IAChB,aAAa;IACb,eAAe;IACf,aAAa;IACb,cAAc;IACd,sBAAsB;CACvB,CAAC,CAAC;AAEH,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC,KAAmB,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IAC3G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC;AACnD,CAAC;AAED,SAAS,cAAc,CAAC,QAAoB;IAC1C,IAAI,CAAC;QACH,QAAQ,EAAE,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,+EAA+E;IACjF,CAAC;AACH,CAAC"}

package/dist/policy/policy.d.ts

@@ -0,0 +1,26 @@
+import type { PermissionMode, PermissionRule } from "../config/config.js";
+import type { ToolAuthorizationRequest } from "../domain/runtime.js";
+export type Capability = "fs.read" | "fs.write" | "fs.delete" | "process.exec" | "process.signal" | "process.pty" | "network.connect" | "network.publish" | "privilege.escalate" | "schedule.read" | "schedule.write" | "agent.spawn" | "agent.message" | "memory.read" | "memory.write" | "external.side_effect";
+export interface PolicyEvaluation {
+    decision: "allow" | "ask" | "deny";
+    capability: Capability;
+    canonicalTarget?: string;
+    summary: string;
+    command?: string;
+    cwd?: string;
+    riskReasons: string[];
+}
+export interface PolicyEngineOptions {
+    mode: PermissionMode;
+    rules: readonly PermissionRule[];
+    workspaceRoot: string;
+    cwd: string;
+}
+export declare class PolicyEngine {
+    #private;
+    private constructor();
+    static create(options: PolicyEngineOptions): Promise<PolicyEngine>;
+    evaluate(request: ToolAuthorizationRequest): Promise<PolicyEvaluation>;
+}
+export declare function classifyShellRisk(command: string): string[];
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/policy/policy.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAErE,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,UAAU,GACV,WAAW,GACX,cAAc,GACd,gBAAgB,GAChB,aAAa,GACb,iBAAiB,GACjB,iBAAiB,GACjB,oBAAoB,GACpB,eAAe,GACf,gBAAgB,GAChB,aAAa,GACb,eAAe,GACf,aAAa,GACb,cAAc,GACd,sBAAsB,CAAC;AAE3B,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;IACnC,UAAU,EAAE,UAAU,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb;AAoBD,qBAAa,YAAY;;IAMvB,OAAO;WAOM,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC;IAIlE,QAAQ,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,gBAAgB,CAAC;CA8I7E;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAc3D"}

package/dist/policy/policy.js

@@ -0,0 +1,228 @@
+import { realpath, stat } from "node:fs/promises";
+import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
+const MUTATING_CAPABILITIES = new Set([
+    "fs.write",
+    "fs.delete",
+    "process.exec",
+    "process.signal",
+    "process.pty",
+    "network.connect",
+    "network.publish",
+    "privilege.escalate",
+    "schedule.write",
+    "agent.spawn",
+    "agent.message",
+    "memory.write",
+    "external.side_effect",
+]);
+const SENSITIVE_PATH_PARTS = [".env", "credentials", ".ssh", ".gnupg", "keyring", "secrets"];
+export class PolicyEngine {
+    #mode;
+    #rules;
+    #workspaceRoot;
+    #cwd;
+    constructor(options, workspaceRoot, cwd) {
+        this.#mode = options.mode;
+        this.#rules = options.rules;
+        this.#workspaceRoot = workspaceRoot;
+        this.#cwd = cwd;
+    }
+    static async create(options) {
+        return new PolicyEngine(options, await realpath(options.workspaceRoot), await realpath(options.cwd));
+    }
+    async evaluate(request) {
+        const classified = await this.#classify(request);
+        const matchingRules = this.#rules.filter((rule) => (rule.capability === "*" || rule.capability === classified.capability) &&
+            (rule.target === undefined || targetMatches(rule.target, classified.canonicalTarget)));
+        const explicit = matchingRules.some((rule) => rule.effect === "deny")
+            ? "deny"
+            : matchingRules.some((rule) => rule.effect === "ask")
+                ? "ask"
+                : matchingRules.some((rule) => rule.effect === "allow")
+                    ? "allow"
+                    : undefined;
+        if (explicit)
+            return { ...classified, decision: explicit };
+        switch (this.#mode) {
+            case "deny":
+                return { ...classified, decision: "deny" };
+            case "allow_all":
+                return { ...classified, decision: "allow" };
+            case "ask_all":
+                return {
+                    ...classified,
+                    decision: MUTATING_CAPABILITIES.has(classified.capability) || classified.riskReasons.length > 0 ? "ask" : "allow",
+                };
+            case "ask_risky":
+                return { ...classified, decision: classified.riskReasons.length > 0 ? "ask" : "allow" };
+        }
+    }
+    async #classify(request) {
+        const input = request.input;
+        switch (request.toolName) {
+            case "read":
+            case "search": {
+                const path = stringInput(input, "path") ?? this.#workspaceRoot;
+                const canonicalTarget = await canonicalizePotentialPath(path, this.#cwd);
+                return {
+                    capability: "fs.read",
+                    canonicalTarget,
+                    summary: `${request.toolName} ${canonicalTarget}`,
+                    riskReasons: this.#pathRisks(canonicalTarget, true),
+                };
+            }
+            case "edit":
+            case "memory_append":
+            case "memory_curate": {
+                const path = stringInput(input, "path") ?? this.#workspaceRoot;
+                const canonicalTarget = await canonicalizePotentialPath(path, this.#cwd);
+                return {
+                    capability: request.toolName.startsWith("memory_") ? "memory.write" : "fs.write",
+                    canonicalTarget,
+                    summary: `${request.toolName} ${canonicalTarget}`,
+                    riskReasons: this.#pathRisks(canonicalTarget, false),
+                };
+            }
+            case "shell": {
+                const command = stringInput(input, "command") ?? "";
+                const cwd = await canonicalizePotentialPath(stringInput(input, "cwd") ?? this.#cwd, this.#cwd);
+                const shellRisks = classifyShellRisk(command);
+                return {
+                    capability: shellRisks.some((reason) => reason.startsWith("privilege")) ? "privilege.escalate" : "process.exec",
+                    canonicalTarget: cwd,
+                    summary: `shell in ${cwd}`,
+                    command,
+                    cwd,
+                    riskReasons: [...this.#pathRisks(cwd, false), ...shellRisks],
+                };
+            }
+            case "notify":
+                return {
+                    capability: "external.side_effect",
+                    canonicalTarget: "local-notification",
+                    summary: "send a local notification",
+                    riskReasons: [],
+                };
+            case "schedule": {
+                const action = stringInput(input, "action") ?? "unknown";
+                const job = input["job"];
+                const jobId = isRecord(job) ? stringInput(job, "id") : undefined;
+                return {
+                    capability: action === "list" ? "schedule.read" : "schedule.write",
+                    canonicalTarget: jobId ? `job:${jobId}` : "jobs",
+                    summary: action === "list" ? "list scheduled jobs" : `update scheduled job ${jobId ?? "unknown"}`,
+                    riskReasons: action === "list" ? [] : ["scheduled activity persists beyond the current session"],
+                };
+            }
+            case "agent_spawn":
+                return {
+                    capability: "agent.spawn",
+                    canonicalTarget: request.sessionId,
+                    summary: `spawn a child agent from ${request.sessionId}`,
+                    riskReasons: ["creates an independent model/tool activity"],
+                };
+            case "agent_send":
+            case "agent_join":
+            case "agent_cancel":
+                return {
+                    capability: "agent.message",
+                    canonicalTarget: stringInput(input, "agentId") ?? request.sessionId,
+                    summary: `${request.toolName} for ${stringInput(input, "agentId") ?? request.sessionId}`,
+                    riskReasons: [],
+                };
+            case "mcp_discover":
+                return {
+                    capability: "external.side_effect",
+                    canonicalTarget: stringInput(input, "serverId") ?? "mcp",
+                    summary: `start and discover MCP server ${stringInput(input, "serverId") ?? "unknown"}`,
+                    riskReasons: ["starts explicitly trusted MCP server code with local user privileges"],
+                };
+            case "mcp_call":
+            default:
+                if (request.toolName === "mcp_call" || request.toolName.startsWith("mcp__")) {
+                    return {
+                        capability: "external.side_effect",
+                        canonicalTarget: request.toolName === "mcp_call"
+                            ? `${stringInput(input, "serverId") ?? "unknown"}/${stringInput(input, "toolName") ?? "unknown"}`
+                            : request.toolName,
+                        summary: `invoke MCP tool ${request.toolName}`,
+                        riskReasons: ["MCP server code and remote tool effects are outside the pSpore process boundary"],
+                    };
+                }
+                return {
+                    capability: "external.side_effect",
+                    canonicalTarget: request.toolName,
+                    summary: `invoke unclassified tool ${request.toolName}`,
+                    riskReasons: ["unclassified tool capability"],
+                };
+        }
+    }
+    #pathRisks(path, reading) {
+        const risks = [];
+        if (!isWithin(this.#workspaceRoot, path))
+            risks.push("target is outside the configured workspace");
+        const lower = path.toLowerCase();
+        if (reading && SENSITIVE_PATH_PARTS.some((part) => lower.includes(part))) {
+            risks.push("target path may contain credentials or secrets");
+        }
+        return risks;
+    }
+}
+export function classifyShellRisk(command) {
+    const risks = [];
+    const normalized = command.replace(/\s+/g, " ").trim().toLowerCase();
+    if (/(^|[;&|]\s*|\s)(sudo|doas|su)(\s|$)/.test(normalized))
+        risks.push("privilege escalation command");
+    if (/\brm\s+[^\n]*(?:-[a-z]*r[a-z]*f|-[a-z]*f[a-z]*r|--recursive)/.test(normalized)) {
+        risks.push("recursive or forced deletion");
+    }
+    if (/\b(mkfs|fdisk|parted|dd)\b|>\s*\/dev\//.test(normalized))
+        risks.push("disk or device mutation");
+    if (/\b(systemctl|service|mount|umount|shutdown|reboot)\b/.test(normalized))
+        risks.push("system service or host state mutation");
+    if (/\b(curl|wget)\b[^|\n]*\|\s*(?:ba)?sh\b/.test(normalized))
+        risks.push("downloaded content piped to a shell");
+    if (/\bgit\s+(push|tag)|\bnpm\s+publish\b|\bgh\s+release\b/.test(normalized))
+        risks.push("publishing or remote repository mutation");
+    if (/\bchmod\s+-r|\bchown\s+-r|>\s*\/(etc|boot|usr|var)\//.test(normalized))
+        risks.push("protected or recursive filesystem mutation");
+    if (/\bnohup\b|\bdisown\b|\bsystemd-run\b|&\s*$/.test(normalized))
+        risks.push("detached or persistent process");
+    return [...new Set(risks)];
+}
+async function canonicalizePotentialPath(input, cwd) {
+    const absolute = isAbsolute(input) ? resolve(input) : resolve(cwd, input);
+    try {
+        return await realpath(absolute);
+    }
+    catch {
+        const parent = await realpath(dirname(absolute));
+        const candidate = resolve(parent, basename(absolute));
+        const metadata = await stat(parent);
+        if (!metadata.isDirectory())
+            throw new Error(`Path parent is not a directory: ${parent}`);
+        return candidate;
+    }
+}
+function isWithin(root, target) {
+    const path = relative(root, target);
+    return path === "" || (!path.startsWith(`..${sep}`) && path !== ".." && !isAbsolute(path));
+}
+function targetMatches(pattern, target) {
+    if (!target)
+        return false;
+    if (pattern.endsWith("/**"))
+        return target === pattern.slice(0, -3) || target.startsWith(`${pattern.slice(0, -3)}${sep}`);
+    if (!pattern.includes("*"))
+        return target === pattern;
+    const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replaceAll("*", ".*");
+    return new RegExp(`^${escaped}$`).test(target);
+}
+function stringInput(input, key) {
+    const value = input[key];
+    return typeof value === "string" ? value : undefined;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=policy.js.map

package/dist/policy/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/policy/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAwClF,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAa;IAChD,UAAU;IACV,WAAW;IACX,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,iBAAiB;IACjB,iBAAiB;IACjB,oBAAoB;IACpB,gBAAgB;IAChB,aAAa;IACb,eAAe;IACf,cAAc;IACd,sBAAsB;CACvB,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AAE7F,MAAM,OAAO,YAAY;IACd,KAAK,CAAiB;IACtB,MAAM,CAA4B;IAClC,cAAc,CAAS;IACvB,IAAI,CAAS;IAEtB,YAAoB,OAA4B,EAAE,aAAqB,EAAE,GAAW;QAClF,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAA4B;QAC9C,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACvG,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAiC;QAC9C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CACtC,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU,CAAC;YACtE,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC,CACxF,CAAC;QACF,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC;YACnE,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC;gBACnD,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC;oBACrD,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,SAAS,CAAC;QAElB,IAAI,QAAQ;YAAE,OAAO,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAC3D,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,KAAK,MAAM;gBACT,OAAO,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC7C,KAAK,WAAW;gBACd,OAAO,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YAC9C,KAAK,SAAS;gBACZ,OAAO;oBACL,GAAG,UAAU;oBACb,QAAQ,EACN,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO;iBAC1G,CAAC;YACJ,KAAK,WAAW;gBACd,OAAO,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAiC;QAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;YACzB,KAAK,MAAM,CAAC;YACZ,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC;gBAC/D,MAAM,eAAe,GAAG,MAAM,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzE,OAAO;oBACL,UAAU,EAAE,SAAS;oBACrB,eAAe;oBACf,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,EAAE;oBACjD,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,IAAI,CAAC;iBACpD,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,CAAC;YACZ,KAAK,eAAe,CAAC;YACrB,KAAK,eAAe,CAAC,CAAC,CAAC;gBACrB,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC;gBAC/D,MAAM,eAAe,GAAG,MAAM,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzE,OAAO;oBACL,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU;oBAChF,eAAe;oBACf,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,EAAE;oBACjD,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC;iBACrD,CAAC;YACJ,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;gBACpD,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC/F,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBAC9C,OAAO;oBACL,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,cAAc;oBAC/G,eAAe,EAAE,GAAG;oBACpB,OAAO,EAAE,YAAY,GAAG,EAAE;oBAC1B,OAAO;oBACP,GAAG;oBACH,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,GAAG,UAAU,CAAC;iBAC7D,CAAC;YACJ,CAAC;YACD,KAAK,QAAQ;gBACX,OAAO;oBACL,UAAU,EAAE,sBAAsB;oBAClC,eAAe,EAAE,oBAAoB;oBACrC,OAAO,EAAE,2BAA2B;oBACpC,WAAW,EAAE,EAAE;iBAChB,CAAC;YACJ,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,SAAS,CAAC;gBACzD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;gBACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACjE,OAAO;oBACL,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB;oBAClE,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM;oBAChD,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,wBAAwB,KAAK,IAAI,SAAS,EAAE;oBACjG,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,wDAAwD,CAAC;iBACjG,CAAC;YACJ,CAAC;YACD,KAAK,aAAa;gBAChB,OAAO;oBACL,UAAU,EAAE,aAAa;oBACzB,eAAe,EAAE,OAAO,CAAC,SAAS;oBAClC,OAAO,EAAE,4BAA4B,OAAO,CAAC,SAAS,EAAE;oBACxD,WAAW,EAAE,CAAC,4CAA4C,CAAC;iBAC5D,CAAC;YACJ,KAAK,YAAY,CAAC;YAClB,KAAK,YAAY,CAAC;YAClB,KAAK,cAAc;gBACjB,OAAO;oBACL,UAAU,EAAE,eAAe;oBAC3B,eAAe,EAAE,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS;oBACnE,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,QAAQ,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE;oBACxF,WAAW,EAAE,EAAE;iBAChB,CAAC;YACJ,KAAK,cAAc;gBACjB,OAAO;oBACL,UAAU,EAAE,sBAAsB;oBAClC,eAAe,EAAE,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,KAAK;oBACxD,OAAO,EAAE,iCAAiC,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,SAAS,EAAE;oBACvF,WAAW,EAAE,CAAC,sEAAsE,CAAC;iBACtF,CAAC;YACJ,KAAK,UAAU,CAAC;YAChB;gBACE,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5E,OAAO;wBACL,UAAU,EAAE,sBAAsB;wBAClC,eAAe,EAAE,OAAO,CAAC,QAAQ,KAAK,UAAU;4BAC9C,CAAC,CAAC,GAAG,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,SAAS,IAAI,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,SAAS,EAAE;4BACjG,CAAC,CAAC,OAAO,CAAC,QAAQ;wBACpB,OAAO,EAAE,mBAAmB,OAAO,CAAC,QAAQ,EAAE;wBAC9C,WAAW,EAAE,CAAC,iFAAiF,CAAC;qBACjG,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,UAAU,EAAE,sBAAsB;oBAClC,eAAe,EAAE,OAAO,CAAC,QAAQ;oBACjC,OAAO,EAAE,4BAA4B,OAAO,CAAC,QAAQ,EAAE;oBACvD,WAAW,EAAE,CAAC,8BAA8B,CAAC;iBAC9C,CAAC;QACN,CAAC;IACH,CAAC;IAED,UAAU,CAAC,IAAY,EAAE,OAAgB;QACvC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QACnG,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,OAAO,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACzE,KAAK,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrE,IAAI,qCAAqC,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACvG,IAAI,8DAA8D,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACpF,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,wCAAwC,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACrG,IAAI,sDAAsD,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACjI,IAAI,wCAAwC,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACjH,IAAI,uDAAuD,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACrI,IAAI,sDAAsD,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IACtI,IAAI,4CAA4C,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAChH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAAa,EAAE,GAAW;IACjE,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,EAAE,CAAC,CAAC;QAC1F,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,MAA0B;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IAC1H,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,KAAK,OAAO,CAAC;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpF,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,KAAwC,EAAE,GAAW;IACxE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}