patchwork-os 0.2.0-alpha.8 → 0.2.0-beta.0

package/dist/connectors/zendesk.js

@@ -0,0 +1,442 @@
+/**
+ * Zendesk connector — read/write Zendesk tickets via the Zendesk REST API v2.
+ *
+ * Auth: API token + email + subdomain.
+ *   - Env vars: ZENDESK_API_TOKEN, ZENDESK_EMAIL, ZENDESK_SUBDOMAIN
+ *   - Stored: getSecretJsonSync("zendesk") → ZendeskTokens
+ *   - Basic auth: `email/token:api_token` (Zendesk token auth convention)
+ *
+ * Tools: listTickets, getTicket, addComment, updateStatus, listUsers
+ *
+ * Extends BaseConnector for unified auth, retry, rate-limit, error handling.
+ */
+import { BaseConnector, } from "./baseConnector.js";
+import { deleteSecretJsonSync, getSecretJsonSync, storeSecretJsonSync, } from "./tokenStorage.js";
+export class ZendeskConnector extends BaseConnector {
+    providerName = "zendesk";
+    tokens = null;
+    getOAuthConfig() {
+        return null;
+    }
+    async authenticate() {
+        const tokens = loadTokens();
+        if (!tokens) {
+            throw new Error("Zendesk not connected. Run: patchwork-os connect zendesk or set ZENDESK_API_TOKEN");
+        }
+        this.tokens = tokens;
+        return {
+            token: tokens.apiToken,
+            scopes: ["read", "write"],
+        };
+    }
+    async healthCheck() {
+        try {
+            const result = await this.apiCall(async (token) => {
+                const res = await fetch(`${this.baseUrl()}/api/v2/users/me`, {
+                    headers: this.buildHeaders(token),
+                });
+                if (!res.ok)
+                    throw new Error(`HTTP ${res.status}`);
+                return res.json();
+            });
+            if ("error" in result)
+                return { ok: false, error: result.error };
+            return { ok: true };
+        }
+        catch (err) {
+            return { ok: false, error: this.normalizeError(err) };
+        }
+    }
+    normalizeError(error) {
+        if (error instanceof Response) {
+            const s = error.status;
+            if (s === 401)
+                return {
+                    code: "auth_expired",
+                    message: "Zendesk authentication expired — reconnect",
+                    retryable: false,
+                    suggestedAction: "patchwork-os connect zendesk",
+                };
+            if (s === 403)
+                return {
+                    code: "permission_denied",
+                    message: "Insufficient Zendesk permissions",
+                    retryable: false,
+                };
+            if (s === 404)
+                return {
+                    code: "not_found",
+                    message: "Zendesk ticket or resource not found",
+                    retryable: false,
+                };
+            if (s === 429)
+                return {
+                    code: "rate_limited",
+                    message: "Zendesk API rate limit exceeded",
+                    retryable: true,
+                    suggestedAction: "Wait and retry",
+                };
+            return {
+                code: "provider_error",
+                message: `Zendesk API error: HTTP ${s}`,
+                retryable: s >= 500,
+            };
+        }
+        if (error instanceof Error) {
+            if (error.message.includes("ENOTFOUND") ||
+                error.message.includes("ECONNREFUSED")) {
+                return {
+                    code: "network_error",
+                    message: `Cannot connect to Zendesk: ${error.message}`,
+                    retryable: true,
+                };
+            }
+        }
+        return {
+            code: "provider_error",
+            message: error instanceof Error ? error.message : String(error),
+            retryable: false,
+        };
+    }
+    getStatus() {
+        const tokens = loadTokens();
+        return {
+            id: "zendesk",
+            status: tokens ? "connected" : "disconnected",
+            lastSync: tokens?.connected_at,
+            workspace: tokens ? `https://${tokens.subdomain}.zendesk.com` : undefined,
+        };
+    }
+    // ── API Methods ────────────────────────────────────────────────────────────
+    async listTickets(params = {}) {
+        const result = await this.apiCall(async (token) => {
+            let url;
+            if (params.query) {
+                const q = encodeURIComponent(`type:ticket ${params.query}`);
+                url = `${this.baseUrl()}/api/v2/search.json?query=${q}&per_page=${params.perPage ?? 25}`;
+            }
+            else {
+                const qs = new URLSearchParams({
+                    per_page: String(params.perPage ?? 25),
+                });
+                if (params.status)
+                    qs.set("status", params.status);
+                if (params.assigneeId)
+                    qs.set("assignee_id", String(params.assigneeId));
+                url = `${this.baseUrl()}/api/v2/tickets.json?${qs}`;
+            }
+            const res = await fetch(url, { headers: this.buildHeaders(token) });
+            this.updateRateLimitFromHeaders({
+                "x-ratelimit-remaining": res.headers.get("x-ratelimit-remaining") ?? undefined,
+                "retry-after": res.headers.get("retry-after") ?? undefined,
+            });
+            if (!res.ok)
+                throw res;
+            const data = (await res.json());
+            const items = data.tickets ?? data.results ?? [];
+            return {
+                results: items,
+                count: data.count ?? items.length,
+                next_page: data.next_page ?? null,
+                previous_page: data.previous_page ?? null,
+            };
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+        return result.data;
+    }
+    async getTicket(ticketId) {
+        const result = await this.apiCall(async (token) => {
+            const res = await fetch(`${this.baseUrl()}/api/v2/tickets/${ticketId}.json`, {
+                headers: this.buildHeaders(token),
+            });
+            if (res.status === 404)
+                return null;
+            if (!res.ok)
+                throw res;
+            const data = (await res.json());
+            return data.ticket;
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+        return result.data;
+    }
+    async getTicketComments(ticketId) {
+        const result = await this.apiCall(async (token) => {
+            const res = await fetch(`${this.baseUrl()}/api/v2/tickets/${ticketId}/comments.json`, { headers: this.buildHeaders(token) });
+            if (!res.ok)
+                throw res;
+            const data = (await res.json());
+            return data.comments;
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+        return result.data;
+    }
+    async addComment(ticketId, body, isPublic = true) {
+        const result = await this.apiCall(async (token) => {
+            const res = await fetch(`${this.baseUrl()}/api/v2/tickets/${ticketId}.json`, {
+                method: "PUT",
+                headers: {
+                    ...this.buildHeaders(token),
+                    "Content-Type": "application/json",
+                },
+                body: JSON.stringify({
+                    ticket: {
+                        comment: { body, public: isPublic },
+                    },
+                }),
+            });
+            if (!res.ok)
+                throw res;
+            const data = (await res.json());
+            return data.ticket;
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+        return result.data;
+    }
+    async updateStatus(ticketId, status) {
+        const result = await this.apiCall(async (token) => {
+            const res = await fetch(`${this.baseUrl()}/api/v2/tickets/${ticketId}.json`, {
+                method: "PUT",
+                headers: {
+                    ...this.buildHeaders(token),
+                    "Content-Type": "application/json",
+                },
+                body: JSON.stringify({ ticket: { status } }),
+            });
+            if (!res.ok)
+                throw res;
+            const data = (await res.json());
+            return data.ticket;
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+        return result.data;
+    }
+    async listUsers(role, perPage = 50) {
+        const result = await this.apiCall(async (token) => {
+            const qs = new URLSearchParams({ per_page: String(perPage) });
+            if (role)
+                qs.set("role", role);
+            const res = await fetch(`${this.baseUrl()}/api/v2/users.json?${qs}`, {
+                headers: this.buildHeaders(token),
+            });
+            if (!res.ok)
+                throw res;
+            const data = (await res.json());
+            return data.users;
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+        return result.data;
+    }
+    // ── Helpers ────────────────────────────────────────────────────────────────
+    baseUrl() {
+        const sub = this.tokens?.subdomain;
+        if (!sub)
+            throw new Error("Zendesk not connected");
+        if (!/^[a-z0-9-]{1,63}$/i.test(sub)) {
+            throw new Error("Zendesk subdomain has invalid format");
+        }
+        return `https://${sub}.zendesk.com`;
+    }
+    buildHeaders(token) {
+        const email = this.tokens?.email ?? "";
+        // Zendesk token auth: email/token:api_token
+        const basic = Buffer.from(`${email}/token:${token}`).toString("base64");
+        return {
+            Authorization: `Basic ${basic}`,
+            Accept: "application/json",
+        };
+    }
+}
+// ── Token persistence ────────────────────────────────────────────────────────
+export function loadTokens() {
+    const envToken = process.env.ZENDESK_API_TOKEN;
+    const envEmail = process.env.ZENDESK_EMAIL;
+    const envSubdomain = process.env.ZENDESK_SUBDOMAIN;
+    if (envToken && envEmail && envSubdomain) {
+        return {
+            apiToken: envToken,
+            email: envEmail,
+            subdomain: envSubdomain,
+            connected_at: new Date().toISOString(),
+        };
+    }
+    return getSecretJsonSync("zendesk");
+}
+export function saveTokens(tokens) {
+    storeSecretJsonSync("zendesk", tokens);
+}
+export function clearTokens() {
+    try {
+        deleteSecretJsonSync("zendesk");
+    }
+    catch {
+        // ignore
+    }
+}
+// ── Singleton instance ───────────────────────────────────────────────────────
+let _instance = null;
+function resetZendeskConnector() {
+    _instance = null;
+}
+export function getZendeskConnector() {
+    if (!_instance) {
+        _instance = new ZendeskConnector();
+    }
+    return _instance;
+}
+export { getZendeskConnector as zendesk };
+/**
+ * POST /connections/zendesk/connect  { apiToken, email, subdomain }
+ */
+export async function handleZendeskConnect(body) {
+    let apiToken;
+    let email;
+    let subdomain;
+    try {
+        const parsed = JSON.parse(body);
+        if (typeof parsed.apiToken !== "string" || !parsed.apiToken) {
+            return {
+                status: 400,
+                contentType: "application/json",
+                body: JSON.stringify({ ok: false, error: "apiToken is required" }),
+            };
+        }
+        if (typeof parsed.email !== "string" || !parsed.email) {
+            return {
+                status: 400,
+                contentType: "application/json",
+                body: JSON.stringify({ ok: false, error: "email is required" }),
+            };
+        }
+        if (typeof parsed.subdomain !== "string" || !parsed.subdomain) {
+            return {
+                status: 400,
+                contentType: "application/json",
+                body: JSON.stringify({
+                    ok: false,
+                    error: 'subdomain is required (e.g. "acme" for acme.zendesk.com)',
+                }),
+            };
+        }
+        apiToken = parsed.apiToken;
+        email = parsed.email;
+        subdomain = parsed.subdomain.replace(/\.zendesk\.com$/, ""); // strip if full domain given
+        // Validate subdomain shape after suffix strip — prevents URL injection /
+        // SSRF via `https://${subdomain}.zendesk.com` interpolation in baseUrl().
+        if (!/^[a-z0-9-]{1,63}$/i.test(subdomain)) {
+            return {
+                status: 400,
+                contentType: "application/json",
+                body: JSON.stringify({
+                    ok: false,
+                    error: "subdomain must be 1-63 alphanumeric/hyphen characters (no dots, slashes, or special chars)",
+                }),
+            };
+        }
+    }
+    catch {
+        return {
+            status: 400,
+            contentType: "application/json",
+            body: JSON.stringify({ ok: false, error: "Invalid JSON body" }),
+        };
+    }
+    try {
+        const basic = Buffer.from(`${email}/token:${apiToken}`).toString("base64");
+        const res = await fetch(`https://${subdomain}.zendesk.com/api/v2/users/me.json`, {
+            headers: {
+                Authorization: `Basic ${basic}`,
+                Accept: "application/json",
+            },
+        });
+        if (!res.ok) {
+            return {
+                status: 401,
+                contentType: "application/json",
+                body: JSON.stringify({
+                    ok: false,
+                    error: `Credentials rejected by Zendesk (HTTP ${res.status}) — check apiToken, email, and subdomain`,
+                }),
+            };
+        }
+        const me = (await res.json());
+        const tokens = {
+            apiToken,
+            email,
+            subdomain,
+            connected_at: new Date().toISOString(),
+        };
+        saveTokens(tokens);
+        resetZendeskConnector();
+        return {
+            status: 200,
+            contentType: "application/json",
+            body: JSON.stringify({
+                ok: true,
+                subdomain,
+                user: me.user?.name ?? me.user?.email ?? "unknown",
+                connectedAt: tokens.connected_at,
+            }),
+        };
+    }
+    catch (err) {
+        return {
+            status: 500,
+            contentType: "application/json",
+            body: JSON.stringify({
+                ok: false,
+                error: err instanceof Error ? err.message : String(err),
+            }),
+        };
+    }
+}
+/**
+ * POST /connections/zendesk/test
+ */
+export async function handleZendeskTest() {
+    const tokens = loadTokens();
+    if (!tokens) {
+        return {
+            status: 400,
+            contentType: "application/json",
+            body: JSON.stringify({ ok: false, error: "Zendesk not connected" }),
+        };
+    }
+    try {
+        const connector = getZendeskConnector();
+        const check = await connector.healthCheck();
+        return {
+            status: check.ok ? 200 : 401,
+            contentType: "application/json",
+            body: JSON.stringify(check.ok ? { ok: true } : { ok: false, error: check.error?.message }),
+        };
+    }
+    catch (err) {
+        return {
+            status: 500,
+            contentType: "application/json",
+            body: JSON.stringify({
+                ok: false,
+                error: err instanceof Error ? err.message : String(err),
+            }),
+        };
+    }
+}
+/**
+ * DELETE /connections/zendesk
+ */
+export function handleZendeskDisconnect() {
+    clearTokens();
+    resetZendeskConnector();
+    return {
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({ ok: true }),
+    };
+}
+//# sourceMappingURL=zendesk.js.map

package/dist/connectors/zendesk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zendesk.js","sourceRoot":"","sources":["../../src/connectors/zendesk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAEL,aAAa,GAGd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAmD3B,MAAM,OAAO,gBAAiB,SAAQ,aAAa;IACxC,YAAY,GAAG,SAAS,CAAC;IAC1B,MAAM,GAAyB,IAAI,CAAC;IAElC,cAAc;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,QAAQ;YACtB,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;SAC1B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;gBAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,EAAE;oBAC3D,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;iBAClC,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACnD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;YACpB,CAAC,CAAC,CAAC;YACH,IAAI,OAAO,IAAI,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YACjE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED,cAAc,CAAC,KAAc;QAC3B,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;YACvB,IAAI,CAAC,KAAK,GAAG;gBACX,OAAO;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,4CAA4C;oBACrD,SAAS,EAAE,KAAK;oBAChB,eAAe,EAAE,8BAA8B;iBAChD,CAAC;YACJ,IAAI,CAAC,KAAK,GAAG;gBACX,OAAO;oBACL,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,kCAAkC;oBAC3C,SAAS,EAAE,KAAK;iBACjB,CAAC;YACJ,IAAI,CAAC,KAAK,GAAG;gBACX,OAAO;oBACL,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,sCAAsC;oBAC/C,SAAS,EAAE,KAAK;iBACjB,CAAC;YACJ,IAAI,CAAC,KAAK,GAAG;gBACX,OAAO;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,iCAAiC;oBAC1C,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,gBAAgB;iBAClC,CAAC;YACJ,OAAO;gBACL,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,2BAA2B,CAAC,EAAE;gBACvC,SAAS,EAAE,CAAC,IAAI,GAAG;aACpB,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,IACE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACnC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EACtC,CAAC;gBACD,OAAO;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,8BAA8B,KAAK,CAAC,OAAO,EAAE;oBACtD,SAAS,EAAE,IAAI;iBAChB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC/D,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,SAAS;QACP,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,SAAS;YACb,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc;YAC7C,QAAQ,EAAE,MAAM,EAAE,YAAY;YAC9B,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,SAAS,cAAc,CAAC,CAAC,CAAC,SAAS;SAC1E,CAAC;IACJ,CAAC;IAED,8EAA8E;IAE9E,KAAK,CAAC,WAAW,CACf,SAKI,EAAE;QAEN,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAChD,IAAI,GAAW,CAAC;YAChB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,CAAC,GAAG,kBAAkB,CAAC,eAAe,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC5D,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,6BAA6B,CAAC,aAAa,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YAC3F,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC;oBAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;iBACvC,CAAC,CAAC;gBACH,IAAI,MAAM,CAAC,MAAM;oBAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;gBACnD,IAAI,MAAM,CAAC,UAAU;oBAAE,EAAE,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;gBACxE,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,wBAAwB,EAAE,EAAE,CAAC;YACtD,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAEpE,IAAI,CAAC,0BAA0B,CAAC;gBAC9B,uBAAuB,EACrB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,SAAS;gBACvD,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS;aAC3D,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,GAAG,CAAC;YACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAM7B,CAAC;YACF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YACjD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM;gBACjC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;gBACjC,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;aAC1C,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,IAAwC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,CAAC,OAAO,EAAE,mBAAmB,QAAQ,OAAO,EACnD;gBACE,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;aAClC,CACF,CAAC;YACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACpC,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,GAAG,CAAC;YACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8B,CAAC;YAC7D,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,IAA4B,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,QAAgB;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,CAAC,OAAO,EAAE,mBAAmB,QAAQ,gBAAgB,EAC5D,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CACtC,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,GAAG,CAAC;YACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmC,CAAC;YAClE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,IAAwB,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,UAAU,CACd,QAAgB,EAChB,IAAY,EACZ,QAAQ,GAAG,IAAI;QAEf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,CAAC,OAAO,EAAE,mBAAmB,QAAQ,OAAO,EACnD;gBACE,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;oBAC3B,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,MAAM,EAAE;wBACN,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE;qBACpC;iBACF,CAAC;aACH,CACF,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,GAAG,CAAC;YACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8B,CAAC;YAC7D,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,IAAqB,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,MAA+B;QAE/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,CAAC,OAAO,EAAE,mBAAmB,QAAQ,OAAO,EACnD;gBACE,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;oBAC3B,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;aAC7C,CACF,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,GAAG,CAAC;YACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8B,CAAC;YAC7D,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,IAAqB,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,SAAS,CACb,IAA0B,EAC1B,OAAO,GAAG,EAAE;QAEZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAChD,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC9D,IAAI,IAAI;gBAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC/B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,sBAAsB,EAAE,EAAE,EAAE;gBACnE,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;aAClC,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,GAAG,CAAC;YACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA6B,CAAC;YAC5D,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,IAAqB,CAAC;IACtC,CAAC;IAED,8EAA8E;IAEtE,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC;QACnC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACnD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,WAAW,GAAG,cAAc,CAAC;IACtC,CAAC;IAEO,YAAY,CAAC,KAAa;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;QACvC,4CAA4C;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxE,OAAO;YACL,aAAa,EAAE,SAAS,KAAK,EAAE;YAC/B,MAAM,EAAE,kBAAkB;SAC3B,CAAC;IACJ,CAAC;CACF;AAED,gFAAgF;AAEhF,MAAM,UAAU,UAAU;IACxB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACnD,IAAI,QAAQ,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;QACzC,OAAO;YACL,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,QAAQ;YACf,SAAS,EAAE,YAAY;YACvB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACvC,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAgB,SAAS,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAqB;IAC9C,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,IAAI,CAAC;QACH,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF,IAAI,SAAS,GAA4B,IAAI,CAAC;AAE9C,SAAS,qBAAqB;IAC5B,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,SAAS,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,OAAO,EAAE,mBAAmB,IAAI,OAAO,EAAE,CAAC;AAW1C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY;IAEZ,IAAI,QAAgB,CAAC;IACrB,IAAI,KAAa,CAAC;IAClB,IAAI,SAAiB,CAAC;IAEtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAI7B,CAAC;QACF,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC5D,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,kBAAkB;gBAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;aACnE,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACtD,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,kBAAkB;gBAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;aAChE,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC9D,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,kBAAkB;gBAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,0DAA0D;iBAClE,CAAC;aACH,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3B,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QACrB,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,CAAC,6BAA6B;QAC1F,yEAAyE;QACzE,0EAA0E;QAC1E,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,kBAAkB;gBAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,EAAE,EAAE,KAAK;oBACT,KAAK,EACH,4FAA4F;iBAC/F,CAAC;aACH,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,kBAAkB;YAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,WAAW,SAAS,mCAAmC,EACvD;YACE,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,KAAK,EAAE;gBAC/B,MAAM,EAAE,kBAAkB;aAC3B;SACF,CACF,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,kBAAkB;gBAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,yCAAyC,GAAG,CAAC,MAAM,0CAA0C;iBACrG,CAAC;aACH,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE3B,CAAC;QAEF,MAAM,MAAM,GAAkB;YAC5B,QAAQ;YACR,KAAK;YACL,SAAS;YACT,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACvC,CAAC;QACF,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,qBAAqB,EAAE,CAAC;QAExB,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,kBAAkB;YAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,EAAE,EAAE,IAAI;gBACR,SAAS;gBACT,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,IAAI,SAAS;gBAClD,WAAW,EAAE,MAAM,CAAC,YAAY;aACjC,CAAC;SACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,kBAAkB;YAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC;SACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,kBAAkB;YAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;SACpE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;YAC5B,WAAW,EAAE,kBAAkB;YAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,CACrE;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,kBAAkB;YAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC;SACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB;IACrC,WAAW,EAAE,CAAC;IACd,qBAAqB,EAAE,CAAC;IACxB,OAAO;QACL,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;KACnC,CAAC;AACJ,CAAC"}

package/dist/cors.d.ts

@@ -0,0 +1,10 @@
+/**
+ * CORS origin validator. Extracted from server.ts so that route modules
+ * (mcpRoutes.ts, etc.) can use it without circular imports.
+ */
+/**
+ * Return the CORS origin to reflect, or null if the origin is untrusted.
+ * Loopback origins are always allowed. Additional origins can be passed via
+ * --cors-origin (e.g. https://claude.ai for remote deployments).
+ */
+export declare function corsOrigin(requestOrigin: string | undefined, extraOrigins?: string[]): string | null;

package/dist/cors.js

@@ -0,0 +1,29 @@
+/**
+ * CORS origin validator. Extracted from server.ts so that route modules
+ * (mcpRoutes.ts, etc.) can use it without circular imports.
+ */
+/**
+ * Return the CORS origin to reflect, or null if the origin is untrusted.
+ * Loopback origins are always allowed. Additional origins can be passed via
+ * --cors-origin (e.g. https://claude.ai for remote deployments).
+ */
+export function corsOrigin(requestOrigin, extraOrigins = []) {
+    if (!requestOrigin)
+        return null;
+    if (extraOrigins.includes(requestOrigin))
+        return requestOrigin;
+    try {
+        const { hostname, protocol } = new URL(requestOrigin);
+        if (protocol === "http:" &&
+            (hostname === "localhost" ||
+                hostname === "127.0.0.1" ||
+                hostname === "[::1]")) {
+            return requestOrigin;
+        }
+    }
+    catch {
+        // malformed origin — deny
+    }
+    return null;
+}
+//# sourceMappingURL=cors.js.map

package/dist/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,aAAiC,EACjC,eAAyB,EAAE;IAE3B,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,OAAO,aAAa,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QACtD,IACE,QAAQ,KAAK,OAAO;YACpB,CAAC,QAAQ,KAAK,WAAW;gBACvB,QAAQ,KAAK,WAAW;gBACxB,QAAQ,KAAK,OAAO,CAAC,EACvB,CAAC;YACD,OAAO,aAAa,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/decisionReplay.d.ts

@@ -0,0 +1,72 @@
+/**
+ * decisionReplay — Phase 3 §2 Decision Replay Debugger.
+ *
+ * "What would have happened if this new policy had been active last Tuesday?"
+ *
+ * Reads historical `approval_decision` lifecycle entries from the activity
+ * log ring, re-evaluates each against the CURRENT CC permission rules, and
+ * returns a diff: which decisions would have changed (allow→deny, deny→allow)
+ * under the new policy.
+ *
+ * Constraints:
+ * - Read-only: no side effects, no queuing, no re-execution of tools.
+ * - Transparent: every result row links back to the original decision via
+ *   timestamp + toolName so a future "why?" UI can surface the raw row.
+ * - Graceful degradation: rows that predate the params/tier capture (before
+ *   the capture PR) are still replayed — they just miss the specifier, so
+ *   the rule match is tool-name-only. Noted in the result via `incomplete`.
+ */
+import type { ActivityLog } from "./activityLog.js";
+import { loadCcPermissions } from "./ccPermissions.js";
+export type ReplayDecision = "allow" | "deny" | "ask" | "none";
+export interface ReplayRow {
+    /** ISO-8601 timestamp of the original decision. */
+    timestamp: string;
+    toolName: string;
+    /** Specifier (e.g. command string) captured at decision time, if present. */
+    specifier?: string;
+    /** Decision recorded in the activity log. */
+    originalDecision: string;
+    /** Decision the current policy would produce. */
+    replayDecision: ReplayDecision;
+    /** True when original === replay. */
+    unchanged: boolean;
+    /**
+     * Direction of change for changed rows:
+     *   "now_allowed"  — was deny/ask, would now be allow
+     *   "now_denied"   — was allow, would now be deny/ask
+     *   "now_asked"    — was allow/deny, would now be ask
+     */
+    changeKind?: "now_allowed" | "now_denied" | "now_asked";
+    /**
+     * True when the row lacked specifier / params capture (pre-capture rows).
+     * The replay is still computed, but only on tool name — may produce
+     * fewer/more matches than the original if specifier-scoped rules exist.
+     */
+    incomplete?: boolean;
+}
+export interface DecisionReplayResult {
+    /** All replayed rows in chronological order. */
+    rows: ReplayRow[];
+    /** ISO-8601 generation timestamp. */
+    generatedAt: string;
+    /** Total rows evaluated. */
+    totalRows: number;
+    /** Rows where the decision would have changed. */
+    changedCount: number;
+    /** Rows that would flip from deny/ask → allow under current policy. */
+    nowAllowedCount: number;
+    /** Rows that would flip from allow → deny/ask under current policy. */
+    nowDeniedCount: number;
+    /** Workspace path used to load current rules. */
+    workspace: string;
+}
+export declare function computeDecisionReplay(activityLog: ActivityLog, opts: {
+    workspace: string;
+    /** Only replay decisions newer than this epoch ms. 0 = all. */
+    sinceMs?: number;
+    /** Cap at this many rows (newest-first after filter). Default 500. */
+    limit?: number;
+    /** Override the CC permissions loader — used in tests. */
+    loadRulesFn?: typeof loadCcPermissions;
+}): DecisionReplayResult;

package/dist/decisionReplay.js

@@ -0,0 +1,92 @@
+/**
+ * decisionReplay — Phase 3 §2 Decision Replay Debugger.
+ *
+ * "What would have happened if this new policy had been active last Tuesday?"
+ *
+ * Reads historical `approval_decision` lifecycle entries from the activity
+ * log ring, re-evaluates each against the CURRENT CC permission rules, and
+ * returns a diff: which decisions would have changed (allow→deny, deny→allow)
+ * under the new policy.
+ *
+ * Constraints:
+ * - Read-only: no side effects, no queuing, no re-execution of tools.
+ * - Transparent: every result row links back to the original decision via
+ *   timestamp + toolName so a future "why?" UI can surface the raw row.
+ * - Graceful degradation: rows that predate the params/tier capture (before
+ *   the capture PR) are still replayed — they just miss the specifier, so
+ *   the rule match is tool-name-only. Noted in the result via `incomplete`.
+ */
+import { evaluateRules, loadCcPermissions } from "./ccPermissions.js";
+function changeKind(original, replay) {
+    if (replay === "allow" && original !== "allow")
+        return "now_allowed";
+    if ((replay === "deny" || replay === "none") && original === "allow")
+        return "now_denied";
+    if (replay === "ask" && original !== "ask")
+        return "now_asked";
+    return undefined;
+}
+export function computeDecisionReplay(activityLog, opts) {
+    const { workspace, sinceMs = 0, limit = 500 } = opts;
+    const loadRules = opts.loadRulesFn ?? loadCcPermissions;
+    // Load current rules once — same workspace as the bridge is running in.
+    const rules = loadRules(workspace);
+    // Pull all approval_decision entries, apply time filter, cap.
+    const all = activityLog.queryApprovalDecisions();
+    const filtered = sinceMs > 0 ? all.filter((e) => Date.parse(e.timestamp) >= sinceMs) : all;
+    const capped = filtered.slice(-Math.min(limit, 500));
+    const rows = [];
+    for (const entry of capped) {
+        const toolName = typeof entry.metadata?.toolName === "string"
+            ? entry.metadata.toolName
+            : null;
+        if (!toolName)
+            continue;
+        const originalDecision = typeof entry.metadata?.decision === "string"
+            ? entry.metadata.decision
+            : "unknown";
+        // Specifier: stored as metadata.specifier (string) or derived from
+        // params.command / params.path / params.url — whichever was captured.
+        let specifier;
+        const rawSpecifier = entry.metadata?.specifier;
+        if (typeof rawSpecifier === "string") {
+            specifier = rawSpecifier;
+        }
+        else {
+            const params = entry.metadata?.params;
+            const cmd = params?.command ?? params?.path ?? params?.url ?? params?.pattern;
+            if (typeof cmd === "string")
+                specifier = cmd;
+        }
+        const incomplete = specifier === undefined;
+        const replay = evaluateRules(toolName, specifier, rules);
+        const unchanged = replay === originalDecision ||
+            (replay === "none" && originalDecision === "allow") ||
+            (replay === "none" && originalDecision === "deny");
+        rows.push({
+            timestamp: entry.timestamp,
+            toolName,
+            ...(specifier !== undefined && { specifier }),
+            originalDecision,
+            replayDecision: replay,
+            unchanged,
+            ...(changeKind(originalDecision, replay) !== undefined && {
+                changeKind: changeKind(originalDecision, replay),
+            }),
+            ...(incomplete && { incomplete: true }),
+        });
+    }
+    const changedRows = rows.filter((r) => !r.unchanged);
+    return {
+        rows,
+        generatedAt: new Date().toISOString(),
+        totalRows: rows.length,
+        changedCount: changedRows.length,
+        nowAllowedCount: changedRows.filter((r) => r.changeKind === "now_allowed")
+            .length,
+        nowDeniedCount: changedRows.filter((r) => r.changeKind === "now_denied")
+            .length,
+        workspace,
+    };
+}
+//# sourceMappingURL=decisionReplay.js.map