zelari-code 2.57.0 → 2.58.0

package/dist/cli/safety/destructiveCommands.js

@@ -20,6 +20,7 @@
  *   the workspace. Echoing a destructive string (e.g. `echo rm -rf`) can hit
  *   — accepted cost of conservatism.
  */
+import { classifyArgv, classifyCommandString } from '@zelari/core/safety/argvClassifier';
 /** The rule list — keep it SHORT and unambiguous (see module doc). */
 export const DESTRUCTIVE_RULES = [
     // `rm` with BOTH recursive and force flags, any combination (-rf, -fr, -rvf).
@@ -60,6 +61,26 @@ export function commandTextFrom(input) {
  * the command shape is not in the conservative list.
  */
 export function destructiveCommandHit(input) {
+    // t145: deterministic flag-aware classifier FIRST — it catches shapes the
+    // regex list misses (e.g. `rm --recursive --force` long forms) and uses
+    // the structured argv when available (exec_process) instead of a
+    // re-joined string. The conservative regex list below stays as the
+    // compatibility fallback (labels kept in sync on purpose).
+    if (typeof input.program === 'string' && input.program) {
+        const args = Array.isArray(input.args)
+            ? input.args.filter((a) => typeof a === 'string')
+            : [];
+        const v = classifyArgv(input.program, args);
+        if (v.tier === 'destructive' || v.tier === 'blocked') {
+            return v.reasons[0] ?? 'destructive command shape';
+        }
+    }
+    if (typeof input.command === 'string' && input.command) {
+        const v = classifyCommandString(input.command);
+        if (v.tier === 'destructive' || v.tier === 'blocked') {
+            return v.reasons[0] ?? 'destructive command shape';
+        }
+    }
     const text = commandTextFrom(input);
     if (!text)
         return null;

package/dist/cli/safety/destructiveCommands.js.map

@@ -1 +1 @@
-{"version":3,"file":"destructiveCommands.js","sourceRoot":"","sources":["../../../src/cli/safety/destructiveCommands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAA+B;IAC3D,8EAA8E;IAC9E,EAAE,EAAE,EAAE,oBAAoB,EAAE,OAAO,EAAE,yDAAyD,EAAE,KAAK,EAAE,6BAA6B,EAAE;IACtI,sDAAsD;IACtD,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,yBAAyB,EAAE;IACxF,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,wBAAwB,EAAE;IACrF,+BAA+B;IAC/B,EAAE,EAAE,EAAE,qBAAqB,EAAE,OAAO,EAAE,mCAAmC,EAAE,KAAK,EAAE,yCAAyC,EAAE;IAC7H,iDAAiD;IACjD,EAAE,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,EAAE,oBAAoB,EAAE;IACnF,mCAAmC;IACnC,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,iCAAiC,EAAE,KAAK,EAAE,oBAAoB,EAAE;IACjG,+BAA+B;IAC/B,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,0BAA0B,EAAE;IACjF,EAAE,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,0BAA0B,EAAE,KAAK,EAAE,uBAAuB,EAAE;IAC5F,6BAA6B;IAC7B,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,kCAAkC,EAAE,KAAK,EAAE,uCAAuC,EAAE;CACtH,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAA8B;IAC5D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClF,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;YACpC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAC9D,CAAC,CAAC,EAAE,CAAC;QACP,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA8B;IAClE,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"destructiveCommands.js","sourceRoot":"","sources":["../../../src/cli/safety/destructiveCommands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AASzF,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAA+B;IAC3D,8EAA8E;IAC9E,EAAE,EAAE,EAAE,oBAAoB,EAAE,OAAO,EAAE,yDAAyD,EAAE,KAAK,EAAE,6BAA6B,EAAE;IACtI,sDAAsD;IACtD,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,yBAAyB,EAAE;IACxF,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,wBAAwB,EAAE;IACrF,+BAA+B;IAC/B,EAAE,EAAE,EAAE,qBAAqB,EAAE,OAAO,EAAE,mCAAmC,EAAE,KAAK,EAAE,yCAAyC,EAAE;IAC7H,iDAAiD;IACjD,EAAE,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,EAAE,oBAAoB,EAAE;IACnF,mCAAmC;IACnC,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,iCAAiC,EAAE,KAAK,EAAE,oBAAoB,EAAE;IACjG,+BAA+B;IAC/B,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,0BAA0B,EAAE;IACjF,EAAE,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,0BAA0B,EAAE,KAAK,EAAE,uBAAuB,EAAE;IAC5F,6BAA6B;IAC7B,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,kCAAkC,EAAE,KAAK,EAAE,uCAAuC,EAAE;CACtH,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAA8B;IAC5D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClF,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;YACpC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAC9D,CAAC,CAAC,EAAE,CAAC;QACP,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA8B;IAClE,0EAA0E;IAC1E,wEAAwE;IACxE,iEAAiE;IACjE,mEAAmE;IACnE,2DAA2D;IAC3D,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;YACpC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAC9D,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACrD,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,2BAA2B,CAAC;QACrD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACvD,MAAM,CAAC,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACrD,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,2BAA2B,CAAC;QACrD,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli/safety/permissionAdapter.js

@@ -0,0 +1,70 @@
+/**
+ * The globs that mean "this path and everything under it", in A's semantics.
+ *
+ * Normalization mirrors `normalizeValue` + `pathPrefixHits`: backslashes (the
+ * Windows config a user may have written) become `/`, duplicate `/` collapse,
+ * surrounding `/` is dropped — case is NOT folded (edge 2 above).
+ *
+ * Returns `[]` for a prefix made only of separators: A's `pathPrefixHits`
+ * refuses a `head` of `/`, so such a rule matches NOTHING — mirroring it with a
+ * catch-all would turn a dead rule into a blanket restriction.
+ */
+export function translatePathPrefix(prefix) {
+    const node = prefix
+        .trim()
+        .replace(/\\/g, '/')
+        .replace(/\/{2,}/g, '/')
+        .replace(/^\/+|\/+$/g, '');
+    if (node === '')
+        return [];
+    return [node, `${node}/**`];
+}
+/**
+ * Translate ONE `.zelari/permissions.json` rule into native B rules.
+ *
+ *   - `pathPrefix`     → the `edit` list (paths are what that list matches),
+ *     1..2 patterns (see `translatePathPrefix`); a `write` category next to it
+ *     only restates what the `edit` list already implies;
+ *   - `category: 'execute'` → the `shell` list, `match: '*'` (A's matcher has
+ *     no command dimension either: the whole execute category is covered);
+ *   - `category: 'write'`   → the `edit` list, `match: '*'`;
+ *   - anything else        → `[]` (edge 4 above).
+ *
+ * The A rule's `note` is carried over as the native `reason`: it is the same
+ * human explanation, and B surfaces it in the very same deny/ask messages.
+ * A rule mixing `execute` with a `pathPrefix` is NOT translatable (an execute
+ * tool has no path argument) and yields `[]` rather than half a rule.
+ */
+export function translatePermissionRule(rule) {
+    const native = (match) => rule.note !== undefined
+        ? { match, effect: rule.effect, reason: rule.note }
+        : { match, effect: rule.effect };
+    if (rule.pathPrefix !== undefined) {
+        if (rule.category !== undefined && rule.category !== 'write')
+            return [];
+        return translatePathPrefix(rule.pathPrefix).map((match) => ({
+            list: 'edit',
+            rule: native(match),
+        }));
+    }
+    if (rule.category === 'execute')
+        return [{ list: 'shell', rule: native('*') }];
+    if (rule.category === 'write')
+        return [{ list: 'edit', rule: native('*') }];
+    return [];
+}
+/**
+ * Translate a whole A file (`.zelari/permissions.json`'s `rules`) into the
+ * native pair of lists. DECLARATION ORDER is preserved inside each list: B's
+ * `resolvePolicyRule` is FIRST-MATCH-WINS, so reordering here would change
+ * verdicts without changing a single rule.
+ */
+export function translatePermissionRules(rules) {
+    const out = { shell: [], edit: [] };
+    for (const rule of rules) {
+        for (const translated of translatePermissionRule(rule))
+            out[translated.list].push(translated.rule);
+    }
+    return out;
+}
+//# sourceMappingURL=permissionAdapter.js.map

package/dist/cli/safety/permissionAdapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAdapter.js","sourceRoot":"","sources":["../../../src/cli/safety/permissionAdapter.ts"],"names":[],"mappings":"AA2DA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,MAAM,IAAI,GAAG,MAAM;SAChB,IAAI,EAAE;SACN,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC3B,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAoB;IAC1D,MAAM,MAAM,GAAG,CAAC,KAAa,EAAc,EAAE,CAC3C,IAAI,CAAC,IAAI,KAAK,SAAS;QACrB,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE;QACnD,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACrC,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,EAAE,CAAC;QACxE,OAAO,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC1D,IAAI,EAAE,MAAe;YACrB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;SACpB,CAAC,CAAC,CAAC;IACN,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/E,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5E,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAgC;IACvE,MAAM,GAAG,GAAsB,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACvD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,UAAU,IAAI,uBAAuB,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/cli/safety/permissionCompat.js

@@ -0,0 +1,69 @@
+import { translatePermissionRule, translatePermissionRules } from './permissionAdapter.js';
+import { loadProjectPermissionRules } from './permissionRules.js';
+/**
+ * Greppable marker on every warning this module produces. Hosts (`toolRegistry`)
+ * print the tagged lines from `PolicySet.warnings` once per registry build, so a
+ * deprecation notice can never be drowned with rule diagnostics.
+ */
+export const COMPAT_WARNING_TAG = '[ADR-0039 compat]';
+/**
+ * How long the deprecated file keeps working: **two minor releases** (ADR-0039
+ * §1 / "Decision 1"). The count appears verbatim in the load-time warning.
+ */
+export const COMPAT_REMOVAL_MINOR_RELEASES = 2;
+/**
+ * The ONE deprecation notice: it names the file, says what "honored through the
+ * compat layer" means (the translation, with its own counts) and how long the
+ * file survives. Counts are derived from the translator, so they cannot drift.
+ */
+function deprecationWarning(file, rules, native, dropped) {
+    const translation = `${rules} rule(s) translated to ${native} engine-B glob rule(s) ` +
+        "(pathPrefix -> edit 'match' node + '/**' subtree, category execute -> shell '*'; " +
+        'declaration order kept, first match wins)';
+    const fallback = dropped > 0
+        ? ` ${dropped} rule(s) have no engine-B equivalent and stay enforced by engine A only.`
+        : '';
+    return (`${COMPAT_WARNING_TAG} ${file}: DEPRECATED - still honored through engine B via the ADR-0039 ` +
+        `compat layer: ${translation}. Removed after ${COMPAT_REMOVAL_MINOR_RELEASES} minor releases ` +
+        '(no earlier than v2.59 - ADR-0039 Phase 3): migrate to .zelari/policy.json, see MIGRATION.md.' +
+        fallback);
+}
+/**
+ * Read + translate `.zelari/permissions.json` for engine B.
+ *
+ * Read-only and cache-respecting: A's loader owns the file access (and the
+ * mtime/size cache, so this is a stat on the warm path), `permissionAdapter` owns
+ * the syntax mapping, and this function owns only the two decisions left — does
+ * a layer exist, and what is the operator told.
+ *
+ * `ZELARI_POLICY=0` never reaches this code: `loadPolicySet` returns the empty
+ * set before reading anything, which is exactly what that opt-out promises. It
+ * disables engine B only — engine A keeps evaluating the file on its own path.
+ */
+export function loadCompatPolicyLayer(root) {
+    const project = loadProjectPermissionRules(root);
+    if (project.error !== undefined) {
+        return {
+            warnings: [
+                `${COMPAT_WARNING_TAG} ${project.error} - no compat layer injected (ADR-0039 Phase 2). ` +
+                    'Engine A keeps failing closed on this dispatch path; a malformed USER config never ' +
+                    'blocks a run (ADR-0039 §3 keeps exit 2 for an explicit strict policy.json load).',
+            ],
+        };
+    }
+    // Nothing to honor and nothing to lose: an absent file and a rule-less file are
+    // one and the same here — the template WS1 ships is `{ "$comment": …, rules: [] }`,
+    // so warning about it would make every fresh tree noisy about a file that
+    // decides nothing.
+    if (project.rules.length === 0)
+        return { warnings: [] };
+    const rules = project.rules.map((entry) => entry.rule);
+    const translated = translatePermissionRules(rules);
+    const native = translated.shell.length + translated.edit.length;
+    // Asked rule by rule so the notice can say how many rules B cannot express
+    // (the layer itself comes from the canonical whole-file translation).
+    const dropped = rules.filter((rule) => translatePermissionRule(rule).length === 0).length;
+    const warnings = [deprecationWarning(project.path, rules.length, native, dropped)];
+    return native > 0 ? { compat: translated, warnings } : { warnings };
+}
+//# sourceMappingURL=permissionCompat.js.map

package/dist/cli/safety/permissionCompat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionCompat.js","sourceRoot":"","sources":["../../../src/cli/safety/permissionCompat.ts"],"names":[],"mappings":"AAgEA,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAEtD;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAc/C;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,IAAY,EAAE,KAAa,EAAE,MAAc,EAAE,OAAe;IACtF,MAAM,WAAW,GACf,GAAG,KAAK,0BAA0B,MAAM,yBAAyB;QACjE,mFAAmF;QACnF,2CAA2C,CAAC;IAC9C,MAAM,QAAQ,GACZ,OAAO,GAAG,CAAC;QACT,CAAC,CAAC,IAAI,OAAO,0EAA0E;QACvF,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,CACL,GAAG,kBAAkB,IAAI,IAAI,iEAAiE;QAC9F,iBAAiB,WAAW,mBAAmB,6BAA6B,kBAAkB;QAC9F,+FAA+F;QAC/F,QAAQ,CACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,OAAO,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE;gBACR,GAAG,kBAAkB,IAAI,OAAO,CAAC,KAAK,kDAAkD;oBACtF,qFAAqF;oBACrF,kFAAkF;aACrF;SACF,CAAC;IACJ,CAAC;IACD,gFAAgF;IAChF,oFAAoF;IACpF,0EAA0E;IAC1E,mBAAmB;IACnB,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;IAChE,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1F,MAAM,QAAQ,GAAG,CAAC,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnF,OAAO,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;AACtE,CAAC"}

package/dist/cli/safety/permissionGate.js

@@ -80,19 +80,9 @@ export function evaluateToolDispatch(input) {
 export function applyAllowRule(categoryAction) {
     return categoryAction === 'ask' ? 'allow' : categoryAction;
 }
-const MAX_RECENT_DENIALS = 20;
-let denialLedger = [];
-/** Record a denial for `/permissions`. Never throws, never blocks a dispatch. */
-export function recordPermissionDenial(record) {
-    denialLedger = [record, ...denialLedger].slice(0, MAX_RECENT_DENIALS);
-}
-/** Most recent denials, newest first. */
-export function listRecentPermissionDenials(limit = 10) {
-    return denialLedger.slice(0, Math.max(0, limit));
-}
-export function clearPermissionDenials() {
-    denialLedger = [];
-}
+// t142: the denial ledger is DERIVE-ONLY — `/permissions` reads the
+// `permission.denied` events already on the session spine (see
+// slashHandlers/permissions.ts). No in-process buffer remains here.
 /** The denial line the user sees ("denied "write_file" — [permissions:project] rule '…'"). */
 export function permissionDenialMessage(toolName, verdict) {
     return formatPermissionDenial(toolName, verdict);
@@ -144,17 +134,98 @@ export async function emitPermissionObserverHooks(hooks, input, ctx = {}) {
         /* an observer never propagates into the gate */
     }
 }
+/**
+ * ADR-0039 Phase 1 — WHICH layer denied, for the layers that are not engine A.
+ *
+ * Only a layer whose effect IS `deny` is eligible: naming a layer that asked
+ * would make the event lie about the rule that blocked the call. Ties follow
+ * the operator-facing `rulePrefix` order — a TaskContract restriction is the
+ * most specific intent, then engine B's agent rule, then a resource claim — and
+ * the category decision is the floor, so this never returns null.
+ */
+export function denyOriginFor(input) {
+    const layers = [
+        ['contract', input.contractRule],
+        ['policy', input.rule],
+        ['policy', input.claimRule],
+    ];
+    for (const [source, layer] of layers) {
+        if (layer?.effect !== 'deny')
+            continue;
+        const matched = layer.match.trim();
+        const reason = layer.reason?.trim();
+        return {
+            source,
+            ...(matched !== '' ? { matchedRuleId: matched } : {}),
+            ...(reason ? { reason } : {}),
+        };
+    }
+    const categoryReason = input.categoryReason?.trim();
+    return { source: 'default', ...(categoryReason ? { reason: categoryReason } : {}) };
+}
+/**
+ * The `permission.denied` payload contract, enforced BEFORE the sink is touched:
+ * a line nobody can read would poison every later replay and silently drop the
+ * denial from the inbox (`deriveOpenNeeds` skips an event with no `tool`). Same
+ * discipline as `emitDecisionEvent` in decisionEmit.ts.
+ *
+ * WHY NOT `decisionPayloadError` (which that sibling uses): its table
+ * (`DECISION_EVENT_PAYLOAD_SCHEMAS`) has NO `permission.denied` entry — slice 2
+ * declared the kind in the vocabulary and the projection but not a schema — so
+ * calling it is not even type-correct (`DecisionEventKind` excludes the kind),
+ * and adding the schema means editing packages/core, outside this slice's
+ * scope. Reported, not silently skipped: the guard mirrors what the readers in
+ * replay.ts / inboxSources.ts actually require (`tool` names the call, `source`
+ * names the decider; `reason` stays optional and free-form).
+ */
+function denialPayloadError(tool, source) {
+    if (typeof tool !== 'string' || tool.trim() === '')
+        return 'tool: must be a non-empty tool name';
+    if (typeof source !== 'string' || source.trim() === '') {
+        return 'source: must name the deciding layer';
+    }
+    return null;
+}
+/**
+ * `permission.denied` (WS1/t133) — and, since ADR-0039 Phase 1, the ONE writer
+ * for EVERY deny: engine A's verdict when a rule denied, else the `origin` the
+ * caller resolved (engine B rule or claim, TaskContract, category default).
+ *
+ * Contract:
+ *   - a deny must NAME its deciding layer; with neither `verdict` nor `origin`
+ *     the event is DROPPED, never written with an invented source;
+ *   - best-effort: a missing sink, a throwing sink or a rejected payload
+ *     returns `{recorded:false}` and NEVER propagates — recording a denial must
+ *     not be able to change the denial itself;
+ *   - exactly ONE event per dispatch: the caller emits from the FINAL deny
+ *     branch only (wrapWithPermissions in toolRegistry.ts), never twice.
+ *
+ * `sessionId`/`ts` stay accepted for the WS1 call shape; the envelope the sink
+ * writes is what carries them today, so the payload keeps the fields replay
+ * reads (`tool`, `matchedRuleId`, `source`, `reason`).
+ */
 export async function emitPermissionDenied(sink, payload) {
-    const { tool, verdict } = payload;
-    const ts = payload.ts ?? Date.now();
-    recordPermissionDenial({
-        ts,
-        tool,
-        matchedRuleId: verdict.matchedRuleId ?? '',
-        source: verdict.source,
-        reason: verdict.reason,
-        ...(payload.sessionId !== undefined ? { sessionId: payload.sessionId } : {}),
-    });
+    const { tool } = payload;
+    const denial = payload.verdict?.decision === 'deny'
+        ? {
+            matchedRuleId: payload.verdict.matchedRuleId ?? '',
+            source: payload.verdict.source,
+            reason: payload.verdict.reason,
+        }
+        : payload.origin
+            ? {
+                matchedRuleId: payload.origin.matchedRuleId ?? '',
+                source: payload.origin.source,
+                ...(payload.origin.reason !== undefined ? { reason: payload.origin.reason } : {}),
+            }
+            : null;
+    if (denial === null) {
+        return { recorded: false, error: 'no deciding layer — a deny must name one' };
+    }
+    const contractError = denialPayloadError(tool, denial.source);
+    if (contractError !== null)
+        return { recorded: false, error: contractError };
+    // t142: the spine event below is the ONLY denial record — no in-process ledger.
     if (!sink)
         return { recorded: false };
     try {
@@ -163,9 +234,9 @@ export async function emitPermissionDenied(sink, payload) {
             actor: { type: 'system', role: 'permissions' },
             data: {
                 tool,
-                matchedRuleId: verdict.matchedRuleId ?? '',
-                source: verdict.source,
-                reason: verdict.reason,
+                matchedRuleId: denial.matchedRuleId,
+                source: denial.source,
+                ...(denial.reason !== undefined ? { reason: denial.reason } : {}),
             },
         });
         const seq = seqFrom(result);

package/dist/cli/safety/permissionGate.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissionGate.js","sourceRoot":"","sources":["../../../src/cli/safety/permissionGate.ts"],"names":[],"mappings":"AA0BA,0EAA0E;AAC1E,6EAA6E;AAC7E,OAAO,EACL,iBAAiB,GAIlB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAA0B,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,wBAAwB,EACxB,sBAAsB,GAIvB,MAAM,uBAAuB,CAAC;AAS/B,2EAA2E;AAC3E,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAA4B,CAAC;AAEnE,mFAAmF;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAA2B,CAAC;AAEjE,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,sBAA+B,CAAC;AAUzE;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAA8B;IACnE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAwB,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAClE,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,KAAK,MAAM,SAAS,IAAI,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC1D,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,QAAQ;QAC1B,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA8B;IACjE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,iBAAiB,KAAK,EAAE;SACjC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,OAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,oDAAoD,KAAK,CAAC,QAAQ,MAAM,MAAM,oBAAoB;SAC3G,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzD,iEAAiE;IACjE,OAAO,OAAO,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,cAAgC;IAC7D,OAAO,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;AAC7D,CAAC;AAYD,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,IAAI,YAAY,GAA6B,EAAE,CAAC;AAEhD,iFAAiF;AACjF,MAAM,UAAU,sBAAsB,CAAC,MAA8B;IACnE,YAAY,GAAG,CAAC,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACxE,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,2BAA2B,CAAC,KAAK,GAAG,EAAE;IACpD,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,YAAY,GAAG,EAAE,CAAC;AACpB,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,uBAAuB,CAAC,QAAgB,EAAE,OAA0B;IAClF,OAAO,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAOD,SAAS,OAAO,CAAC,MAAe;IAC9B,MAAM,GAAG,GACP,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,IAAI,MAAM;QAC9D,CAAC,CAAE,MAA2B,CAAC,GAAG;QAClC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,GAAG,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AA6BD,0EAA0E;AAC1E,MAAM,UAAU,iCAAiC,CAAC,KAA0B;IAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC;IACtC,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvC,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAA6C,EAC7C,KAA0B,EAC1B,MAAmB,EAAE;IAErB,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO;IACtC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,eAAe,CACzB;YACE,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,SAAS,OAAO,CAAC,IAAI,mBAAmB,OAAO,CAAC,aAAa,IAAI,mBAAmB,EAAE;YAC/F,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;AACH,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAqC,EACrC,OAAsF;IAEtF,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAClC,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACpC,sBAAsB,CAAC;QACrB,EAAE;QACF,IAAI;QACJ,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE;QAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAC;IACH,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;YACxB,IAAI,EAAE,sBAAsB;YAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE;YAC9C,IAAI,EAAE;gBACJ,IAAI;gBACJ,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE;gBAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB;SACF,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;AACH,CAAC;AAuBD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA6B;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC;IAC5F,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC;IACtC,IAAI,OAAO,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IACtF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;IACnF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAqC,EACrC,KAA+B;IAE/B,MAAM,IAAI,GAAG,iCAAiC,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACpC,OAAO,iBAAiB,CACtB,IAAI,EACJ,qBAAqB,EACrB,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAC1C,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,CACxC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAqC,EACrC,OAAmF;IAEnF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,OAAO,iBAAiB,CACtB,IAAI,EACJ,yBAAyB,EACzB;QACE,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;QACnC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,EACD,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,CACxC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"permissionGate.js","sourceRoot":"","sources":["../../../src/cli/safety/permissionGate.ts"],"names":[],"mappings":"AA6BA,0EAA0E;AAC1E,6EAA6E;AAC7E,OAAO,EACL,iBAAiB,GAIlB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAA0B,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,wBAAwB,EACxB,sBAAsB,GAGvB,MAAM,uBAAuB,CAAC;AAY/B,2EAA2E;AAC3E,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAA4B,CAAC;AAEnE,mFAAmF;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAA2B,CAAC;AAEjE,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,sBAA+B,CAAC;AAUzE;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAA8B;IACnE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAwB,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAClE,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,KAAK,MAAM,SAAS,IAAI,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC1D,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,QAAQ;QAC1B,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA8B;IACjE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,iBAAiB,KAAK,EAAE;SACjC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,OAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,oDAAoD,KAAK,CAAC,QAAQ,MAAM,MAAM,oBAAoB;SAC3G,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzD,iEAAiE;IACjE,OAAO,OAAO,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,cAAgC;IAC7D,OAAO,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;AAC7D,CAAC;AAED,oEAAoE;AACpE,+DAA+D;AAC/D,oEAAoE;AAEpE,8FAA8F;AAC9F,MAAM,UAAU,uBAAuB,CAAC,QAAgB,EAAE,OAA0B;IAClF,OAAO,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AASD,SAAS,OAAO,CAAC,MAAe;IAC9B,MAAM,GAAG,GACP,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,IAAI,MAAM;QAC9D,CAAC,CAAE,MAA2B,CAAC,GAAG;QAClC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,GAAG,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AA6BD,0EAA0E;AAC1E,MAAM,UAAU,iCAAiC,CAAC,KAA0B;IAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC;IACtC,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvC,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAA6C,EAC7C,KAA0B,EAC1B,MAAmB,EAAE;IAErB,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO;IACtC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,eAAe,CACzB;YACE,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,SAAS,OAAO,CAAC,IAAI,mBAAmB,OAAO,CAAC,aAAa,IAAI,mBAAmB,EAAE;YAC/F,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;AACH,CAAC;AA+BD;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,KAK7B;IACC,MAAM,MAAM,GAA6E;QACvF,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC;QAChC,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC;QACtB,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;KAC5B,CAAC;IACF,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACrC,IAAI,KAAK,EAAE,MAAM,KAAK,MAAM;YAAE,SAAS;QACvC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QACpC,OAAO;YACL,MAAM;YACN,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACpD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACtF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,kBAAkB,CAAC,IAAa,EAAE,MAAe;IACxD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,qCAAqC,CAAC;IACjG,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvD,OAAO,sCAAsC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAqC,EACrC,OAAkC;IAElC,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACzB,MAAM,MAAM,GACV,OAAO,CAAC,OAAO,EAAE,QAAQ,KAAK,MAAM;QAClC,CAAC,CAAC;YACE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE;YAClD,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;YAC9B,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;SAC/B;QACH,CAAC,CAAC,OAAO,CAAC,MAAM;YACd,CAAC,CAAC;gBACE,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE;gBACjD,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;gBAC7B,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClF;YACH,CAAC,CAAC,IAAI,CAAC;IACb,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAC7E,gFAAgF;IAChF,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;YACxB,IAAI,EAAE,sBAAsB;YAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE;YAC9C,IAAI,EAAE;gBACJ,IAAI;gBACJ,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClE;SACF,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;AACH,CAAC;AAuBD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA6B;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC;IAC5F,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC;IACtC,IAAI,OAAO,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IACtF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;IACnF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAqC,EACrC,KAA+B;IAE/B,MAAM,IAAI,GAAG,iCAAiC,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACpC,OAAO,iBAAiB,CACtB,IAAI,EACJ,qBAAqB,EACrB,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAC1C,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,CACxC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAqC,EACrC,OAAmF;IAEnF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,OAAO,iBAAiB,CACtB,IAAI,EACJ,yBAAyB,EACzB;QACE,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;QACnC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,EACD,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,CACxC,CAAC;AACJ,CAAC"}

package/dist/cli/safety/policyEngine.js

@@ -53,6 +53,9 @@
 import { readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import path from 'node:path';
+// ADR-0039 Phase 2: the deprecated `.zelari/permissions.json`, read through
+// engine A's own loader and translated into native globs for the compat layer.
+import { loadCompatPolicyLayer } from './permissionCompat.js';
 /**
  * Thrown ONLY in strict mode when a policy file exists but fails JSON or
  * schema parsing. Carries machine-readable fields so hosts (headless runner,
@@ -102,20 +105,28 @@ export function emptyPolicySet() {
 }
 /** Raw layers for one agent; unknown/unlisted agents get the empty layers. */
 export function agentLayersFor(set, agent) {
-    return set.agents.get(agent) ?? EMPTY_POLICY_LAYERS;
+    const layers = set.agents.get(agent) ?? EMPTY_POLICY_LAYERS;
+    // ADR-0039 Phase 2: the compat layer is keyed by the FILE, not by the agent,
+    // so it reaches every agent — including the ones `policy.json` never mentions
+    // (those would otherwise silently lose the file they still rely on).
+    return set.compat === undefined ? layers : { ...layers, compat: set.compat };
 }
 /**
- * COMPAT view (v1 shape): project rules then global rules in ONE list —
- * first-match over this concatenation IS legacy precedence. Restrict-only
- * consumers must use agentLayersFor + matchAgentPolicyRuleLayered instead.
+ * COMPAT view (v1 shape): project rules, then the ADR-0039 compat layer, then
+ * global rules in ONE list — first-match over this concatenation IS legacy
+ * precedence. Restrict-only consumers must use agentLayersFor +
+ * matchAgentPolicyRuleLayered instead.
  */
 export function agentRulesFor(set, agent) {
     const l = set.agents.get(agent);
-    if (!l)
+    const compat = set.compat;
+    if (!l && !compat)
         return EMPTY_POLICY_RULE_SET;
+    const project = l?.project ?? EMPTY_POLICY_RULE_SET;
+    const global = l?.global ?? EMPTY_POLICY_RULE_SET;
     return {
-        shell: [...l.project.shell, ...l.global.shell],
-        edit: [...l.project.edit, ...l.global.edit],
+        shell: [...project.shell, ...(compat?.shell ?? []), ...global.shell],
+        edit: [...project.edit, ...(compat?.edit ?? []), ...global.edit],
     };
 }
 // ── Glob matching ──────────────────────────────────────────────────────────
@@ -432,6 +443,13 @@ function readPolicyFile(file, warnings, mode) {
  * decide what to do — the headless runner turns it into exit 2 / reason
  * `policy-load-failed` (headless/policyGate.ts). Missing files stay empty in
  * both modes. Pass `homeDir` to override the global-file location (tests).
+ *
+ * ADR-0039 Phase 2 adds a THIRD, deprecated source to the same load:
+ * `<root>/.zelari/permissions.json` (engine A syntax) is read through engine A's
+ * loader, translated to native globs and returned as `PolicySet.compat`
+ * (permissionCompat.ts owns the decision; agentLayersFor merges it into every
+ * agent's layers). Its problems are warnings in BOTH modes on purpose — ADR-0039
+ * §3 keeps exit 2 for an explicit strict `policy.json` load.
  */
 export function loadPolicySet(root, opts = {}) {
     if (isPolicyEngineDisabled())
@@ -441,6 +459,16 @@ export function loadPolicySet(root, opts = {}) {
     const precedence = policyPrecedenceFromEnv();
     const project = readPolicyFile(path.join(root, '.zelari', 'policy.json'), warnings, mode);
     const global = readPolicyFile(path.join(opts.homeDir ?? homedir(), '.zelari', 'policy.json'), warnings, mode);
+    // ADR-0039 Phase 2: the DEPRECATED `<root>/.zelari/permissions.json` is
+    // honored through THIS engine now — read with engine A's own loader, translated
+    // to native globs and injected as a separate `compat` layer (never merged into
+    // `project`: a decision it takes must stay attributable). Its notices travel in
+    // `warnings` for the host to print once, and nothing here throws in strict
+    // mode: strictness is a property of an EXPLICIT policy.json load (ADR-0039 §3),
+    // while a malformed user config that engine A already degrades to `ask` must
+    // not turn into an exit 2. Skipped entirely when ZELARI_POLICY=0 (above).
+    const compat = loadCompatPolicyLayer(root);
+    warnings.push(...compat.warnings);
     const agents = new Map();
     for (const [agent, p] of project) {
         agents.set(agent, { project: p, global: EMPTY_POLICY_RULE_SET });
@@ -449,6 +477,11 @@ export function loadPolicySet(root, opts = {}) {
         const l = agents.get(agent);
         agents.set(agent, l ? { ...l, global: g } : { project: EMPTY_POLICY_RULE_SET, global: g });
     }
-    return { agents, warnings, precedence };
+    return {
+        agents,
+        warnings,
+        precedence,
+        ...(compat.compat !== undefined ? { compat: compat.compat } : {}),
+    };
 }
 //# sourceMappingURL=policyEngine.js.map

package/dist/cli/safety/policyEngine.js.map

@@ -1 +1 @@
-{"version":3,"file":"policyEngine.js","sourceRoot":"","sources":["../../../src/cli/safety/policyEngine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAmD7B;;;;;;;GAOG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,+DAA+D;IACtD,IAAI,CAAmB;IAChC,+EAA+E;IACtE,IAAI,CAAS;IACtB,uEAAuE;IAC9D,IAAI,CAAU;IAEvB,YAAY,IAAY,EAAE,MAAc,EAAE,OAA0B,EAAE;QACpE,KAAK,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACrD,CAAC;CACF;AAiBD;qEACqE;AACrE,MAAM,CAAC,MAAM,WAAW,GAAsB;IAC5C,MAAM;IACN,SAAS;IACT,SAAS;IACT,KAAK;IACL,KAAK;IACL,IAAI;IACJ,OAAO;CACR,CAAC;AAoCF;oEACoE;AACpE,MAAM,CAAC,MAAM,aAAa,GAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AACzF,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,qBAAqB,GAAkB,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAC5E,MAAM,CAAC,MAAM,mBAAmB,GAAyB;IACvD,MAAM,EAAE,qBAAqB;IAC7B,OAAO,EAAE,qBAAqB;CAC/B,CAAC;AAEF,MAAM,UAAU,cAAc;IAC5B,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE,EAAE,CAAC;AACpF,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,GAAc,EAAE,KAAa;IAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAc,EAAE,KAAa;IACzD,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC;QAAE,OAAO,qBAAqB,CAAC;IACrC,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9C,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC;YACnC,GAAG,IAAI,IAAI,CAAC;QACd,CAAC;aAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACzC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA4B,EAAE,KAAa;IAC3E,MAAM,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAE7E,gFAAgF;AAChF,MAAM,CAAC,MAAM,WAAW,GAAiC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAEvF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAsB,EAAE,IAAuB;IAC7E,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,IAAa;IACzD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAClE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;QAC3B,CAAC,CAAC,IAAI,CAAC;IACT,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAgC,EAChC,QAAmC,EACnC,IAAa,EACb,IAAa;IAEb,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;IAC7F,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACtB,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/G,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACb,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;gBAChD,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACrD,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAE7E,+EAA+E;AAC/E,MAAM,UAAU,sBAAsB;IACpC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrE,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC;AACrD,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,aAAa,CAAC,GAAY,EAAE,MAAc,EAAE,QAAkB;IACrE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,qCAAqC,OAAO,GAAG,qBAAqB,CAAC,CAAC;QAC7F,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,uCAAuC,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QACD,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAChE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,MAAM,KAAK,gDAAgD,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CACN,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CACnG,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,GAAY,EAAE,MAAc,EAAE,QAAkB;IAC1E,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,2CAA2C,OAAO,GAAG,qBAAqB,CAAC,CAAC;QACnG,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,0CAA0C,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,2BAA2B,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CACxE,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,0CAA0C,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAChE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,+CAA+C,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,IAAI,EAAgC,CAAC;QACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC;gBACvE,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,KAAK,IAAI,sEAAsE,CACxF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,EAAE,GAAG,SAAS,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,GACR,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC1F,GAAG,CAAC,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,SAAS,eAAe,CACtB,GAAY,EACZ,MAAc,EACd,QAAkB;IAElB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,oDAAoD,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAC5D,QAAQ,CAAC,IAAI,CACX,GAAG,MAAM,2BAA2B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,oCAAoC,CAChG,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,mCAAmC,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,6CAA6C,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,oBAAoB,GAAG,aAAa,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACpG,SAAS;QACX,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,YAAY,GAAG,8BAA8B,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,WAAW,GAAG,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,WAAW,GAAG,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,WAAW,GAAG,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC7F,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,OAAe;IAClD,MAAM,CAAC,GAAG,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,IAAI,EAAE,CAAC,CAAC,OAAO;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CACrB,IAAY,EACZ,QAAkB,EAClB,IAAoB;IAEpB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,uEAAuE;QACvE,8DAA8D;QAC9D,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,mBAAmB,MAAM,mBAAmB,CAAC,CAAC;QACnE,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,iBAAiB,MAAM,GAAG,EAAE;gBAC1D,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC5D,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,GAAG,GACP,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,oCAAoC,CAAC;QAC5E,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5D,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAA0B,EAAE;IACtE,IAAI,sBAAsB,EAAE;QAAE,OAAO,cAAc,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC;IACvC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAG,uBAAuB,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,cAAc,CAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,EAC9D,QAAQ,EACR,IAAI,CACL,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgC,CAAC;IACvD,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"policyEngine.js","sourceRoot":"","sources":["../../../src/cli/safety/policyEngine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,4EAA4E;AAC5E,+EAA+E;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAiD9D;;;;;;;GAOG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,+DAA+D;IACtD,IAAI,CAAmB;IAChC,+EAA+E;IACtE,IAAI,CAAS;IACtB,uEAAuE;IAC9D,IAAI,CAAU;IAEvB,YAAY,IAAY,EAAE,MAAc,EAAE,OAA0B,EAAE;QACpE,KAAK,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACrD,CAAC;CACF;AAiBD;qEACqE;AACrE,MAAM,CAAC,MAAM,WAAW,GAAsB;IAC5C,MAAM;IACN,SAAS;IACT,SAAS;IACT,KAAK;IACL,KAAK;IACL,IAAI;IACJ,OAAO;CACR,CAAC;AAuDF;oEACoE;AACpE,MAAM,CAAC,MAAM,aAAa,GAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AACzF,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,qBAAqB,GAAkB,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAC5E,MAAM,CAAC,MAAM,mBAAmB,GAAyB;IACvD,MAAM,EAAE,qBAAqB;IAC7B,OAAO,EAAE,qBAAqB;CAC/B,CAAC;AAEF,MAAM,UAAU,cAAc;IAC5B,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE,EAAE,CAAC;AACpF,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,GAAc,EAAE,KAAa;IAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC;IAC5D,6EAA6E;IAC7E,8EAA8E;IAC9E,qEAAqE;IACrE,OAAO,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,GAAc,EAAE,KAAa;IACzD,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,qBAAqB,CAAC;IAChD,MAAM,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,qBAAqB,CAAC;IACpD,MAAM,MAAM,GAAG,CAAC,EAAE,MAAM,IAAI,qBAAqB,CAAC;IAClD,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;QACpE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC;YACnC,GAAG,IAAI,IAAI,CAAC;QACd,CAAC;aAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACzC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA4B,EAAE,KAAa;IAC3E,MAAM,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAE7E,gFAAgF;AAChF,MAAM,CAAC,MAAM,WAAW,GAAiC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAEvF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAsB,EAAE,IAAuB;IAC7E,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,IAAa;IACzD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAClE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;QAC3B,CAAC,CAAC,IAAI,CAAC;IACT,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAgC,EAChC,QAAmC,EACnC,IAAa,EACb,IAAa;IAEb,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;IAC7F,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACtB,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/G,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACb,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;gBAChD,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACrD,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAE7E,+EAA+E;AAC/E,MAAM,UAAU,sBAAsB;IACpC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrE,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC;AACrD,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,aAAa,CAAC,GAAY,EAAE,MAAc,EAAE,QAAkB;IACrE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,qCAAqC,OAAO,GAAG,qBAAqB,CAAC,CAAC;QAC7F,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,uCAAuC,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QACD,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAChE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,MAAM,KAAK,gDAAgD,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CACN,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CACnG,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,GAAY,EAAE,MAAc,EAAE,QAAkB;IAC1E,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,2CAA2C,OAAO,GAAG,qBAAqB,CAAC,CAAC;QACnG,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,0CAA0C,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,2BAA2B,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CACxE,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,0CAA0C,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAChE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,+CAA+C,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,IAAI,EAAgC,CAAC;QACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC;gBACvE,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,KAAK,IAAI,sEAAsE,CACxF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,EAAE,GAAG,SAAS,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,GACR,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC1F,GAAG,CAAC,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,SAAS,eAAe,CACtB,GAAY,EACZ,MAAc,EACd,QAAkB;IAElB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,oDAAoD,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAC5D,QAAQ,CAAC,IAAI,CACX,GAAG,MAAM,2BAA2B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,oCAAoC,CAChG,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,mCAAmC,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,6CAA6C,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,oBAAoB,GAAG,aAAa,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACpG,SAAS;QACX,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,YAAY,GAAG,8BAA8B,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,WAAW,GAAG,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,WAAW,GAAG,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,WAAW,GAAG,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC7F,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,OAAe;IAClD,MAAM,CAAC,GAAG,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,IAAI,EAAE,CAAC,CAAC,OAAO;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CACrB,IAAY,EACZ,QAAkB,EAClB,IAAoB;IAEpB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,uEAAuE;QACvE,8DAA8D;QAC9D,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,mBAAmB,MAAM,mBAAmB,CAAC,CAAC;QACnE,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,iBAAiB,MAAM,GAAG,EAAE;gBAC1D,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC5D,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,GAAG,GACP,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,oCAAoC,CAAC;QAC5E,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5D,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAA0B,EAAE;IACtE,IAAI,sBAAsB,EAAE;QAAE,OAAO,cAAc,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC;IACvC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAG,uBAAuB,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,cAAc,CAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,EAC9D,QAAQ,EACR,IAAI,CACL,CAAC;IACF,wEAAwE;IACxE,gFAAgF;IAChF,+EAA+E;IAC/E,gFAAgF;IAChF,2EAA2E;IAC3E,gFAAgF;IAChF,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC3C,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgC,CAAC;IACvD,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO;QACL,MAAM;QACN,QAAQ;QACR,UAAU;QACV,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC"}

package/dist/cli/safety/policyLayers.js

@@ -17,39 +17,43 @@ export function intersectEffects(...effects) {
     return best ?? 'allow';
 }
 /**
- * Resolve THIS agent's policy contribution across BOTH layers for one tool
+ * Resolve THIS agent's policy contribution across ALL its layers for one tool
  * invocation:
  *
  * - `restrict-only` (default): each layer matches independently and the
- *   STRICTER effect wins; equal ranks surface the project rule (it is the
- *   more specific intent).
- * - `legacy`: v1 semantics — project rules concatenated before global ones,
- *   FIRST match wins (a project match masks the global rule entirely).
+ *   STRICTER effect wins; equal ranks surface the more specific intent, in
+ *   this order — project, then the ADR-0039 `compat` layer (the deprecated
+ *   `.zelari/permissions.json`, project-scoped config), then the global floor.
+ * - `legacy`: v1 semantics — rules concatenated in THAT SAME order, FIRST match
+ *   wins (a project match masks everything after it). The compat layer sits
+ *   after the project rules for the same reason: `.zelari/permissions.json` is
+ *   project-scoped config and must not outrank a `policy.json` rule.
  *
- * Either way a single rule carries the effect the caller must intersect into
- * the category decision (see intersectEffects and wrapWithPermissions in
- * toolRegistry.ts). Tools with no usable argument match nothing in both
- * layers → null, leaving the category decision untouched.
+ * Either way the layer is purely ADDITIVE: it can make the result stricter,
+ * never laxer (see intersectEffects and wrapWithPermissions in toolRegistry.ts).
+ * Tools with no usable argument match nothing in every layer → null, leaving
+ * the category decision untouched.
  */
 export function matchAgentPolicyRuleLayered(layers, precedence, required, args, root) {
     if (!layers)
         return null;
+    const compat = layers.compat;
     if (precedence === 'legacy') {
-        // v1: ONE concatenated list — project rules first, first-match-wins.
+        // v1: ONE concatenated list — project rules, then compat, then global.
         return matchAgentPolicyRule({
-            shell: [...layers.project.shell, ...layers.global.shell],
-            edit: [...layers.project.edit, ...layers.global.edit],
+            shell: [...layers.project.shell, ...(compat?.shell ?? []), ...layers.global.shell],
+            edit: [...layers.project.edit, ...(compat?.edit ?? []), ...layers.global.edit],
         }, required, args, root);
     }
-    // Default restrict-only: independent matches, stricter effect wins (ties
-    // keep the project rule as the surfaced representative).
-    const g = matchAgentPolicyRule(layers.global, required, args, root);
+    // Default restrict-only: independent matches, stricter effect wins; the first
+    // candidate carrying the winning effect is the surfaced representative.
     const p = matchAgentPolicyRule(layers.project, required, args, root);
-    if (!g)
-        return p;
-    if (!p)
-        return g;
-    const win = intersectEffects(p.effect, g.effect);
-    return p.effect === win ? p : g;
+    const c = compat ? matchAgentPolicyRule(compat, required, args, root) : null;
+    const g = matchAgentPolicyRule(layers.global, required, args, root);
+    const candidates = [p, c, g].filter((rule) => rule !== null);
+    if (candidates.length === 0)
+        return null;
+    const win = intersectEffects(...candidates.map((rule) => rule.effect));
+    return candidates.find((rule) => rule.effect === win) ?? null;
 }
 //# sourceMappingURL=policyLayers.js.map

package/dist/cli/safety/policyLayers.js.map

@@ -1 +1 @@
-{"version":3,"file":"policyLayers.js","sourceRoot":"","sources":["../../../src/cli/safety/policyLayers.ts"],"names":[],"mappings":"AAsBA,OAAO,EACL,WAAW,EACX,oBAAoB,GAIrB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAG,OAA4C;IAC9E,IAAI,IAAkC,CAAC;IACvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,IAAI,IAAI,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,MAAM,CAAC;IACnF,CAAC;IACD,OAAO,IAAI,IAAI,OAAO,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAwC,EACxC,UAA4B,EAC5B,QAAmC,EACnC,IAAa,EACb,IAAa;IAEb,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,qEAAqE;QACrE,OAAO,oBAAoB,CACzB;YACE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YACxD,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;SACtD,EACD,QAAQ,EACR,IAAI,EACJ,IAAI,CACL,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,yDAAyD;IACzD,MAAM,CAAC,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACpE,MAAM,CAAC,GAAG,oBAAoB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrE,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"policyLayers.js","sourceRoot":"","sources":["../../../src/cli/safety/policyLayers.ts"],"names":[],"mappings":"AAuBA,OAAO,EACL,WAAW,EACX,oBAAoB,GAIrB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAG,OAA4C;IAC9E,IAAI,IAAkC,CAAC;IACvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,IAAI,IAAI,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,MAAM,CAAC;IACnF,CAAC;IACD,OAAO,IAAI,IAAI,OAAO,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAwC,EACxC,UAA4B,EAC5B,QAAmC,EACnC,IAAa,EACb,IAAa;IAEb,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,uEAAuE;QACvE,OAAO,oBAAoB,CACzB;YACE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YAClF,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;SAC/E,EACD,QAAQ,EACR,IAAI,EACJ,IAAI,CACL,CAAC;IACJ,CAAC;IACD,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,CAAC,GAAG,oBAAoB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,MAAM,CAAC,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAsB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACjF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC;AAChE,CAAC"}