@a5c-ai/agent-platform 5.0.1-staging.016f0b0e8119

package/dist/governance/categories.d.ts

@@ -0,0 +1,58 @@
+/**
+ * GAP-SEC: Deterministic Policy Categories.
+ *
+ * Categorizes policy rules into A/B/C/D tiers with distinct enforcement
+ * behaviors and wraps the base policy engine with category-aware evaluation.
+ */
+import type { PolicyRule, PolicyEvaluationContext, PolicyDecision } from './types';
+/** Policy category identifiers. */
+export type PolicyCategory = 'A' | 'B' | 'C' | 'D';
+/** A PolicyRule annotated with a category. */
+export interface CategorizedPolicyRule extends PolicyRule {
+    category?: PolicyCategory;
+}
+/** Enforcement behavior per category. */
+export interface CategoryEnforcementBehavior {
+    category: PolicyCategory;
+    description: string;
+    immutable: boolean;
+    requiresClassification: boolean;
+    isFallback: boolean;
+}
+/** Extended decision with category metadata. */
+export interface CategorizedPolicyDecision extends PolicyDecision {
+    requiresClassification?: boolean;
+    usedFallback?: boolean;
+}
+/** Categorized engine interface. */
+export interface CategorizedPolicyEngine {
+    readonly rules: readonly CategorizedPolicyRule[];
+    evaluate(context: PolicyEvaluationContext): CategorizedPolicyDecision;
+}
+/**
+ * Wrap a plain PolicyRule with a category annotation.
+ */
+export declare function categorizePolicyRule(rule: PolicyRule, category: PolicyCategory): CategorizedPolicyRule;
+/**
+ * Infer a category for a rule that lacks one.
+ *
+ * Heuristic:
+ * - rate-limit + deny -> A (critical)
+ * - permission + deny -> C (needs classification)
+ * - trust-level       -> D (fallback)
+ * - everything else   -> B (advisory)
+ */
+export declare function inferPolicyCategory(rule: PolicyRule): PolicyCategory;
+/**
+ * Create a categorized policy engine that evaluates rules with
+ * category-aware precedence:
+ *
+ * 1. Category A (immutable) - evaluated first, cannot be overridden
+ * 2. Category B (advisory)  - warnings / normal evaluation
+ * 3. Category C (classification-required) - denials flagged
+ * 4. Category D (fallback)  - posture-based fallback
+ *
+ * Accepts CategorizedPolicyRule[] (rules without a category are auto-inferred).
+ */
+export declare function createCategorizedEngine(rules: CategorizedPolicyRule[]): CategorizedPolicyEngine;
+//# sourceMappingURL=categories.d.ts.map

package/dist/governance/categories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"categories.d.ts","sourceRoot":"","sources":["../../src/governance/categories.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAMnF,mCAAmC;AACnC,MAAM,MAAM,cAAc,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;AAEnD,8CAA8C;AAC9C,MAAM,WAAW,qBAAsB,SAAQ,UAAU;IACvD,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,yCAAyC;AACzC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,cAAc,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,sBAAsB,EAAE,OAAO,CAAC;IAChC,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,gDAAgD;AAChD,MAAM,WAAW,yBAA0B,SAAQ,cAAc;IAC/D,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,oCAAoC;AACpC,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACjD,QAAQ,CAAC,OAAO,EAAE,uBAAuB,GAAG,yBAAyB,CAAC;CACvE;AAiBD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,GAAG,qBAAqB,CAEtG;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,cAAc,CAKpE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,qBAAqB,EAAE,GAAG,uBAAuB,CAuE/F"}

package/dist/governance/categories.js

@@ -0,0 +1,120 @@
+"use strict";
+/**
+ * GAP-SEC: Deterministic Policy Categories.
+ *
+ * Categorizes policy rules into A/B/C/D tiers with distinct enforcement
+ * behaviors and wraps the base policy engine with category-aware evaluation.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.categorizePolicyRule = categorizePolicyRule;
+exports.inferPolicyCategory = inferPolicyCategory;
+exports.createCategorizedEngine = createCategorizedEngine;
+const engine_1 = require("./engine");
+// ---------------------------------------------------------------------------
+// Category behaviours
+// ---------------------------------------------------------------------------
+const _CATEGORY_BEHAVIORS = {
+    A: { category: 'A', description: 'Immutable critical rules', immutable: true, requiresClassification: false, isFallback: false },
+    B: { category: 'B', description: 'Advisory rules', immutable: false, requiresClassification: false, isFallback: false },
+    C: { category: 'C', description: 'Classification-required rules', immutable: false, requiresClassification: true, isFallback: false },
+    D: { category: 'D', description: 'Fallback posture-based rules', immutable: false, requiresClassification: false, isFallback: true },
+};
+// ---------------------------------------------------------------------------
+// Core functions
+// ---------------------------------------------------------------------------
+/**
+ * Wrap a plain PolicyRule with a category annotation.
+ */
+function categorizePolicyRule(rule, category) {
+    return { ...rule, category };
+}
+/**
+ * Infer a category for a rule that lacks one.
+ *
+ * Heuristic:
+ * - rate-limit + deny -> A (critical)
+ * - permission + deny -> C (needs classification)
+ * - trust-level       -> D (fallback)
+ * - everything else   -> B (advisory)
+ */
+function inferPolicyCategory(rule) {
+    if (rule.kind === 'rate-limit' && rule.action === 'deny')
+        return 'A';
+    if (rule.kind === 'permission' && rule.action === 'deny')
+        return 'C';
+    if (rule.kind === 'trust-level')
+        return 'D';
+    return 'B';
+}
+/**
+ * Create a categorized policy engine that evaluates rules with
+ * category-aware precedence:
+ *
+ * 1. Category A (immutable) - evaluated first, cannot be overridden
+ * 2. Category B (advisory)  - warnings / normal evaluation
+ * 3. Category C (classification-required) - denials flagged
+ * 4. Category D (fallback)  - posture-based fallback
+ *
+ * Accepts CategorizedPolicyRule[] (rules without a category are auto-inferred).
+ */
+function createCategorizedEngine(rules) {
+    // Ensure every rule has a category
+    const categorized = rules.map(r => r.category ? r : { ...r, category: inferPolicyCategory(r) });
+    // Partition by category
+    const byCategory = { A: [], B: [], C: [], D: [] };
+    for (const rule of categorized) {
+        byCategory[rule.category].push(rule);
+    }
+    // Build per-category engines
+    const engineA = (0, engine_1.createPolicyEngine)(byCategory.A);
+    const engineB = (0, engine_1.createPolicyEngine)(byCategory.B);
+    const engineC = (0, engine_1.createPolicyEngine)(byCategory.C);
+    const engineD = (0, engine_1.createPolicyEngine)(byCategory.D);
+    return {
+        rules: Object.freeze([...categorized]),
+        evaluate(context) {
+            const allWarnings = [];
+            // 1. Category A - immutable, first match wins
+            if (byCategory.A.length > 0) {
+                const decisionA = engineA.evaluate(context);
+                allWarnings.push(...decisionA.warnings);
+                if (!decisionA.allowed) {
+                    return { ...decisionA, warnings: allWarnings };
+                }
+                // If A explicitly allows, still continue to collect warnings from B
+                // but A deny is final.
+            }
+            // 2. Category B - advisory (collect warnings)
+            if (byCategory.B.length > 0) {
+                const decisionB = engineB.evaluate(context);
+                allWarnings.push(...decisionB.warnings);
+                // B deny/allow also applies if no A deny
+                if (!decisionB.allowed) {
+                    return { ...decisionB, warnings: allWarnings };
+                }
+            }
+            // 3. Category C - requires classification
+            if (byCategory.C.length > 0) {
+                const decisionC = engineC.evaluate(context);
+                allWarnings.push(...decisionC.warnings);
+                if (!decisionC.allowed) {
+                    return { ...decisionC, warnings: allWarnings, requiresClassification: true };
+                }
+            }
+            // 4. Category D - fallback
+            if (byCategory.D.length > 0) {
+                const decisionD = engineD.evaluate(context);
+                allWarnings.push(...decisionD.warnings);
+                if (decisionD.rule) {
+                    return { ...decisionD, warnings: allWarnings, usedFallback: true };
+                }
+            }
+            // Default allow
+            return {
+                allowed: true,
+                reason: 'Allowed by default policy',
+                warnings: allWarnings,
+            };
+        },
+    };
+}

package/dist/governance/decisionTrail.d.ts

@@ -0,0 +1,60 @@
+/**
+ * GAP-OBS-004: Policy Decision Trail.
+ *
+ * Audit trail for governance policy decisions. Records which policies
+ * were evaluated, their results, and the final decision for each
+ * effect dispatch.
+ */
+import type { PolicyRule, PolicyDecision } from "./types";
+/** Record of a single policy's evaluation against an effect. */
+export interface PolicyEvalRecord {
+    ruleId: string;
+    ruleKind: string;
+    action: string;
+    matched: boolean;
+    priority: number;
+}
+/** Full audit entry for one effect dispatch decision. */
+export interface DecisionTrailEntry {
+    effectId: string;
+    effectKind: string;
+    evaluatedAt: string;
+    policies: PolicyEvalRecord[];
+    finalOutcome: "allow" | "deny";
+    decidingRuleId: string | undefined;
+    reason: string;
+    warnings: string[];
+    runId?: string;
+    stepId?: string;
+}
+/** Options to build a decision trail entry. */
+export interface DecisionTrailOptions {
+    effectId: string;
+    effectKind: string;
+    rulesEvaluated: PolicyRule[];
+    finalDecision: PolicyDecision;
+    matchedRuleId?: string;
+    runId?: string;
+    stepId?: string;
+}
+/** Summary statistics for a set of decision trail entries. */
+export interface DecisionTrailSummary {
+    totalEffects: number;
+    allowCount: number;
+    denyCount: number;
+    topDecidingRules: Array<{
+        ruleId: string;
+        count: number;
+    }>;
+}
+/**
+ * Build a DecisionTrailEntry from evaluation options.
+ * Pure function — no I/O.
+ */
+export declare function buildDecisionTrailEntry(options: DecisionTrailOptions): DecisionTrailEntry;
+/**
+ * Summarize a collection of decision trail entries.
+ * Pure function — no I/O.
+ */
+export declare function summarizeDecisionTrail(entries: DecisionTrailEntry[]): DecisionTrailSummary;
+//# sourceMappingURL=decisionTrail.d.ts.map

package/dist/governance/decisionTrail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisionTrail.d.ts","sourceRoot":"","sources":["../../src/governance/decisionTrail.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAM1D,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,YAAY,EAAE,OAAO,GAAG,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,+CAA+C;AAC/C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,UAAU,EAAE,CAAC;IAC7B,aAAa,EAAE,cAAc,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,8DAA8D;AAC9D,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5D;AAMD;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,oBAAoB,GAC5B,kBAAkB,CAqBpB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,kBAAkB,EAAE,GAC5B,oBAAoB,CA8BtB"}

package/dist/governance/decisionTrail.js

@@ -0,0 +1,68 @@
+"use strict";
+/**
+ * GAP-OBS-004: Policy Decision Trail.
+ *
+ * Audit trail for governance policy decisions. Records which policies
+ * were evaluated, their results, and the final decision for each
+ * effect dispatch.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildDecisionTrailEntry = buildDecisionTrailEntry;
+exports.summarizeDecisionTrail = summarizeDecisionTrail;
+// ---------------------------------------------------------------------------
+// Core functions
+// ---------------------------------------------------------------------------
+/**
+ * Build a DecisionTrailEntry from evaluation options.
+ * Pure function — no I/O.
+ */
+function buildDecisionTrailEntry(options) {
+    const policies = options.rulesEvaluated.map((rule) => ({
+        ruleId: rule.id,
+        ruleKind: rule.kind,
+        action: rule.action,
+        matched: rule.id === options.matchedRuleId,
+        priority: rule.priority,
+    }));
+    return {
+        effectId: options.effectId,
+        effectKind: options.effectKind,
+        evaluatedAt: new Date().toISOString(),
+        policies,
+        finalOutcome: options.finalDecision.allowed ? "allow" : "deny",
+        decidingRuleId: options.matchedRuleId,
+        reason: options.finalDecision.reason,
+        warnings: options.finalDecision.warnings,
+        runId: options.runId,
+        stepId: options.stepId,
+    };
+}
+/**
+ * Summarize a collection of decision trail entries.
+ * Pure function — no I/O.
+ */
+function summarizeDecisionTrail(entries) {
+    let allowCount = 0;
+    let denyCount = 0;
+    const ruleFreq = new Map();
+    for (const entry of entries) {
+        if (entry.finalOutcome === "allow") {
+            allowCount++;
+        }
+        else {
+            denyCount++;
+        }
+        if (entry.decidingRuleId) {
+            ruleFreq.set(entry.decidingRuleId, (ruleFreq.get(entry.decidingRuleId) ?? 0) + 1);
+        }
+    }
+    const topDecidingRules = [...ruleFreq.entries()]
+        .map(([ruleId, count]) => ({ ruleId, count }))
+        .sort((a, b) => b.count - a.count);
+    return {
+        totalEffects: entries.length,
+        allowCount,
+        denyCount,
+        topDecidingRules,
+    };
+}

package/dist/governance/engine.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Governance Policy Engine (GAP-SEC-001).
+ * Evaluates declarative policy rules with precedence: deny > warn > allow > default-allow.
+ */
+import type { PolicyRule, PolicyCondition, PolicyEvaluationContext, PolicyEngine } from './types';
+/**
+ * Evaluate a single condition against the evaluation context.
+ */
+export declare function matchCondition(condition: PolicyCondition, context: PolicyEvaluationContext): boolean;
+/**
+ * Create a policy engine from a set of rules.
+ *
+ * Evaluation precedence:
+ * 1. Deny rules (sorted by priority desc) — first match blocks
+ * 2. Warn rules (all matching collected as warnings)
+ * 3. Allow rules (sorted by priority desc) — first match allows explicitly
+ * 4. Default: allow
+ */
+export declare function createPolicyEngine(rules: PolicyRule[]): PolicyEngine;
+//# sourceMappingURL=engine.d.ts.map

package/dist/governance/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/governance/engine.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,UAAU,EACV,eAAe,EACf,uBAAuB,EAEvB,YAAY,EACb,MAAM,SAAS,CAAC;AAiBjB;;GAEG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAwCpG;AAaD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,YAAY,CAmDpE"}

package/dist/governance/engine.js

@@ -0,0 +1,124 @@
+"use strict";
+/**
+ * Governance Policy Engine (GAP-SEC-001).
+ * Evaluates declarative policy rules with precedence: deny > warn > allow > default-allow.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.matchCondition = matchCondition;
+exports.createPolicyEngine = createPolicyEngine;
+const types_1 = require("./types");
+/**
+ * Resolve a dot-notation field path against the evaluation context.
+ * Returns undefined if any segment is missing.
+ */
+function resolveField(context, fieldPath) {
+    const parts = fieldPath.split('.');
+    let current = context;
+    for (const part of parts) {
+        if (current == null || typeof current !== 'object')
+            return undefined;
+        current = current[part];
+    }
+    return current;
+}
+/**
+ * Evaluate a single condition against the evaluation context.
+ */
+function matchCondition(condition, context) {
+    const fieldValue = resolveField(context, condition.field);
+    if (fieldValue === undefined || fieldValue === null)
+        return false;
+    switch (condition.op) {
+        case 'eq':
+            return String(fieldValue) === condition.value;
+        case 'neq':
+            return String(fieldValue) !== condition.value;
+        case 'gt':
+            return typeof fieldValue === 'number' && fieldValue > Number(condition.value);
+        case 'lt':
+            return typeof fieldValue === 'number' && fieldValue < Number(condition.value);
+        case 'gte':
+            return typeof fieldValue === 'number' && fieldValue >= Number(condition.value);
+        case 'lte':
+            return typeof fieldValue === 'number' && fieldValue <= Number(condition.value);
+        case 'contains':
+            if (Array.isArray(fieldValue)) {
+                return fieldValue.includes(condition.value);
+            }
+            return String(fieldValue).includes(condition.value);
+        case 'matches':
+            try {
+                return new RegExp(condition.value).test(String(fieldValue));
+            }
+            catch {
+                return false;
+            }
+        default:
+            return false;
+    }
+}
+/**
+ * Check whether a rule matches the given context.
+ * Uses the stateful shouldMatch callback if present, otherwise declarative matchCondition.
+ */
+function ruleMatches(rule, context) {
+    if ((0, types_1.isStatefulRule)(rule)) {
+        return rule.shouldMatch(context);
+    }
+    return matchCondition(rule.condition, context);
+}
+/**
+ * Create a policy engine from a set of rules.
+ *
+ * Evaluation precedence:
+ * 1. Deny rules (sorted by priority desc) — first match blocks
+ * 2. Warn rules (all matching collected as warnings)
+ * 3. Allow rules (sorted by priority desc) — first match allows explicitly
+ * 4. Default: allow
+ */
+function createPolicyEngine(rules) {
+    // Pre-sort rules by action group, then priority descending
+    const denyRules = rules.filter(r => r.action === 'deny').sort((a, b) => b.priority - a.priority);
+    const warnRules = rules.filter(r => r.action === 'warn').sort((a, b) => b.priority - a.priority);
+    const allowRules = rules.filter(r => r.action === 'allow').sort((a, b) => b.priority - a.priority);
+    return {
+        rules: Object.freeze([...rules]),
+        evaluate(context) {
+            const warnings = [];
+            // 1. Deny rules — first match blocks
+            for (const rule of denyRules) {
+                if (ruleMatches(rule, context)) {
+                    return {
+                        allowed: false,
+                        rule,
+                        reason: `Denied by rule ${rule.id}`,
+                        warnings,
+                    };
+                }
+            }
+            // 2. Warn rules — collect all matching
+            for (const rule of warnRules) {
+                if (ruleMatches(rule, context)) {
+                    warnings.push(`Warning from rule ${rule.id}: ${rule.metadata?.reason ?? rule.kind}`);
+                }
+            }
+            // 3. Allow rules — first match allows explicitly
+            for (const rule of allowRules) {
+                if (ruleMatches(rule, context)) {
+                    return {
+                        allowed: true,
+                        rule,
+                        reason: `Allowed by rule ${rule.id}`,
+                        warnings,
+                    };
+                }
+            }
+            // 4. Default: allow
+            return {
+                allowed: true,
+                reason: 'Allowed by default policy',
+                warnings,
+            };
+        },
+    };
+}

package/dist/governance/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Governance Policy Layer module (GAP-SEC-001).
+ * Centralized policy engine for evaluating security rules at effect dispatch.
+ */
+export type { PolicyRuleKind, PolicyConditionOp, PolicyAction, PolicyCondition, PolicyRule, StatefulPolicyRule, PolicyEvaluationContext, PolicyDecision, PolicyDecisionLog, PolicyEngine, } from './types';
+export { isStatefulRule } from './types';
+export { createPolicyEngine, matchCondition } from './engine';
+export { maxIterationsPolicy, taskKindPolicy, rateLimitPolicy } from './builtins';
+export { logPolicyDecision, readPolicyDecisionLog } from './logging';
+export { breakpointRulesToPolicies } from './bridge';
+export { buildDecisionTrailEntry, summarizeDecisionTrail, type DecisionTrailEntry, type DecisionTrailOptions, type DecisionTrailSummary, type PolicyEvalRecord, } from './decisionTrail';
+export { createMandate, activateMandate, revokeMandate, deriveMandate, validateMandateForContext, mandateToPolicy, type ExecutionMandate, type MandateScope, type MandateLifecycle, type MandateProvenance, type MandateValidationResult, } from './mandate';
+export { createAuthorityChain, validateAuthorityChain, attenuateScope, traceAuthorityToHuman, type AuthorityPrincipal, type AuthorityGrant, type AuthorityChain, type AuthorityChainLink, type AuthorityTrace, type AuthorityChainValidationResult, } from './authority';
+export { categorizePolicyRule, createCategorizedEngine, inferPolicyCategory, type PolicyCategory, type CategorizedPolicyRule, type CategoryEnforcementBehavior, type CategorizedPolicyDecision, type CategorizedPolicyEngine, } from './categories';
+export { postureToPolicyRules, allPosturesToPolicies, } from './postureBridge';
+export { evaluateSandboxAccess, matchesPattern, composeSandboxPolicies, attenuateSandboxPolicy, type SandboxOperationKind, type SandboxRule, type SandboxPolicy, type SandboxDecision, type SandboxOperation, } from './sandboxPolicy';
+export { sandboxDecisionToInteraction, buildSandboxEvent, inheritSandboxPolicy, type SandboxEvent, } from './sandboxBridge';
+export { createPermissionEvent, aggregateChainEvents, filterEvents, type PermissionEvent, type PermissionEventSource, type CreatePermissionEventOptions, type FilterCriteria, } from './permissionEvents';
+export { formatPermissionForTui, formatPermissionForJsonStream, formatPermissionForCli, createPropagationConfig, shouldPropagate, type PropagationTarget, type PropagationConfig, } from './permissionPropagation';
+//# sourceMappingURL=index.d.ts.map

package/dist/governance/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/governance/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,YAAY,GACb,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAGzC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG9D,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlF,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAGrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AAGrD,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,aAAa,EACb,eAAe,EACf,aAAa,EACb,aAAa,EACb,yBAAyB,EACzB,eAAe,EACf,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,cAAc,EACd,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,8BAA8B,GACpC,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,GAC7B,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,4BAA4B,EAC5B,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,YAAY,GAClB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,4BAA4B,EACjC,KAAK,cAAc,GACpB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,yBAAyB,CAAC"}

package/dist/governance/index.js

@@ -0,0 +1,75 @@
+"use strict";
+/**
+ * Governance Policy Layer module (GAP-SEC-001).
+ * Centralized policy engine for evaluating security rules at effect dispatch.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.shouldPropagate = exports.createPropagationConfig = exports.formatPermissionForCli = exports.formatPermissionForJsonStream = exports.formatPermissionForTui = exports.filterEvents = exports.aggregateChainEvents = exports.createPermissionEvent = exports.inheritSandboxPolicy = exports.buildSandboxEvent = exports.sandboxDecisionToInteraction = exports.attenuateSandboxPolicy = exports.composeSandboxPolicies = exports.matchesPattern = exports.evaluateSandboxAccess = exports.allPosturesToPolicies = exports.postureToPolicyRules = exports.inferPolicyCategory = exports.createCategorizedEngine = exports.categorizePolicyRule = exports.traceAuthorityToHuman = exports.attenuateScope = exports.validateAuthorityChain = exports.createAuthorityChain = exports.mandateToPolicy = exports.validateMandateForContext = exports.deriveMandate = exports.revokeMandate = exports.activateMandate = exports.createMandate = exports.summarizeDecisionTrail = exports.buildDecisionTrailEntry = exports.breakpointRulesToPolicies = exports.readPolicyDecisionLog = exports.logPolicyDecision = exports.rateLimitPolicy = exports.taskKindPolicy = exports.maxIterationsPolicy = exports.matchCondition = exports.createPolicyEngine = exports.isStatefulRule = void 0;
+var types_1 = require("./types");
+Object.defineProperty(exports, "isStatefulRule", { enumerable: true, get: function () { return types_1.isStatefulRule; } });
+// Engine
+var engine_1 = require("./engine");
+Object.defineProperty(exports, "createPolicyEngine", { enumerable: true, get: function () { return engine_1.createPolicyEngine; } });
+Object.defineProperty(exports, "matchCondition", { enumerable: true, get: function () { return engine_1.matchCondition; } });
+// Built-in policies
+var builtins_1 = require("./builtins");
+Object.defineProperty(exports, "maxIterationsPolicy", { enumerable: true, get: function () { return builtins_1.maxIterationsPolicy; } });
+Object.defineProperty(exports, "taskKindPolicy", { enumerable: true, get: function () { return builtins_1.taskKindPolicy; } });
+Object.defineProperty(exports, "rateLimitPolicy", { enumerable: true, get: function () { return builtins_1.rateLimitPolicy; } });
+// Audit logging
+var logging_1 = require("./logging");
+Object.defineProperty(exports, "logPolicyDecision", { enumerable: true, get: function () { return logging_1.logPolicyDecision; } });
+Object.defineProperty(exports, "readPolicyDecisionLog", { enumerable: true, get: function () { return logging_1.readPolicyDecisionLog; } });
+// Breakpoint bridge
+var bridge_1 = require("./bridge");
+Object.defineProperty(exports, "breakpointRulesToPolicies", { enumerable: true, get: function () { return bridge_1.breakpointRulesToPolicies; } });
+// Decision trail (GAP-OBS-004)
+var decisionTrail_1 = require("./decisionTrail");
+Object.defineProperty(exports, "buildDecisionTrailEntry", { enumerable: true, get: function () { return decisionTrail_1.buildDecisionTrailEntry; } });
+Object.defineProperty(exports, "summarizeDecisionTrail", { enumerable: true, get: function () { return decisionTrail_1.summarizeDecisionTrail; } });
+// Mandate system
+var mandate_1 = require("./mandate");
+Object.defineProperty(exports, "createMandate", { enumerable: true, get: function () { return mandate_1.createMandate; } });
+Object.defineProperty(exports, "activateMandate", { enumerable: true, get: function () { return mandate_1.activateMandate; } });
+Object.defineProperty(exports, "revokeMandate", { enumerable: true, get: function () { return mandate_1.revokeMandate; } });
+Object.defineProperty(exports, "deriveMandate", { enumerable: true, get: function () { return mandate_1.deriveMandate; } });
+Object.defineProperty(exports, "validateMandateForContext", { enumerable: true, get: function () { return mandate_1.validateMandateForContext; } });
+Object.defineProperty(exports, "mandateToPolicy", { enumerable: true, get: function () { return mandate_1.mandateToPolicy; } });
+// Authority chain
+var authority_1 = require("./authority");
+Object.defineProperty(exports, "createAuthorityChain", { enumerable: true, get: function () { return authority_1.createAuthorityChain; } });
+Object.defineProperty(exports, "validateAuthorityChain", { enumerable: true, get: function () { return authority_1.validateAuthorityChain; } });
+Object.defineProperty(exports, "attenuateScope", { enumerable: true, get: function () { return authority_1.attenuateScope; } });
+Object.defineProperty(exports, "traceAuthorityToHuman", { enumerable: true, get: function () { return authority_1.traceAuthorityToHuman; } });
+// Categorized policy engine
+var categories_1 = require("./categories");
+Object.defineProperty(exports, "categorizePolicyRule", { enumerable: true, get: function () { return categories_1.categorizePolicyRule; } });
+Object.defineProperty(exports, "createCategorizedEngine", { enumerable: true, get: function () { return categories_1.createCategorizedEngine; } });
+Object.defineProperty(exports, "inferPolicyCategory", { enumerable: true, get: function () { return categories_1.inferPolicyCategory; } });
+// Posture-to-policy bridge
+var postureBridge_1 = require("./postureBridge");
+Object.defineProperty(exports, "postureToPolicyRules", { enumerable: true, get: function () { return postureBridge_1.postureToPolicyRules; } });
+Object.defineProperty(exports, "allPosturesToPolicies", { enumerable: true, get: function () { return postureBridge_1.allPosturesToPolicies; } });
+// Sandbox policy (GAP-SEC-002)
+var sandboxPolicy_1 = require("./sandboxPolicy");
+Object.defineProperty(exports, "evaluateSandboxAccess", { enumerable: true, get: function () { return sandboxPolicy_1.evaluateSandboxAccess; } });
+Object.defineProperty(exports, "matchesPattern", { enumerable: true, get: function () { return sandboxPolicy_1.matchesPattern; } });
+Object.defineProperty(exports, "composeSandboxPolicies", { enumerable: true, get: function () { return sandboxPolicy_1.composeSandboxPolicies; } });
+Object.defineProperty(exports, "attenuateSandboxPolicy", { enumerable: true, get: function () { return sandboxPolicy_1.attenuateSandboxPolicy; } });
+// Sandbox bridge (GAP-SEC-002)
+var sandboxBridge_1 = require("./sandboxBridge");
+Object.defineProperty(exports, "sandboxDecisionToInteraction", { enumerable: true, get: function () { return sandboxBridge_1.sandboxDecisionToInteraction; } });
+Object.defineProperty(exports, "buildSandboxEvent", { enumerable: true, get: function () { return sandboxBridge_1.buildSandboxEvent; } });
+Object.defineProperty(exports, "inheritSandboxPolicy", { enumerable: true, get: function () { return sandboxBridge_1.inheritSandboxPolicy; } });
+// Permission events
+var permissionEvents_1 = require("./permissionEvents");
+Object.defineProperty(exports, "createPermissionEvent", { enumerable: true, get: function () { return permissionEvents_1.createPermissionEvent; } });
+Object.defineProperty(exports, "aggregateChainEvents", { enumerable: true, get: function () { return permissionEvents_1.aggregateChainEvents; } });
+Object.defineProperty(exports, "filterEvents", { enumerable: true, get: function () { return permissionEvents_1.filterEvents; } });
+// Permission propagation
+var permissionPropagation_1 = require("./permissionPropagation");
+Object.defineProperty(exports, "formatPermissionForTui", { enumerable: true, get: function () { return permissionPropagation_1.formatPermissionForTui; } });
+Object.defineProperty(exports, "formatPermissionForJsonStream", { enumerable: true, get: function () { return permissionPropagation_1.formatPermissionForJsonStream; } });
+Object.defineProperty(exports, "formatPermissionForCli", { enumerable: true, get: function () { return permissionPropagation_1.formatPermissionForCli; } });
+Object.defineProperty(exports, "createPropagationConfig", { enumerable: true, get: function () { return permissionPropagation_1.createPropagationConfig; } });
+Object.defineProperty(exports, "shouldPropagate", { enumerable: true, get: function () { return permissionPropagation_1.shouldPropagate; } });

package/dist/governance/logging.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Governance policy decision audit logging (GAP-SEC-001).
+ * Appends decisions to a JSONL file for audit trail.
+ * Uses async handle-based I/O with fsync for crash safety.
+ */
+import type { PolicyDecisionLog } from './types';
+/**
+ * Append a policy decision to the audit log.
+ * Uses handle-based async I/O with fsync for crash safety.
+ */
+export declare function logPolicyDecision(logDir: string, entry: PolicyDecisionLog): Promise<void>;
+/**
+ * Read all policy decisions from the audit log.
+ * Returns empty array if the file does not exist.
+ * Throws on permission errors or other unexpected failures.
+ */
+export declare function readPolicyDecisionLog(logDir: string): Promise<PolicyDecisionLog[]>;
+//# sourceMappingURL=logging.d.ts.map

package/dist/governance/logging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../../src/governance/logging.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAIjD;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAW/F;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAaxF"}