@a5c-ai/agent-platform 5.0.1-staging.016f0b0e8119

package/dist/governance/logging.js

@@ -0,0 +1,83 @@
+"use strict";
+/**
+ * Governance policy decision audit logging (GAP-SEC-001).
+ * Appends decisions to a JSONL file for audit trail.
+ * Uses async handle-based I/O with fsync for crash safety.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logPolicyDecision = logPolicyDecision;
+exports.readPolicyDecisionLog = readPolicyDecisionLog;
+const node_fs_1 = require("node:fs");
+const path = __importStar(require("node:path"));
+const LOG_FILENAME = 'governance-decisions.jsonl';
+/**
+ * Append a policy decision to the audit log.
+ * Uses handle-based async I/O with fsync for crash safety.
+ */
+async function logPolicyDecision(logDir, entry) {
+    await node_fs_1.promises.mkdir(logDir, { recursive: true });
+    const logPath = path.join(logDir, LOG_FILENAME);
+    const line = JSON.stringify(entry) + '\n';
+    const handle = await node_fs_1.promises.open(logPath, 'a');
+    try {
+        await handle.writeFile(line, 'utf8');
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * Read all policy decisions from the audit log.
+ * Returns empty array if the file does not exist.
+ * Throws on permission errors or other unexpected failures.
+ */
+async function readPolicyDecisionLog(logDir) {
+    const logPath = path.join(logDir, LOG_FILENAME);
+    try {
+        const content = await node_fs_1.promises.readFile(logPath, 'utf8');
+        return content
+            .split('\n')
+            .filter(line => line.trim())
+            .map(line => JSON.parse(line));
+    }
+    catch (error) {
+        const err = error;
+        if (err.code === 'ENOENT')
+            return [];
+        throw error;
+    }
+}

package/dist/governance/mandate.d.ts

@@ -0,0 +1,83 @@
+/**
+ * GAP-SEC: Execution Mandate system.
+ *
+ * Mandates are scoped, lifecycle-managed authority grants that can be
+ * derived (attenuated) and converted to PolicyRule[] for engine evaluation.
+ */
+import type { PolicyRule, PolicyEvaluationContext } from './types';
+/** The set of permissions / limits a mandate grants. */
+export interface MandateScope {
+    /** Effect kinds allowed. Array of strings, or ['*'] for wildcard. */
+    allowedEffectKinds: string[];
+    /** Maximum iterations permitted. */
+    maxIterations: number;
+    /** Maximum concurrent tasks permitted. */
+    maxConcurrentTasks: number;
+    /** Timeout in milliseconds. */
+    timeoutMs: number;
+}
+/** Lifecycle states of a mandate. */
+export type MandateLifecycle = 'created' | 'active' | 'revoked';
+/** Where this mandate came from. */
+export interface MandateProvenance {
+    /** The root mandate ID (self-referential for root mandates). */
+    rootMandateId: string;
+    /** Chain of mandate IDs from root to parent. */
+    derivationChain: string[];
+}
+/** An execution mandate. */
+export interface ExecutionMandate {
+    mandateId: string;
+    scope: MandateScope;
+    grantedBy: string;
+    lifecycle: MandateLifecycle;
+    provenance: MandateProvenance;
+    createdAt: string;
+    activatedAt?: string;
+    /** High-resolution activation mark (performance.now()) for precise expiry checks. */
+    activatedMark?: number;
+    revokedAt?: string;
+    revokedBy?: string;
+}
+export interface CreateMandateOptions {
+    scope: MandateScope;
+    grantedBy: string;
+}
+export interface RevokeMandateOptions {
+    revokedBy: string;
+    reason: string;
+}
+export interface DeriveMandateOptions {
+    scope: MandateScope;
+    grantedBy: string;
+}
+export interface MandateValidationResult {
+    valid: boolean;
+    reason?: string;
+}
+/**
+ * Create a new mandate in the 'created' lifecycle state.
+ */
+export declare function createMandate(options: CreateMandateOptions): ExecutionMandate;
+/**
+ * Transition a mandate from 'created' to 'active'.
+ */
+export declare function activateMandate(mandate: ExecutionMandate): ExecutionMandate;
+/**
+ * Revoke a mandate. Only active mandates can be revoked.
+ */
+export declare function revokeMandate(mandate: ExecutionMandate, options: RevokeMandateOptions): ExecutionMandate;
+/**
+ * Derive a child mandate from an active parent. The child scope must be
+ * equal to or narrower than the parent scope (intersection semantics).
+ */
+export declare function deriveMandate(parent: ExecutionMandate, options: DeriveMandateOptions): ExecutionMandate;
+/**
+ * Validate whether a mandate permits the given evaluation context.
+ */
+export declare function validateMandateForContext(mandate: ExecutionMandate, ctx: PolicyEvaluationContext): MandateValidationResult;
+/**
+ * Convert a mandate's scope into PolicyRule[] for governance engine evaluation.
+ */
+export declare function mandateToPolicy(mandate: ExecutionMandate): PolicyRule[];
+//# sourceMappingURL=mandate.d.ts.map

package/dist/governance/mandate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mandate.d.ts","sourceRoot":"","sources":["../../src/governance/mandate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAMnE,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,oCAAoC;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,0CAA0C;IAC1C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qCAAqC;AACrC,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEhE,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;IACtB,gDAAgD;IAChD,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,4BAA4B;AAC5B,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,YAAY,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,YAAY,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,YAAY,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAMD;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,gBAAgB,CAa7E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,gBAAgB,CAa3E;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,oBAAoB,GAAG,gBAAgB,CAWxG;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,oBAAoB,GAAG,gBAAgB,CA2CvG;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,gBAAgB,EACzB,GAAG,EAAE,uBAAuB,GAC3B,uBAAuB,CA8BzB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,UAAU,EAAE,CAkCvE"}

package/dist/governance/mandate.js

@@ -0,0 +1,180 @@
+"use strict";
+/**
+ * GAP-SEC: Execution Mandate system.
+ *
+ * Mandates are scoped, lifecycle-managed authority grants that can be
+ * derived (attenuated) and converted to PolicyRule[] for engine evaluation.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMandate = createMandate;
+exports.activateMandate = activateMandate;
+exports.revokeMandate = revokeMandate;
+exports.deriveMandate = deriveMandate;
+exports.validateMandateForContext = validateMandateForContext;
+exports.mandateToPolicy = mandateToPolicy;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+// ---------------------------------------------------------------------------
+// Core functions
+// ---------------------------------------------------------------------------
+/**
+ * Create a new mandate in the 'created' lifecycle state.
+ */
+function createMandate(options) {
+    const mandateId = node_crypto_1.default.randomUUID();
+    return {
+        mandateId,
+        scope: { ...options.scope, allowedEffectKinds: [...options.scope.allowedEffectKinds] },
+        grantedBy: options.grantedBy,
+        lifecycle: 'created',
+        provenance: {
+            rootMandateId: mandateId,
+            derivationChain: [],
+        },
+        createdAt: new Date().toISOString(),
+    };
+}
+/**
+ * Transition a mandate from 'created' to 'active'.
+ */
+function activateMandate(mandate) {
+    if (mandate.lifecycle !== 'created') {
+        throw new Error(`Cannot activate mandate in '${mandate.lifecycle}' state; must be 'created'`);
+    }
+    const now = Date.now();
+    const result = {
+        ...mandate,
+        scope: { ...mandate.scope, allowedEffectKinds: [...mandate.scope.allowedEffectKinds] },
+        lifecycle: 'active',
+        activatedAt: new Date(now).toISOString(),
+    };
+    result.activatedMark = performance.now();
+    return result;
+}
+/**
+ * Revoke a mandate. Only active mandates can be revoked.
+ */
+function revokeMandate(mandate, options) {
+    if (mandate.lifecycle === 'revoked') {
+        throw new Error('Cannot revoke an already-revoked mandate');
+    }
+    return {
+        ...mandate,
+        scope: { ...mandate.scope, allowedEffectKinds: [...mandate.scope.allowedEffectKinds] },
+        lifecycle: 'revoked',
+        revokedAt: new Date().toISOString(),
+        revokedBy: options.revokedBy,
+    };
+}
+/**
+ * Derive a child mandate from an active parent. The child scope must be
+ * equal to or narrower than the parent scope (intersection semantics).
+ */
+function deriveMandate(parent, options) {
+    if (parent.lifecycle !== 'active') {
+        throw new Error(`Cannot derive from mandate in '${parent.lifecycle}' state; must be 'active'`);
+    }
+    // Validate scope is not wider than parent
+    const parentKinds = parent.scope.allowedEffectKinds;
+    const isParentWildcard = parentKinds.length === 1 && parentKinds[0] === '*';
+    const childKinds = options.scope.allowedEffectKinds;
+    if (!isParentWildcard) {
+        for (const kind of childKinds) {
+            if (kind === '*') {
+                throw new Error('Child scope expands beyond parent: wildcard child not allowed when parent has explicit effect kinds');
+            }
+            if (!parentKinds.includes(kind)) {
+                throw new Error(`Child scope expands beyond parent: effect kind '${kind}' not in parent scope`);
+            }
+        }
+    }
+    if (options.scope.maxIterations > parent.scope.maxIterations) {
+        throw new Error(`Child scope expands beyond parent: maxIterations ${options.scope.maxIterations} > ${parent.scope.maxIterations}`);
+    }
+    if (options.scope.maxConcurrentTasks > parent.scope.maxConcurrentTasks) {
+        throw new Error(`Child scope expands beyond parent: maxConcurrentTasks ${options.scope.maxConcurrentTasks} > ${parent.scope.maxConcurrentTasks}`);
+    }
+    if (options.scope.timeoutMs > parent.scope.timeoutMs) {
+        throw new Error(`Child scope expands beyond parent: timeoutMs ${options.scope.timeoutMs} > ${parent.scope.timeoutMs}`);
+    }
+    const mandateId = node_crypto_1.default.randomUUID();
+    return {
+        mandateId,
+        scope: { ...options.scope, allowedEffectKinds: [...options.scope.allowedEffectKinds] },
+        grantedBy: options.grantedBy,
+        lifecycle: 'created',
+        provenance: {
+            rootMandateId: parent.provenance.rootMandateId,
+            derivationChain: [...parent.provenance.derivationChain, parent.mandateId],
+        },
+        createdAt: new Date().toISOString(),
+    };
+}
+/**
+ * Validate whether a mandate permits the given evaluation context.
+ */
+function validateMandateForContext(mandate, ctx) {
+    // Check lifecycle
+    if (mandate.lifecycle === 'revoked') {
+        return { valid: false, reason: 'Mandate has been revoked' };
+    }
+    if (mandate.lifecycle !== 'active') {
+        return { valid: false, reason: `Mandate is in '${mandate.lifecycle}' state, not active` };
+    }
+    // Check expiration (activatedAt + timeoutMs)
+    if (mandate.activatedAt) {
+        let elapsedMs;
+        if (mandate.activatedMark != null) {
+            elapsedMs = performance.now() - mandate.activatedMark;
+        }
+        else {
+            elapsedMs = Date.now() - new Date(mandate.activatedAt).getTime();
+        }
+        if (elapsedMs >= mandate.scope.timeoutMs) {
+            return { valid: false, reason: 'Mandate has expired' };
+        }
+    }
+    // Check effect kind
+    const kinds = mandate.scope.allowedEffectKinds;
+    const isWildcard = kinds.length === 1 && kinds[0] === '*';
+    if (!isWildcard && !kinds.includes(ctx.effectKind)) {
+        return { valid: false, reason: `Effect kind '${ctx.effectKind}' is not allowed by mandate scope` };
+    }
+    return { valid: true };
+}
+/**
+ * Convert a mandate's scope into PolicyRule[] for governance engine evaluation.
+ */
+function mandateToPolicy(mandate) {
+    const rules = [];
+    const prefix = `mandate:${mandate.mandateId.slice(0, 8)}`;
+    // 1. Deny rule for out-of-scope effect kinds (if not wildcard)
+    const kinds = mandate.scope.allowedEffectKinds;
+    const isWildcard = kinds.length === 1 && kinds[0] === '*';
+    if (!isWildcard) {
+        // Create a deny rule that matches any effectKind NOT in the allowed list.
+        // We use a regex negative lookahead.
+        const escaped = kinds.map(k => k.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
+        const pattern = `^(?!${escaped.join('|')}$)`;
+        rules.push({
+            id: `${prefix}:deny-out-of-scope`,
+            kind: 'permission',
+            condition: { field: 'effectKind', op: 'matches', value: pattern },
+            action: 'deny',
+            priority: 200,
+            metadata: { source: 'mandate', mandateId: mandate.mandateId },
+        });
+    }
+    // 2. Iteration limit rule
+    rules.push({
+        id: `${prefix}:max-iterations`,
+        kind: 'rate-limit',
+        condition: { field: 'iteration', op: 'gt', value: String(mandate.scope.maxIterations) },
+        action: 'deny',
+        priority: 150,
+        metadata: { source: 'mandate', mandateId: mandate.mandateId },
+    });
+    return rules;
+}

package/dist/governance/permissionEvents.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Permission event creation, aggregation, and filtering for the governance layer.
+ */
+export type PermissionEventSource = 'harness' | 'subagent' | 'sandbox' | 'policy-engine';
+export interface PermissionEvent {
+    kind: string;
+    operation: {
+        kind: string;
+        target: string;
+        [key: string]: unknown;
+    };
+    decision: {
+        action: string;
+        reason: string;
+        [key: string]: unknown;
+    };
+    timestamp: string;
+    source: PermissionEventSource;
+    mandateId?: string;
+    chainId?: string;
+}
+export interface CreatePermissionEventOptions {
+    kind: string;
+    operation: {
+        kind: string;
+        target: string;
+        [key: string]: unknown;
+    };
+    decision: {
+        action: string;
+        reason: string;
+        [key: string]: unknown;
+    };
+    source: PermissionEventSource;
+    timestamp?: string;
+    mandateId?: string;
+    chainId?: string;
+}
+export declare function createPermissionEvent(options: CreatePermissionEventOptions): PermissionEvent;
+/**
+ * Flatten multiple event arrays (from parent/child runs), filter by chainId,
+ * and sort chronologically.
+ */
+export declare function aggregateChainEvents(chainId: string, eventArrays: PermissionEvent[][]): PermissionEvent[];
+export interface FilterCriteria {
+    source?: PermissionEventSource;
+    action?: string;
+    kind?: string;
+}
+export declare function filterEvents(events: PermissionEvent[], criteria: FilterCriteria): PermissionEvent[];
+//# sourceMappingURL=permissionEvents.d.ts.map

package/dist/governance/permissionEvents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionEvents.d.ts","sourceRoot":"","sources":["../../src/governance/permissionEvents.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,eAAe,CAAC;AAEzF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACpE,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACpE,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACrE,MAAM,EAAE,qBAAqB,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAMD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,eAAe,CAU5F;AAMD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,eAAe,EAAE,EAAE,GAC/B,eAAe,EAAE,CAWnB;AAMD,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,cAAc,GAAG,eAAe,EAAE,CAOnG"}

package/dist/governance/permissionEvents.js

@@ -0,0 +1,52 @@
+"use strict";
+/**
+ * Permission event creation, aggregation, and filtering for the governance layer.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createPermissionEvent = createPermissionEvent;
+exports.aggregateChainEvents = aggregateChainEvents;
+exports.filterEvents = filterEvents;
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+function createPermissionEvent(options) {
+    return {
+        kind: options.kind,
+        operation: options.operation,
+        decision: options.decision,
+        timestamp: options.timestamp ?? new Date().toISOString(),
+        source: options.source,
+        ...(options.mandateId !== undefined ? { mandateId: options.mandateId } : {}),
+        ...(options.chainId !== undefined ? { chainId: options.chainId } : {}),
+    };
+}
+// ---------------------------------------------------------------------------
+// Aggregation
+// ---------------------------------------------------------------------------
+/**
+ * Flatten multiple event arrays (from parent/child runs), filter by chainId,
+ * and sort chronologically.
+ */
+function aggregateChainEvents(chainId, eventArrays) {
+    const all = [];
+    for (const arr of eventArrays) {
+        for (const ev of arr) {
+            if (ev.chainId === chainId) {
+                all.push(ev);
+            }
+        }
+    }
+    all.sort((a, b) => (a.timestamp < b.timestamp ? -1 : a.timestamp > b.timestamp ? 1 : 0));
+    return all;
+}
+function filterEvents(events, criteria) {
+    return events.filter((ev) => {
+        if (criteria.source !== undefined && ev.source !== criteria.source)
+            return false;
+        if (criteria.action !== undefined && ev.decision.action !== criteria.action)
+            return false;
+        if (criteria.kind !== undefined && ev.kind !== criteria.kind)
+            return false;
+        return true;
+    });
+}

package/dist/governance/permissionPropagation.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Permission event propagation: formatting for different output targets
+ * and configuration for which event kinds propagate to which targets.
+ */
+import type { PermissionEvent } from './permissionEvents';
+export interface PropagationTarget {
+    name: string;
+    kinds: string[];
+}
+export interface PropagationConfig {
+    targets: PropagationTarget[];
+}
+export declare function formatPermissionForTui(event: PermissionEvent): string;
+export declare function formatPermissionForJsonStream(event: PermissionEvent): PermissionEvent;
+export declare function formatPermissionForCli(event: PermissionEvent): string;
+export declare function createPropagationConfig(targets: PropagationTarget[]): PropagationConfig;
+export declare function shouldPropagate(event: PermissionEvent, targetName: string, config: PropagationConfig): boolean;
+//# sourceMappingURL=permissionPropagation.d.ts.map

package/dist/governance/permissionPropagation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionPropagation.d.ts","sourceRoot":"","sources":["../../src/governance/permissionPropagation.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAM1D,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AA4BD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAIrE;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,eAAe,GAAG,eAAe,CAGrF;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAGrE;AAMD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,iBAAiB,CAEvF;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAIT"}

package/dist/governance/permissionPropagation.js

@@ -0,0 +1,58 @@
+"use strict";
+/**
+ * Permission event propagation: formatting for different output targets
+ * and configuration for which event kinds propagate to which targets.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatPermissionForTui = formatPermissionForTui;
+exports.formatPermissionForJsonStream = formatPermissionForJsonStream;
+exports.formatPermissionForCli = formatPermissionForCli;
+exports.createPropagationConfig = createPropagationConfig;
+exports.shouldPropagate = shouldPropagate;
+// ---------------------------------------------------------------------------
+// ANSI helpers
+// ---------------------------------------------------------------------------
+const RESET = '\x1b[0m';
+const RED = '\x1b[31m';
+const GREEN = '\x1b[32m';
+const YELLOW = '\x1b[33m';
+function colorForAction(action) {
+    switch (action) {
+        case 'block':
+            return RED;
+        case 'allow':
+            return GREEN;
+        case 'prompt':
+            return YELLOW;
+        default:
+            return '';
+    }
+}
+// ---------------------------------------------------------------------------
+// Formatters
+// ---------------------------------------------------------------------------
+function formatPermissionForTui(event) {
+    const color = colorForAction(event.decision.action);
+    const target = event.operation.target ?? '';
+    return `${color}[${event.decision.action}]${RESET} ${event.kind} ${target}`;
+}
+function formatPermissionForJsonStream(event) {
+    // Return a clean copy with all fields — already JSON-serializable
+    return { ...event };
+}
+function formatPermissionForCli(event) {
+    const target = event.operation.target ?? '';
+    return `${event.decision.action} ${event.kind} ${target}`;
+}
+// ---------------------------------------------------------------------------
+// Config
+// ---------------------------------------------------------------------------
+function createPropagationConfig(targets) {
+    return { targets };
+}
+function shouldPropagate(event, targetName, config) {
+    const target = config.targets.find((t) => t.name === targetName);
+    if (!target)
+        return false;
+    return target.kinds.includes(event.kind);
+}

package/dist/governance/postureBridge.d.ts

@@ -0,0 +1,17 @@
+/**
+ * GAP-SEC: Posture-to-Policy Bridge.
+ *
+ * Converts breakpoint approval postures into governance PolicyRule[] so they
+ * can be evaluated by the unified policy engine.
+ */
+import type { ActionCategory, ApprovalPosture } from "@a5c-ai/babysitter-sdk";
+import type { PolicyRule } from './types';
+/**
+ * Convert a single posture for a given action category into PolicyRule[].
+ */
+export declare function postureToPolicyRules(category: ActionCategory, posture: ApprovalPosture): PolicyRule[];
+/**
+ * Convert all DEFAULT_POSTURES (optionally overridden) into a sorted PolicyRule[].
+ */
+export declare function allPosturesToPolicies(overrides?: Partial<Record<ActionCategory, Partial<ApprovalPosture>>>): PolicyRule[];
+//# sourceMappingURL=postureBridge.d.ts.map

package/dist/governance/postureBridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postureBridge.d.ts","sourceRoot":"","sources":["../../src/governance/postureBridge.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAqB1C;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,eAAe,GACvB,UAAU,EAAE,CAwEd;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,GACpE,UAAU,EAAE,CAed"}