@a5c-ai/babysitter-sdk 0.0.188-staging.e72bed21 → 0.0.188-staging.f022ecec

package/dist/cli/commands/instructions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instructions.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/instructions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAsBH,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,eAAe,GAAG,gBAAgB,GAAG,aAAa,GAAG,qBAAqB,CAAC;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AA+JD;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,MAAM,CAAC,CA6FjB"}
+{"version":3,"file":"instructions.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/instructions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA0BH,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,eAAe,GAAG,gBAAgB,GAAG,aAAa,GAAG,qBAAqB,CAAC;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AA+JD;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,MAAM,CAAC,CA2HjB"}

package/dist/cli/commands/instructions.js

@@ -195,6 +195,12 @@ async function handleInstructionsCommand(args) {
     if (!hooksActive) {
         hookOverride.hookDriven = false;
     }
+    // Detect execution context (CI, trigger, branch, actor) and derive
+    // capability flags so the babysit skill can select context-appropriate
+    // library processes when dispatching (e.g. GitHub collaboration,
+    // scheduled reporting, local-dev relaxations).
+    const executionContext = (0, prompts_1.detectExecutionContext)();
+    const capabilityFlags = (0, prompts_1.deriveCapabilityFlags)(executionContext);
     const ctx = factory({
         interactive: args.interactive,
         ...libraryInfo,
@@ -218,6 +224,9 @@ async function handleInstructionsCommand(args) {
             promptType: composer.promptType,
             hookDriven: ctx.hookDriven,
             hooksDetected: hooksActive,
+            executionContext,
+            capabilityFlags,
+            suggestedProcesses: (0, prompts_1.processPathsForCapabilities)(capabilityFlags),
             content,
             partsIncluded: composer.partsIncluded,
         }, null, 2));
@@ -229,7 +238,27 @@ async function handleInstructionsCommand(args) {
             // clarifies the JSON output. The text output is self-explanatory
             // from the generated instructions.
         }
-        console.log(content);
+        const activeCapabilities = Object.entries(capabilityFlags)
+            .filter(([, v]) => v === true)
+            .map(([k]) => k);
+        const contextHeader = [
+            '## Execution Context',
+            '',
+            `- CI: \`${executionContext.ci}\``,
+            `- Trigger: \`${executionContext.trigger}\``,
+            executionContext.branch.ref ? `- Branch: \`${executionContext.branch.ref}\`` : undefined,
+            executionContext.repo ? `- Repo: \`${executionContext.repo.owner}/${executionContext.repo.name}\`` : undefined,
+            executionContext.actor ? `- Actor: \`${executionContext.actor.login}\`${executionContext.actor.isBot ? ' (bot)' : ''}` : undefined,
+            '',
+            `Active context capabilities: ${activeCapabilities.length > 0 ? activeCapabilities.map(c => `\`${c}\``).join(', ') : '_(none)_'}`,
+            '',
+            'When selecting library processes to dispatch, prefer those whose triggers match the active capabilities above.',
+            '',
+            '---',
+            '',
+        ].filter((l) => l !== undefined).join('\n');
+        const processGuide = (0, prompts_1.renderCapabilityProcessGuide)(capabilityFlags);
+        console.log(contextHeader + processGuide + content);
     }
     return 0;
 }

package/dist/config/defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEtE;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,QAAQ,EAAE,QAAQ,CAAC;IAEnB;;;OAGG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,KAAK,EAAE,OAAO,CAAC;IAEf;;OAEG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IAEjB;;OAEG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,eAAO,MAAM,eAAe;;;;;;;;;CASlB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAAC,gBAAgB,CAwEtC,CAAC;AAEX;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAQ1C;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAQxC;AAiDD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAqCjF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,gBAAgB,GAAG,sBAAsB,CA2E/E;AAED;;;;GAIG;AACH,wBAAgB,WAAW,IAAI,QAAQ,CAAC,gBAAgB,CAAC,CAExD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAEjE"}
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEtE;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,QAAQ,EAAE,QAAQ,CAAC;IAEnB;;;OAGG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,KAAK,EAAE,OAAO,CAAC;IAEf;;OAEG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IAEjB;;OAEG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,eAAO,MAAM,eAAe;;;;;;;;;CASlB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAAC,gBAAgB,CAwEtC,CAAC;AAEX;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAQ1C;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAmBxC;AAiDD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAqCjF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,gBAAgB,GAAG,sBAAsB,CA2E/E;AAED;;;;GAIG;AACH,wBAAgB,WAAW,IAAI,QAAQ,CAAC,gBAAgB,CAAC,CAExD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAEjE"}

package/dist/config/defaults.js

@@ -159,8 +159,15 @@ function getGlobalStateDir() {
  * Override: set BABYSITTER_LOG_DIR to use a different path.
  */
 function getGlobalLogDir() {
-    if (process.env.BABYSITTER_LOG_DIR) {
-        return path.resolve(process.env.BABYSITTER_LOG_DIR);
+    const override = process.env.BABYSITTER_LOG_DIR?.trim();
+    if (override) {
+        if (!path.isAbsolute(override)) {
+            const rebased = path.join(os.homedir(), ".a5c", "logs");
+            // eslint-disable-next-line no-console
+            console.warn(`[babysitter] BABYSITTER_LOG_DIR must be an absolute path; got ${JSON.stringify(override)}. Falling back to ${rebased}. Set an absolute path to silence this warning.`);
+            return rebased;
+        }
+        return path.resolve(override);
     }
     const globalRoot = process.env.BABYSITTER_GLOBAL_STATE_DIR?.trim()
         ? path.resolve(process.env.BABYSITTER_GLOBAL_STATE_DIR)

package/dist/governance/authority.d.ts

@@ -0,0 +1,68 @@
+/**
+ * GAP-SEC: Authority Chain system.
+ *
+ * Models delegation chains from human principals through agent principals,
+ * with monotonically narrowing scope at each hop.
+ */
+import type { MandateScope } from './mandate';
+/** A principal (human or agent) in the authority chain. */
+export interface AuthorityPrincipal {
+    kind: 'human' | 'agent';
+    id: string;
+    displayName: string;
+}
+/** A single grant of authority from one principal to another. */
+export interface AuthorityGrant {
+    from: AuthorityPrincipal;
+    to: AuthorityPrincipal;
+    scope: MandateScope;
+    grantedAt: string;
+    revokedAt?: string;
+    expiresAt?: string;
+}
+/** A link in the authority chain (wrapping a grant). */
+export interface AuthorityChainLink {
+    grant: AuthorityGrant;
+    index: number;
+}
+/** A full authority chain from root to leaf. */
+export interface AuthorityChain {
+    grants: AuthorityGrant[];
+    rootPrincipal: AuthorityPrincipal;
+    effectiveScope: MandateScope;
+}
+/** Result of chain validation. */
+export interface AuthorityChainValidationResult {
+    valid: boolean;
+    reason?: string;
+}
+/** Result of tracing authority to a human root. */
+export interface AuthorityTrace {
+    humanPrincipal: AuthorityPrincipal;
+    hopCount: number;
+    principalPath: string[];
+}
+/**
+ * Create an authority chain from an ordered list of grants.
+ * Computes the effective scope as the intersection of all grant scopes.
+ */
+export declare function createAuthorityChain(grants: AuthorityGrant[]): AuthorityChain;
+/**
+ * Validate an authority chain. Checks:
+ * 1. Root must be a human principal.
+ * 2. No revoked links.
+ * 3. No expired links.
+ * 4. Scopes monotonically narrow (no expansion).
+ */
+export declare function validateAuthorityChain(chain: AuthorityChain): AuthorityChainValidationResult;
+/**
+ * Attenuate (intersect) two scopes. The result is never wider than either input.
+ * Pure function.
+ */
+export declare function attenuateScope(parent: MandateScope, child: MandateScope): MandateScope;
+/**
+ * Trace authority back to the human root, returning the human principal,
+ * hop count, and full principal path.
+ */
+export declare function traceAuthorityToHuman(chain: AuthorityChain): AuthorityTrace;
+//# sourceMappingURL=authority.d.ts.map

package/dist/governance/authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority.d.ts","sourceRoot":"","sources":["../../src/governance/authority.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAM9C,2DAA2D;AAC3D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iEAAiE;AACjE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,EAAE,EAAE,kBAAkB,CAAC;IACvB,KAAK,EAAE,YAAY,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wDAAwD;AACxD,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,cAAc,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,aAAa,EAAE,kBAAkB,CAAC;IAClC,cAAc,EAAE,YAAY,CAAC;CAC9B;AAED,kCAAkC;AAClC,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,mDAAmD;AACnD,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,kBAAkB,CAAC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAMD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,cAAc,CAkB7E;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,cAAc,GAAG,8BAA8B,CAiC5F;AA2BD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,GAAG,YAAY,CAqBtF;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,cAAc,GAAG,cAAc,CAW3E"}

package/dist/governance/authority.js

@@ -0,0 +1,136 @@
+"use strict";
+/**
+ * GAP-SEC: Authority Chain system.
+ *
+ * Models delegation chains from human principals through agent principals,
+ * with monotonically narrowing scope at each hop.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuthorityChain = createAuthorityChain;
+exports.validateAuthorityChain = validateAuthorityChain;
+exports.attenuateScope = attenuateScope;
+exports.traceAuthorityToHuman = traceAuthorityToHuman;
+// ---------------------------------------------------------------------------
+// Core functions
+// ---------------------------------------------------------------------------
+/**
+ * Create an authority chain from an ordered list of grants.
+ * Computes the effective scope as the intersection of all grant scopes.
+ */
+function createAuthorityChain(grants) {
+    if (grants.length === 0) {
+        throw new Error('Authority chain requires at least one grant');
+    }
+    const rootPrincipal = grants[0].from;
+    // Compute effective scope as intersection of all grant scopes
+    let effectiveScope = { ...grants[0].scope, allowedEffectKinds: [...grants[0].scope.allowedEffectKinds] };
+    for (let i = 1; i < grants.length; i++) {
+        effectiveScope = attenuateScope(effectiveScope, grants[i].scope);
+    }
+    return {
+        grants: [...grants],
+        rootPrincipal,
+        effectiveScope,
+    };
+}
+/**
+ * Validate an authority chain. Checks:
+ * 1. Root must be a human principal.
+ * 2. No revoked links.
+ * 3. No expired links.
+ * 4. Scopes monotonically narrow (no expansion).
+ */
+function validateAuthorityChain(chain) {
+    // 1. Root must be human
+    if (chain.rootPrincipal.kind !== 'human') {
+        return { valid: false, reason: 'Authority chain must be rooted in a human principal' };
+    }
+    const now = Date.now();
+    for (let i = 0; i < chain.grants.length; i++) {
+        const grant = chain.grants[i];
+        // 2. No revoked links
+        if (grant.revokedAt) {
+            return { valid: false, reason: `Grant at index ${i} has been revoked` };
+        }
+        // 3. No expired links
+        if (grant.expiresAt && new Date(grant.expiresAt).getTime() <= now) {
+            return { valid: false, reason: `Grant at index ${i} has expired` };
+        }
+        // 4. Scope must not expand beyond previous grant
+        if (i > 0) {
+            const parentScope = chain.grants[i - 1].scope;
+            const childScope = grant.scope;
+            if (!isScopeSubsetOrEqual(parentScope, childScope)) {
+                return { valid: false, reason: `Grant at index ${i} expands scope beyond parent` };
+            }
+        }
+    }
+    return { valid: true };
+}
+/**
+ * Check if childScope is a subset of or equal to parentScope.
+ */
+function isScopeSubsetOrEqual(parent, child) {
+    // Check effect kinds
+    const parentWildcard = parent.allowedEffectKinds.length === 1 && parent.allowedEffectKinds[0] === '*';
+    if (!parentWildcard) {
+        for (const kind of child.allowedEffectKinds) {
+            if (kind === '*') {
+                return false; // wildcard child cannot escape non-wildcard parent
+            }
+            if (!parent.allowedEffectKinds.includes(kind)) {
+                return false;
+            }
+        }
+    }
+    // Check numeric limits
+    if (child.maxIterations > parent.maxIterations)
+        return false;
+    if (child.maxConcurrentTasks > parent.maxConcurrentTasks)
+        return false;
+    if (child.timeoutMs > parent.timeoutMs)
+        return false;
+    return true;
+}
+/**
+ * Attenuate (intersect) two scopes. The result is never wider than either input.
+ * Pure function.
+ */
+function attenuateScope(parent, child) {
+    const parentWildcard = parent.allowedEffectKinds.length === 1 && parent.allowedEffectKinds[0] === '*';
+    const childWildcard = child.allowedEffectKinds.length === 1 && child.allowedEffectKinds[0] === '*';
+    let allowedEffectKinds;
+    if (parentWildcard && childWildcard) {
+        allowedEffectKinds = ['*'];
+    }
+    else if (parentWildcard) {
+        allowedEffectKinds = [...child.allowedEffectKinds];
+    }
+    else if (childWildcard) {
+        allowedEffectKinds = [...parent.allowedEffectKinds];
+    }
+    else {
+        allowedEffectKinds = parent.allowedEffectKinds.filter(k => child.allowedEffectKinds.includes(k));
+    }
+    return {
+        allowedEffectKinds,
+        maxIterations: Math.min(parent.maxIterations, child.maxIterations),
+        maxConcurrentTasks: Math.min(parent.maxConcurrentTasks, child.maxConcurrentTasks),
+        timeoutMs: Math.min(parent.timeoutMs, child.timeoutMs),
+    };
+}
+/**
+ * Trace authority back to the human root, returning the human principal,
+ * hop count, and full principal path.
+ */
+function traceAuthorityToHuman(chain) {
+    const principalPath = [chain.grants[0].from.id];
+    for (const grant of chain.grants) {
+        principalPath.push(grant.to.id);
+    }
+    return {
+        humanPrincipal: chain.rootPrincipal,
+        hopCount: chain.grants.length,
+        principalPath,
+    };
+}

package/dist/governance/categories.d.ts

@@ -0,0 +1,58 @@
+/**
+ * GAP-SEC: Deterministic Policy Categories.
+ *
+ * Categorizes policy rules into A/B/C/D tiers with distinct enforcement
+ * behaviors and wraps the base policy engine with category-aware evaluation.
+ */
+import type { PolicyRule, PolicyEvaluationContext, PolicyDecision } from './types';
+/** Policy category identifiers. */
+export type PolicyCategory = 'A' | 'B' | 'C' | 'D';
+/** A PolicyRule annotated with a category. */
+export interface CategorizedPolicyRule extends PolicyRule {
+    category?: PolicyCategory;
+}
+/** Enforcement behavior per category. */
+export interface CategoryEnforcementBehavior {
+    category: PolicyCategory;
+    description: string;
+    immutable: boolean;
+    requiresClassification: boolean;
+    isFallback: boolean;
+}
+/** Extended decision with category metadata. */
+export interface CategorizedPolicyDecision extends PolicyDecision {
+    requiresClassification?: boolean;
+    usedFallback?: boolean;
+}
+/** Categorized engine interface. */
+export interface CategorizedPolicyEngine {
+    readonly rules: readonly CategorizedPolicyRule[];
+    evaluate(context: PolicyEvaluationContext): CategorizedPolicyDecision;
+}
+/**
+ * Wrap a plain PolicyRule with a category annotation.
+ */
+export declare function categorizePolicyRule(rule: PolicyRule, category: PolicyCategory): CategorizedPolicyRule;
+/**
+ * Infer a category for a rule that lacks one.
+ *
+ * Heuristic:
+ * - rate-limit + deny -> A (critical)
+ * - permission + deny -> C (needs classification)
+ * - trust-level       -> D (fallback)
+ * - everything else   -> B (advisory)
+ */
+export declare function inferPolicyCategory(rule: PolicyRule): PolicyCategory;
+/**
+ * Create a categorized policy engine that evaluates rules with
+ * category-aware precedence:
+ *
+ * 1. Category A (immutable) - evaluated first, cannot be overridden
+ * 2. Category B (advisory)  - warnings / normal evaluation
+ * 3. Category C (classification-required) - denials flagged
+ * 4. Category D (fallback)  - posture-based fallback
+ *
+ * Accepts CategorizedPolicyRule[] (rules without a category are auto-inferred).
+ */
+export declare function createCategorizedEngine(rules: CategorizedPolicyRule[]): CategorizedPolicyEngine;
+//# sourceMappingURL=categories.d.ts.map

package/dist/governance/categories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"categories.d.ts","sourceRoot":"","sources":["../../src/governance/categories.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAMnF,mCAAmC;AACnC,MAAM,MAAM,cAAc,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;AAEnD,8CAA8C;AAC9C,MAAM,WAAW,qBAAsB,SAAQ,UAAU;IACvD,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,yCAAyC;AACzC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,cAAc,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,sBAAsB,EAAE,OAAO,CAAC;IAChC,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,gDAAgD;AAChD,MAAM,WAAW,yBAA0B,SAAQ,cAAc;IAC/D,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,oCAAoC;AACpC,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACjD,QAAQ,CAAC,OAAO,EAAE,uBAAuB,GAAG,yBAAyB,CAAC;CACvE;AAiBD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,GAAG,qBAAqB,CAEtG;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,cAAc,CAKpE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,qBAAqB,EAAE,GAAG,uBAAuB,CAuE/F"}

package/dist/governance/categories.js

@@ -0,0 +1,120 @@
+"use strict";
+/**
+ * GAP-SEC: Deterministic Policy Categories.
+ *
+ * Categorizes policy rules into A/B/C/D tiers with distinct enforcement
+ * behaviors and wraps the base policy engine with category-aware evaluation.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.categorizePolicyRule = categorizePolicyRule;
+exports.inferPolicyCategory = inferPolicyCategory;
+exports.createCategorizedEngine = createCategorizedEngine;
+const engine_1 = require("./engine");
+// ---------------------------------------------------------------------------
+// Category behaviours
+// ---------------------------------------------------------------------------
+const _CATEGORY_BEHAVIORS = {
+    A: { category: 'A', description: 'Immutable critical rules', immutable: true, requiresClassification: false, isFallback: false },
+    B: { category: 'B', description: 'Advisory rules', immutable: false, requiresClassification: false, isFallback: false },
+    C: { category: 'C', description: 'Classification-required rules', immutable: false, requiresClassification: true, isFallback: false },
+    D: { category: 'D', description: 'Fallback posture-based rules', immutable: false, requiresClassification: false, isFallback: true },
+};
+// ---------------------------------------------------------------------------
+// Core functions
+// ---------------------------------------------------------------------------
+/**
+ * Wrap a plain PolicyRule with a category annotation.
+ */
+function categorizePolicyRule(rule, category) {
+    return { ...rule, category };
+}
+/**
+ * Infer a category for a rule that lacks one.
+ *
+ * Heuristic:
+ * - rate-limit + deny -> A (critical)
+ * - permission + deny -> C (needs classification)
+ * - trust-level       -> D (fallback)
+ * - everything else   -> B (advisory)
+ */
+function inferPolicyCategory(rule) {
+    if (rule.kind === 'rate-limit' && rule.action === 'deny')
+        return 'A';
+    if (rule.kind === 'permission' && rule.action === 'deny')
+        return 'C';
+    if (rule.kind === 'trust-level')
+        return 'D';
+    return 'B';
+}
+/**
+ * Create a categorized policy engine that evaluates rules with
+ * category-aware precedence:
+ *
+ * 1. Category A (immutable) - evaluated first, cannot be overridden
+ * 2. Category B (advisory)  - warnings / normal evaluation
+ * 3. Category C (classification-required) - denials flagged
+ * 4. Category D (fallback)  - posture-based fallback
+ *
+ * Accepts CategorizedPolicyRule[] (rules without a category are auto-inferred).
+ */
+function createCategorizedEngine(rules) {
+    // Ensure every rule has a category
+    const categorized = rules.map(r => r.category ? r : { ...r, category: inferPolicyCategory(r) });
+    // Partition by category
+    const byCategory = { A: [], B: [], C: [], D: [] };
+    for (const rule of categorized) {
+        byCategory[rule.category].push(rule);
+    }
+    // Build per-category engines
+    const engineA = (0, engine_1.createPolicyEngine)(byCategory.A);
+    const engineB = (0, engine_1.createPolicyEngine)(byCategory.B);
+    const engineC = (0, engine_1.createPolicyEngine)(byCategory.C);
+    const engineD = (0, engine_1.createPolicyEngine)(byCategory.D);
+    return {
+        rules: Object.freeze([...categorized]),
+        evaluate(context) {
+            const allWarnings = [];
+            // 1. Category A - immutable, first match wins
+            if (byCategory.A.length > 0) {
+                const decisionA = engineA.evaluate(context);
+                allWarnings.push(...decisionA.warnings);
+                if (!decisionA.allowed) {
+                    return { ...decisionA, warnings: allWarnings };
+                }
+                // If A explicitly allows, still continue to collect warnings from B
+                // but A deny is final.
+            }
+            // 2. Category B - advisory (collect warnings)
+            if (byCategory.B.length > 0) {
+                const decisionB = engineB.evaluate(context);
+                allWarnings.push(...decisionB.warnings);
+                // B deny/allow also applies if no A deny
+                if (!decisionB.allowed) {
+                    return { ...decisionB, warnings: allWarnings };
+                }
+            }
+            // 3. Category C - requires classification
+            if (byCategory.C.length > 0) {
+                const decisionC = engineC.evaluate(context);
+                allWarnings.push(...decisionC.warnings);
+                if (!decisionC.allowed) {
+                    return { ...decisionC, warnings: allWarnings, requiresClassification: true };
+                }
+            }
+            // 4. Category D - fallback
+            if (byCategory.D.length > 0) {
+                const decisionD = engineD.evaluate(context);
+                allWarnings.push(...decisionD.warnings);
+                if (decisionD.rule) {
+                    return { ...decisionD, warnings: allWarnings, usedFallback: true };
+                }
+            }
+            // Default allow
+            return {
+                allowed: true,
+                reason: 'Allowed by default policy',
+                warnings: allWarnings,
+            };
+        },
+    };
+}

package/dist/governance/index.d.ts

@@ -9,4 +9,12 @@ export { maxIterationsPolicy, taskKindPolicy, rateLimitPolicy } from './builtins
 export { logPolicyDecision, readPolicyDecisionLog } from './logging';
 export { breakpointRulesToPolicies } from './bridge';
 export { buildDecisionTrailEntry, summarizeDecisionTrail, type DecisionTrailEntry, type DecisionTrailOptions, type DecisionTrailSummary, type PolicyEvalRecord, } from './decisionTrail';
+export { createMandate, activateMandate, revokeMandate, deriveMandate, validateMandateForContext, mandateToPolicy, type ExecutionMandate, type MandateScope, type MandateLifecycle, type MandateProvenance, type MandateValidationResult, } from './mandate';
+export { createAuthorityChain, validateAuthorityChain, attenuateScope, traceAuthorityToHuman, type AuthorityPrincipal, type AuthorityGrant, type AuthorityChain, type AuthorityChainLink, type AuthorityTrace, type AuthorityChainValidationResult, } from './authority';
+export { categorizePolicyRule, createCategorizedEngine, inferPolicyCategory, type PolicyCategory, type CategorizedPolicyRule, type CategoryEnforcementBehavior, type CategorizedPolicyDecision, type CategorizedPolicyEngine, } from './categories';
+export { postureToPolicyRules, allPosturesToPolicies, } from './postureBridge';
+export { evaluateSandboxAccess, matchesPattern, composeSandboxPolicies, attenuateSandboxPolicy, type SandboxOperationKind, type SandboxRule, type SandboxPolicy, type SandboxDecision, type SandboxOperation, } from './sandboxPolicy';
+export { sandboxDecisionToInteraction, buildSandboxEvent, inheritSandboxPolicy, type SandboxEvent, } from './sandboxBridge';
+export { createPermissionEvent, aggregateChainEvents, filterEvents, type PermissionEvent, type PermissionEventSource, type CreatePermissionEventOptions, type FilterCriteria, } from './permissionEvents';
+export { formatPermissionForTui, formatPermissionForJsonStream, formatPermissionForCli, createPropagationConfig, shouldPropagate, type PropagationTarget, type PropagationConfig, } from './permissionPropagation';
 //# sourceMappingURL=index.d.ts.map

package/dist/governance/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/governance/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,YAAY,GACb,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAGzC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG9D,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlF,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAGrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AAGrD,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/governance/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,YAAY,GACb,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAGzC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG9D,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlF,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAGrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AAGrD,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,aAAa,EACb,eAAe,EACf,aAAa,EACb,aAAa,EACb,yBAAyB,EACzB,eAAe,EACf,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,cAAc,EACd,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,8BAA8B,GACpC,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,GAC7B,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,4BAA4B,EAC5B,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,YAAY,GAClB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,4BAA4B,EACjC,KAAK,cAAc,GACpB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,yBAAyB,CAAC"}

package/dist/governance/index.js

@@ -4,7 +4,7 @@
  * Centralized policy engine for evaluating security rules at effect dispatch.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.summarizeDecisionTrail = exports.buildDecisionTrailEntry = exports.breakpointRulesToPolicies = exports.readPolicyDecisionLog = exports.logPolicyDecision = exports.rateLimitPolicy = exports.taskKindPolicy = exports.maxIterationsPolicy = exports.matchCondition = exports.createPolicyEngine = exports.isStatefulRule = void 0;
+exports.shouldPropagate = exports.createPropagationConfig = exports.formatPermissionForCli = exports.formatPermissionForJsonStream = exports.formatPermissionForTui = exports.filterEvents = exports.aggregateChainEvents = exports.createPermissionEvent = exports.inheritSandboxPolicy = exports.buildSandboxEvent = exports.sandboxDecisionToInteraction = exports.attenuateSandboxPolicy = exports.composeSandboxPolicies = exports.matchesPattern = exports.evaluateSandboxAccess = exports.allPosturesToPolicies = exports.postureToPolicyRules = exports.inferPolicyCategory = exports.createCategorizedEngine = exports.categorizePolicyRule = exports.traceAuthorityToHuman = exports.attenuateScope = exports.validateAuthorityChain = exports.createAuthorityChain = exports.mandateToPolicy = exports.validateMandateForContext = exports.deriveMandate = exports.revokeMandate = exports.activateMandate = exports.createMandate = exports.summarizeDecisionTrail = exports.buildDecisionTrailEntry = exports.breakpointRulesToPolicies = exports.readPolicyDecisionLog = exports.logPolicyDecision = exports.rateLimitPolicy = exports.taskKindPolicy = exports.maxIterationsPolicy = exports.matchCondition = exports.createPolicyEngine = exports.isStatefulRule = void 0;
 var types_1 = require("./types");
 Object.defineProperty(exports, "isStatefulRule", { enumerable: true, get: function () { return types_1.isStatefulRule; } });
 // Engine
@@ -27,3 +27,49 @@ Object.defineProperty(exports, "breakpointRulesToPolicies", { enumerable: true,
 var decisionTrail_1 = require("./decisionTrail");
 Object.defineProperty(exports, "buildDecisionTrailEntry", { enumerable: true, get: function () { return decisionTrail_1.buildDecisionTrailEntry; } });
 Object.defineProperty(exports, "summarizeDecisionTrail", { enumerable: true, get: function () { return decisionTrail_1.summarizeDecisionTrail; } });
+// Mandate system
+var mandate_1 = require("./mandate");
+Object.defineProperty(exports, "createMandate", { enumerable: true, get: function () { return mandate_1.createMandate; } });
+Object.defineProperty(exports, "activateMandate", { enumerable: true, get: function () { return mandate_1.activateMandate; } });
+Object.defineProperty(exports, "revokeMandate", { enumerable: true, get: function () { return mandate_1.revokeMandate; } });
+Object.defineProperty(exports, "deriveMandate", { enumerable: true, get: function () { return mandate_1.deriveMandate; } });
+Object.defineProperty(exports, "validateMandateForContext", { enumerable: true, get: function () { return mandate_1.validateMandateForContext; } });
+Object.defineProperty(exports, "mandateToPolicy", { enumerable: true, get: function () { return mandate_1.mandateToPolicy; } });
+// Authority chain
+var authority_1 = require("./authority");
+Object.defineProperty(exports, "createAuthorityChain", { enumerable: true, get: function () { return authority_1.createAuthorityChain; } });
+Object.defineProperty(exports, "validateAuthorityChain", { enumerable: true, get: function () { return authority_1.validateAuthorityChain; } });
+Object.defineProperty(exports, "attenuateScope", { enumerable: true, get: function () { return authority_1.attenuateScope; } });
+Object.defineProperty(exports, "traceAuthorityToHuman", { enumerable: true, get: function () { return authority_1.traceAuthorityToHuman; } });
+// Categorized policy engine
+var categories_1 = require("./categories");
+Object.defineProperty(exports, "categorizePolicyRule", { enumerable: true, get: function () { return categories_1.categorizePolicyRule; } });
+Object.defineProperty(exports, "createCategorizedEngine", { enumerable: true, get: function () { return categories_1.createCategorizedEngine; } });
+Object.defineProperty(exports, "inferPolicyCategory", { enumerable: true, get: function () { return categories_1.inferPolicyCategory; } });
+// Posture-to-policy bridge
+var postureBridge_1 = require("./postureBridge");
+Object.defineProperty(exports, "postureToPolicyRules", { enumerable: true, get: function () { return postureBridge_1.postureToPolicyRules; } });
+Object.defineProperty(exports, "allPosturesToPolicies", { enumerable: true, get: function () { return postureBridge_1.allPosturesToPolicies; } });
+// Sandbox policy (GAP-SEC-002)
+var sandboxPolicy_1 = require("./sandboxPolicy");
+Object.defineProperty(exports, "evaluateSandboxAccess", { enumerable: true, get: function () { return sandboxPolicy_1.evaluateSandboxAccess; } });
+Object.defineProperty(exports, "matchesPattern", { enumerable: true, get: function () { return sandboxPolicy_1.matchesPattern; } });
+Object.defineProperty(exports, "composeSandboxPolicies", { enumerable: true, get: function () { return sandboxPolicy_1.composeSandboxPolicies; } });
+Object.defineProperty(exports, "attenuateSandboxPolicy", { enumerable: true, get: function () { return sandboxPolicy_1.attenuateSandboxPolicy; } });
+// Sandbox bridge (GAP-SEC-002)
+var sandboxBridge_1 = require("./sandboxBridge");
+Object.defineProperty(exports, "sandboxDecisionToInteraction", { enumerable: true, get: function () { return sandboxBridge_1.sandboxDecisionToInteraction; } });
+Object.defineProperty(exports, "buildSandboxEvent", { enumerable: true, get: function () { return sandboxBridge_1.buildSandboxEvent; } });
+Object.defineProperty(exports, "inheritSandboxPolicy", { enumerable: true, get: function () { return sandboxBridge_1.inheritSandboxPolicy; } });
+// Permission events
+var permissionEvents_1 = require("./permissionEvents");
+Object.defineProperty(exports, "createPermissionEvent", { enumerable: true, get: function () { return permissionEvents_1.createPermissionEvent; } });
+Object.defineProperty(exports, "aggregateChainEvents", { enumerable: true, get: function () { return permissionEvents_1.aggregateChainEvents; } });
+Object.defineProperty(exports, "filterEvents", { enumerable: true, get: function () { return permissionEvents_1.filterEvents; } });
+// Permission propagation
+var permissionPropagation_1 = require("./permissionPropagation");
+Object.defineProperty(exports, "formatPermissionForTui", { enumerable: true, get: function () { return permissionPropagation_1.formatPermissionForTui; } });
+Object.defineProperty(exports, "formatPermissionForJsonStream", { enumerable: true, get: function () { return permissionPropagation_1.formatPermissionForJsonStream; } });
+Object.defineProperty(exports, "formatPermissionForCli", { enumerable: true, get: function () { return permissionPropagation_1.formatPermissionForCli; } });
+Object.defineProperty(exports, "createPropagationConfig", { enumerable: true, get: function () { return permissionPropagation_1.createPropagationConfig; } });
+Object.defineProperty(exports, "shouldPropagate", { enumerable: true, get: function () { return permissionPropagation_1.shouldPropagate; } });

package/dist/governance/mandate.d.ts

@@ -0,0 +1,83 @@
+/**
+ * GAP-SEC: Execution Mandate system.
+ *
+ * Mandates are scoped, lifecycle-managed authority grants that can be
+ * derived (attenuated) and converted to PolicyRule[] for engine evaluation.
+ */
+import type { PolicyRule, PolicyEvaluationContext } from './types';
+/** The set of permissions / limits a mandate grants. */
+export interface MandateScope {
+    /** Effect kinds allowed. Array of strings, or ['*'] for wildcard. */
+    allowedEffectKinds: string[];
+    /** Maximum iterations permitted. */
+    maxIterations: number;
+    /** Maximum concurrent tasks permitted. */
+    maxConcurrentTasks: number;
+    /** Timeout in milliseconds. */
+    timeoutMs: number;
+}
+/** Lifecycle states of a mandate. */
+export type MandateLifecycle = 'created' | 'active' | 'revoked';
+/** Where this mandate came from. */
+export interface MandateProvenance {
+    /** The root mandate ID (self-referential for root mandates). */
+    rootMandateId: string;
+    /** Chain of mandate IDs from root to parent. */
+    derivationChain: string[];
+}
+/** An execution mandate. */
+export interface ExecutionMandate {
+    mandateId: string;
+    scope: MandateScope;
+    grantedBy: string;
+    lifecycle: MandateLifecycle;
+    provenance: MandateProvenance;
+    createdAt: string;
+    activatedAt?: string;
+    /** High-resolution activation mark (performance.now()) for precise expiry checks. */
+    activatedMark?: number;
+    revokedAt?: string;
+    revokedBy?: string;
+}
+export interface CreateMandateOptions {
+    scope: MandateScope;
+    grantedBy: string;
+}
+export interface RevokeMandateOptions {
+    revokedBy: string;
+    reason: string;
+}
+export interface DeriveMandateOptions {
+    scope: MandateScope;
+    grantedBy: string;
+}
+export interface MandateValidationResult {
+    valid: boolean;
+    reason?: string;
+}
+/**
+ * Create a new mandate in the 'created' lifecycle state.
+ */
+export declare function createMandate(options: CreateMandateOptions): ExecutionMandate;
+/**
+ * Transition a mandate from 'created' to 'active'.
+ */
+export declare function activateMandate(mandate: ExecutionMandate): ExecutionMandate;
+/**
+ * Revoke a mandate. Only active mandates can be revoked.
+ */
+export declare function revokeMandate(mandate: ExecutionMandate, options: RevokeMandateOptions): ExecutionMandate;
+/**
+ * Derive a child mandate from an active parent. The child scope must be
+ * equal to or narrower than the parent scope (intersection semantics).
+ */
+export declare function deriveMandate(parent: ExecutionMandate, options: DeriveMandateOptions): ExecutionMandate;
+/**
+ * Validate whether a mandate permits the given evaluation context.
+ */
+export declare function validateMandateForContext(mandate: ExecutionMandate, ctx: PolicyEvaluationContext): MandateValidationResult;
+/**
+ * Convert a mandate's scope into PolicyRule[] for governance engine evaluation.
+ */
+export declare function mandateToPolicy(mandate: ExecutionMandate): PolicyRule[];
+//# sourceMappingURL=mandate.d.ts.map

package/dist/governance/mandate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mandate.d.ts","sourceRoot":"","sources":["../../src/governance/mandate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAMnE,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,oCAAoC;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,0CAA0C;IAC1C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qCAAqC;AACrC,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEhE,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;IACtB,gDAAgD;IAChD,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,4BAA4B;AAC5B,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,YAAY,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,YAAY,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,YAAY,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAMD;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,gBAAgB,CAa7E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,gBAAgB,CAa3E;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,oBAAoB,GAAG,gBAAgB,CAWxG;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,oBAAoB,GAAG,gBAAgB,CA2CvG;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,gBAAgB,EACzB,GAAG,EAAE,uBAAuB,GAC3B,uBAAuB,CA8BzB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,UAAU,EAAE,CAkCvE"}