@adhd/agent-core-policy 2.1.0

package/src/store/agent-policy-store.js

@@ -0,0 +1,241 @@
+import { eq } from 'drizzle-orm';
+import { agentCategoriesTable, agentPoliciesTable, categoryPoliciesTable, } from '../db/schema.js';
+import { PolicyError } from './policy-template-store.js';
+/**
+ * Typed error thrown by {@link AgentPolicyStore} — mirrors the PolicyError
+ * pattern but for junction-specific error codes.
+ */
+export class AgentPolicyError extends Error {
+    code;
+    data;
+    constructor(code, message, data) {
+        super(message);
+        this.name = 'AgentPolicyError';
+        this.code = code;
+        this.data = data;
+    }
+}
+// Re-export so callers can import the base PolicyError from this module too.
+export { PolicyError };
+// ──────────────────────────────────────────────
+// Store
+// ──────────────────────────────────────────────
+/**
+ * Thin Drizzle wrapper for the `policy_agent_policies` junction table.
+ *
+ * Mirrors the `PolicyTemplateStore` / `agent-mcp` AgentStore pattern:
+ *  - constructor takes a `BetterSQLite3Database` handle (caller owns lifecycle)
+ *  - methods are synchronous Drizzle queries
+ *  - errors throw {@link AgentPolicyError} with typed codes
+ *
+ * Direct-attach (`attach`) sets `inherited_from = NULL`.  Category inheritance
+ * resolution (`resolveForAgent`, added in the `policy-inheritance` state) reads
+ * the joined category membership at query time — lazy, per Decision 1.
+ */
+export class AgentPolicyStore {
+    db;
+    constructor(
+    // Accept any schema parameter so callers can pass a schema-typed db
+    // (e.g. drizzle(sqlite, { schema })) without a type-narrowing cast.
+    db) {
+        this.db = db;
+    }
+    /**
+     * Attach a policy template DIRECTLY to an agent (`inherited_from = null`).
+     *
+     * @throws {AgentPolicyError} AGENT_POLICY_ALREADY_ATTACHED when the
+     *   (agentSlug, policySlug) pair already exists.
+     */
+    attach(input) {
+        const existing = this.db
+            .select()
+            .from(agentPoliciesTable)
+            .where(eq(agentPoliciesTable.agentSlug, input.agentSlug))
+            .all()
+            .find((r) => r.policySlug === input.policySlug);
+        if (existing) {
+            throw new AgentPolicyError('AGENT_POLICY_ALREADY_ATTACHED', `Policy '${input.policySlug}' is already attached to agent '${input.agentSlug}'`);
+        }
+        const row = {
+            agentSlug: input.agentSlug,
+            policySlug: input.policySlug,
+            // drizzle `text({ mode: "json" })` serialises automatically when
+            // passed an object value; NULL is represented as null/undefined.
+            overrideConfig: (input.overrideConfig ?? null),
+            isMandatory: input.isMandatory ?? false,
+            // Direct attach — NOT inherited from a category. [Decision 1]
+            inheritedFrom: null,
+        };
+        this.db.insert(agentPoliciesTable).values(row).run();
+        const insertedRow = this.db
+            .select()
+            .from(agentPoliciesTable)
+            .where(eq(agentPoliciesTable.agentSlug, input.agentSlug))
+            .all()
+            .find((r) => r.policySlug === input.policySlug);
+        if (!insertedRow) {
+            throw new AgentPolicyError('AGENT_POLICY_ALREADY_ATTACHED', `Failed to read back inserted policy '${input.policySlug}' for agent '${input.agentSlug}'`);
+        }
+        return this._toRow(insertedRow);
+    }
+    /**
+     * Return all direct `policy_agent_policies` rows for the given agent slug.
+     *
+     * Returns only rows stored directly against the agent (`inherited_from IS NULL`
+     * for direct-attach rows).  Use {@link resolveForAgent} to include inherited
+     * policies from category membership.
+     *
+     * @param agentSlug — the slug of the agent whose policies to retrieve.
+     */
+    listForAgent(agentSlug) {
+        const rows = this.db
+            .select()
+            .from(agentPoliciesTable)
+            .where(eq(agentPoliciesTable.agentSlug, agentSlug))
+            .all();
+        return rows.map((r) => this._toRow(r));
+    }
+    /**
+     * Attach a policy template to a taxonomy CATEGORY (lazy inheritance).
+     *
+     * Stores a single `policy_category_policies` row — does NOT fan out rows to
+     * individual agents.  Any agent already in or later added to the category
+     * inherits this policy at the next `resolveForAgent` call. [Decision 1]
+     *
+     * @throws {AgentPolicyError} CATEGORY_POLICY_ALREADY_ATTACHED when the
+     *   (categorySlug, policySlug) pair already exists.
+     */
+    attachToCategory(input) {
+        const existing = this.db
+            .select()
+            .from(categoryPoliciesTable)
+            .where(eq(categoryPoliciesTable.categorySlug, input.categorySlug))
+            .all()
+            .find((r) => r.policySlug === input.policySlug);
+        if (existing) {
+            throw new AgentPolicyError('CATEGORY_POLICY_ALREADY_ATTACHED', `Policy '${input.policySlug}' is already attached to category '${input.categorySlug}'`);
+        }
+        const row = {
+            categorySlug: input.categorySlug,
+            policySlug: input.policySlug,
+            isMandatory: input.isMandatory ?? false,
+        };
+        this.db.insert(categoryPoliciesTable).values(row).run();
+        return {
+            categorySlug: row.categorySlug,
+            policySlug: row.policySlug,
+            isMandatory: Boolean(row.isMandatory),
+        };
+    }
+    /**
+     * Record that an agent is a member of a taxonomy category.
+     *
+     * At the next `resolveForAgent` call the agent automatically inherits all
+     * policies attached to the category — no re-fanout or migration needed.
+     * This is the "agent added AFTER the category-attach" case from Decision 1.
+     *
+     * @throws {AgentPolicyError} AGENT_CATEGORY_ALREADY_JOINED when the
+     *   (agentSlug, categorySlug) pair already exists.
+     */
+    addAgentToCategory(input) {
+        const existing = this.db
+            .select()
+            .from(agentCategoriesTable)
+            .where(eq(agentCategoriesTable.agentSlug, input.agentSlug))
+            .all()
+            .find((r) => r.categorySlug === input.categorySlug);
+        if (existing) {
+            throw new AgentPolicyError('AGENT_CATEGORY_ALREADY_JOINED', `Agent '${input.agentSlug}' is already in category '${input.categorySlug}'`);
+        }
+        this.db
+            .insert(agentCategoriesTable)
+            .values({ agentSlug: input.agentSlug, categorySlug: input.categorySlug })
+            .run();
+    }
+    /**
+     * Resolve the complete effective policy set for an agent at query time.
+     *
+     * Returns a union of:
+     *  1. Policies attached DIRECTLY to the agent (inheritedFrom = null).
+     *  2. Policies inherited from every category the agent belongs to,
+     *     synthesised as rows with inheritedFrom = categorySlug. [Decision 1]
+     *
+     * The join is performed at call time so newly added category policies or
+     * membership changes are always reflected — there is no stale materialised
+     * cache to invalidate.
+     *
+     * If an agent has a direct-attach for a policy AND inherits the same policy
+     * from a category, the direct-attach row takes precedence (override wins).
+     *
+     * @param agentSlug — the slug of the agent to resolve policies for.
+     */
+    resolveForAgent(agentSlug) {
+        // 1. Direct-attach policies for this agent.
+        const directRows = this.db
+            .select()
+            .from(agentPoliciesTable)
+            .where(eq(agentPoliciesTable.agentSlug, agentSlug))
+            .all();
+        const directPolicySlugs = new Set(directRows.map((r) => r.policySlug));
+        // 2. Categories the agent belongs to.
+        const categoryMemberships = this.db
+            .select()
+            .from(agentCategoriesTable)
+            .where(eq(agentCategoriesTable.agentSlug, agentSlug))
+            .all();
+        // 3. For each category membership, fetch attached policies and synthesise
+        //    inherited rows — skipping any policy already covered by a direct-attach
+        //    (direct attachment wins per the override semantics).
+        const inheritedRows = [];
+        for (const membership of categoryMemberships) {
+            const catPolicies = this.db
+                .select()
+                .from(categoryPoliciesTable)
+                .where(eq(categoryPoliciesTable.categorySlug, membership.categorySlug))
+                .all();
+            for (const catPolicy of catPolicies) {
+                if (directPolicySlugs.has(catPolicy.policySlug)) {
+                    // Direct-attach overrides; skip the inherited copy.
+                    continue;
+                }
+                inheritedRows.push({
+                    agentSlug: agentSlug,
+                    policySlug: catPolicy.policySlug,
+                    overrideConfig: null,
+                    isMandatory: Boolean(catPolicy.isMandatory),
+                    // The key contract: inherited_from = the category slug. [Decision 1]
+                    inheritedFrom: catPolicy.categorySlug,
+                });
+            }
+        }
+        return [...directRows.map((r) => this._toRow(r)), ...inheritedRows];
+    }
+    // ── private helpers ──────────────────────────────────────────────────────
+    _toRow(row) {
+        return {
+            agentSlug: row.agentSlug,
+            policySlug: row.policySlug,
+            // drizzle returns parsed JS value for `mode:"json"` columns.
+            overrideConfig: row.overrideConfig ?? null,
+            isMandatory: Boolean(row.isMandatory),
+            inheritedFrom: row.inheritedFrom ?? null,
+        };
+    }
+}
+/**
+ * Compute effective rules by shallow-merging `overrideConfig` on top of
+ * `templateRules`. Override keys replace template keys (arrays and nested
+ * objects are replaced wholesale). An absent or empty override leaves the
+ * template unchanged. [Decision 3]
+ *
+ * @param templateRules — the base rules object from `policy_policy_templates`.
+ * @param overrideConfig — the per-agent override (may be null/undefined).
+ * @returns the effective merged rules object.
+ */
+export function resolveEffectiveRules(templateRules, overrideConfig) {
+    if (!overrideConfig || Object.keys(overrideConfig).length === 0) {
+        return templateRules;
+    }
+    return { ...templateRules, ...overrideConfig };
+}
+//# sourceMappingURL=agent-policy-store.js.map

package/src/store/agent-policy-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-policy-store.js","sourceRoot":"","sources":["../../../../../../packages/agent/agent-core-policy/src/store/agent-policy-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAKjC,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAWzD;;;GAGG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAAuB;IAC3B,IAAI,CAAW;IAExB,YAAY,IAA0B,EAAE,OAAe,EAAE,IAAc;QACrE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,6EAA6E;AAC7E,OAAO,EAAE,WAAW,EAAE,CAAC;AAoFvB,iDAAiD;AACjD,QAAQ;AACR,iDAAiD;AAEjD;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,gBAAgB;IAIR;IAHnB;IACE,oEAAoE;IACpE,oEAAoE;IACnD,EAA4B;QAA5B,OAAE,GAAF,EAAE,CAA0B;IAC5C,CAAC;IAEJ;;;;;OAKG;IACH,MAAM,CAAC,KAA6B;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE;aACrB,MAAM,EAAE;aACR,IAAI,CAAC,kBAAkB,CAAC;aACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;aACxD,GAAG,EAAE;aACL,IAAI,CAAC,CAAC,CAAyB,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC;QAE1E,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CACxB,+BAA+B,EAC/B,WAAW,KAAK,CAAC,UAAU,mCAAmC,KAAK,CAAC,SAAS,GAAG,CACjF,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG;YACV,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,iEAAiE;YACjE,iEAAiE;YACjE,cAAc,EAAE,CAAC,KAAK,CAAC,cAAc,IAAI,IAAI,CAErC;YACR,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK;YACvC,8DAA8D;YAC9D,aAAa,EAAE,IAAI;SACpB,CAAC;QAEF,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAErD,MAAM,WAAW,GAAG,IAAI,CAAC,EAAE;aACxB,MAAM,EAAE;aACR,IAAI,CAAC,kBAAkB,CAAC;aACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;aACxD,GAAG,EAAE;aACL,IAAI,CAAC,CAAC,CAAyB,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC;QAE1E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,gBAAgB,CACxB,+BAA+B,EAC/B,wCAAwC,KAAK,CAAC,UAAU,gBAAgB,KAAK,CAAC,SAAS,GAAG,CAC3F,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;OAQG;IACH,YAAY,CAAC,SAAiB;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,MAAM,EAAE;aACR,IAAI,CAAC,kBAAkB,CAAC;aACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;aAClD,GAAG,EAAE,CAAC;QAET,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAyC,EAAE,EAAE,CAC5D,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CACf,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,gBAAgB,CAAC,KAAgC;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE;aACrB,MAAM,EAAE;aACR,IAAI,CAAC,qBAAqB,CAAC;aAC3B,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;aACjE,GAAG,EAAE;aACL,IAAI,CAAC,CAAC,CAAyB,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC;QAE1E,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CACxB,kCAAkC,EAClC,WAAW,KAAK,CAAC,UAAU,sCAAsC,KAAK,CAAC,YAAY,GAAG,CACvF,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG;YACV,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK;SACxC,CAAC;QAEF,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAExD,OAAO;YACL,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;SACtC,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,kBAAkB,CAAC,KAAyB;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE;aACrB,MAAM,EAAE;aACR,IAAI,CAAC,oBAAoB,CAAC;aAC1B,KAAK,CAAC,EAAE,CAAC,oBAAoB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;aAC1D,GAAG,EAAE;aACL,IAAI,CACH,CAAC,CAA2B,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,CACvE,CAAC;QAEJ,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CACxB,+BAA+B,EAC/B,UAAU,KAAK,CAAC,SAAS,6BAA6B,KAAK,CAAC,YAAY,GAAG,CAC5E,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,oBAAoB,CAAC;aAC5B,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;aACxE,GAAG,EAAE,CAAC;IACX,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,CAAC,SAAiB;QAC/B,4CAA4C;QAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,kBAAkB,CAAC;aACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;aAClD,GAAG,EAAgD,CAAC;QAEvD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAEvE,sCAAsC;QACtC,MAAM,mBAAmB,GAAG,IAAI,CAAC,EAAE;aAChC,MAAM,EAAE;aACR,IAAI,CAAC,oBAAoB,CAAC;aAC1B,KAAK,CAAC,EAAE,CAAC,oBAAoB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;aACpD,GAAG,EAAkD,CAAC;QAEzD,0EAA0E;QAC1E,6EAA6E;QAC7E,0DAA0D;QAC1D,MAAM,aAAa,GAAqB,EAAE,CAAC;QAE3C,KAAK,MAAM,UAAU,IAAI,mBAAmB,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,EAAE;iBACxB,MAAM,EAAE;iBACR,IAAI,CAAC,qBAAqB,CAAC;iBAC3B,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAAC,YAAY,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;iBACtE,GAAG,EAAmD,CAAC;YAE1D,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;gBACpC,IAAI,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;oBAChD,oDAAoD;oBACpD,SAAS;gBACX,CAAC;gBAED,aAAa,CAAC,IAAI,CAAC;oBACjB,SAAS,EAAE,SAAS;oBACpB,UAAU,EAAE,SAAS,CAAC,UAAU;oBAChC,cAAc,EAAE,IAAI;oBACpB,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC;oBAC3C,qEAAqE;oBACrE,aAAa,EAAE,SAAS,CAAC,YAAY;iBACtC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,aAAa,CAAC,CAAC;IACtE,CAAC;IAED,4EAA4E;IAEpE,MAAM,CAAC,GAA2C;QACxD,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,6DAA6D;YAC7D,cAAc,EACX,GAAG,CAAC,cAAiD,IAAI,IAAI;YAChE,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YACrC,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI;SACzC,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,aAAsC,EACtC,cAA0D;IAE1D,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,GAAG,aAAa,EAAE,GAAG,cAAc,EAAE,CAAC;AACjD,CAAC"}

package/src/store/policy-template-store.d.ts

@@ -0,0 +1,72 @@
+type AnyBetterSQLite3Database = import('drizzle-orm/better-sqlite3').BetterSQLite3Database<any>;
+export type PolicyErrorCode = 'POLICY_TEMPLATE_NOT_FOUND' | 'POLICY_TEMPLATE_ALREADY_EXISTS';
+/**
+ * Typed error thrown by policy stores — mirrors the ToolError pattern from
+ * agent-mcp but uses the policy-specific error code union.
+ */
+export declare class PolicyError extends Error {
+    readonly code: PolicyErrorCode;
+    readonly data?: unknown;
+    constructor(code: PolicyErrorCode, message: string, data?: unknown);
+}
+/** A policy template as persisted and returned by {@link PolicyTemplateStore}. */
+export interface PolicyTemplate {
+    /** Unique identifier slug (text PK). */
+    slug: string;
+    /** FK to policy_policy_types.slug (plain text — no cross-prefix FK). */
+    type: string;
+    description: string;
+    /** Structured rule parameters — deserialized from the JSON column. */
+    rules: Record<string, unknown>;
+    /**
+     * One or more enforcement mechanism strings.
+     * Always a JSON ARRAY — never a scalar string. [inv:enforcement-is-array]
+     */
+    enforcement: string[];
+    /** Schema version; starts at 1. */
+    version: number;
+    /** True for system-owned templates (shipped with the package). */
+    isSystem: boolean;
+}
+/**
+ * Input for {@link PolicyTemplateStore.create}. `version` and `isSystem`
+ * default to 1 / false when omitted.
+ */
+export type PolicyTemplateCreateInput = Omit<PolicyTemplate, 'version' | 'isSystem'> & {
+    version?: number;
+    isSystem?: boolean;
+};
+/**
+ * Thin Drizzle wrapper for the `policy_policy_templates` table.
+ *
+ * Mirrors `@adhd/agent-mcp`'s AgentStore pattern:
+ *  - constructor takes a `BetterSQLite3Database` handle (caller owns lifecycle)
+ *  - methods are synchronous Drizzle queries
+ *  - errors throw {@link PolicyError} with typed codes
+ */
+export declare class PolicyTemplateStore {
+    private readonly db;
+    constructor(db: AnyBetterSQLite3Database);
+    /**
+     * Persist a new policy template.
+     *
+     * @throws {PolicyError} POLICY_TEMPLATE_ALREADY_EXISTS if the slug is taken.
+     */
+    create(input: PolicyTemplateCreateInput): PolicyTemplate;
+    /**
+     * Retrieve a single template by slug.
+     *
+     * @throws {PolicyError} POLICY_TEMPLATE_NOT_FOUND if no such slug exists.
+     */
+    read(slug: string): PolicyTemplate;
+    /**
+     * Return all templates, optionally filtered by `type` slug.
+     *
+     * @param typeFilter — when provided, only templates whose `type` matches
+     *                     this slug are returned.
+     */
+    list(typeFilter?: string): PolicyTemplate[];
+    private _toTemplate;
+}
+export {};
+//# sourceMappingURL=policy-template-store.d.ts.map

package/src/store/policy-template-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-template-store.d.ts","sourceRoot":"","sources":["../../../../../../packages/agent/agent-core-policy/src/store/policy-template-store.ts"],"names":[],"mappings":"AAGA,KAAK,wBAAwB,GAAG,OAAO,4BAA4B,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC;AAQhG,MAAM,MAAM,eAAe,GACvB,2BAA2B,GAC3B,gCAAgC,CAAC;AAErC;;;GAGG;AACH,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;gBAEZ,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO;CAMnE;AAMD,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B;;;OAGG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAC1C,cAAc,EACd,SAAS,GAAG,UAAU,CACvB,GAAG;IACF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAMF;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAI5B,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,wBAAwB;IAG/C;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,yBAAyB,GAAG,cAAc;IA2CxD;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc;IAiBlC;;;;;OAKG;IACH,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,cAAc,EAAE;IAc3C,OAAO,CAAC,WAAW;CAcpB"}

package/src/store/policy-template-store.js

@@ -0,0 +1,118 @@
+import { eq } from 'drizzle-orm';
+import { policyTemplatesTable } from '../db/schema.js';
+/**
+ * Typed error thrown by policy stores — mirrors the ToolError pattern from
+ * agent-mcp but uses the policy-specific error code union.
+ */
+export class PolicyError extends Error {
+    code;
+    data;
+    constructor(code, message, data) {
+        super(message);
+        this.name = 'PolicyError';
+        this.code = code;
+        this.data = data;
+    }
+}
+// ──────────────────────────────────────────────
+// Store
+// ──────────────────────────────────────────────
+/**
+ * Thin Drizzle wrapper for the `policy_policy_templates` table.
+ *
+ * Mirrors `@adhd/agent-mcp`'s AgentStore pattern:
+ *  - constructor takes a `BetterSQLite3Database` handle (caller owns lifecycle)
+ *  - methods are synchronous Drizzle queries
+ *  - errors throw {@link PolicyError} with typed codes
+ */
+export class PolicyTemplateStore {
+    db;
+    constructor(
+    // Accept any schema parameter so callers can pass a schema-typed db
+    // (e.g. drizzle(sqlite, { schema })) without a type-narrowing cast.
+    db) {
+        this.db = db;
+    }
+    /**
+     * Persist a new policy template.
+     *
+     * @throws {PolicyError} POLICY_TEMPLATE_ALREADY_EXISTS if the slug is taken.
+     */
+    create(input) {
+        const existing = this.db
+            .select()
+            .from(policyTemplatesTable)
+            .where(eq(policyTemplatesTable.slug, input.slug))
+            .get();
+        if (existing) {
+            throw new PolicyError('POLICY_TEMPLATE_ALREADY_EXISTS', `Policy template '${input.slug}' already exists`);
+        }
+        const row = {
+            slug: input.slug,
+            type: input.type,
+            description: input.description,
+            // drizzle `text({ mode: "json" })` serialises automatically when
+            // passed an object/array value.
+            rules: input.rules,
+            enforcement: input.enforcement,
+            version: input.version ?? 1,
+            isSystem: input.isSystem ?? false,
+        };
+        this.db.insert(policyTemplatesTable).values(row).run();
+        const inserted = this.db
+            .select()
+            .from(policyTemplatesTable)
+            .where(eq(policyTemplatesTable.slug, input.slug))
+            .get();
+        if (!inserted) {
+            throw new Error(`Failed to read back inserted policy template '${input.slug}'`);
+        }
+        return this._toTemplate(inserted);
+    }
+    /**
+     * Retrieve a single template by slug.
+     *
+     * @throws {PolicyError} POLICY_TEMPLATE_NOT_FOUND if no such slug exists.
+     */
+    read(slug) {
+        const row = this.db
+            .select()
+            .from(policyTemplatesTable)
+            .where(eq(policyTemplatesTable.slug, slug))
+            .get();
+        if (!row) {
+            throw new PolicyError('POLICY_TEMPLATE_NOT_FOUND', `Policy template '${slug}' not found`);
+        }
+        return this._toTemplate(row);
+    }
+    /**
+     * Return all templates, optionally filtered by `type` slug.
+     *
+     * @param typeFilter — when provided, only templates whose `type` matches
+     *                     this slug are returned.
+     */
+    list(typeFilter) {
+        const rows = typeFilter
+            ? this.db
+                .select()
+                .from(policyTemplatesTable)
+                .where(eq(policyTemplatesTable.type, typeFilter))
+                .all()
+            : this.db.select().from(policyTemplatesTable).all();
+        return rows.map((row) => this._toTemplate(row));
+    }
+    // ── private helpers ──────────────────────────────────────────────────────
+    _toTemplate(row) {
+        return {
+            slug: row.slug,
+            type: row.type,
+            description: row.description,
+            // drizzle returns parsed JS value for `mode:"json"` columns.
+            rules: row.rules,
+            enforcement: row.enforcement,
+            version: row.version,
+            isSystem: Boolean(row.isSystem),
+        };
+    }
+}
+//# sourceMappingURL=policy-template-store.js.map

package/src/store/policy-template-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-template-store.js","sourceRoot":"","sources":["../../../../../../packages/agent/agent-core-policy/src/store/policy-template-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAKjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAUvD;;;GAGG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,IAAI,CAAkB;IACtB,IAAI,CAAW;IAExB,YAAY,IAAqB,EAAE,OAAe,EAAE,IAAc;QAChE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAsCD,iDAAiD;AACjD,QAAQ;AACR,iDAAiD;AAEjD;;;;;;;GAOG;AACH,MAAM,OAAO,mBAAmB;IAIX;IAHnB;IACE,oEAAoE;IACpE,oEAAoE;IACnD,EAA4B;QAA5B,OAAE,GAAF,EAAE,CAA0B;IAC5C,CAAC;IAEJ;;;;OAIG;IACH,MAAM,CAAC,KAAgC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE;aACrB,MAAM,EAAE;aACR,IAAI,CAAC,oBAAoB,CAAC;aAC1B,KAAK,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;aAChD,GAAG,EAAE,CAAC;QAET,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CACnB,gCAAgC,EAChC,oBAAoB,KAAK,CAAC,IAAI,kBAAkB,CACjD,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG;YACV,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,iEAAiE;YACjE,gCAAgC;YAChC,KAAK,EAAE,KAAK,CAAC,KAA0B;YACvC,WAAW,EAAE,KAAK,CAAC,WAAgC;YACnD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,CAAC;YAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK;SAClC,CAAC;QAEF,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAEvD,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE;aACrB,MAAM,EAAE;aACR,IAAI,CAAC,oBAAoB,CAAC;aAC1B,KAAK,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;aAChD,GAAG,EAAE,CAAC;QAET,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,iDAAiD,KAAK,CAAC,IAAI,GAAG,CAC/D,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,IAAY;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,MAAM,EAAE;aACR,IAAI,CAAC,oBAAoB,CAAC;aAC1B,KAAK,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aAC1C,GAAG,EAAE,CAAC;QAET,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,WAAW,CACnB,2BAA2B,EAC3B,oBAAoB,IAAI,aAAa,CACtC,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,IAAI,CAAC,UAAmB;QACtB,MAAM,IAAI,GAAG,UAAU;YACrB,CAAC,CAAC,IAAI,CAAC,EAAE;iBACJ,MAAM,EAAE;iBACR,IAAI,CAAC,oBAAoB,CAAC;iBAC1B,KAAK,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;iBAChD,GAAG,EAAE;YACV,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,GAAG,EAAE,CAAC;QAEtD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,4EAA4E;IAEpE,WAAW,CACjB,GAA6C;QAE7C,OAAO;YACL,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,6DAA6D;YAC7D,KAAK,EAAE,GAAG,CAAC,KAA2C;YACtD,WAAW,EAAE,GAAG,CAAC,WAAkC;YACnD,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;SAChC,CAAC;IACJ,CAAC;CACF"}