@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/governance/multi-tenant.js

@@ -0,0 +1,273 @@
+/**
+ * Multi-tenancy support for AI governance.
+ *
+ * Enables namespaced governance contexts so multiple teams/projects
+ * can share a single governance installation with isolated rules,
+ * permissions, and audit trails.
+ *
+ * @connexum/ai-governance
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+export class TenantNotFoundError extends Error {
+    tenantId;
+    constructor(tenantId) {
+        super(`Tenant not found: ${tenantId}`);
+        this.tenantId = tenantId;
+        this.name = 'TenantNotFoundError';
+    }
+}
+export class TenantCycleError extends Error {
+    chain;
+    constructor(chain) {
+        super(`Circular tenant inheritance detected: ${chain.join(' -> ')}`);
+        this.chain = chain;
+        this.name = 'TenantCycleError';
+    }
+}
+export class MultiTenantGovernance {
+    config;
+    tenants = new Map();
+    registryFile;
+    constructor(config) {
+        this.config = {
+            maxDepth: 3,
+            ...config,
+        };
+        this.registryFile = path.join(this.config.baseDir, 'tenants.json');
+        this.ensureDir(this.config.baseDir);
+        this.loadRegistry();
+    }
+    /**
+     * Register a new tenant.
+     */
+    registerTenant(config) {
+        // Sanitize tenant ID to prevent directory traversal
+        this.validateTenantId(config.id);
+        if (this.tenants.has(config.id)) {
+            throw new Error(`Tenant already exists: ${config.id}`);
+        }
+        // Validate parent exists if specified
+        if (config.parentId && !this.tenants.has(config.parentId)) {
+            throw new TenantNotFoundError(config.parentId);
+        }
+        // Check inheritance depth
+        if (config.parentId) {
+            const depth = this.getInheritanceDepth(config.parentId);
+            if (depth >= this.config.maxDepth) {
+                throw new Error(`Tenant nesting depth ${depth + 1} exceeds maximum ${this.config.maxDepth}`);
+            }
+        }
+        const tenant = {
+            active: true,
+            packs: [],
+            permissionOverrides: {},
+            ...config,
+        };
+        this.tenants.set(tenant.id, tenant);
+        // Create tenant directories
+        const tenantDir = path.join(this.config.baseDir, tenant.id);
+        this.ensureDir(tenantDir);
+        this.ensureDir(path.join(tenantDir, 'permissions'));
+        this.ensureDir(path.join(tenantDir, 'logs'));
+        // Create default governance file if not specified
+        const govFile = tenant.governanceFile || path.join(tenantDir, 'governance.md');
+        if (!fs.existsSync(govFile)) {
+            fs.writeFileSync(govFile, `# Governance Rules - ${tenant.name}\n\nTenant: ${tenant.id}\nCreated: ${new Date().toISOString()}\n`);
+        }
+        this.saveRegistry();
+        return this.resolveTenantContext(tenant.id);
+    }
+    /**
+     * Get a tenant's resolved context (with inheritance).
+     */
+    getTenantContext(tenantId) {
+        if (!this.tenants.has(tenantId)) {
+            throw new TenantNotFoundError(tenantId);
+        }
+        return this.resolveTenantContext(tenantId);
+    }
+    /**
+     * List all registered tenants.
+     */
+    listTenants() {
+        return Array.from(this.tenants.values());
+    }
+    /**
+     * Update a tenant's configuration.
+     */
+    updateTenant(tenantId, updates) {
+        const existing = this.tenants.get(tenantId);
+        if (!existing) {
+            throw new TenantNotFoundError(tenantId);
+        }
+        // Prevent changing ID
+        const { id: _id, ...safeUpdates } = updates;
+        // Validate new parent if changing
+        if (safeUpdates.parentId !== undefined) {
+            if (safeUpdates.parentId && !this.tenants.has(safeUpdates.parentId)) {
+                throw new TenantNotFoundError(safeUpdates.parentId);
+            }
+            // Check for cycles
+            if (safeUpdates.parentId) {
+                this.checkCycle(tenantId, safeUpdates.parentId);
+            }
+        }
+        const updated = { ...existing, ...safeUpdates };
+        this.tenants.set(tenantId, updated);
+        this.saveRegistry();
+        return updated;
+    }
+    /**
+     * Deactivate a tenant (soft delete).
+     */
+    deactivateTenant(tenantId) {
+        this.updateTenant(tenantId, { active: false });
+    }
+    /**
+     * Verify cross-tenant isolation.
+     * Checks that no tenant can access another tenant's data paths.
+     */
+    verifyIsolation() {
+        const violations = [];
+        const tenantDirs = new Map();
+        for (const [id, tenant] of this.tenants) {
+            const tenantDir = path.resolve(this.config.baseDir, id);
+            tenantDirs.set(id, tenantDir);
+            // Check governance file is within tenant boundary or explicit override
+            const govFile = tenant.governanceFile || path.join(tenantDir, 'governance.md');
+            const resolvedGov = path.resolve(govFile);
+            if (!tenant.governanceFile && !resolvedGov.startsWith(tenantDir)) {
+                violations.push(`Tenant ${id}: governance file ${resolvedGov} escapes tenant boundary`);
+            }
+        }
+        // Check no tenant directory is a subdirectory of another
+        const dirs = Array.from(tenantDirs.entries());
+        for (let i = 0; i < dirs.length; i++) {
+            for (let j = i + 1; j < dirs.length; j++) {
+                const [idA, dirA] = dirs[i];
+                const [idB, dirB] = dirs[j];
+                if (dirA.startsWith(dirB + path.sep)) {
+                    violations.push(`Tenant ${idA} directory is inside tenant ${idB} directory`);
+                }
+                if (dirB.startsWith(dirA + path.sep)) {
+                    violations.push(`Tenant ${idB} directory is inside tenant ${idA} directory`);
+                }
+            }
+        }
+        return {
+            valid: violations.length === 0,
+            violations,
+        };
+    }
+    /**
+     * Resolve effective permissions for a tenant (including inheritance).
+     */
+    resolvePermissions(tenantId) {
+        if (!this.tenants.has(tenantId)) {
+            throw new TenantNotFoundError(tenantId);
+        }
+        const chain = this.getInheritanceChain(tenantId);
+        const permissions = {};
+        // Apply from root ancestor to current (child overrides parent)
+        for (const ancestorId of chain) {
+            const tenant = this.tenants.get(ancestorId);
+            if (tenant.permissionOverrides) {
+                Object.assign(permissions, tenant.permissionOverrides);
+            }
+        }
+        return permissions;
+    }
+    /**
+     * Get the number of registered tenants.
+     */
+    get tenantCount() {
+        return this.tenants.size;
+    }
+    // --- Private helpers ---
+    resolveTenantContext(tenantId) {
+        const tenant = this.tenants.get(tenantId);
+        const tenantDir = path.join(this.config.baseDir, tenant.id);
+        return {
+            tenant,
+            governanceFile: tenant.governanceFile || path.join(tenantDir, 'governance.md'),
+            permissionsDir: path.join(tenantDir, 'permissions'),
+            logDir: path.join(tenantDir, 'logs'),
+            inheritedPermissions: this.resolvePermissions(tenantId),
+        };
+    }
+    getInheritanceChain(tenantId) {
+        const chain = [];
+        const visited = new Set();
+        let current = tenantId;
+        while (current) {
+            if (visited.has(current)) {
+                throw new TenantCycleError([...chain, current]);
+            }
+            visited.add(current);
+            chain.unshift(current);
+            const tenant = this.tenants.get(current);
+            current = tenant?.parentId;
+        }
+        return chain;
+    }
+    getInheritanceDepth(tenantId) {
+        return this.getInheritanceChain(tenantId).length;
+    }
+    checkCycle(tenantId, newParentId) {
+        const visited = new Set([tenantId]);
+        let current = newParentId;
+        while (current) {
+            if (visited.has(current)) {
+                throw new TenantCycleError([...visited, current]);
+            }
+            visited.add(current);
+            const tenant = this.tenants.get(current);
+            current = tenant?.parentId;
+        }
+    }
+    validateTenantId(id) {
+        if (!id || typeof id !== 'string') {
+            throw new Error('Tenant ID must be a non-empty string');
+        }
+        // Block directory traversal characters and null bytes
+        if (/[\/\\]|\.\.|\0/.test(id)) {
+            throw new Error(`Invalid tenant ID '${id}': must not contain path separators, '..', or null bytes`);
+        }
+        // Only allow alphanumeric, hyphens, and underscores
+        if (!/^[a-zA-Z0-9_-]+$/.test(id)) {
+            throw new Error(`Invalid tenant ID '${id}': only alphanumeric characters, hyphens, and underscores allowed`);
+        }
+        // Verify resolved path stays within baseDir
+        const resolved = path.resolve(this.config.baseDir, id);
+        if (!resolved.startsWith(path.resolve(this.config.baseDir) + path.sep)) {
+            throw new Error(`Tenant ID '${id}' resolves outside base directory`);
+        }
+    }
+    loadRegistry() {
+        if (fs.existsSync(this.registryFile)) {
+            try {
+                const data = JSON.parse(fs.readFileSync(this.registryFile, 'utf-8'));
+                if (Array.isArray(data)) {
+                    for (const t of data) {
+                        this.tenants.set(t.id, t);
+                    }
+                }
+            }
+            catch {
+                // Corrupted registry - start fresh
+                this.tenants.clear();
+            }
+        }
+    }
+    saveRegistry() {
+        const data = Array.from(this.tenants.values());
+        fs.writeFileSync(this.registryFile, JSON.stringify(data, null, 2));
+    }
+    ensureDir(dir) {
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true });
+        }
+    }
+}
+//# sourceMappingURL=multi-tenant.js.map

package/dist/esm/governance/multi-tenant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-tenant.js","sourceRoot":"","sources":["../../../src/governance/multi-tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AA+C7B,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACzB;IAAnB,YAAmB,QAAgB;QACjC,KAAK,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;QADtB,aAAQ,GAAR,QAAQ,CAAQ;QAEjC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACtB;IAAnB,YAAmB,KAAe;QAChC,KAAK,CAAC,yCAAyC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QADpD,UAAK,GAAL,KAAK,CAAU;QAEhC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,OAAO,qBAAqB;IACxB,MAAM,CAA8B;IACpC,OAAO,GAA8B,IAAI,GAAG,EAAE,CAAC;IAC/C,YAAY,CAAS;IAE7B,YAAY,MAAyB;QACnC,IAAI,CAAC,MAAM,GAAG;YACZ,QAAQ,EAAE,CAAC;YACX,GAAG,MAAM;SACV,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACnE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,MAAoB;QACjC,oDAAoD;QACpD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAEjC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,sCAAsC;QACtC,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;QAED,0BAA0B;QAC1B,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACxD,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,wBAAwB,KAAK,GAAG,CAAC,oBAAoB,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAC5E,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAiB;YAC3B,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,EAAE;YACT,mBAAmB,EAAE,EAAE;YACvB,GAAG,MAAM;SACV,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAEpC,4BAA4B;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC1B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QAE7C,kDAAkD;QAClD,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QAC/E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,EAAE,CAAC,aAAa,CACd,OAAO,EACP,wBAAwB,MAAM,CAAC,IAAI,eAAe,MAAM,CAAC,EAAE,cAAc,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,CACtG,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,QAAgB;QAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,QAAgB,EAAE,OAA8B;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,sBAAsB;QACtB,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,CAAC;QAE5C,kCAAkC;QAClC,IAAI,WAAW,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACvC,IAAI,WAAW,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,mBAAmB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YACtD,CAAC;YACD,mBAAmB;YACnB,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAiB,EAAE,GAAG,QAAQ,EAAE,GAAG,WAAW,EAAE,CAAC;QAC9D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,QAAgB;QAC/B,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,CAAC;IAED;;;OAGG;IACH,eAAe;QACb,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QAE7C,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACxD,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAE9B,uEAAuE;YACvE,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;YAC/E,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAE1C,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjE,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,qBAAqB,WAAW,0BAA0B,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACzC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC5B,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC5B,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACrC,UAAU,CAAC,IAAI,CAAC,UAAU,GAAG,+BAA+B,GAAG,YAAY,CAAC,CAAC;gBAC/E,CAAC;gBACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACrC,UAAU,CAAC,IAAI,CAAC,UAAU,GAAG,+BAA+B,GAAG,YAAY,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC;YAC9B,UAAU;SACX,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,QAAgB;QACjC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,WAAW,GAAgE,EAAE,CAAC;QAEpF,+DAA+D;QAC/D,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBAC/B,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,0BAA0B;IAElB,oBAAoB,CAAC,QAAgB;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAE5D,OAAO;YACL,MAAM;YACN,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;YAC9E,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC;YACnD,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;YACpC,oBAAoB,EAAE,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC;SACxD,CAAC;IACJ,CAAC;IAEO,mBAAmB,CAAC,QAAgB;QAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,IAAI,OAAO,GAAuB,QAAQ,CAAC;QAE3C,OAAO,OAAO,EAAE,CAAC;YACf,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,gBAAgB,CAAC,CAAC,GAAG,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;YAClD,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACrB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACzC,OAAO,GAAG,MAAM,EAAE,QAAQ,CAAC;QAC7B,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,mBAAmB,CAAC,QAAgB;QAC1C,OAAO,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IACnD,CAAC;IAEO,UAAU,CAAC,QAAgB,EAAE,WAAmB;QACtD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5C,IAAI,OAAO,GAAuB,WAAW,CAAC;QAE9C,OAAO,OAAO,EAAE,CAAC;YACf,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACpD,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACrB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACzC,OAAO,GAAG,MAAM,EAAE,QAAQ,CAAC;QAC7B,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,EAAU;QACjC,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,sDAAsD;QACtD,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,sBAAsB,EAAE,0DAA0D,CACnF,CAAC;QACJ,CAAC;QACD,oDAAoD;QACpD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,sBAAsB,EAAE,mEAAmE,CAC5F,CAAC;QACJ,CAAC;QACD,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,cAAc,EAAE,mCAAmC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;gBACrE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;wBACrB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;oBAC5B,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;gBACnC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAEO,SAAS,CAAC,GAAW;QAC3B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;CACF"}

package/dist/esm/governance/onboarding-tier-router.js

@@ -0,0 +1,109 @@
+/**
+ * Onboarding Tier Router (W5.1-support of F-NEW-PRODUCT-AGENT-VISIBILITY-CLUSTER-2026-05-12).
+ *
+ * Pure decision helper for the non-technical onboarding ladder. Takes a
+ * prospect profile (tech-team size, install capability, vertical, agent
+ * count, cloud-LLM-only?, whether they're regulated) and recommends a
+ * Tier with reasoning.
+ *
+ * Tier A  Proxy URL swap (zero install)        cloud-LLM-only customers
+ * Tier B  Browser extension                    individual users + small teams
+ * Tier C  CSM-assisted install (Zoom)          mid-market with hooks needed
+ * Tier D  MSP / partner channel installation   regulated enterprises
+ * Tier E  Compliance-as-a-Service (fully run)  zero-AI-team regulated firms
+ *
+ * Engine consumed by the dashboard signup flow + the landing-page
+ * "Which tier is right for you?" wizard.
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-NON-TECH-ONBOARDING-LADDER (router substrate)
+ */
+const TIER_LABEL = {
+    A: 'Proxy URL swap (zero install)',
+    B: 'Browser extension',
+    C: 'CSM-assisted install',
+    D: 'MSP / partner channel install',
+    E: 'Compliance-as-a-Service (fully managed)',
+};
+const TIER_CTA = {
+    A: 'Start with one URL change — get your proxy snippet now',
+    B: 'Install the Chrome extension and see your governance in 60 seconds',
+    C: 'Book a 30-minute install session with our customer success team',
+    D: 'Talk to a certified MSP partner for a guided deployment',
+    E: 'Get a managed dashboard + monthly compliance reports — we run it',
+};
+export function recommendOnboardingTier(profile) {
+    const reasoning = [];
+    const alternatives = [];
+    // ---- Hard signals that pin a specific tier ----
+    // Tier E: explicit ask for fully-managed compliance
+    if (profile.wantsFullyManaged) {
+        reasoning.push('Customer explicitly wants a fully-managed compliance service.');
+        if (profile.regulated) {
+            reasoning.push('Regulated industry; CaaS bundles monthly compliance reports.');
+        }
+        alternatives.push({ tier: 'D', reason: 'MSP channel if a partner is already engaged' });
+        return tier('E', reasoning, alternatives);
+    }
+    // Tier D: regulated + existing MSP partner relationship
+    if (profile.regulated && profile.hasMspPartner) {
+        reasoning.push('Regulated industry with an existing MSP / system-integrator relationship.');
+        reasoning.push('Partner-managed install minimizes change-control friction.');
+        alternatives.push({ tier: 'C', reason: 'Direct CSM install if you want to keep MSP out of the loop' });
+        alternatives.push({ tier: 'E', reason: 'Move to CaaS if MSP capacity is constrained' });
+        return tier('D', reasoning, alternatives);
+    }
+    // Tier A: zero technical lift — cloud-LLM-only and at least one engineer to change a URL
+    if (profile.cloudLlmOnly && profile.techTeamSize >= 1) {
+        reasoning.push('Agents are cloud-LLM-only — proxy URL swap covers the full governance surface.');
+        reasoning.push(`Tech team has ${profile.techTeamSize} engineer(s) — capacity to change an env var.`);
+        alternatives.push({ tier: 'C', reason: 'CSM-assisted if your team prefers to watch the install on a call' });
+        if (profile.agentCount >= 50) {
+            alternatives.push({ tier: 'D', reason: 'MSP channel scales for fleets of 50+ agents' });
+        }
+        return tier('A', reasoning, alternatives);
+    }
+    // Tier B: individual / small team, browser-driven AI usage.
+    // Regulated orgs never land here — they need formal install + audit
+    // chain, not browser extension. Regulated falls through to Tier D below.
+    if (profile.techTeamSize === 0 && profile.agentCount <= 5 && !profile.regulated) {
+        reasoning.push('No dedicated tech team and a small agent footprint.');
+        reasoning.push('Browser extension covers Claude.ai / Cursor / ChatGPT sessions without install in the codebase.');
+        alternatives.push({ tier: 'C', reason: 'CSM-assisted if you outgrow the extension' });
+        return tier('B', reasoning, alternatives);
+    }
+    // Tier C: default for mid-market with tool-using agents that need hooks
+    if (profile.techTeamSize >= 1 && profile.techTeamSize <= 10) {
+        reasoning.push(`Tech team of ${profile.techTeamSize} can install hooks with guided support.`);
+        if (!profile.cloudLlmOnly) {
+            reasoning.push('Agents use tools beyond LLM calls — full hook install required.');
+        }
+        alternatives.push({ tier: 'A', reason: 'If you can pin agents to cloud-LLM-only, swap to proxy instead' });
+        if (profile.regulated) {
+            alternatives.push({ tier: 'D', reason: 'MSP channel scales better in a regulated org' });
+        }
+        return tier('C', reasoning, alternatives);
+    }
+    // Tier D (default for larger): regulated or large-team
+    if (profile.techTeamSize > 10 || profile.regulated) {
+        reasoning.push(profile.regulated
+            ? 'Regulated industry — partner-managed install + ongoing compliance support.'
+            : `Tech team of ${profile.techTeamSize} is large enough to want a managed install programme.`);
+        alternatives.push({ tier: 'C', reason: 'Direct CSM install if you want full ownership' });
+        alternatives.push({ tier: 'E', reason: 'CaaS if you want us to run the whole programme' });
+        return tier('D', reasoning, alternatives);
+    }
+    // Fallback: Tier A (cloud-LLM-only assumption) with a note
+    reasoning.push('Fallback: proxy URL swap is the lowest-friction path.');
+    alternatives.push({ tier: 'C', reason: 'CSM-assisted if proxy alone is insufficient' });
+    return tier('A', reasoning, alternatives);
+}
+function tier(t, reasoning, alternatives) {
+    return {
+        tier: t,
+        label: TIER_LABEL[t],
+        reasoning,
+        alternatives,
+        cta: TIER_CTA[t],
+    };
+}
+//# sourceMappingURL=onboarding-tier-router.js.map

package/dist/esm/governance/onboarding-tier-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding-tier-router.js","sourceRoot":"","sources":["../../../src/governance/onboarding-tier-router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AA2CH,MAAM,UAAU,GAAmC;IACjD,CAAC,EAAE,+BAA+B;IAClC,CAAC,EAAE,mBAAmB;IACtB,CAAC,EAAE,sBAAsB;IACzB,CAAC,EAAE,+BAA+B;IAClC,CAAC,EAAE,yCAAyC;CAC7C,CAAC;AAEF,MAAM,QAAQ,GAAmC;IAC/C,CAAC,EAAE,wDAAwD;IAC3D,CAAC,EAAE,oEAAoE;IACvE,CAAC,EAAE,iEAAiE;IACpE,CAAC,EAAE,yDAAyD;IAC5D,CAAC,EAAE,kEAAkE;CACtE,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,OAAwB;IAC9D,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAuC,EAAE,CAAC;IAE5D,kDAAkD;IAElD,oDAAoD;IACpD,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC9B,SAAS,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;QAChF,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,SAAS,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;QACjF,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAC5C,CAAC;IAED,wDAAwD;IACxD,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC/C,SAAS,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QAC5F,SAAS,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QAC7E,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,4DAA4D,EAAE,CAAC,CAAC;QACvG,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAC5C,CAAC;IAED,yFAAyF;IACzF,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,EAAE,CAAC;QACtD,SAAS,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;QACjG,SAAS,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,YAAY,+CAA+C,CAAC,CAAC;QACrG,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC,CAAC;QAC7G,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YAC7B,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAC5C,CAAC;IAED,4DAA4D;IAC5D,oEAAoE;IACpE,yEAAyE;IACzE,IAAI,OAAO,CAAC,YAAY,KAAK,CAAC,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAChF,SAAS,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACtE,SAAS,CAAC,IAAI,CAAC,iGAAiG,CAAC,CAAC;QAClH,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAC5C,CAAC;IAED,wEAAwE;IACxE,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,IAAI,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC5D,SAAS,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,YAAY,yCAAyC,CAAC,CAAC;QAC9F,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,SAAS,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;QACpF,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,gEAAgE,EAAE,CAAC,CAAC;QAC3G,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAC5C,CAAC;IAED,uDAAuD;IACvD,IAAI,OAAO,CAAC,YAAY,GAAG,EAAE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACnD,SAAS,CAAC,IAAI,CACZ,OAAO,CAAC,SAAS;YACf,CAAC,CAAC,4EAA4E;YAC9E,CAAC,CAAC,gBAAgB,OAAO,CAAC,YAAY,uDAAuD,CAChG,CAAC;QACF,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC,CAAC;QAC1F,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAC5C,CAAC;IAED,2DAA2D;IAC3D,SAAS,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACxE,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,IAAI,CACX,CAAiB,EACjB,SAAmB,EACnB,YAAgD;IAEhD,OAAO;QACL,IAAI,EAAE,CAAC;QACP,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;QACpB,SAAS;QACT,YAAY;QACZ,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;KACjB,CAAC;AACJ,CAAC"}

package/dist/esm/governance/onboarding-tier-router.test.js

@@ -0,0 +1,106 @@
+/**
+ * RED-GREEN tests for the onboarding tier router (W5.1-support).
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-NON-TECH-ONBOARDING-LADDER
+ */
+import { describe, it } from 'node:test';
+import * as assert from 'node:assert/strict';
+import { recommendOnboardingTier } from './onboarding-tier-router.js';
+const profile = (over = {}) => ({
+    techTeamSize: 3,
+    cloudLlmOnly: false,
+    vertical: 'devtools',
+    agentCount: 5,
+    regulated: false,
+    hasMspPartner: false,
+    wantsFullyManaged: false,
+    ...over,
+});
+describe('onboarding tier router (W5.1)', () => {
+    it('Tier E: wantsFullyManaged trumps everything else', () => {
+        const r = recommendOnboardingTier(profile({ wantsFullyManaged: true, regulated: true }));
+        assert.equal(r.tier, 'E');
+        assert.match(r.label, /Compliance-as-a-Service/);
+        assert.ok(r.alternatives.some((a) => a.tier === 'D'));
+        assert.match(r.cta, /managed dashboard/);
+    });
+    it('Tier D: regulated + existing MSP partner', () => {
+        const r = recommendOnboardingTier(profile({ regulated: true, hasMspPartner: true, techTeamSize: 4 }));
+        assert.equal(r.tier, 'D');
+        assert.match(r.cta, /MSP/);
+        assert.ok(r.alternatives.some((a) => a.tier === 'C'));
+    });
+    it('Tier A: cloud-LLM-only + at least one engineer', () => {
+        const r = recommendOnboardingTier(profile({ cloudLlmOnly: true, techTeamSize: 2, regulated: false }));
+        assert.equal(r.tier, 'A');
+        assert.match(r.cta, /one URL change/);
+        assert.ok(r.alternatives.some((a) => a.tier === 'C'));
+    });
+    it('Tier A includes MSP alternative for fleets of 50+ agents', () => {
+        const r = recommendOnboardingTier(profile({ cloudLlmOnly: true, techTeamSize: 2, agentCount: 75 }));
+        assert.equal(r.tier, 'A');
+        assert.ok(r.alternatives.some((a) => a.tier === 'D'));
+    });
+    it('Tier B: zero tech team + small agent footprint', () => {
+        const r = recommendOnboardingTier(profile({ techTeamSize: 0, agentCount: 2 }));
+        assert.equal(r.tier, 'B');
+        assert.match(r.cta, /Chrome extension/);
+    });
+    it('Tier C: mid-market tech team with tool-using agents', () => {
+        const r = recommendOnboardingTier(profile({ techTeamSize: 5, cloudLlmOnly: false, agentCount: 12 }));
+        assert.equal(r.tier, 'C');
+        assert.match(r.cta, /customer success/);
+        assert.ok(r.alternatives.some((a) => a.tier === 'A'));
+    });
+    it('Tier D fallback: large team (>10)', () => {
+        const r = recommendOnboardingTier(profile({ techTeamSize: 15, cloudLlmOnly: false, regulated: false }));
+        assert.equal(r.tier, 'D');
+        assert.ok(r.alternatives.some((a) => a.tier === 'E'));
+    });
+    it('Tier D fallback: regulated org without MSP partner', () => {
+        const r = recommendOnboardingTier(profile({ techTeamSize: 0, cloudLlmOnly: false, regulated: true }));
+        assert.equal(r.tier, 'D');
+        assert.match(r.reasoning.join(' '), /Regulated/);
+    });
+    it('reasoning is non-empty for every recommendation', () => {
+        const profiles = [
+            profile({ wantsFullyManaged: true }),
+            profile({ regulated: true, hasMspPartner: true }),
+            profile({ cloudLlmOnly: true }),
+            profile({ techTeamSize: 0, agentCount: 1 }),
+            profile({ techTeamSize: 5 }),
+            profile({ techTeamSize: 20 }),
+        ];
+        for (const p of profiles) {
+            const r = recommendOnboardingTier(p);
+            assert.ok(r.reasoning.length > 0, `${r.tier} should explain itself`);
+            assert.ok(r.cta.length > 0);
+        }
+    });
+    it('cta and label match the recommended tier', () => {
+        const tiers = [
+            { profile: profile({ wantsFullyManaged: true }), expected: 'as-a-Service' },
+            { profile: profile({ regulated: true, hasMspPartner: true }), expected: 'MSP' },
+            { profile: profile({ cloudLlmOnly: true, techTeamSize: 2 }), expected: 'Proxy' },
+            { profile: profile({ techTeamSize: 0, agentCount: 1 }), expected: 'Browser' },
+            { profile: profile({ techTeamSize: 5 }), expected: 'CSM' },
+        ];
+        for (const t of tiers) {
+            const r = recommendOnboardingTier(t.profile);
+            assert.match(r.label + ' ' + r.cta, new RegExp(t.expected, 'i'));
+        }
+    });
+    it('alternatives are never empty', () => {
+        const profiles = [
+            profile(),
+            profile({ wantsFullyManaged: true }),
+            profile({ cloudLlmOnly: true }),
+            profile({ regulated: true, hasMspPartner: true }),
+        ];
+        for (const p of profiles) {
+            const r = recommendOnboardingTier(p);
+            assert.ok(r.alternatives.length > 0, `${r.tier} should have at least one alternative`);
+        }
+    });
+});
+//# sourceMappingURL=onboarding-tier-router.test.js.map

package/dist/esm/governance/onboarding-tier-router.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding-tier-router.test.js","sourceRoot":"","sources":["../../../src/governance/onboarding-tier-router.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAC;AAE7C,OAAO,EAAE,uBAAuB,EAAwB,MAAM,0BAA0B,CAAC;AAEzF,MAAM,OAAO,GAAG,CAAC,OAAiC,EAAE,EAAmB,EAAE,CAAC,CAAC;IACzE,YAAY,EAAE,CAAC;IACf,YAAY,EAAE,KAAK;IACnB,QAAQ,EAAE,UAAU;IACpB,UAAU,EAAE,CAAC;IACb,SAAS,EAAE,KAAK;IAChB,aAAa,EAAE,KAAK;IACpB,iBAAiB,EAAE,KAAK;IACxB,GAAG,IAAI;CACR,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,GAAG,uBAAuB,CAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACzF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;QACjD,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,GAAG,uBAAuB,CAC/B,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CACnE,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,GAAG,uBAAuB,CAC/B,OAAO,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CACnE,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,GAAG,uBAAuB,CAC/B,OAAO,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CACjE,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,GAAG,uBAAuB,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,GAAG,uBAAuB,CAC/B,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAClE,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,GAAG,uBAAuB,CAC/B,OAAO,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CACrE,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,GAAG,uBAAuB,CAC/B,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CACnE,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,QAAQ,GAAG;YACf,OAAO,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;YACpC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;YACjD,OAAO,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YAC/B,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YAC3C,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;SAC9B,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,wBAAwB,CAAC,CAAC;YACrE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,KAAK,GAA0D;YACnE,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE;YAC3E,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;YAC/E,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE;YAChF,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE;YAC7E,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;SAC3D,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QACnE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,QAAQ,GAAG;YACf,OAAO,EAAE;YACT,OAAO,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;YACpC,OAAO,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YAC/B,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAClD,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,uCAAuC,CAAC,CAAC;QACzF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/esm/governance/org-reputation.js

@@ -0,0 +1,88 @@
+/**
+ * Org Reputation Aggregator (extension of W3.4 trust-score rollup).
+ *
+ * Computes the org-level reputation signal that other orgs see when they
+ * query the trust API about an agent issued by this org. Maps directly to
+ * the credit-agency-for-AI-agents framing (Thomas Layer 0 2026-05-06):
+ * each org has a reputation that aggregates the behaviour of every agent
+ * they ever deployed.
+ *
+ * Aggregation rules:
+ *   - Numeric: signal-volume-weighted mean across constituent agents
+ *     (more-active agents have more weight, single-shot agents are
+ *     diluted appropriately).
+ *   - Confidence bands match the existing OrgReputation type:
+ *       0   signals     -> low
+ *       1-9 signals     -> low
+ *       10-99 signals   -> medium
+ *       100+ signals    -> high
+ *
+ * Pure math; same input -> same output. Auditor-reproducible.
+ *
+ * @connexum/ai-governance  Credit-agency org reputation surface
+ */
+function confidenceForSignals(n) {
+    if (n >= 100)
+        return 'high';
+    if (n >= 10)
+        return 'medium';
+    return 'low';
+}
+function weightedMean(values) {
+    const totalWeight = values.reduce((a, v) => a + v.weight, 0);
+    if (totalWeight === 0)
+        return 0;
+    const weightedSum = values.reduce((a, v) => a + v.value * v.weight, 0);
+    return Math.round(weightedSum / totalWeight);
+}
+export function computeOrgReputation(input) {
+    if (input.agents.length === 0) {
+        return {
+            org_id: input.org_id,
+            score: 0,
+            confidence: 'low',
+            based_on_signal_count: 0,
+            agent_count: 0,
+            axis_breakdown: {
+                agent_activity: 0,
+                operator_activity: 0,
+                agent_build_structure: 0,
+            },
+            computed_at: input.computed_at,
+        };
+    }
+    // Each agent's weight = its signal_count + 1 (so an agent with zero signals
+    // still contributes a small amount; prevents reputation gaming via
+    // never-activating agents).
+    const weightedAgent = input.agents.map((a) => ({
+        value: a.score.agent_activity.composite,
+        weight: a.signal_count + 1,
+    }));
+    const weightedOperator = input.agents.map((a) => ({
+        value: a.score.operator_activity.composite,
+        weight: a.signal_count + 1,
+    }));
+    const weightedBuild = input.agents.map((a) => ({
+        value: a.score.agent_build_structure.composite,
+        weight: a.signal_count + 1,
+    }));
+    const weightedComposite = input.agents.map((a) => ({
+        value: a.score.composite,
+        weight: a.signal_count + 1,
+    }));
+    const totalSignals = input.agents.reduce((a, x) => a + x.signal_count, 0);
+    return {
+        org_id: input.org_id,
+        score: weightedMean(weightedComposite),
+        confidence: confidenceForSignals(totalSignals),
+        based_on_signal_count: totalSignals,
+        agent_count: input.agents.length,
+        axis_breakdown: {
+            agent_activity: weightedMean(weightedAgent),
+            operator_activity: weightedMean(weightedOperator),
+            agent_build_structure: weightedMean(weightedBuild),
+        },
+        computed_at: input.computed_at,
+    };
+}
+//# sourceMappingURL=org-reputation.js.map

package/dist/esm/governance/org-reputation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-reputation.js","sourceRoot":"","sources":["../../../src/governance/org-reputation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAgCH,SAAS,oBAAoB,CAAC,CAAS;IACrC,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,MAAM,CAAC;IAC5B,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,MAAwD;IAC5E,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC7D,IAAI,WAAW,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAChC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,CAAC;YACR,UAAU,EAAE,KAAK;YACjB,qBAAqB,EAAE,CAAC;YACxB,WAAW,EAAE,CAAC;YACd,cAAc,EAAE;gBACd,cAAc,EAAE,CAAC;gBACjB,iBAAiB,EAAE,CAAC;gBACpB,qBAAqB,EAAE,CAAC;aACzB;YACD,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,mEAAmE;IACnE,4BAA4B;IAC5B,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS;QACvC,MAAM,EAAE,CAAC,CAAC,YAAY,GAAG,CAAC;KAC3B,CAAC,CAAC,CAAC;IACJ,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAS;QAC1C,MAAM,EAAE,CAAC,CAAC,YAAY,GAAG,CAAC;KAC3B,CAAC,CAAC,CAAC;IACJ,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,SAAS;QAC9C,MAAM,EAAE,CAAC,CAAC,YAAY,GAAG,CAAC;KAC3B,CAAC,CAAC,CAAC;IACJ,MAAM,iBAAiB,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS;QACxB,MAAM,EAAE,CAAC,CAAC,YAAY,GAAG,CAAC;KAC3B,CAAC,CAAC,CAAC;IAEJ,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAE1E,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,YAAY,CAAC,iBAAiB,CAAC;QACtC,UAAU,EAAE,oBAAoB,CAAC,YAAY,CAAC;QAC9C,qBAAqB,EAAE,YAAY;QACnC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;QAChC,cAAc,EAAE;YACd,cAAc,EAAE,YAAY,CAAC,aAAa,CAAC;YAC3C,iBAAiB,EAAE,YAAY,CAAC,gBAAgB,CAAC;YACjD,qBAAqB,EAAE,YAAY,CAAC,aAAa,CAAC;SACnD;QACD,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC;AACJ,CAAC"}