@connexum/ai-governance 1.0.0-beta.11

package/dist/governance/approval-queue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-queue.js","sourceRoot":"","sources":["../../src/governance/approval-queue.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyDH,8DAYC;AAnED,uCAAyB;AACzB,2CAA6B;AAC7B,+CAAiC;AA4CjC;;;;;;;;GAQG;AACH,SAAgB,yBAAyB,CACvC,KAA+E;IAE/E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;gBAC5D,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AA2DD,MAAa,aAAa;IAChB,MAAM,CAA8B;IACpC,KAAK,GAAiC,IAAI,GAAG,EAAE,CAAC;IAChD,SAAS,CAAS;IAE1B,YAAY,MAA2B;QACrC,IAAI,CAAC,MAAM,GAAG;YACZ,SAAS,EAAE,MAAM,EAAE,iDAAiD;YACpE,aAAa,EAAE,MAAM;YACrB,gBAAgB,EAAE,EAAE;YACpB,iBAAiB,EAAE,EAAE;YACrB,YAAY,EAAE,GAAG;YACjB,cAAc,EAAE,EAAE;YAClB,aAAa,EAAE,KAAK;YACpB,oFAAoF;YACpF,cAAc,EAAE,SAAS;YACzB,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,EAAE;YACd,aAAa,EAAE,EAAE;YACjB,GAAG,MAAM;SACV,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QAED,+DAA+D;QAC/D,+DAA+D;QAC/D,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CACb,mEAAmE;oBACnE,kEAAkE;oBAClE,+DAA+D;oBAC/D,kDAAkD;oBAClD,+DAA+D,CAChE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QACnE,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAa,EAAE,IAAY,EAAE,YAAoB,EAAE,MAAc;QACtE,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,CAAC,MAAM,CAAC,YAAY,SAAS;gBACzD,sDAAsD,CACvD,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAoB;YAC/B,EAAE,EAAE,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YAChE,KAAK;YACL,IAAI;YACJ,YAAY;YACZ,MAAM;YACN,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;YAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;SACzE,CAAC;QAEF,yEAAyE;QACzE,wEAAwE;QACxE,qEAAqE;QACrE,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC/B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CACxD,uBAAuB,EACvB;gBACE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE;gBACpC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE;gBACxC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE;aAC/C,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,QAA0B;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,SAAS,aAAa,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,YAAY,QAAQ,CAAC,SAAS,mCAAmC,OAAO,CAAC,MAAM,GAAG,CACnF,CAAC;QACJ,CAAC;QAED,oCAAoC;QACpC,MAAM,eAAe,GAAG,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACjE,MAAM,kBAAkB,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAEvF,IAAI,eAAe,EAAE,CAAC;YACpB,kEAAkE;YAClE,+DAA+D;YAC/D,IAAI,CAAC,QAAQ,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC3D,MAAM,IAAI,KAAK,CACb,+EAA+E;oBAC/E,uDAAuD,CACxD,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;iBAC1E,MAAM,CAAC,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;iBAClD,MAAM,CAAC,KAAK,CAAC,CAAC;YACjB,oEAAoE;YACpE,gEAAgE;YAChE,wEAAwE;YACxE,gCAAgC;YAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;YACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;gBACnF,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,UAAU,QAAQ,CAAC,UAAU,oDAAoD;gBACjF,yBAAyB,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,IAAI;gBAC/E,gFAAgF,CACjF,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QACjC,OAAO,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;QACzC,OAAO,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9C,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QAE7B,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAiB;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,eAAe;QACf,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YAExD,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC;gBACrB,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;oBAC7E,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC;oBAC7B,OAAO,CAAC,IAAI,GAAG,gBAAgB,IAAI,CAAC,MAAM,CAAC,gBAAgB,UAAU,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,WAAW,CAAC;gBAC/G,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;oBAC3B,OAAO,CAAC,IAAI,GAAG,qBAAqB,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,WAAW,CAAC;gBAC9E,CAAC;gBACD,OAAO,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBAC9C,OAAO,CAAC,UAAU,GAAG,gBAAgB,CAAC;gBACtC,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;aACnC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;aACnC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,KAAa;QACtB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;aACnC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC;aAC9B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,YAAY;QACV,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;aACnC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,QAAQ;QAQN,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACpE,OAAO;YACL,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,MAAM;YACrD,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,MAAM;YACvD,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,MAAM;YACnD,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,MAAM;YACrD,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,MAAM;SAC1D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,WAAmB,QAAQ;QACjC,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC;QAErC,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACvC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACvD,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;oBACpD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACtB,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,OAAO,GAAG,CAAC;YAAE,IAAI,CAAC,UAAU,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,0BAA0B;IAElB,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACrC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;gBACxD,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC;oBACrB,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;wBAC7E,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC;wBAC7B,OAAO,CAAC,IAAI,GAAG,gBAAgB,IAAI,CAAC,MAAM,CAAC,gBAAgB,gBAAgB,CAAC;oBAC9E,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;wBAC3B,OAAO,CAAC,IAAI,GAAG,2BAA2B,CAAC;oBAC7C,CAAC;oBACD,OAAO,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;oBAC9C,OAAO,CAAC,UAAU,GAAG,gBAAgB,CAAC;gBACxC,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sDAAuD,GAAa,CAAC,OAAO,IAAI,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO;QAE3C,IAAI,CAAC;YACH,MAAM,IAAI,GAAsB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YACrF,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oDAAqD,GAAa,CAAC,OAAO,IAAI,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AA1SD,sCA0SC"}

package/dist/governance/approval-service.d.ts

@@ -0,0 +1,79 @@
+/**
+ * ApprovalService -- REST API-friendly wrapper around ApprovalQueue.
+ *
+ * Bridges the gap between the HMAC-based ApprovalQueue and the
+ * dashboard REST API. Handles token generation for authenticated
+ * users so the dashboard doesn't need to know the HMAC secret.
+ *
+ * @connexum/ai-governance
+ */
+import { ApprovalQueue, type ApprovalRequest } from './approval-queue';
+export interface ApprovalServiceConfig {
+    /** The underlying ApprovalQueue instance */
+    queue: ApprovalQueue;
+    /** HMAC secret (same as ApprovalQueue's approvalSecret) */
+    approvalSecret: string;
+}
+export interface DashboardApprovalDecision {
+    requestId: string;
+    status: 'approved' | 'denied';
+    /** Authenticated user identity from session (e.g., 'user:john@acme.com') */
+    userId: string;
+    note?: string;
+}
+export declare class ApprovalService {
+    private queue;
+    private secret;
+    constructor(config: ApprovalServiceConfig);
+    /**
+     * Submit a new approval request.
+     */
+    submit(agent: string, tool: string, inputSummary: string, reason: string): ApprovalRequest;
+    /**
+     * Resolve an approval from the dashboard.
+     *
+     * Generates the HMAC token internally so dashboard API handlers
+     * don't need access to the approval secret.
+     */
+    resolveFromDashboard(decision: DashboardApprovalDecision): ApprovalRequest;
+    /**
+     * Resolve multiple approvals at once (bulk approve/deny from dashboard).
+     */
+    bulkResolve(decisions: DashboardApprovalDecision[]): {
+        resolved: ApprovalRequest[];
+        errors: Array<{
+            requestId: string;
+            error: string;
+        }>;
+    };
+    /**
+     * Get all pending approval requests.
+     */
+    getPending(): ApprovalRequest[];
+    /**
+     * Check the status of a specific request.
+     */
+    check(requestId: string): ApprovalRequest | null;
+    /**
+     * Get approval queue statistics.
+     */
+    getStats(): {
+        total: number;
+        pending: number;
+        approved: number;
+        denied: number;
+        expired: number;
+        escalated: number;
+    };
+    /**
+     * Get all escalated requests.
+     */
+    getEscalated(): ApprovalRequest[];
+    /**
+     * Generate the HMAC approval token for a given request + status.
+     * This is the bridge: the dashboard calls this service, which
+     * has the secret, so the dashboard API handler doesn't need it.
+     */
+    private generateToken;
+}
+//# sourceMappingURL=approval-service.d.ts.map

package/dist/governance/approval-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-service.d.ts","sourceRoot":"","sources":["../../src/governance/approval-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,aAAa,EAAE,KAAK,eAAe,EAAyB,MAAM,kBAAkB,CAAC;AAE9F,MAAM,WAAW,qBAAqB;IACpC,4CAA4C;IAC5C,KAAK,EAAE,aAAa,CAAC;IACrB,2DAA2D;IAC3D,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC9B,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,KAAK,CAAgB;IAC7B,OAAO,CAAC,MAAM,CAAS;gBAEX,MAAM,EAAE,qBAAqB;IAKzC;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe;IAI1F;;;;;OAKG;IACH,oBAAoB,CAAC,QAAQ,EAAE,yBAAyB,GAAG,eAAe;IAc1E;;OAEG;IACH,WAAW,CAAC,SAAS,EAAE,yBAAyB,EAAE,GAAG;QAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QAAC,MAAM,EAAE,KAAK,CAAC;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE;IAezI;;OAEG;IACH,UAAU,IAAI,eAAe,EAAE;IAI/B;;OAEG;IACH,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAIhD;;OAEG;IACH,QAAQ;;;;;;;;IAIR;;OAEG;IACH,YAAY,IAAI,eAAe,EAAE;IAIjC;;;;OAIG;IACH,OAAO,CAAC,aAAa;CAKtB"}

package/dist/governance/approval-service.js

@@ -0,0 +1,129 @@
+"use strict";
+/**
+ * ApprovalService -- REST API-friendly wrapper around ApprovalQueue.
+ *
+ * Bridges the gap between the HMAC-based ApprovalQueue and the
+ * dashboard REST API. Handles token generation for authenticated
+ * users so the dashboard doesn't need to know the HMAC secret.
+ *
+ * @connexum/ai-governance
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApprovalService = void 0;
+const crypto = __importStar(require("crypto"));
+class ApprovalService {
+    queue;
+    secret;
+    constructor(config) {
+        this.queue = config.queue;
+        this.secret = config.approvalSecret;
+    }
+    /**
+     * Submit a new approval request.
+     */
+    submit(agent, tool, inputSummary, reason) {
+        return this.queue.submit(agent, tool, inputSummary, reason);
+    }
+    /**
+     * Resolve an approval from the dashboard.
+     *
+     * Generates the HMAC token internally so dashboard API handlers
+     * don't need access to the approval secret.
+     */
+    resolveFromDashboard(decision) {
+        const approvalToken = this.generateToken(decision.requestId, decision.status);
+        const queueDecision = {
+            requestId: decision.requestId,
+            status: decision.status,
+            resolvedBy: `human:${decision.userId}`,
+            note: decision.note,
+            approvalToken,
+        };
+        return this.queue.resolve(queueDecision);
+    }
+    /**
+     * Resolve multiple approvals at once (bulk approve/deny from dashboard).
+     */
+    bulkResolve(decisions) {
+        const resolved = [];
+        const errors = [];
+        for (const decision of decisions) {
+            try {
+                resolved.push(this.resolveFromDashboard(decision));
+            }
+            catch (err) {
+                errors.push({ requestId: decision.requestId, error: err.message });
+            }
+        }
+        return { resolved, errors };
+    }
+    /**
+     * Get all pending approval requests.
+     */
+    getPending() {
+        return this.queue.getPending();
+    }
+    /**
+     * Check the status of a specific request.
+     */
+    check(requestId) {
+        return this.queue.check(requestId);
+    }
+    /**
+     * Get approval queue statistics.
+     */
+    getStats() {
+        return this.queue.getStats();
+    }
+    /**
+     * Get all escalated requests.
+     */
+    getEscalated() {
+        return this.queue.getEscalated();
+    }
+    /**
+     * Generate the HMAC approval token for a given request + status.
+     * This is the bridge: the dashboard calls this service, which
+     * has the secret, so the dashboard API handler doesn't need it.
+     */
+    generateToken(requestId, status) {
+        return crypto.createHmac('sha256', this.secret)
+            .update(`${requestId}:${status}`)
+            .digest('hex');
+    }
+}
+exports.ApprovalService = ApprovalService;
+//# sourceMappingURL=approval-service.js.map

package/dist/governance/approval-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-service.js","sourceRoot":"","sources":["../../src/governance/approval-service.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,+CAAiC;AAkBjC,MAAa,eAAe;IAClB,KAAK,CAAgB;IACrB,MAAM,CAAS;IAEvB,YAAY,MAA6B;QACvC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAa,EAAE,IAAY,EAAE,YAAoB,EAAE,MAAc;QACtE,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;OAKG;IACH,oBAAoB,CAAC,QAAmC;QACtD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE9E,MAAM,aAAa,GAAqB;YACtC,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,SAAS,QAAQ,CAAC,MAAM,EAAE;YACtC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,aAAa;SACd,CAAC;QAEF,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,SAAsC;QAChD,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,MAAM,MAAM,GAAgD,EAAE,CAAC;QAE/D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAiB;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,SAAiB,EAAE,MAAc;QACrD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC;aAC5C,MAAM,CAAC,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC;aAChC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;CACF;AA5FD,0CA4FC"}

package/dist/governance/audit-chain-emitter.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Unified Audit Chain Emitter.
+ *
+ * Many cluster surfaces emit their own event types (OverrideEvent from W1.9,
+ * PackVersionEvent from W1.4, SelfRegistrationEvent from W2.2, etc). This
+ * helper normalises them into a single AuditChainEntry shape and hash-chains
+ * the entries so downstream verifiers can detect tampering.
+ *
+ * Chain invariant:
+ *   - Each entry carries `prevHash` (SHA-256 of the prior canonical entry).
+ *   - Each entry carries `selfHash` (SHA-256 of the current canonical entry
+ *     WITHOUT the selfHash field).
+ *   - Verifier walks the chain head-to-tail and checks both fields.
+ *
+ * Pure helper — no IO. Storage / fan-out is the caller's job (Postgres
+ * append, OTLP emit, S3 archive, etc.). This keeps the audit-chain logic
+ * unit-testable and free of side effects.
+ *
+ * @connexum/ai-governance  Audit chain unification (tamper-evident integrity)
+ */
+import type { OverrideEvent } from './pack-inheritance.js';
+import type { PackVersionEvent } from './pack-versioning.js';
+import type { SelfRegistrationEvent } from './self-registration-hook.js';
+/**
+ * Canonical AuditChainEntry. Every source event maps to this shape before
+ * being appended.
+ */
+export interface AuditChainEntry {
+    /** Monotonic chain index (0 for genesis, +1 per append). */
+    seq: number;
+    /** ISO 8601 entry timestamp. */
+    at: string;
+    /** Source event class. */
+    source: 'OVERRIDE' | 'PACK_VERSION' | 'AGENT_REGISTERED' | 'AGENT_TOOL_OBSERVED' | 'APPROVAL_NOTIFICATION' | 'COMPLIANCE_AGENT_SPAWNED' | 'COMPLIANCE_AGENT_REGISTERED' | 'COMPLIANCE_AGENT_HEARTBEAT' | 'DATA_MANIFEST_CREATED' | 'DATA_MANIFEST_ACTIVATED' | 'DATA_MANIFEST_REVOKED' | 'AGENT_DATA_READ' | 'COMPLIANCE_AGENT_REPORT_EMITTED' | 'GENERIC';
+    /** Stable id of the source event when known. */
+    sourceId?: string;
+    /** Tenant scope. */
+    orgId: string;
+    /** Agent scope when applicable. */
+    agentId?: string;
+    /** Actor (employee / system) that produced the event. */
+    actor?: string;
+    /** Verbatim source-event payload. */
+    data: Record<string, unknown>;
+    /** SHA-256 base64url of the previous entry's selfHash (or 'GENESIS'). */
+    prevHash: string;
+    /** SHA-256 base64url of this entry's canonical bytes (computed at append time). */
+    selfHash: string;
+}
+/** Adapters that normalise source events into the chain-entry shape. */
+export declare function fromOverrideEvent(ev: OverrideEvent): Omit<AuditChainEntry, 'seq' | 'prevHash' | 'selfHash'>;
+export declare function fromPackVersionEvent(ev: PackVersionEvent, orgId: string): Omit<AuditChainEntry, 'seq' | 'prevHash' | 'selfHash'>;
+export declare function fromSelfRegistrationEvent(ev: SelfRegistrationEvent): Omit<AuditChainEntry, 'seq' | 'prevHash' | 'selfHash'>;
+export interface ApprovalNotificationAuditInput {
+    ticketId: string;
+    orgId: string;
+    agentId?: string;
+    recipientId: string;
+    channel: 'dashboard' | 'email' | 'sms';
+    delivered: boolean;
+    providerMessageId?: string;
+    error?: string;
+    at: string;
+}
+export declare function fromApprovalNotification(ev: ApprovalNotificationAuditInput): Omit<AuditChainEntry, 'seq' | 'prevHash' | 'selfHash'>;
+/**
+ * Append-only in-process audit chain. Persistence is the caller's job —
+ * subscribe to onAppend and forward to Postgres / OTLP / S3 / etc.
+ */
+export declare class AuditChainEmitter {
+    private readonly entries;
+    private readonly onAppend;
+    constructor(options?: {
+        onAppend?: (entry: AuditChainEntry) => void;
+    });
+    append(prepared: Omit<AuditChainEntry, 'seq' | 'prevHash' | 'selfHash'>): AuditChainEntry;
+    /** Read-only view of the chain. */
+    list(): AuditChainEntry[];
+    /** Look up by sequence number. */
+    get(seq: number): AuditChainEntry | undefined;
+    /** Length of the chain. */
+    size(): number;
+}
+export type ChainVerifyError = {
+    code: 'OK';
+} | {
+    code: 'PREV_HASH_MISMATCH';
+    seq: number;
+} | {
+    code: 'SELF_HASH_MISMATCH';
+    seq: number;
+} | {
+    code: 'OUT_OF_ORDER_SEQ';
+    seq: number;
+    expected: number;
+};
+/**
+ * Verify chain integrity head-to-tail. Returns OK or the first failure.
+ * Safe to call against an externally-supplied list (e.g. after persistence
+ * round-trip).
+ */
+export declare function verifyAuditChain(entries: ReadonlyArray<AuditChainEntry>): ChainVerifyError;
+//# sourceMappingURL=audit-chain-emitter.d.ts.map

package/dist/governance/audit-chain-emitter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-chain-emitter.d.ts","sourceRoot":"","sources":["../../src/governance/audit-chain-emitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEzE;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;IACZ,gCAAgC;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,0BAA0B;IAC1B,MAAM,EACF,UAAU,GACV,cAAc,GACd,kBAAkB,GAClB,qBAAqB,GACrB,uBAAuB,GACvB,0BAA0B,GAC1B,6BAA6B,GAC7B,4BAA4B,GAE5B,uBAAuB,GACvB,yBAAyB,GACzB,uBAAuB,GACvB,iBAAiB,GAEjB,iCAAiC,GACjC,SAAS,CAAC;IACd,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAuBD,wEAAwE;AAExE,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,aAAa,GAAG,IAAI,CAAC,eAAe,EAAE,KAAK,GAAG,UAAU,GAAG,UAAU,CAAC,CAgB3G;AAED,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,KAAK,GAAG,UAAU,GAAG,UAAU,CAAC,CAehI;AAED,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,qBAAqB,GAAG,IAAI,CAAC,eAAe,EAAE,KAAK,GAAG,UAAU,GAAG,UAAU,CAAC,CA2B3H;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,WAAW,GAAG,OAAO,GAAG,KAAK,CAAC;IACvC,SAAS,EAAE,OAAO,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,8BAA8B,GACjC,IAAI,CAAC,eAAe,EAAE,KAAK,GAAG,UAAU,GAAG,UAAU,CAAC,CAgBxD;AAED;;;GAGG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiD;gBAE9D,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAA;KAAO;IAIzE,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK,GAAG,UAAU,GAAG,UAAU,CAAC,GAAG,eAAe;IAWzF,mCAAmC;IACnC,IAAI,IAAI,eAAe,EAAE;IAIzB,kCAAkC;IAClC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAI7C,2BAA2B;IAC3B,IAAI,IAAI,MAAM;CAGf;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,GACd;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,GAAG,gBAAgB,CAe1F"}

package/dist/governance/audit-chain-emitter.js

@@ -0,0 +1,220 @@
+"use strict";
+/**
+ * Unified Audit Chain Emitter.
+ *
+ * Many cluster surfaces emit their own event types (OverrideEvent from W1.9,
+ * PackVersionEvent from W1.4, SelfRegistrationEvent from W2.2, etc). This
+ * helper normalises them into a single AuditChainEntry shape and hash-chains
+ * the entries so downstream verifiers can detect tampering.
+ *
+ * Chain invariant:
+ *   - Each entry carries `prevHash` (SHA-256 of the prior canonical entry).
+ *   - Each entry carries `selfHash` (SHA-256 of the current canonical entry
+ *     WITHOUT the selfHash field).
+ *   - Verifier walks the chain head-to-tail and checks both fields.
+ *
+ * Pure helper — no IO. Storage / fan-out is the caller's job (Postgres
+ * append, OTLP emit, S3 archive, etc.). This keeps the audit-chain logic
+ * unit-testable and free of side effects.
+ *
+ * @connexum/ai-governance  Audit chain unification (tamper-evident integrity)
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditChainEmitter = void 0;
+exports.fromOverrideEvent = fromOverrideEvent;
+exports.fromPackVersionEvent = fromPackVersionEvent;
+exports.fromSelfRegistrationEvent = fromSelfRegistrationEvent;
+exports.fromApprovalNotification = fromApprovalNotification;
+exports.verifyAuditChain = verifyAuditChain;
+const crypto = __importStar(require("node:crypto"));
+const GENESIS_PREV = 'GENESIS';
+function canonicalJson(value) {
+    if (value === undefined)
+        return 'null';
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return '[' + value.map(canonicalJson).join(',') + ']';
+    const obj = value;
+    // Skip undefined-valued keys so hashes survive JSON round-trips
+    // (JSON.stringify drops undefined entries from objects).
+    const keys = Object.keys(obj).filter((k) => obj[k] !== undefined).sort();
+    return '{' + keys.map((k) => JSON.stringify(k) + ':' + canonicalJson(obj[k])).join(',') + '}';
+}
+function sha256B64url(input) {
+    return crypto.createHash('sha256').update(input).digest().toString('base64url');
+}
+function computeSelfHash(entry) {
+    return sha256B64url(canonicalJson(entry));
+}
+/** Adapters that normalise source events into the chain-entry shape. */
+function fromOverrideEvent(ev) {
+    return {
+        at: ev.composedAt,
+        source: 'OVERRIDE',
+        sourceId: ev.overrideId,
+        orgId: ev.orgId,
+        agentId: ev.agentId,
+        actor: ev.approver,
+        data: {
+            capability: ev.capability,
+            baselineAction: ev.baselineAction,
+            relaxedAction: ev.relaxedAction,
+            justification: ev.justification,
+            approvedAt: ev.approvedAt,
+        },
+    };
+}
+function fromPackVersionEvent(ev, orgId) {
+    return {
+        at: ev.timestamp,
+        source: 'PACK_VERSION',
+        sourceId: `${ev.packId}:${ev.version}:${ev.kind}`,
+        orgId,
+        actor: ev.actor,
+        data: {
+            kind: ev.kind,
+            packId: ev.packId,
+            version: ev.version,
+            previousVersion: ev.previousVersion,
+            detail: ev.detail,
+        },
+    };
+}
+function fromSelfRegistrationEvent(ev) {
+    return {
+        at: ev.timestamp,
+        source: ev.kind === 'AGENT_REGISTERED' ? 'AGENT_REGISTERED' : 'AGENT_TOOL_OBSERVED',
+        sourceId: `${ev.orgId}::${ev.agentId}::${ev.tool}`,
+        orgId: ev.orgId,
+        agentId: ev.agentId,
+        data: {
+            tool: ev.tool,
+            toolInventory: ev.manifest.tools,
+            // F-NEW-DASHBOARD-E2E-006 (2026-05-13): persist the build-shape fields
+            // the trust-score-refresh pipeline needs to compute
+            // `agent_build_structure`. Without these, `recomputeBuildStructureScore`
+            // falls back to ZERO_BUILD and `has_human_in_loop` is structurally
+            // always false. Stored under `manifest` so the gov-server's manifestFor
+            // lookup can recover the shape from the audit chain.
+            manifest: {
+                agentId: ev.manifest.agentId,
+                tools: ev.manifest.tools,
+                hooks: ev.manifest.hooks,
+                llmProvider: ev.manifest.llmProvider,
+                pluginIntegrityVerified: ev.manifest.pluginIntegrityVerified,
+                declaredApprovalGates: ev.manifest.declaredApprovalGates,
+                declaredForbiddenCapabilities: ev.manifest.declaredForbiddenCapabilities,
+            },
+        },
+    };
+}
+function fromApprovalNotification(ev) {
+    return {
+        at: ev.at,
+        source: 'APPROVAL_NOTIFICATION',
+        sourceId: `${ev.ticketId}::${ev.recipientId}::${ev.channel}`,
+        orgId: ev.orgId,
+        agentId: ev.agentId,
+        actor: ev.recipientId,
+        data: {
+            ticketId: ev.ticketId,
+            channel: ev.channel,
+            delivered: ev.delivered,
+            providerMessageId: ev.providerMessageId,
+            error: ev.error,
+        },
+    };
+}
+/**
+ * Append-only in-process audit chain. Persistence is the caller's job —
+ * subscribe to onAppend and forward to Postgres / OTLP / S3 / etc.
+ */
+class AuditChainEmitter {
+    entries = [];
+    onAppend;
+    constructor(options = {}) {
+        this.onAppend = options.onAppend;
+    }
+    append(prepared) {
+        const seq = this.entries.length;
+        const prevHash = seq === 0 ? GENESIS_PREV : this.entries[seq - 1].selfHash;
+        const skeleton = { ...prepared, seq, prevHash };
+        const selfHash = computeSelfHash(skeleton);
+        const entry = { ...skeleton, selfHash };
+        this.entries.push(entry);
+        this.onAppend?.(entry);
+        return entry;
+    }
+    /** Read-only view of the chain. */
+    list() {
+        return [...this.entries];
+    }
+    /** Look up by sequence number. */
+    get(seq) {
+        return this.entries[seq];
+    }
+    /** Length of the chain. */
+    size() {
+        return this.entries.length;
+    }
+}
+exports.AuditChainEmitter = AuditChainEmitter;
+/**
+ * Verify chain integrity head-to-tail. Returns OK or the first failure.
+ * Safe to call against an externally-supplied list (e.g. after persistence
+ * round-trip).
+ */
+function verifyAuditChain(entries) {
+    let prevHash = GENESIS_PREV;
+    for (let i = 0; i < entries.length; i++) {
+        const e = entries[i];
+        if (e.seq !== i)
+            return { code: 'OUT_OF_ORDER_SEQ', seq: e.seq, expected: i };
+        if (e.prevHash !== prevHash)
+            return { code: 'PREV_HASH_MISMATCH', seq: e.seq };
+        // Reconstruct the exact pre-hash skeleton: every field of `e` EXCEPT selfHash.
+        // Preserves the original key set (undefined / missing distinction matters
+        // for canonical hashing).
+        const { selfHash: _ignored, ...skeleton } = e;
+        const recomputed = computeSelfHash(skeleton);
+        if (recomputed !== e.selfHash)
+            return { code: 'SELF_HASH_MISMATCH', seq: e.seq };
+        prevHash = e.selfHash;
+    }
+    return { code: 'OK' };
+}
+//# sourceMappingURL=audit-chain-emitter.js.map

package/dist/governance/audit-chain-emitter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-chain-emitter.js","sourceRoot":"","sources":["../../src/governance/audit-chain-emitter.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0EH,8CAgBC;AAED,oDAeC;AAED,8DA2BC;AAcD,4DAkBC;AAoDD,4CAeC;AAzOD,oDAAsC;AAiDtC,MAAM,YAAY,GAAG,SAAS,CAAC;AAE/B,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACvC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAChF,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,gEAAgE;IAChE,yDAAyD;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IACzE,OAAO,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AAChG,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,eAAe,CAAC,KAAwC;IAC/D,OAAO,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,wEAAwE;AAExE,SAAgB,iBAAiB,CAAC,EAAiB;IACjD,OAAO;QACL,EAAE,EAAE,EAAE,CAAC,UAAU;QACjB,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,EAAE,CAAC,UAAU;QACvB,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,OAAO,EAAE,EAAE,CAAC,OAAO;QACnB,KAAK,EAAE,EAAE,CAAC,QAAQ;QAClB,IAAI,EAAE;YACJ,UAAU,EAAE,EAAE,CAAC,UAAU;YACzB,cAAc,EAAE,EAAE,CAAC,cAAc;YACjC,aAAa,EAAE,EAAE,CAAC,aAAa;YAC/B,aAAa,EAAE,EAAE,CAAC,aAAa;YAC/B,UAAU,EAAE,EAAE,CAAC,UAAU;SAC1B;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAAC,EAAoB,EAAE,KAAa;IACtE,OAAO;QACL,EAAE,EAAE,EAAE,CAAC,SAAS;QAChB,MAAM,EAAE,cAAc;QACtB,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,IAAI,EAAE;QACjD,KAAK;QACL,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,IAAI,EAAE;YACJ,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,eAAe,EAAE,EAAE,CAAC,eAAe;YACnC,MAAM,EAAE,EAAE,CAAC,MAAM;SAClB;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,yBAAyB,CAAC,EAAyB;IACjE,OAAO;QACL,EAAE,EAAE,EAAE,CAAC,SAAS;QAChB,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,qBAAqB;QACnF,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,IAAI,EAAE;QAClD,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,OAAO,EAAE,EAAE,CAAC,OAAO;QACnB,IAAI,EAAE;YACJ,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,aAAa,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK;YAChC,uEAAuE;YACvE,oDAAoD;YACpD,yEAAyE;YACzE,mEAAmE;YACnE,wEAAwE;YACxE,qDAAqD;YACrD,QAAQ,EAAE;gBACR,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO;gBAC5B,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK;gBACxB,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK;gBACxB,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW;gBACpC,uBAAuB,EAAE,EAAE,CAAC,QAAQ,CAAC,uBAAuB;gBAC5D,qBAAqB,EAAE,EAAE,CAAC,QAAQ,CAAC,qBAAqB;gBACxD,6BAA6B,EAAE,EAAE,CAAC,QAAQ,CAAC,6BAA6B;aACzE;SACF;KACF,CAAC;AACJ,CAAC;AAcD,SAAgB,wBAAwB,CACtC,EAAkC;IAElC,OAAO;QACL,EAAE,EAAE,EAAE,CAAC,EAAE;QACT,MAAM,EAAE,uBAAuB;QAC/B,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,KAAK,EAAE,CAAC,WAAW,KAAK,EAAE,CAAC,OAAO,EAAE;QAC5D,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,OAAO,EAAE,EAAE,CAAC,OAAO;QACnB,KAAK,EAAE,EAAE,CAAC,WAAW;QACrB,IAAI,EAAE;YACJ,QAAQ,EAAE,EAAE,CAAC,QAAQ;YACrB,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,SAAS,EAAE,EAAE,CAAC,SAAS;YACvB,iBAAiB,EAAE,EAAE,CAAC,iBAAiB;YACvC,KAAK,EAAE,EAAE,CAAC,KAAK;SAChB;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAa,iBAAiB;IACX,OAAO,GAAsB,EAAE,CAAC;IAChC,QAAQ,CAAiD;IAE1E,YAAY,UAA2D,EAAE;QACvE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IACnC,CAAC;IAED,MAAM,CAAC,QAAgE;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3E,MAAM,QAAQ,GAAsC,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QACnF,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAoB,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACzD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mCAAmC;IACnC,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,kCAAkC;IAClC,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,2BAA2B;IAC3B,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7B,CAAC;CACF;AAjCD,8CAiCC;AAQD;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,OAAuC;IACtE,IAAI,QAAQ,GAAG,YAAY,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;QAC/E,+EAA+E;QAC/E,0EAA0E;QAC1E,0BAA0B;QAC1B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,UAAU,KAAK,CAAC,CAAC,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;QACjF,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC"}

package/dist/governance/audit-chain-emitter.test.d.ts

@@ -0,0 +1,7 @@
+/**
+ * RED-GREEN tests for the audit-chain emitter.
+ *
+ * @connexum/ai-governance  audit-chain unification
+ */
+export {};
+//# sourceMappingURL=audit-chain-emitter.test.d.ts.map

package/dist/governance/audit-chain-emitter.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-chain-emitter.test.d.ts","sourceRoot":"","sources":["../../src/governance/audit-chain-emitter.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}