@connexum/ai-governance 1.0.0-beta.11

package/dist/governance/governance-runtime.d.ts

@@ -0,0 +1,148 @@
+/**
+ * GovernanceRuntime -- Core enforcement layer for AI agent governance.
+ *
+ * This module provides SHA-256 tamper detection on governance files,
+ * deny-by-default permission filtering, and activity logging.
+ *
+ * Portable: works in any Claude Code project. No external dependencies.
+ *
+ * @connexum/ai-governance
+ */
+export interface GovernanceConfig {
+    /** Path to governance rules file */
+    governanceFile: string;
+    /** Path to directory containing agent permissions */
+    permissionsDir: string;
+    /** Path for activity logs */
+    logDir: string;
+    /** Enable SHA-256 tamper detection (default: true) */
+    tamperDetection?: boolean;
+    /** Cycle timeout in milliseconds (default: 300000 = 5 min) */
+    cycleTimeoutMs?: number;
+    /** Admin token for authorizing governance hash updates (from env: GOVERNANCE_ADMIN_TOKEN) */
+    adminToken?: string;
+}
+export interface PermissionLevel {
+    tool: string;
+    level: 'ALLOWED' | 'BLOCKED' | 'APPROVAL_REQUIRED';
+}
+export interface GovernanceVerification {
+    valid: boolean;
+    hash: string;
+    expectedHash: string | null;
+    timestamp: string;
+}
+export interface ActivityLogEntry {
+    timestamp: string;
+    agent: string;
+    action: string;
+    target: string;
+    result: 'allowed' | 'blocked' | 'error';
+    detail?: string;
+}
+export declare class GovernanceTamperError extends Error {
+    expectedHash: string;
+    actualHash: string;
+    file: string;
+    constructor(expectedHash: string, actualHash: string, file: string);
+}
+export declare class GovernanceRuntime {
+    private config;
+    private governanceHash;
+    private hashManifest;
+    private activityLog;
+    /**
+     * AIAG-024: Cache parsed permissions keyed by (agentName, file-mtime-ms).
+     * Prevents a disk read on every preAction/filterTools/checkToolAccess call
+     * in hot paths. Cache auto-invalidates when the permissions file is edited.
+     */
+    private permissionsCache;
+    constructor(config: GovernanceConfig);
+    /**
+     * Verify governance file integrity.
+     * Throws GovernanceTamperError if tampered.
+     */
+    verifyGovernance(): GovernanceVerification;
+    /**
+     * Build and verify a hash manifest for multiple governance files.
+     */
+    buildHashManifest(files: string[]): Map<string, string>;
+    /**
+     * Verify all files in the hash manifest.
+     * Returns list of tampered/missing files.
+     */
+    verifyManifest(): {
+        tampered: string[];
+        missing: string[];
+        valid: string[];
+    };
+    /**
+     * Load and parse agent permissions from PERMISSIONS.md format.
+     * Returns empty map if file missing (deny-by-default).
+     */
+    loadPermissions(agentName: string): Map<string, PermissionLevel>;
+    /**
+     * Filter tools based on agent permissions. Deny-by-default.
+     * Tools not in permissions = BLOCKED.
+     */
+    filterTools(tools: string[], agentName: string): string[];
+    /**
+     * Check if a specific tool call is allowed for an agent.
+     */
+    checkToolAccess(toolName: string, agentName: string): {
+        allowed: boolean;
+        level: string;
+        reason: string;
+    };
+    /**
+     * Log an activity entry.
+     */
+    logActivity(entry: ActivityLogEntry): void;
+    /**
+     * Get activity log entries (in-memory).
+     */
+    getActivityLog(): ActivityLogEntry[];
+    /**
+     * Update governance hash after an authorized change.
+     * Only call this when a human operator intentionally modifies governance.
+     * Requires an authorization token to prevent unauthorized hash resets.
+     */
+    updateGovernanceHash(authorizationToken?: string): string;
+    /**
+     * Export hash manifest to JSON file for persistence across sessions.
+     */
+    exportManifest(outputPath: string): void;
+    /**
+     * Import hash manifest from JSON file.
+     */
+    importManifest(inputPath: string): void;
+    /**
+     * Get the path where the governance hash is persisted.
+     */
+    private getHashFilePath;
+    /**
+     * Persist governance hash to disk for cross-restart tamper detection.
+     */
+    private persistHash;
+    /**
+     * Set the active compliance pack selection for a project via the governance server.
+     *
+     * Calls POST /api/v1/projects/:projectId/packs and emits a
+     * project.packs.changed canonical audit event server-side.
+     *
+     * @param projectId - The project to configure
+     * @param packIds - Pack IDs to activate for this project
+     * @param versions - Optional semver pins per packId
+     * @param opts - Connection options (apiUrl, licenseKey). Defaults to env vars.
+     */
+    setProjectPacks(projectId: string, packIds: string[], versions?: Record<string, string>, opts?: {
+        apiUrl?: string;
+        licenseKey?: string;
+    }): Promise<{
+        selectedPackIds: string[];
+        selectedPackVersions: Record<string, string>;
+    }>;
+    private computeHash;
+    private ensureDir;
+}
+//# sourceMappingURL=governance-runtime.d.ts.map

package/dist/governance/governance-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance-runtime.d.ts","sourceRoot":"","sources":["../../src/governance/governance-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,MAAM,WAAW,gBAAgB;IAC/B,oCAAoC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,cAAc,EAAE,MAAM,CAAC;IACvB,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6FAA6F;IAC7F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,mBAAmB,CAAC;CACpD;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAErC,YAAY,EAAE,MAAM;IACpB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,MAAM;gBAFZ,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM;CAQtB;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,YAAY,CAAkC;IACtD,OAAO,CAAC,WAAW,CAA0B;IAE7C;;;;OAIG;IACH,OAAO,CAAC,gBAAgB,CAA6E;gBAEzF,MAAM,EAAE,gBAAgB;IAgDpC;;;OAGG;IACH,gBAAgB,IAAI,sBAAsB;IAmC1C;;OAEG;IACH,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAUvD;;;OAGG;IACH,cAAc,IAAI;QAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE;IAmB5E;;;OAGG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC;IAoChE;;;OAGG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE;IAgBzD;;OAEG;IACH,eAAe,CACb,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAiCtD;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI;IAmB1C;;OAEG;IACH,cAAc,IAAI,gBAAgB,EAAE;IAIpC;;;;OAIG;IACH,oBAAoB,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM;IAsDzD;;OAEG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAQxC;;OAEG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAQvC;;OAEG;IACH,OAAO,CAAC,eAAe;IAIvB;;OAEG;IACH,OAAO,CAAC,WAAW;IAgBnB;;;;;;;;;;OAUG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EAAE,EACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9C,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,EAAE,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IAqCvF,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,SAAS;CAKlB"}

package/dist/governance/governance-runtime.js

@@ -0,0 +1,414 @@
+"use strict";
+/**
+ * GovernanceRuntime -- Core enforcement layer for AI agent governance.
+ *
+ * This module provides SHA-256 tamper detection on governance files,
+ * deny-by-default permission filtering, and activity logging.
+ *
+ * Portable: works in any Claude Code project. No external dependencies.
+ *
+ * @connexum/ai-governance
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GovernanceRuntime = exports.GovernanceTamperError = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const crypto = __importStar(require("crypto"));
+class GovernanceTamperError extends Error {
+    expectedHash;
+    actualHash;
+    file;
+    constructor(expectedHash, actualHash, file) {
+        super(`Governance file tampered: ${file}. ` +
+            `Expected ${expectedHash.slice(0, 16)}..., got ${actualHash.slice(0, 16)}...`);
+        this.expectedHash = expectedHash;
+        this.actualHash = actualHash;
+        this.file = file;
+        this.name = 'GovernanceTamperError';
+    }
+}
+exports.GovernanceTamperError = GovernanceTamperError;
+class GovernanceRuntime {
+    config;
+    governanceHash = null;
+    hashManifest = new Map();
+    activityLog = [];
+    /**
+     * AIAG-024: Cache parsed permissions keyed by (agentName, file-mtime-ms).
+     * Prevents a disk read on every preAction/filterTools/checkToolAccess call
+     * in hot paths. Cache auto-invalidates when the permissions file is edited.
+     */
+    permissionsCache = new Map();
+    constructor(config) {
+        this.config = {
+            tamperDetection: true,
+            cycleTimeoutMs: 600000, // 10 min (DEV MODE -- production: 300000 / 5min)
+            adminToken: '',
+            ...config,
+        };
+        // Allow admin token from environment variable
+        if (!this.config.adminToken && process.env.GOVERNANCE_ADMIN_TOKEN) {
+            this.config.adminToken = process.env.GOVERNANCE_ADMIN_TOKEN;
+        }
+        // Ensure directories exist
+        this.ensureDir(this.config.logDir);
+        this.ensureDir(this.config.permissionsDir);
+        // Compute initial governance hash and persist/verify against stored hash
+        if (this.config.tamperDetection && fs.existsSync(this.config.governanceFile)) {
+            const currentHash = this.computeHash(this.config.governanceFile);
+            const hashFilePath = this.getHashFilePath();
+            if (fs.existsSync(hashFilePath)) {
+                // Compare against persisted hash from previous run
+                const persistedHash = fs.readFileSync(hashFilePath, 'utf-8').trim();
+                if (persistedHash && persistedHash !== currentHash) {
+                    // Log the tamper detection event before throwing
+                    this.logActivity({
+                        timestamp: new Date().toISOString(),
+                        agent: 'system',
+                        action: 'governance_tamper_detected_on_startup',
+                        target: this.config.governanceFile,
+                        result: 'error',
+                        detail: `Persisted hash ${persistedHash.slice(0, 16)}... does not match current ${currentHash.slice(0, 16)}...`,
+                    });
+                    throw new GovernanceTamperError(persistedHash, currentHash, this.config.governanceFile);
+                }
+            }
+            this.governanceHash = currentHash;
+            this.persistHash(currentHash);
+        }
+    }
+    /**
+     * Verify governance file integrity.
+     * Throws GovernanceTamperError if tampered.
+     */
+    verifyGovernance() {
+        const timestamp = new Date().toISOString();
+        if (!fs.existsSync(this.config.governanceFile)) {
+            return {
+                valid: false,
+                hash: '',
+                expectedHash: this.governanceHash,
+                timestamp,
+            };
+        }
+        const currentHash = this.computeHash(this.config.governanceFile);
+        if (this.governanceHash && currentHash !== this.governanceHash) {
+            throw new GovernanceTamperError(this.governanceHash, currentHash, this.config.governanceFile);
+        }
+        // First run -- set baseline
+        if (!this.governanceHash) {
+            this.governanceHash = currentHash;
+        }
+        return {
+            valid: true,
+            hash: currentHash,
+            expectedHash: this.governanceHash,
+            timestamp,
+        };
+    }
+    /**
+     * Build and verify a hash manifest for multiple governance files.
+     */
+    buildHashManifest(files) {
+        for (const file of files) {
+            if (fs.existsSync(file)) {
+                const hash = this.computeHash(file);
+                this.hashManifest.set(file, hash);
+            }
+        }
+        return new Map(this.hashManifest);
+    }
+    /**
+     * Verify all files in the hash manifest.
+     * Returns list of tampered/missing files.
+     */
+    verifyManifest() {
+        const result = { tampered: [], missing: [], valid: [] };
+        for (const [file, expectedHash] of this.hashManifest) {
+            if (!fs.existsSync(file)) {
+                result.missing.push(file);
+                continue;
+            }
+            const currentHash = this.computeHash(file);
+            if (currentHash !== expectedHash) {
+                result.tampered.push(file);
+            }
+            else {
+                result.valid.push(file);
+            }
+        }
+        return result;
+    }
+    /**
+     * Load and parse agent permissions from PERMISSIONS.md format.
+     * Returns empty map if file missing (deny-by-default).
+     */
+    loadPermissions(agentName) {
+        const permFile = path.join(this.config.permissionsDir, `${agentName}.md`);
+        if (!fs.existsSync(permFile)) {
+            // Deny-by-default: no permissions file = zero tools
+            return new Map();
+        }
+        // AIAG-024: return cached parse if file hasn't changed since last load.
+        let mtimeMs = 0;
+        try {
+            mtimeMs = fs.statSync(permFile).mtimeMs;
+        }
+        catch {
+            mtimeMs = 0;
+        }
+        const cached = this.permissionsCache.get(agentName);
+        if (cached && cached.mtimeMs === mtimeMs) {
+            return cached.map;
+        }
+        const permissions = new Map();
+        const content = fs.readFileSync(permFile, 'utf-8');
+        const regex = /^-\s+(\w+)\s*:\s*(ALLOWED|BLOCKED|APPROVAL_REQUIRED)/gm;
+        let match;
+        while ((match = regex.exec(content)) !== null) {
+            permissions.set(match[1], {
+                tool: match[1],
+                level: match[2],
+            });
+        }
+        this.permissionsCache.set(agentName, { mtimeMs, map: permissions });
+        return permissions;
+    }
+    /**
+     * Filter tools based on agent permissions. Deny-by-default.
+     * Tools not in permissions = BLOCKED.
+     */
+    filterTools(tools, agentName) {
+        const permissions = this.loadPermissions(agentName);
+        // No permissions file = zero tools (deny-by-default)
+        if (permissions.size === 0) {
+            return [];
+        }
+        return tools.filter((tool) => {
+            const perm = permissions.get(tool);
+            // Unlisted tool = BLOCKED (deny-by-default)
+            if (!perm)
+                return false;
+            return perm.level === 'ALLOWED';
+        });
+    }
+    /**
+     * Check if a specific tool call is allowed for an agent.
+     */
+    checkToolAccess(toolName, agentName) {
+        const permissions = this.loadPermissions(agentName);
+        if (permissions.size === 0) {
+            return {
+                allowed: false,
+                level: 'BLOCKED',
+                reason: `No permissions file for agent '${agentName}'. Deny-by-default.`,
+            };
+        }
+        const perm = permissions.get(toolName);
+        if (!perm) {
+            return {
+                allowed: false,
+                level: 'BLOCKED',
+                reason: `Tool '${toolName}' not listed in permissions for '${agentName}'. Deny-by-default.`,
+            };
+        }
+        return {
+            allowed: perm.level === 'ALLOWED',
+            level: perm.level,
+            reason: perm.level === 'ALLOWED'
+                ? 'Permitted'
+                : perm.level === 'APPROVAL_REQUIRED'
+                    ? 'Requires human approval before execution'
+                    : 'Explicitly blocked',
+        };
+    }
+    /**
+     * Log an activity entry.
+     */
+    logActivity(entry) {
+        this.activityLog.push(entry);
+        // Write to disk
+        const logFile = path.join(this.config.logDir, `activity-${new Date().toISOString().split('T')[0]}.jsonl`);
+        try {
+            fs.appendFileSync(logFile, JSON.stringify(entry) + '\n');
+        }
+        catch (err) {
+            // Compliance logging failure is a critical event -- report to stderr
+            process.stderr.write(`[GOVERNANCE CRITICAL] Failed to write audit log: ${err.message}\n`);
+        }
+    }
+    /**
+     * Get activity log entries (in-memory).
+     */
+    getActivityLog() {
+        return [...this.activityLog];
+    }
+    /**
+     * Update governance hash after an authorized change.
+     * Only call this when a human operator intentionally modifies governance.
+     * Requires an authorization token to prevent unauthorized hash resets.
+     */
+    updateGovernanceHash(authorizationToken) {
+        if (!authorizationToken) {
+            throw new Error('Authorization required: updateGovernanceHash() must be called with a valid authorization token. ' +
+                'This prevents agents from silently resetting governance file integrity checks.');
+        }
+        // Validate the token against the configured admin token using timing-safe comparison
+        const expectedToken = this.config.adminToken;
+        if (!expectedToken) {
+            throw new Error('No admin token configured. Set adminToken in GovernanceConfig or GOVERNANCE_ADMIN_TOKEN environment variable.');
+        }
+        const tokenBuffer = Buffer.from(authorizationToken);
+        const expectedBuffer = Buffer.from(expectedToken);
+        if (tokenBuffer.length !== expectedBuffer.length ||
+            !crypto.timingSafeEqual(tokenBuffer, expectedBuffer)) {
+            // Log the failed attempt
+            this.logActivity({
+                timestamp: new Date().toISOString(),
+                agent: 'system',
+                action: 'governance_hash_update_unauthorized',
+                target: this.config.governanceFile,
+                result: 'blocked',
+                detail: 'Invalid authorization token provided for governance hash update',
+            });
+            throw new Error('Invalid authorization token. Governance hash update denied.');
+        }
+        if (!fs.existsSync(this.config.governanceFile)) {
+            throw new Error('Governance file not found');
+        }
+        // Log the hash update for audit trail
+        this.logActivity({
+            timestamp: new Date().toISOString(),
+            agent: 'system',
+            action: 'governance_hash_update',
+            target: this.config.governanceFile,
+            result: 'allowed',
+            detail: `Hash updated with authorization token ${authorizationToken.slice(0, 8)}...`,
+        });
+        this.governanceHash = this.computeHash(this.config.governanceFile);
+        this.persistHash(this.governanceHash);
+        return this.governanceHash;
+    }
+    /**
+     * Export hash manifest to JSON file for persistence across sessions.
+     */
+    exportManifest(outputPath) {
+        const manifest = {};
+        for (const [file, hash] of this.hashManifest) {
+            manifest[file] = hash;
+        }
+        fs.writeFileSync(outputPath, JSON.stringify(manifest, null, 2));
+    }
+    /**
+     * Import hash manifest from JSON file.
+     */
+    importManifest(inputPath) {
+        if (!fs.existsSync(inputPath))
+            return;
+        const manifest = JSON.parse(fs.readFileSync(inputPath, 'utf-8'));
+        for (const [file, hash] of Object.entries(manifest)) {
+            this.hashManifest.set(file, hash);
+        }
+    }
+    /**
+     * Get the path where the governance hash is persisted.
+     */
+    getHashFilePath() {
+        return path.join(this.config.logDir, '.governance-hash');
+    }
+    /**
+     * Persist governance hash to disk for cross-restart tamper detection.
+     */
+    persistHash(hash) {
+        try {
+            const hashFilePath = this.getHashFilePath();
+            this.ensureDir(path.dirname(hashFilePath));
+            fs.writeFileSync(hashFilePath, hash + '\n');
+        }
+        catch (err) {
+            process.stderr.write(`[GOVERNANCE CRITICAL] Failed to persist governance hash: ${err.message}\n`);
+        }
+    }
+    // ---------------------------------------------------------------------------
+    // W2: Per-project pack selection
+    // ---------------------------------------------------------------------------
+    /**
+     * Set the active compliance pack selection for a project via the governance server.
+     *
+     * Calls POST /api/v1/projects/:projectId/packs and emits a
+     * project.packs.changed canonical audit event server-side.
+     *
+     * @param projectId - The project to configure
+     * @param packIds - Pack IDs to activate for this project
+     * @param versions - Optional semver pins per packId
+     * @param opts - Connection options (apiUrl, licenseKey). Defaults to env vars.
+     */
+    async setProjectPacks(projectId, packIds, versions, opts) {
+        const apiUrl = opts?.apiUrl ?? process.env['GOVERNANCE_API_URL'] ?? 'http://localhost:3200';
+        const licenseKey = opts?.licenseKey ?? process.env['CONNEXUM_LICENSE'] ?? '';
+        const payload = { packIds };
+        if (versions)
+            payload['versions'] = versions;
+        const response = await fetch(`${apiUrl.replace(/\/$/, '')}/api/v1/projects/${encodeURIComponent(projectId)}/packs`, {
+            method: 'POST',
+            headers: {
+                'Authorization': `Bearer ${licenseKey}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify(payload),
+        });
+        if (!response.ok) {
+            const err = await response.json().catch(() => ({ error: `HTTP ${response.status}` }));
+            throw new Error(`setProjectPacks failed (HTTP ${response.status}): ${err.error ?? 'unknown error'}`);
+        }
+        const data = await response.json();
+        return {
+            selectedPackIds: data.selectedPackIds,
+            selectedPackVersions: data.selectedPackVersions,
+        };
+    }
+    computeHash(filePath) {
+        const content = fs.readFileSync(filePath);
+        return crypto.createHash('sha256').update(content).digest('hex');
+    }
+    ensureDir(dir) {
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true });
+        }
+    }
+}
+exports.GovernanceRuntime = GovernanceRuntime;
+//# sourceMappingURL=governance-runtime.js.map

package/dist/governance/governance-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance-runtime.js","sourceRoot":"","sources":["../../src/governance/governance-runtime.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAC7B,+CAAiC;AAsCjC,MAAa,qBAAsB,SAAQ,KAAK;IAErC;IACA;IACA;IAHT,YACS,YAAoB,EACpB,UAAkB,EAClB,IAAY;QAEnB,KAAK,CACH,6BAA6B,IAAI,IAAI;YACrC,YAAY,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAC9E,CAAC;QAPK,iBAAY,GAAZ,YAAY,CAAQ;QACpB,eAAU,GAAV,UAAU,CAAQ;QAClB,SAAI,GAAJ,IAAI,CAAQ;QAMnB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAZD,sDAYC;AAED,MAAa,iBAAiB;IACpB,MAAM,CAA6B;IACnC,cAAc,GAAkB,IAAI,CAAC;IACrC,YAAY,GAAwB,IAAI,GAAG,EAAE,CAAC;IAC9C,WAAW,GAAuB,EAAE,CAAC;IAE7C;;;;OAIG;IACK,gBAAgB,GAAG,IAAI,GAAG,EAAkE,CAAC;IAErG,YAAY,MAAwB;QAClC,IAAI,CAAC,MAAM,GAAG;YACZ,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,MAAM,EAAE,iDAAiD;YACzE,UAAU,EAAE,EAAE;YACd,GAAG,MAAM;SACV,CAAC;QAEF,8CAA8C;QAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;YAClE,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;QAC9D,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAE3C,yEAAyE;QACzE,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7E,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACjE,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YAE5C,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChC,mDAAmD;gBACnD,MAAM,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;gBACpE,IAAI,aAAa,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;oBACnD,iDAAiD;oBACjD,IAAI,CAAC,WAAW,CAAC;wBACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,KAAK,EAAE,QAAQ;wBACf,MAAM,EAAE,uCAAuC;wBAC/C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;wBAClC,MAAM,EAAE,OAAO;wBACf,MAAM,EAAE,kBAAkB,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK;qBAChH,CAAC,CAAC;oBACH,MAAM,IAAI,qBAAqB,CAC7B,aAAa,EACb,WAAW,EACX,IAAI,CAAC,MAAM,CAAC,cAAc,CAC3B,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,CAAC,cAAc,GAAG,WAAW,CAAC;YAClC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,gBAAgB;QACd,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/C,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,EAAE;gBACR,YAAY,EAAE,IAAI,CAAC,cAAc;gBACjC,SAAS;aACV,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAEjE,IAAI,IAAI,CAAC,cAAc,IAAI,WAAW,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;YAC/D,MAAM,IAAI,qBAAqB,CAC7B,IAAI,CAAC,cAAc,EACnB,WAAW,EACX,IAAI,CAAC,MAAM,CAAC,cAAc,CAC3B,CAAC;QACJ,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,GAAG,WAAW,CAAC;QACpC,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,WAAW;YACjB,YAAY,EAAE,IAAI,CAAC,cAAc;YACjC,SAAS;SACV,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,KAAe;QAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBACpC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QACD,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,EAAc,EAAE,OAAO,EAAE,EAAc,EAAE,KAAK,EAAE,EAAc,EAAE,CAAC;QAE5F,KAAK,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;gBACjC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,SAAiB;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,SAAS,KAAK,CAAC,CAAC;QAE1E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,oDAAoD;YACpD,OAAO,IAAI,GAAG,EAAE,CAAC;QACnB,CAAC;QAED,wEAAwE;QACxE,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YACzC,OAAO,MAAM,CAAC,GAAG,CAAC;QACpB,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,GAAG,EAA2B,CAAC;QACvD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,wDAAwD,CAAC;QACvE,IAAI,KAAK,CAAC;QAEV,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBACxB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;gBACd,KAAK,EAAE,KAAK,CAAC,CAAC,CAA6B;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;QACpE,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,KAAe,EAAE,SAAiB;QAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAEpD,qDAAqD;QACrD,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YAC3B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACnC,4CAA4C;YAC5C,IAAI,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC;YACxB,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,eAAe,CACb,QAAgB,EAChB,SAAiB;QAEjB,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAEpD,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,SAAS;gBAChB,MAAM,EAAE,kCAAkC,SAAS,qBAAqB;aACzE,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEvC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,SAAS;gBAChB,MAAM,EAAE,SAAS,QAAQ,oCAAoC,SAAS,qBAAqB;aAC5F,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,KAAK,KAAK,SAAS;YACjC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EACJ,IAAI,CAAC,KAAK,KAAK,SAAS;gBACtB,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,mBAAmB;oBAClC,CAAC,CAAC,0CAA0C;oBAC5C,CAAC,CAAC,oBAAoB;SAC7B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,KAAuB;QACjC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE7B,gBAAgB;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CACvB,IAAI,CAAC,MAAM,CAAC,MAAM,EAClB,YAAY,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAC3D,CAAC;QAEF,IAAI,CAAC;YACH,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oDAAqD,GAAa,CAAC,OAAO,IAAI,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACH,oBAAoB,CAAC,kBAA2B;QAC9C,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,kGAAkG;gBAClG,gFAAgF,CACjF,CAAC;QACJ,CAAC;QAED,qFAAqF;QACrF,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QAC7C,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,+GAA+G,CAChH,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACpD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAElD,IAAI,WAAW,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;YAC5C,CAAC,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;YACzD,yBAAyB;YACzB,IAAI,CAAC,WAAW,CAAC;gBACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,KAAK,EAAE,QAAQ;gBACf,MAAM,EAAE,qCAAqC;gBAC7C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;gBAClC,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,iEAAiE;aAC1E,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,sCAAsC;QACtC,IAAI,CAAC,WAAW,CAAC;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,wBAAwB;YAChC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;YAClC,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,yCAAyC,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK;SACrF,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACnE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,UAAkB;QAC/B,MAAM,QAAQ,GAA2B,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACxB,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,SAAiB;QAC9B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACjE,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,IAAc,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED;;OAEG;IACK,eAAe;QACrB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,IAAY;QAC9B,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YAC5C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YAC3C,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4DAA6D,GAAa,CAAC,OAAO,IAAI,CACvF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,iCAAiC;IACjC,8EAA8E;IAE9E;;;;;;;;;;OAUG;IACH,KAAK,CAAC,eAAe,CACnB,SAAiB,EACjB,OAAiB,EACjB,QAAiC,EACjC,IAA+C;QAE/C,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,uBAAuB,CAAC;QAC5F,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAE7E,MAAM,OAAO,GAA4B,EAAE,OAAO,EAAE,CAAC;QACrD,IAAI,QAAQ;YAAE,OAAO,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC;QAE7C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,kBAAkB,CAAC,SAAS,CAAC,QAAQ,EACrF;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,UAAU,EAAE;gBACvC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;YACtF,MAAM,IAAI,KAAK,CACb,gCAAgC,QAAQ,CAAC,MAAM,MAAO,GAA8B,CAAC,KAAK,IAAI,eAAe,EAAE,CAChH,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAG/B,CAAC;QAEF,OAAO;YACL,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;SAChD,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,QAAgB;QAClC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;IAEO,SAAS,CAAC,GAAW;QAC3B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;CACF;AAlbD,8CAkbC"}

package/dist/governance/hook-install-snippet.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Hook Install Snippet Generator (companion to W4.4 proxy onboarding).
+ *
+ * Generates customer-facing copy-paste snippets for wiring governance hooks
+ * into their existing agent codebase. The proxy onboarding (W4.4) covers
+ * cloud-LLM-only customers via URL swap; this generator covers customers
+ * who need the full hook install for tool-using agents (Claude Code,
+ * OpenAI Agents SDK function calling, LangChain agents with tools, etc.).
+ *
+ * Each framework gets:
+ *   - install command (npm / pip)
+ *   - configuration snippet (where the hook is wired)
+ *   - verification step (how to confirm the hook fired the first time)
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-AGENT-DISCOVERY-CLI / W5.1 hook-install path
+ */
+export type HookFramework = 'claude-code' | 'openai-agents-py' | 'openai-agents-ts' | 'langchain-py' | 'langchain-ts' | 'crew-ai' | 'langgraph';
+export interface HookInstallInput {
+    framework: HookFramework;
+    tenantId: string;
+    /** Endpoint that receives governance events. Default proxy.my-cc.io/api/v1/events. */
+    endpoint?: string;
+}
+export interface HookInstallSnippet {
+    framework: HookFramework;
+    tenantId: string;
+    endpoint: string;
+    /** Shell command to install the SDK. */
+    installCommand: string;
+    /** Path / filename where the configuration goes. */
+    configPath: string;
+    /** Copy-paste snippet body. */
+    snippet: string;
+    /** Verification step the customer runs after install. */
+    verificationStep: string;
+}
+export declare function buildHookInstallSnippet(input: HookInstallInput): HookInstallSnippet;
+export declare const SUPPORTED_HOOK_FRAMEWORKS: ReadonlyArray<{
+    id: HookFramework;
+    label: string;
+}>;
+//# sourceMappingURL=hook-install-snippet.d.ts.map

package/dist/governance/hook-install-snippet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-install-snippet.d.ts","sourceRoot":"","sources":["../../src/governance/hook-install-snippet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,MAAM,aAAa,GACrB,aAAa,GACb,kBAAkB,GAClB,kBAAkB,GAClB,cAAc,GACd,cAAc,GACd,SAAS,GACT,WAAW,CAAC;AAEhB,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,aAAa,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,sFAAsF;IACtF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,aAAa,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,cAAc,EAAE,MAAM,CAAC;IACvB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAID,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,gBAAgB,GAAG,kBAAkB,CAqBnF;AA+KD,eAAO,MAAM,yBAAyB,EAAE,aAAa,CAAC;IAAE,EAAE,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAQzF,CAAC"}