@connexum/ai-governance 1.0.0-beta.11

package/dist/governance/instinct-system.js

@@ -0,0 +1,388 @@
+"use strict";
+/**
+ * InstinctSystem -- Continuous learning with confidence-scored behavioral patterns.
+ *
+ * Agents build up "instincts" -- patterns they've learned work well.
+ * Unlike memory (facts), instincts are behavioral with confidence scores.
+ *
+ * Confidence lifecycle:
+ *   New: 0.3 -> Success: +0.1 -> Auto-promote at >= 0.8 across 2+ projects
+ *   Failure: -0.15 -> Decay: -0.05 per 7 days idle -> Prune at < 0.2
+ *
+ * @connexum/ai-governance
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InstinctSystem = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const crypto = __importStar(require("crypto"));
+class InstinctSystem {
+    instinctsFile;
+    logFile;
+    config;
+    constructor(config) {
+        this.config = {
+            initialConfidence: 0.3,
+            successBoost: 0.1,
+            failurePenalty: 0.15,
+            decayAfterDays: 7,
+            decayRate: 0.05,
+            pruneThreshold: 0.2,
+            maxAgeDays: 30,
+            promotionThreshold: 0.8,
+            promotionMinProjects: 2,
+            maxInstincts: 100,
+            ...config,
+        };
+        const agentDir = path.join(config.dataDir, config.agentName);
+        if (!fs.existsSync(agentDir)) {
+            fs.mkdirSync(agentDir, { recursive: true });
+        }
+        this.instinctsFile = path.join(agentDir, 'instincts.json');
+        this.logFile = path.join(agentDir, 'instinct-log.jsonl');
+    }
+    /**
+     * Learn a new instinct from experience.
+     */
+    learn(pattern, context, sessionId, tags = []) {
+        const instincts = this.loadInstincts();
+        // Check for duplicate/similar pattern
+        const existing = instincts.find((i) => i.pattern.toLowerCase() === pattern.toLowerCase());
+        if (existing) {
+            // Reinforce existing instinct
+            existing.appliedCount++;
+            if (!existing.learnedFrom.includes(sessionId)) {
+                existing.learnedFrom.push(sessionId);
+            }
+            if (!existing.projects.includes(this.config.projectName)) {
+                existing.projects.push(this.config.projectName);
+            }
+            existing.lastApplied = new Date().toISOString();
+            this.saveInstincts(instincts);
+            this.log('reinforce', existing.id, pattern);
+            return existing;
+        }
+        // Create new instinct
+        const instinct = {
+            id: `inst_${crypto.randomBytes(8).toString('hex')}`,
+            pattern,
+            context,
+            confidence: this.config.initialConfidence,
+            source: 'learned',
+            learnedFrom: [sessionId],
+            appliedCount: 0,
+            successCount: 0,
+            failureCount: 0,
+            lastApplied: null,
+            createdAt: new Date().toISOString(),
+            ttlDays: this.config.maxAgeDays,
+            projects: [this.config.projectName],
+            tags,
+        };
+        instincts.push(instinct);
+        // Enforce max instincts (remove lowest confidence first)
+        if (instincts.length > this.config.maxInstincts) {
+            instincts.sort((a, b) => a.confidence - b.confidence);
+            instincts.splice(0, instincts.length - this.config.maxInstincts);
+        }
+        this.saveInstincts(instincts);
+        this.log('learn', instinct.id, pattern);
+        return instinct;
+    }
+    /**
+     * Record successful application of an instinct.
+     */
+    recordSuccess(instinctId) {
+        const instincts = this.loadInstincts();
+        const instinct = instincts.find((i) => i.id === instinctId);
+        if (!instinct)
+            return null;
+        instinct.appliedCount++;
+        instinct.successCount++;
+        instinct.confidence = Math.min(0.9, instinct.confidence + this.config.successBoost);
+        instinct.lastApplied = new Date().toISOString();
+        if (!instinct.projects.includes(this.config.projectName)) {
+            instinct.projects.push(this.config.projectName);
+        }
+        this.saveInstincts(instincts);
+        this.log('success', instinctId, `confidence: ${instinct.confidence.toFixed(2)}`);
+        return instinct;
+    }
+    /**
+     * Record failed application of an instinct.
+     */
+    recordFailure(instinctId, reason) {
+        const instincts = this.loadInstincts();
+        const instinct = instincts.find((i) => i.id === instinctId);
+        if (!instinct)
+            return null;
+        instinct.appliedCount++;
+        instinct.failureCount++;
+        instinct.confidence = Math.max(0, instinct.confidence - this.config.failurePenalty);
+        instinct.lastApplied = new Date().toISOString();
+        this.saveInstincts(instincts);
+        this.log('failure', instinctId, reason || `confidence: ${instinct.confidence.toFixed(2)}`);
+        return instinct;
+    }
+    /**
+     * Find instincts relevant to a given context.
+     * Returns instincts sorted by confidence (highest first).
+     */
+    findRelevant(contextKeywords, minConfidence = 0.3) {
+        const instincts = this.loadInstincts();
+        const keywords = contextKeywords.map((k) => k.toLowerCase());
+        return instincts
+            .filter((i) => {
+            if (i.confidence < minConfidence)
+                return false;
+            const text = `${i.pattern} ${i.context} ${i.tags.join(' ')}`.toLowerCase();
+            return keywords.some((k) => text.includes(k));
+        })
+            .sort((a, b) => b.confidence - a.confidence);
+    }
+    /**
+     * Apply confidence decay to stale instincts.
+     * Call this periodically (e.g., on session start).
+     */
+    applyDecay() {
+        const instincts = this.loadInstincts();
+        const now = Date.now();
+        let decayed = 0;
+        let pruned = 0;
+        const remaining = instincts.filter((instinct) => {
+            const lastActive = instinct.lastApplied
+                ? new Date(instinct.lastApplied).getTime()
+                : new Date(instinct.createdAt).getTime();
+            const daysSinceActive = (now - lastActive) / (1000 * 60 * 60 * 24);
+            // Apply decay if stale
+            if (daysSinceActive > this.config.decayAfterDays) {
+                const decayPeriods = Math.floor((daysSinceActive - this.config.decayAfterDays) / this.config.decayAfterDays);
+                const decay = decayPeriods * this.config.decayRate;
+                instinct.confidence = Math.max(0, instinct.confidence - decay);
+                decayed++;
+            }
+            // Prune if below threshold or too old
+            if (instinct.confidence < this.config.pruneThreshold) {
+                pruned++;
+                this.log('prune', instinct.id, `confidence ${instinct.confidence.toFixed(2)} below threshold`);
+                return false;
+            }
+            const ageDays = (now - new Date(instinct.createdAt).getTime()) / (1000 * 60 * 60 * 24);
+            if (ageDays > instinct.ttlDays && instinct.confidence < this.config.promotionThreshold) {
+                pruned++;
+                this.log('prune', instinct.id, `expired (${Math.round(ageDays)} days old)`);
+                return false;
+            }
+            return true;
+        });
+        this.saveInstincts(remaining);
+        return { decayed, pruned };
+    }
+    /**
+     * Find instincts eligible for global promotion.
+     * Criteria: confidence >= threshold AND used in >= N projects.
+     */
+    findPromotable() {
+        const instincts = this.loadInstincts();
+        return instincts.filter((i) => i.confidence >= this.config.promotionThreshold &&
+            i.projects.length >= this.config.promotionMinProjects &&
+            i.source !== 'promoted');
+    }
+    /**
+     * Promote an instinct to global scope.
+     */
+    promote(instinctId) {
+        const instincts = this.loadInstincts();
+        const instinct = instincts.find((i) => i.id === instinctId);
+        if (!instinct)
+            return null;
+        instinct.source = 'promoted';
+        instinct.ttlDays = 90; // Extended TTL for promoted instincts
+        this.saveInstincts(instincts);
+        this.log('promote', instinctId, `global promotion (confidence: ${instinct.confidence.toFixed(2)})`);
+        return instinct;
+    }
+    /**
+     * Export instincts for sharing between agents/projects.
+     */
+    exportInstincts(minConfidence = 0.5) {
+        return this.loadInstincts().filter((i) => i.confidence >= minConfidence);
+    }
+    /**
+     * Import instincts from another agent/project.
+     */
+    importInstincts(instincts) {
+        const existing = this.loadInstincts();
+        const existingPatterns = new Set(existing.map((i) => i.pattern.toLowerCase()));
+        let imported = 0;
+        let skipped = 0;
+        for (const instinct of instincts) {
+            if (existingPatterns.has(instinct.pattern.toLowerCase())) {
+                skipped++;
+                continue;
+            }
+            existing.push({
+                ...instinct,
+                id: `inst_${crypto.randomBytes(8).toString('hex')}`,
+                source: 'imported',
+                confidence: Math.min(instinct.confidence, 0.6), // Cap imported confidence
+            });
+            imported++;
+        }
+        this.saveInstincts(existing);
+        this.log('import', 'batch', `imported ${imported}, skipped ${skipped}`);
+        return { imported, skipped };
+    }
+    /**
+     * Get comprehensive status of all instincts.
+     */
+    getStatus() {
+        const instincts = this.loadInstincts();
+        const now = Date.now();
+        const byProject = {};
+        const bySource = {};
+        let totalConfidence = 0;
+        let highConfidence = 0;
+        let lowConfidence = 0;
+        let stale = 0;
+        for (const i of instincts) {
+            totalConfidence += i.confidence;
+            if (i.confidence >= 0.7)
+                highConfidence++;
+            if (i.confidence < 0.4)
+                lowConfidence++;
+            for (const p of i.projects) {
+                byProject[p] = (byProject[p] || 0) + 1;
+            }
+            bySource[i.source] = (bySource[i.source] || 0) + 1;
+            const lastActive = i.lastApplied
+                ? new Date(i.lastApplied).getTime()
+                : new Date(i.createdAt).getTime();
+            if ((now - lastActive) / (1000 * 60 * 60 * 24) > this.config.decayAfterDays) {
+                stale++;
+            }
+        }
+        return {
+            total: instincts.length,
+            active: instincts.length - stale,
+            highConfidence,
+            lowConfidence,
+            promotable: this.findPromotable().length,
+            stale,
+            byProject,
+            bySource,
+            avgConfidence: instincts.length > 0 ? totalConfidence / instincts.length : 0,
+        };
+    }
+    /**
+     * Force re-evaluation of all instincts.
+     * Recalculates confidence based on success/failure ratios.
+     */
+    evolve() {
+        const instincts = this.loadInstincts();
+        let evolved = 0;
+        for (const instinct of instincts) {
+            if (instinct.appliedCount === 0)
+                continue;
+            const successRate = instinct.successCount / instinct.appliedCount;
+            const newConfidence = this.config.initialConfidence +
+                (successRate * (0.9 - this.config.initialConfidence));
+            if (Math.abs(newConfidence - instinct.confidence) > 0.05) {
+                instinct.confidence = Math.max(0, Math.min(0.9, newConfidence));
+                evolved++;
+            }
+        }
+        this.saveInstincts(instincts);
+        this.log('evolve', 'all', `${evolved} instincts re-evaluated`);
+        return { evolved };
+    }
+    /**
+     * Get all instincts (read-only).
+     */
+    getAll() {
+        return this.loadInstincts();
+    }
+    /**
+     * Remove a specific instinct.
+     */
+    remove(instinctId) {
+        const instincts = this.loadInstincts();
+        const idx = instincts.findIndex((i) => i.id === instinctId);
+        if (idx === -1)
+            return false;
+        instincts.splice(idx, 1);
+        this.saveInstincts(instincts);
+        this.log('remove', instinctId, 'manually removed');
+        return true;
+    }
+    loadInstincts() {
+        if (!fs.existsSync(this.instinctsFile))
+            return [];
+        try {
+            return JSON.parse(fs.readFileSync(this.instinctsFile, 'utf-8'));
+        }
+        catch {
+            return [];
+        }
+    }
+    saveInstincts(instincts) {
+        try {
+            fs.writeFileSync(this.instinctsFile, JSON.stringify(instincts, null, 2));
+        }
+        catch (err) {
+            // Instinct persistence failure means learned patterns are lost
+            process.stderr.write(`[INSTINCT SYSTEM] Failed to save instincts for ${this.config.agentName}: ${err.message}\n`);
+        }
+    }
+    log(action, instinctId, detail) {
+        const entry = {
+            timestamp: new Date().toISOString(),
+            agent: this.config.agentName,
+            project: this.config.projectName,
+            action,
+            instinctId,
+            detail,
+        };
+        try {
+            fs.appendFileSync(this.logFile, JSON.stringify(entry) + '\n');
+        }
+        catch {
+            // Fire-and-forget
+        }
+    }
+}
+exports.InstinctSystem = InstinctSystem;
+//# sourceMappingURL=instinct-system.js.map

package/dist/governance/instinct-system.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instinct-system.js","sourceRoot":"","sources":["../../src/governance/instinct-system.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAC7B,+CAAiC;AA4DjC,MAAa,cAAc;IACjB,aAAa,CAAS;IACtB,OAAO,CAAS;IAChB,MAAM,CAA2B;IAEzC,YAAY,MAAsB;QAChC,IAAI,CAAC,MAAM,GAAG;YACZ,iBAAiB,EAAE,GAAG;YACtB,YAAY,EAAE,GAAG;YACjB,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE,CAAC;YACjB,SAAS,EAAE,IAAI;YACf,cAAc,EAAE,GAAG;YACnB,UAAU,EAAE,EAAE;YACd,kBAAkB,EAAE,GAAG;YACvB,oBAAoB,EAAE,CAAC;YACvB,YAAY,EAAE,GAAG;YACjB,GAAG,MAAM;SACV,CAAC;QAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAe,EAAE,OAAe,EAAE,SAAiB,EAAE,OAAiB,EAAE;QAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAEvC,sCAAsC;QACtC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACpC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAClD,CAAC;QAEF,IAAI,QAAQ,EAAE,CAAC;YACb,8BAA8B;YAC9B,QAAQ,CAAC,YAAY,EAAE,CAAC;YACxB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9C,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;gBACzD,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAClD,CAAC;YACD,QAAQ,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAChD,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC5C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,sBAAsB;QACtB,MAAM,QAAQ,GAAa;YACzB,EAAE,EAAE,QAAQ,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACnD,OAAO;YACP,OAAO;YACP,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;YACzC,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,CAAC,SAAS,CAAC;YACxB,YAAY,EAAE,CAAC;YACf,YAAY,EAAE,CAAC;YACf,YAAY,EAAE,CAAC;YACf,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAC/B,QAAQ,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YACnC,IAAI;SACL,CAAC;QAEF,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEzB,yDAAyD;QACzD,IAAI,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAChD,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;YACtD,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,UAAkB;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,QAAQ,CAAC,YAAY,EAAE,CAAC;QACxB,QAAQ,CAAC,YAAY,EAAE,CAAC;QACxB,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACpF,QAAQ,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAEhD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YACzD,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,eAAe,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,UAAkB,EAAE,MAAe;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,QAAQ,CAAC,YAAY,EAAE,CAAC;QACxB,QAAQ,CAAC,YAAY,EAAE,CAAC;QACxB,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACpF,QAAQ,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAEhD,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,IAAI,eAAe,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,eAAyB,EAAE,gBAAwB,GAAG;QACjE,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAE7D,OAAO,SAAS;aACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACZ,IAAI,CAAC,CAAC,UAAU,GAAG,aAAa;gBAAE,OAAO,KAAK,CAAC;YAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;YAC3E,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC,CAAC;aACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IACjD,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC9C,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW;gBACrC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;gBAC1C,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YAE3C,MAAM,eAAe,GAAG,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YAEnE,uBAAuB;YACvB,IAAI,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;gBACjD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAC7B,CAAC,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAC5E,CAAC;gBACF,MAAM,KAAK,GAAG,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;gBACnD,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC;gBAC/D,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,sCAAsC;YACtC,IAAI,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;gBACrD,MAAM,EAAE,CAAC;gBACT,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,cAAc,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;gBAC/F,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YACvF,IAAI,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBACvF,MAAM,EAAE,CAAC;gBACT,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,YAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;gBAC5E,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,OAAO,SAAS,CAAC,MAAM,CACrB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB;YAC9C,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB;YACrD,CAAC,CAAC,MAAM,KAAK,UAAU,CAC1B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,UAAkB;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC;QAC7B,QAAQ,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,sCAAsC;QAC7D,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,iCAAiC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACpG,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,gBAAwB,GAAG;QACzC,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC;IAC3E,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,SAAqB;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACtC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC/E,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBACzD,OAAO,EAAE,CAAC;gBACV,SAAS;YACX,CAAC;YAED,QAAQ,CAAC,IAAI,CAAC;gBACZ,GAAG,QAAQ;gBACX,EAAE,EAAE,QAAQ,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gBACnD,MAAM,EAAE,UAAU;gBAClB,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,0BAA0B;aAC3E,CAAC,CAAC;YACH,QAAQ,EAAE,CAAC;QACb,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,QAAQ,aAAa,OAAO,EAAE,CAAC,CAAC;QACxE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,SAAS;QACP,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,MAAM,SAAS,GAA2B,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAA2B,EAAE,CAAC;QAC5C,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,eAAe,IAAI,CAAC,CAAC,UAAU,CAAC;YAChC,IAAI,CAAC,CAAC,UAAU,IAAI,GAAG;gBAAE,cAAc,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,UAAU,GAAG,GAAG;gBAAE,aAAa,EAAE,CAAC;YAExC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC3B,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACzC,CAAC;YACD,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAEnD,MAAM,UAAU,GAAG,CAAC,CAAC,WAAW;gBAC9B,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;gBACnC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC5E,KAAK,EAAE,CAAC;YACV,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,SAAS,CAAC,MAAM;YACvB,MAAM,EAAE,SAAS,CAAC,MAAM,GAAG,KAAK;YAChC,cAAc;YACd,aAAa;YACb,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,MAAM;YACxC,KAAK;YACL,SAAS;YACT,QAAQ;YACR,aAAa,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;SAC7E,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,CAAC,YAAY,KAAK,CAAC;gBAAE,SAAS;YAE1C,MAAM,WAAW,GAAG,QAAQ,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;YAClE,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB;gBACjD,CAAC,WAAW,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAExD,IAAI,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,EAAE,CAAC;gBACzD,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;gBAChE,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,yBAAyB,CAAC,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAkB;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QAC5D,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAE7B,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC;YAAE,OAAO,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,SAAqB;QACzC,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+DAA+D;YAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kDAAkD,IAAI,CAAC,MAAM,CAAC,SAAS,KAAM,GAAa,CAAC,OAAO,IAAI,CACvG,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,GAAG,CAAC,MAAc,EAAE,UAAkB,EAAE,MAAc;QAC5D,MAAM,KAAK,GAAG;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAC5B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YAChC,MAAM;YACN,UAAU;YACV,MAAM;SACP,CAAC;QACF,IAAI,CAAC;YACH,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;CACF;AA/XD,wCA+XC"}

package/dist/governance/insurance-certificate.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Insurance Certificate Signer — signed envelope of a AgentTrustReport.
+ *
+ * Per Thomas Layer 0 2026-05-06 trademark positioning:
+ *   "The Sovereignty Certificate is the regulatory credential."
+ *
+ * Wraps a AgentTrustReport (slice 31) in a tamper-evident Ed25519-signed
+ * envelope that downstream parties — partner orgs, insurers, auditors,
+ * regulators — can verify without contacting our service.
+ *
+ * Verification is OFFLINE per Locked Invariant 4: cache the issuer
+ * public key once, verify any number of certificates against it.
+ *
+ * Uses the same canonical-JSON serialisation as signed-manifest (W2.x
+ * crypto), so signatures verify deterministically across SDKs.
+ *
+ * @connexum/ai-governance  Insurance Certificate / Sovereignty Credential
+ */
+import * as crypto from 'node:crypto';
+import type { AgentTrustReport } from './agent-trust-report.js';
+/** Maximum certificate age before verification rejects it. Default 90 days. */
+export declare const DEFAULT_CERT_MAX_AGE_DAYS = 90;
+export type CertificateClass = 
+/** Routine compliance report, valid through period.to + max-age. */
+'standard'
+/** High-stakes certification (insurance underwriting, regulator submission). */
+ | 'attested'
+/** Pre-production / staging — not for production reliance. */
+ | 'provisional';
+export interface CertificatePayload {
+    /** Issuing org (the customer running the platform). */
+    issuerOrgId: string;
+    /** Subject — the org whose agent the report covers. */
+    subjectOrgId: string;
+    /** Certificate class. */
+    class: CertificateClass;
+    /** Embedded compliance report. */
+    report: AgentTrustReport;
+    /** Random hex nonce, 32 chars. */
+    nonce: string;
+    /** ISO 8601 issuance time. */
+    issuedAt: string;
+    /** Optional ISO 8601 expiry — when absent, validity is period.to + max-age. */
+    expiresAt?: string;
+}
+export interface InsuranceCertificate {
+    payload: CertificatePayload;
+    signature: string;
+    alg: 'ed25519';
+}
+export interface IssueCertificateInput {
+    report: AgentTrustReport;
+    issuerOrgId: string;
+    subjectOrgId?: string;
+    certClass?: CertificateClass;
+    privateKey: crypto.KeyObject;
+    nowIso?: string;
+    /** Optional explicit expiry override. */
+    expiresAt?: string;
+}
+export declare function issueInsuranceCertificate(input: IssueCertificateInput): InsuranceCertificate;
+export interface VerifyCertificateOptions {
+    /** Expected issuer — protects against confused-deputy attacks. */
+    expectedIssuerOrgId?: string;
+    /** Override "now" for tests. */
+    nowMs?: number;
+    /** Max age in days before rejection. Default 90. */
+    maxAgeDays?: number;
+}
+export interface CertificateVerifyError extends Error {
+    code: 'INVALID_SIGNATURE' | 'EXPIRED' | 'MALFORMED' | 'ISSUER_MISMATCH' | 'NOT_YET_VALID';
+}
+/**
+ * Verify a certificate offline against the issuer's cached public key.
+ * Returns the validated payload OR throws CertificateVerifyError.
+ *
+ * Validity window:
+ *   - explicit expiresAt if present
+ *   - else issuedAt + maxAgeDays (default 90)
+ * Plus issuedAt cannot be in the future beyond a 5-minute clock-skew tolerance.
+ */
+export declare function verifyInsuranceCertificate(cert: InsuranceCertificate, publicKey: crypto.KeyObject, options?: VerifyCertificateOptions): CertificatePayload;
+/**
+ * Compact certificate fingerprint for dashboard cards / partner-share links.
+ * SHA-256 of the canonical payload, base64url first 16 chars.
+ */
+export declare function certificateFingerprint(cert: InsuranceCertificate): string;
+//# sourceMappingURL=insurance-certificate.d.ts.map

package/dist/governance/insurance-certificate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"insurance-certificate.d.ts","sourceRoot":"","sources":["../../src/governance/insurance-certificate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,+EAA+E;AAC/E,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,MAAM,MAAM,gBAAgB;AAC1B,oEAAoE;AAClE,UAAU;AACZ,gFAAgF;GAC9E,UAAU;AACZ,8DAA8D;GAC5D,aAAa,CAAC;AAElB,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,YAAY,EAAE,MAAM,CAAC;IACrB,yBAAyB;IACzB,KAAK,EAAE,gBAAgB,CAAC;IACxB,kCAAkC;IAClC,MAAM,EAAE,gBAAgB,CAAC;IACzB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,SAAS,CAAC;CAChB;AAYD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,qBAAqB,GAAG,oBAAoB,CAsB5F;AAED,MAAM,WAAW,wBAAwB;IACvC,kEAAkE;IAClE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAuB,SAAQ,KAAK;IACnD,IAAI,EACA,mBAAmB,GACnB,SAAS,GACT,WAAW,GACX,iBAAiB,GACjB,eAAe,CAAC;CACrB;AASD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,oBAAoB,EAC1B,SAAS,EAAE,MAAM,CAAC,SAAS,EAC3B,OAAO,GAAE,wBAA6B,GACrC,kBAAkB,CAwCpB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,CAIzE"}

package/dist/governance/insurance-certificate.js

@@ -0,0 +1,155 @@
+"use strict";
+/**
+ * Insurance Certificate Signer — signed envelope of a AgentTrustReport.
+ *
+ * Per Thomas Layer 0 2026-05-06 trademark positioning:
+ *   "The Sovereignty Certificate is the regulatory credential."
+ *
+ * Wraps a AgentTrustReport (slice 31) in a tamper-evident Ed25519-signed
+ * envelope that downstream parties — partner orgs, insurers, auditors,
+ * regulators — can verify without contacting our service.
+ *
+ * Verification is OFFLINE per Locked Invariant 4: cache the issuer
+ * public key once, verify any number of certificates against it.
+ *
+ * Uses the same canonical-JSON serialisation as signed-manifest (W2.x
+ * crypto), so signatures verify deterministically across SDKs.
+ *
+ * @connexum/ai-governance  Insurance Certificate / Sovereignty Credential
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_CERT_MAX_AGE_DAYS = void 0;
+exports.issueInsuranceCertificate = issueInsuranceCertificate;
+exports.verifyInsuranceCertificate = verifyInsuranceCertificate;
+exports.certificateFingerprint = certificateFingerprint;
+const crypto = __importStar(require("node:crypto"));
+const signed_manifest_js_1 = require("./signed-manifest.js");
+/** Maximum certificate age before verification rejects it. Default 90 days. */
+exports.DEFAULT_CERT_MAX_AGE_DAYS = 90;
+function canonicalJson(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value)) {
+        return '[' + value.map((v) => canonicalJson(v)).join(',') + ']';
+    }
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    return '{' + keys.map((k) => JSON.stringify(k) + ':' + canonicalJson(obj[k])).join(',') + '}';
+}
+function issueInsuranceCertificate(input) {
+    if (!input.issuerOrgId || input.issuerOrgId.trim() === '') {
+        throw new signed_manifest_js_1.ManifestSignatureError('MALFORMED', 'issuerOrgId is required');
+    }
+    const subjectOrgId = input.subjectOrgId ?? input.report.orgId;
+    const issuedAt = input.nowIso ?? new Date().toISOString();
+    const nonce = crypto.randomBytes(16).toString('hex');
+    const payload = {
+        issuerOrgId: input.issuerOrgId,
+        subjectOrgId,
+        class: input.certClass ?? 'standard',
+        report: input.report,
+        nonce,
+        issuedAt,
+        expiresAt: input.expiresAt,
+    };
+    const sig = crypto.sign(null, Buffer.from(canonicalJson(payload), 'utf8'), input.privateKey);
+    return {
+        payload,
+        signature: sig.toString('base64url'),
+        alg: 'ed25519',
+    };
+}
+function err(code, message) {
+    const e = new Error(message);
+    e.code = code;
+    e.name = 'CertificateVerifyError';
+    return e;
+}
+/**
+ * Verify a certificate offline against the issuer's cached public key.
+ * Returns the validated payload OR throws CertificateVerifyError.
+ *
+ * Validity window:
+ *   - explicit expiresAt if present
+ *   - else issuedAt + maxAgeDays (default 90)
+ * Plus issuedAt cannot be in the future beyond a 5-minute clock-skew tolerance.
+ */
+function verifyInsuranceCertificate(cert, publicKey, options = {}) {
+    if (!cert || !cert.payload || !cert.signature || cert.alg !== 'ed25519') {
+        throw err('MALFORMED', 'certificate missing payload / signature / alg');
+    }
+    if (options.expectedIssuerOrgId && cert.payload.issuerOrgId !== options.expectedIssuerOrgId) {
+        throw err('ISSUER_MISMATCH', `expected issuer ${options.expectedIssuerOrgId} but got ${cert.payload.issuerOrgId}`);
+    }
+    const issuedAtMs = new Date(cert.payload.issuedAt).getTime();
+    if (Number.isNaN(issuedAtMs))
+        throw err('MALFORMED', 'issuedAt is not a valid timestamp');
+    const nowMs = options.nowMs ?? Date.now();
+    const skewMs = 5 * 60 * 1000;
+    if (issuedAtMs - nowMs > skewMs) {
+        throw err('NOT_YET_VALID', 'issuedAt is in the future beyond clock-skew tolerance');
+    }
+    // Validity window
+    let expiryMs;
+    if (cert.payload.expiresAt) {
+        expiryMs = new Date(cert.payload.expiresAt).getTime();
+        if (Number.isNaN(expiryMs))
+            throw err('MALFORMED', 'expiresAt is not a valid timestamp');
+    }
+    else {
+        const maxAgeMs = (options.maxAgeDays ?? exports.DEFAULT_CERT_MAX_AGE_DAYS) * 24 * 60 * 60 * 1000;
+        expiryMs = issuedAtMs + maxAgeMs;
+    }
+    if (nowMs > expiryMs) {
+        throw err('EXPIRED', 'certificate is past its validity window');
+    }
+    const canonical = canonicalJson(cert.payload);
+    const sig = Buffer.from(cert.signature, 'base64url');
+    const ok = crypto.verify(null, Buffer.from(canonical, 'utf8'), publicKey, sig);
+    if (!ok)
+        throw err('INVALID_SIGNATURE', 'Ed25519 signature did not verify');
+    return cert.payload;
+}
+/**
+ * Compact certificate fingerprint for dashboard cards / partner-share links.
+ * SHA-256 of the canonical payload, base64url first 16 chars.
+ */
+function certificateFingerprint(cert) {
+    const canonical = canonicalJson(cert.payload);
+    const hash = crypto.createHash('sha256').update(canonical).digest();
+    return hash.toString('base64url').slice(0, 16);
+}
+//# sourceMappingURL=insurance-certificate.js.map

package/dist/governance/insurance-certificate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"insurance-certificate.js","sourceRoot":"","sources":["../../src/governance/insurance-certificate.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6DH,8DAsBC;AAoCD,gEA4CC;AAMD,wDAIC;AA3KD,oDAAsC;AAEtC,6DAA8D;AAE9D,+EAA+E;AAClE,QAAA,yBAAyB,GAAG,EAAE,CAAC;AAiC5C,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAClE,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AAChG,CAAC;AAaD,SAAgB,yBAAyB,CAAC,KAA4B;IACpE,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1D,MAAM,IAAI,2CAAsB,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;IAC9D,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,OAAO,GAAuB;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY;QACZ,KAAK,EAAE,KAAK,CAAC,SAAS,IAAI,UAAU;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK;QACL,QAAQ;QACR,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7F,OAAO;QACL,OAAO;QACP,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;QACpC,GAAG,EAAE,SAAS;KACf,CAAC;AACJ,CAAC;AAoBD,SAAS,GAAG,CAAC,IAAoC,EAAE,OAAe;IAChE,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,CAA2B,CAAC;IACvD,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;IACd,CAAC,CAAC,IAAI,GAAG,wBAAwB,CAAC;IAClC,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,0BAA0B,CACxC,IAA0B,EAC1B,SAA2B,EAC3B,UAAoC,EAAE;IAEtC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,GAAG,CAAC,WAAW,EAAE,+CAA+C,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,OAAO,CAAC,mBAAmB,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,mBAAmB,EAAE,CAAC;QAC5F,MAAM,GAAG,CACP,iBAAiB,EACjB,mBAAmB,OAAO,CAAC,mBAAmB,YAAY,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;IAC7D,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,MAAM,GAAG,CAAC,WAAW,EAAE,mCAAmC,CAAC,CAAC;IAE1F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAC7B,IAAI,UAAU,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;QAChC,MAAM,GAAG,CAAC,eAAe,EAAE,uDAAuD,CAAC,CAAC;IACtF,CAAC;IAED,kBAAkB;IAClB,IAAI,QAAgB,CAAC;IACrB,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC3B,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QACtD,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,MAAM,GAAG,CAAC,WAAW,EAAE,oCAAoC,CAAC,CAAC;IAC3F,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,iCAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACzF,QAAQ,GAAG,UAAU,GAAG,QAAQ,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;QACrB,MAAM,GAAG,CAAC,SAAS,EAAE,yCAAyC,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAC/E,IAAI,CAAC,EAAE;QAAE,MAAM,GAAG,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC;IAE5E,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB,CAAC,IAA0B;IAC/D,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;IACpE,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC"}

package/dist/governance/insurance-certificate.test.d.ts

@@ -0,0 +1,7 @@
+/**
+ * RED-GREEN tests for the insurance certificate signer.
+ *
+ * @connexum/ai-governance  Insurance Certificate
+ */
+export {};
+//# sourceMappingURL=insurance-certificate.test.d.ts.map