@connexum/ai-governance 1.0.0-beta.11

package/dist/governance/insurance-certificate.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"insurance-certificate.test.d.ts","sourceRoot":"","sources":["../../src/governance/insurance-certificate.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/governance/insurance-certificate.test.js

@@ -0,0 +1,240 @@
+"use strict";
+/**
+ * RED-GREEN tests for the insurance certificate signer.
+ *
+ * @connexum/ai-governance  Insurance Certificate
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const assert = __importStar(require("node:assert/strict"));
+const insurance_certificate_1 = require("./insurance-certificate");
+const signed_manifest_1 = require("./signed-manifest");
+const agent_trust_report_1 = require("./agent-trust-report");
+const trust_score_three_dim_1 = require("./trust-score-three-dim");
+const owasp_agentic_scanner_1 = require("./owasp-agentic-scanner");
+const improvement_recommendations_1 = require("./improvement-recommendations");
+const cleanManifest = () => ({
+    agentId: 'agent-x',
+    tools: [],
+    hooks: { preToolUse: true, postToolUse: true, postResponse: true },
+    llmProvider: 'connexum-proxy/anthropic',
+    pluginIntegrityVerified: true,
+    rateLimitsConfigured: true,
+    declaredApprovalGates: [],
+    declaredForbiddenCapabilities: [],
+});
+function makeReport() {
+    const dim = (c) => ({
+        scope_adherence: c, policy_compliance: c, anomaly_rate: c,
+        incident_history: c, behavioral_consistency: c, composite: c,
+    });
+    const opDim = (c) => ({
+        out_of_scope_ingestion: c, scope_violation_by_team: c,
+        scope_violation_by_data_class: c, human_override_frequency: c, composite: c,
+    });
+    const bDim = (c) => ({
+        owasp_agentic_score: c, hook_coverage_count: 3,
+        declared_capability_class_count: 4, has_human_in_loop: true,
+        plugin_integrity_verified: true, proxy_routed: true, composite: c,
+    });
+    const scan = (0, owasp_agentic_scanner_1.scanAgent)(cleanManifest());
+    return (0, agent_trust_report_1.generateAgentTrustReport)({
+        agentId: 'agent-x',
+        orgId: 'subject-org',
+        period: { from: '2026-05-01T00:00:00.000Z', to: '2026-05-12T00:00:00.000Z' },
+        packBindings: ['hipaa'],
+        score: (0, trust_score_three_dim_1.composeThreeDimensionalScore)({
+            agent_activity: dim(90),
+            operator_activity: opDim(90),
+            agent_build_structure: bDim(90),
+        }),
+        scanReport: scan,
+        recommendations: (0, improvement_recommendations_1.buildRecommendationSet)({ agentId: 'agent-x', buildScan: scan }),
+    });
+}
+(0, node_test_1.describe)('insurance certificate signer', () => {
+    (0, node_test_1.it)('issues a certificate and verifies it with the issuer public key', () => {
+        const { publicKey, privateKey } = (0, signed_manifest_1.generateOrgKeyPair)();
+        const cert = (0, insurance_certificate_1.issueInsuranceCertificate)({
+            report: makeReport(),
+            issuerOrgId: 'issuer-org',
+            privateKey,
+        });
+        const payload = (0, insurance_certificate_1.verifyInsuranceCertificate)(cert, publicKey);
+        assert.equal(payload.issuerOrgId, 'issuer-org');
+        assert.equal(payload.subjectOrgId, 'subject-org');
+        assert.equal(payload.class, 'standard');
+        assert.equal(payload.report.agentId, 'agent-x');
+    });
+    (0, node_test_1.it)('subjectOrgId defaults to the report.orgId when not supplied', () => {
+        const { publicKey, privateKey } = (0, signed_manifest_1.generateOrgKeyPair)();
+        const cert = (0, insurance_certificate_1.issueInsuranceCertificate)({
+            report: makeReport(),
+            issuerOrgId: 'issuer-org',
+            privateKey,
+        });
+        const payload = (0, insurance_certificate_1.verifyInsuranceCertificate)(cert, publicKey);
+        assert.equal(payload.subjectOrgId, 'subject-org'); // from report.orgId
+    });
+    (0, node_test_1.it)('explicit certClass is preserved', () => {
+        const { publicKey, privateKey } = (0, signed_manifest_1.generateOrgKeyPair)();
+        const cert = (0, insurance_certificate_1.issueInsuranceCertificate)({
+            report: makeReport(),
+            issuerOrgId: 'issuer-org',
+            certClass: 'attested',
+            privateKey,
+        });
+        const payload = (0, insurance_certificate_1.verifyInsuranceCertificate)(cert, publicKey);
+        assert.equal(payload.class, 'attested');
+    });
+    (0, node_test_1.it)('verification rejects a tampered payload', () => {
+        const { publicKey, privateKey } = (0, signed_manifest_1.generateOrgKeyPair)();
+        const cert = (0, insurance_certificate_1.issueInsuranceCertificate)({
+            report: makeReport(),
+            issuerOrgId: 'issuer-org',
+            privateKey,
+        });
+        const tampered = {
+            ...cert,
+            payload: { ...cert.payload, class: 'attested' },
+        };
+        assert.throws(() => (0, insurance_certificate_1.verifyInsuranceCertificate)(tampered, publicKey), (e) => e.code === 'INVALID_SIGNATURE');
+    });
+    (0, node_test_1.it)('verification rejects signature from a different private key', () => {
+        const { privateKey: pkA } = (0, signed_manifest_1.generateOrgKeyPair)();
+        const { publicKey: pubB } = (0, signed_manifest_1.generateOrgKeyPair)();
+        const cert = (0, insurance_certificate_1.issueInsuranceCertificate)({
+            report: makeReport(),
+            issuerOrgId: 'issuer-org',
+            privateKey: pkA,
+        });
+        assert.throws(() => (0, insurance_certificate_1.verifyInsuranceCertificate)(cert, pubB), (e) => e.code === 'INVALID_SIGNATURE');
+    });
+    (0, node_test_1.it)('expectedIssuerOrgId mismatch is rejected (confused-deputy guard)', () => {
+        const { publicKey, privateKey } = (0, signed_manifest_1.generateOrgKeyPair)();
+        const cert = (0, insurance_certificate_1.issueInsuranceCertificate)({
+            report: makeReport(),
+            issuerOrgId: 'issuer-org',
+            privateKey,
+        });
+        assert.throws(() => (0, insurance_certificate_1.verifyInsuranceCertificate)(cert, publicKey, {
+            expectedIssuerOrgId: 'a-different-issuer',
+        }), (e) => e.code === 'ISSUER_MISMATCH');
+    });
+    (0, node_test_1.it)('expired certificate is rejected (default max-age 90 days)', () => {
+        const { publicKey, privateKey } = (0, signed_manifest_1.generateOrgKeyPair)();
+        const old = new Date(Date.now() - (insurance_certificate_1.DEFAULT_CERT_MAX_AGE_DAYS + 5) * 24 * 60 * 60 * 1000).toISOString();
+        const cert = (0, insurance_certificate_1.issueInsuranceCertificate)({
+            report: makeReport(),
+            issuerOrgId: 'issuer-org',
+            privateKey,
+            nowIso: old,
+        });
+        assert.throws(() => (0, insurance_certificate_1.verifyInsuranceCertificate)(cert, publicKey), (e) => e.code === 'EXPIRED');
+    });
+    (0, node_test_1.it)('explicit expiresAt overrides the default max-age window', () => {
+        const { publicKey, privateKey } = (0, signed_manifest_1.generateOrgKeyPair)();
+        const now = new Date().toISOString();
+        const future = new Date(Date.now() + 365 * 24 * 60 * 60 * 1000).toISOString();
+        const cert = (0, insurance_certificate_1.issueInsuranceCertificate)({
+            report: makeReport(),
+            issuerOrgId: 'issuer-org',
+            privateKey,
+            nowIso: now,
+            expiresAt: future,
+        });
+        const payload = (0, insurance_certificate_1.verifyInsuranceCertificate)(cert, publicKey);
+        assert.equal(payload.expiresAt, future);
+    });
+    (0, node_test_1.it)('certificate issued at a future timestamp beyond skew is rejected', () => {
+        const { publicKey, privateKey } = (0, signed_manifest_1.generateOrgKeyPair)();
+        const future = new Date(Date.now() + 60 * 60 * 1000).toISOString();
+        const cert = (0, insurance_certificate_1.issueInsuranceCertificate)({
+            report: makeReport(),
+            issuerOrgId: 'issuer-org',
+            privateKey,
+            nowIso: future,
+        });
+        assert.throws(() => (0, insurance_certificate_1.verifyInsuranceCertificate)(cert, publicKey), (e) => e.code === 'NOT_YET_VALID');
+    });
+    (0, node_test_1.it)('missing issuerOrgId throws', () => {
+        const { privateKey } = (0, signed_manifest_1.generateOrgKeyPair)();
+        assert.throws(() => (0, insurance_certificate_1.issueInsuranceCertificate)({
+            report: makeReport(),
+            issuerOrgId: '',
+            privateKey,
+        }));
+    });
+    (0, node_test_1.it)('certificateFingerprint produces a stable 16-char base64url id', () => {
+        const { privateKey } = (0, signed_manifest_1.generateOrgKeyPair)();
+        const cert1 = (0, insurance_certificate_1.issueInsuranceCertificate)({
+            report: makeReport(),
+            issuerOrgId: 'issuer-org',
+            privateKey,
+            nowIso: '2026-05-12T00:00:00.000Z',
+        });
+        const fp = (0, insurance_certificate_1.certificateFingerprint)(cert1);
+        assert.equal(fp.length, 16);
+        assert.match(fp, /^[A-Za-z0-9_-]+$/);
+        // Same cert -> same fingerprint
+        assert.equal((0, insurance_certificate_1.certificateFingerprint)(cert1), fp);
+    });
+    (0, node_test_1.it)('different reports produce different fingerprints', () => {
+        const { privateKey } = (0, signed_manifest_1.generateOrgKeyPair)();
+        const c1 = (0, insurance_certificate_1.issueInsuranceCertificate)({
+            report: { ...makeReport(), id: 'cr-1' },
+            issuerOrgId: 'issuer-org',
+            privateKey,
+        });
+        const c2 = (0, insurance_certificate_1.issueInsuranceCertificate)({
+            report: { ...makeReport(), id: 'cr-2' },
+            issuerOrgId: 'issuer-org',
+            privateKey,
+        });
+        assert.notEqual((0, insurance_certificate_1.certificateFingerprint)(c1), (0, insurance_certificate_1.certificateFingerprint)(c2));
+    });
+    (0, node_test_1.it)('alg field is locked to ed25519; mismatched alg fails verification', () => {
+        const { publicKey, privateKey } = (0, signed_manifest_1.generateOrgKeyPair)();
+        const cert = (0, insurance_certificate_1.issueInsuranceCertificate)({
+            report: makeReport(),
+            issuerOrgId: 'issuer-org',
+            privateKey,
+        });
+        const bad = { ...cert, alg: 'hmac-sha256' };
+        assert.throws(() => (0, insurance_certificate_1.verifyInsuranceCertificate)(bad, publicKey), (e) => e.code === 'MALFORMED');
+    });
+});
+//# sourceMappingURL=insurance-certificate.test.js.map

package/dist/governance/insurance-certificate.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"insurance-certificate.test.js","sourceRoot":"","sources":["../../src/governance/insurance-certificate.test.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,yCAAyC;AACzC,2DAA6C;AAE7C,mEAOiC;AACjC,uDAAuD;AACvD,6DAAgE;AAChE,mEAAuE;AACvE,mEAAoD;AACpD,+EAAuE;AAGvE,MAAM,aAAa,GAAG,GAAkB,EAAE,CAAC,CAAC;IAC1C,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,EAAE;IACT,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;IAClE,WAAW,EAAE,0BAA0B;IACvC,uBAAuB,EAAE,IAAI;IAC7B,oBAAoB,EAAE,IAAI;IAC1B,qBAAqB,EAAE,EAAE;IACzB,6BAA6B,EAAE,EAAE;CAClC,CAAC,CAAC;AAEH,SAAS,UAAU;IACjB,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC;QAC1B,eAAe,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;QACzD,gBAAgB,EAAE,CAAC,EAAE,sBAAsB,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;KAC7D,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC;QAC5B,sBAAsB,EAAE,CAAC,EAAE,uBAAuB,EAAE,CAAC;QACrD,6BAA6B,EAAE,CAAC,EAAE,wBAAwB,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;KAC5E,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC;QAC3B,mBAAmB,EAAE,CAAC,EAAE,mBAAmB,EAAE,CAAC;QAC9C,+BAA+B,EAAE,CAAC,EAAE,iBAAiB,EAAE,IAAI;QAC3D,yBAAyB,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KAClE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAA,iCAAS,EAAC,aAAa,EAAE,CAAC,CAAC;IACxC,OAAO,IAAA,6CAAwB,EAAC;QAC9B,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,aAAa;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,EAAE,EAAE,0BAA0B,EAAE;QAC5E,YAAY,EAAE,CAAC,OAAO,CAAC;QACvB,KAAK,EAAE,IAAA,oDAA4B,EAAC;YAClC,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC;YACvB,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC;YAC5B,qBAAqB,EAAE,IAAI,CAAC,EAAE,CAAC;SAChC,CAAC;QACF,UAAU,EAAE,IAAI;QAChB,eAAe,EAAE,IAAA,oDAAsB,EAAC,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACjF,CAAC,CAAC;AACL,CAAC;AAED,IAAA,oBAAQ,EAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,IAAA,cAAE,EAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAA,oCAAkB,GAAE,CAAC;QACvD,MAAM,IAAI,GAAG,IAAA,iDAAyB,EAAC;YACrC,MAAM,EAAE,UAAU,EAAE;YACpB,WAAW,EAAE,YAAY;YACzB,UAAU;SACX,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAA,kDAA0B,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAA,oCAAkB,GAAE,CAAC;QACvD,MAAM,IAAI,GAAG,IAAA,iDAAyB,EAAC;YACrC,MAAM,EAAE,UAAU,EAAE;YACpB,WAAW,EAAE,YAAY;YACzB,UAAU;SACX,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAA,kDAA0B,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,oBAAoB;IACzE,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAA,oCAAkB,GAAE,CAAC;QACvD,MAAM,IAAI,GAAG,IAAA,iDAAyB,EAAC;YACrC,MAAM,EAAE,UAAU,EAAE;YACpB,WAAW,EAAE,YAAY;YACzB,SAAS,EAAE,UAAU;YACrB,UAAU;SACX,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAA,kDAA0B,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAA,oCAAkB,GAAE,CAAC;QACvD,MAAM,IAAI,GAAG,IAAA,iDAAyB,EAAC;YACrC,MAAM,EAAE,UAAU,EAAE;YACpB,WAAW,EAAE,YAAY;YACzB,UAAU;SACX,CAAC,CAAC;QACH,MAAM,QAAQ,GAAyB;YACrC,GAAG,IAAI;YACP,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE;SAChD,CAAC;QACF,MAAM,CAAC,MAAM,CACX,GAAG,EAAE,CAAC,IAAA,kDAA0B,EAAC,QAAQ,EAAE,SAAS,CAAC,EACrD,CAAC,CAAU,EAAE,EAAE,CAAE,CAA4B,CAAC,IAAI,KAAK,mBAAmB,CAC3E,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,IAAA,oCAAkB,GAAE,CAAC;QACjD,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAA,oCAAkB,GAAE,CAAC;QACjD,MAAM,IAAI,GAAG,IAAA,iDAAyB,EAAC;YACrC,MAAM,EAAE,UAAU,EAAE;YACpB,WAAW,EAAE,YAAY;YACzB,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CACX,GAAG,EAAE,CAAC,IAAA,kDAA0B,EAAC,IAAI,EAAE,IAAI,CAAC,EAC5C,CAAC,CAAU,EAAE,EAAE,CAAE,CAA4B,CAAC,IAAI,KAAK,mBAAmB,CAC3E,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAA,oCAAkB,GAAE,CAAC;QACvD,MAAM,IAAI,GAAG,IAAA,iDAAyB,EAAC;YACrC,MAAM,EAAE,UAAU,EAAE;YACpB,WAAW,EAAE,YAAY;YACzB,UAAU;SACX,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CACX,GAAG,EAAE,CACH,IAAA,kDAA0B,EAAC,IAAI,EAAE,SAAS,EAAE;YAC1C,mBAAmB,EAAE,oBAAoB;SAC1C,CAAC,EACJ,CAAC,CAAU,EAAE,EAAE,CAAE,CAA4B,CAAC,IAAI,KAAK,iBAAiB,CACzE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAA,oCAAkB,GAAE,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,IAAI,CAClB,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,iDAAyB,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CACnE,CAAC,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,IAAA,iDAAyB,EAAC;YACrC,MAAM,EAAE,UAAU,EAAE;YACpB,WAAW,EAAE,YAAY;YACzB,UAAU;YACV,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CACX,GAAG,EAAE,CAAC,IAAA,kDAA0B,EAAC,IAAI,EAAE,SAAS,CAAC,EACjD,CAAC,CAAU,EAAE,EAAE,CAAE,CAA4B,CAAC,IAAI,KAAK,SAAS,CACjE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAA,oCAAkB,GAAE,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9E,MAAM,IAAI,GAAG,IAAA,iDAAyB,EAAC;YACrC,MAAM,EAAE,UAAU,EAAE;YACpB,WAAW,EAAE,YAAY;YACzB,UAAU;YACV,MAAM,EAAE,GAAG;YACX,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAA,kDAA0B,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAA,oCAAkB,GAAE,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,IAAA,iDAAyB,EAAC;YACrC,MAAM,EAAE,UAAU,EAAE;YACpB,WAAW,EAAE,YAAY;YACzB,UAAU;YACV,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CACX,GAAG,EAAE,CAAC,IAAA,kDAA0B,EAAC,IAAI,EAAE,SAAS,CAAC,EACjD,CAAC,CAAU,EAAE,EAAE,CAAE,CAA4B,CAAC,IAAI,KAAK,eAAe,CACvE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,EAAE,UAAU,EAAE,GAAG,IAAA,oCAAkB,GAAE,CAAC;QAC5C,MAAM,CAAC,MAAM,CACX,GAAG,EAAE,CACH,IAAA,iDAAyB,EAAC;YACxB,MAAM,EAAE,UAAU,EAAE;YACpB,WAAW,EAAE,EAAE;YACf,UAAU;SACX,CAAC,CACL,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAA,oCAAkB,GAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAA,iDAAyB,EAAC;YACtC,MAAM,EAAE,UAAU,EAAE;YACpB,WAAW,EAAE,YAAY;YACzB,UAAU;YACV,MAAM,EAAE,0BAA0B;SACnC,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,IAAA,8CAAsB,EAAC,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC;QACrC,gCAAgC;QAChC,MAAM,CAAC,KAAK,CAAC,IAAA,8CAAsB,EAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,EAAE,UAAU,EAAE,GAAG,IAAA,oCAAkB,GAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAA,iDAAyB,EAAC;YACnC,MAAM,EAAE,EAAE,GAAG,UAAU,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACvC,WAAW,EAAE,YAAY;YACzB,UAAU;SACX,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,IAAA,iDAAyB,EAAC;YACnC,MAAM,EAAE,EAAE,GAAG,UAAU,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACvC,WAAW,EAAE,YAAY;YACzB,UAAU;SACX,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,IAAA,8CAAsB,EAAC,EAAE,CAAC,EAAE,IAAA,8CAAsB,EAAC,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAA,oCAAkB,GAAE,CAAC;QACvD,MAAM,IAAI,GAAG,IAAA,iDAAyB,EAAC;YACrC,MAAM,EAAE,UAAU,EAAE;YACpB,WAAW,EAAE,YAAY;YACzB,UAAU;SACX,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,aAAoB,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM,CACX,GAAG,EAAE,CAAC,IAAA,kDAA0B,EAAC,GAAG,EAAE,SAAS,CAAC,EAChD,CAAC,CAAU,EAAE,EAAE,CAAE,CAA4B,CAAC,IAAI,KAAK,WAAW,CACnE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/governance/manifest-push-emitter.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Manifest Push Emitter — customer-side helper that signs a manifest and
+ * POSTs it to the receive endpoint.
+ *
+ * Wraps:
+ *   - W2.1 discovery output (AgentManifest)
+ *   - signed-manifest helper (Ed25519 + canonical JSON)
+ *   - retry with exponential backoff for transient failures (5xx / network)
+ *
+ * Honors Invariant 10 — push-only, fire-and-forget from the customer side.
+ * Local backpressure queue (in-memory) is left to the caller; this helper
+ * focuses on the single push lifecycle.
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-AGENT-DISCOVERY-CLI (client push)
+ */
+import * as crypto from 'node:crypto';
+import { type SignedManifest } from './signed-manifest.js';
+import type { AgentManifest } from './owasp-agentic-scanner.js';
+import type { HttpsTransport } from './approval-channel-adapters.js';
+export interface PushEmitterOptions {
+    orgId: string;
+    privateKey: crypto.KeyObject;
+    /** Receive endpoint URL (e.g. https://proxy.my-cc.io/api/v1/manifests). */
+    endpoint: string;
+    /** Max retries on transient (5xx / network) failure. Default 3. */
+    maxRetries?: number;
+    /** Base backoff in ms (multiplied by 2^attempt). Default 500. */
+    baseBackoffMs?: number;
+    /** Injectable transport for tests. Defaults to nodeHttpsTransport. */
+    transport?: HttpsTransport;
+    /** Injectable sleep for tests. Defaults to globalThis.setTimeout. */
+    sleep?: (ms: number) => Promise<void>;
+}
+export interface PushResult {
+    ok: boolean;
+    status?: number;
+    attempts: number;
+    /** Server-returned receipt id, if any (parsed from JSON response body). */
+    receiptId?: string;
+    /** Error message on final failure. */
+    error?: string;
+}
+export declare class ManifestPushEmitter {
+    private readonly options;
+    constructor(options: PushEmitterOptions);
+    /** Sign and push a single manifest. */
+    push(manifest: AgentManifest): Promise<PushResult>;
+    /** Push a manifest you have already signed (e.g. signed on a different host). */
+    pushSigned(signed: SignedManifest): Promise<PushResult>;
+}
+//# sourceMappingURL=manifest-push-emitter.d.ts.map

package/dist/governance/manifest-push-emitter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-push-emitter.d.ts","sourceRoot":"","sources":["../../src/governance/manifest-push-emitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAGrE,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC;IAC7B,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,qEAAqE;IACrE,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAUD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAGtB;gBAEU,OAAO,EAAE,kBAAkB;IAkBvC,uCAAuC;IACjC,IAAI,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC;IAKxD,iFAAiF;IAC3E,UAAU,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC;CA+D9D"}

package/dist/governance/manifest-push-emitter.js

@@ -0,0 +1,111 @@
+"use strict";
+/**
+ * Manifest Push Emitter — customer-side helper that signs a manifest and
+ * POSTs it to the receive endpoint.
+ *
+ * Wraps:
+ *   - W2.1 discovery output (AgentManifest)
+ *   - signed-manifest helper (Ed25519 + canonical JSON)
+ *   - retry with exponential backoff for transient failures (5xx / network)
+ *
+ * Honors Invariant 10 — push-only, fire-and-forget from the customer side.
+ * Local backpressure queue (in-memory) is left to the caller; this helper
+ * focuses on the single push lifecycle.
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-AGENT-DISCOVERY-CLI (client push)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ManifestPushEmitter = void 0;
+const signed_manifest_js_1 = require("./signed-manifest.js");
+const approval_channel_adapters_js_1 = require("./approval-channel-adapters.js");
+const DEFAULT_SLEEP = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function parseUrl(url) {
+    const u = new URL(url);
+    return { hostname: u.hostname, path: u.pathname + u.search };
+}
+class ManifestPushEmitter {
+    options;
+    constructor(options) {
+        if (!options.orgId || options.orgId.trim() === '') {
+            throw new Error('ManifestPushEmitter: orgId is required');
+        }
+        if (!options.endpoint || options.endpoint.trim() === '') {
+            throw new Error('ManifestPushEmitter: endpoint is required');
+        }
+        this.options = {
+            orgId: options.orgId,
+            privateKey: options.privateKey,
+            endpoint: options.endpoint,
+            maxRetries: options.maxRetries ?? 3,
+            baseBackoffMs: options.baseBackoffMs ?? 500,
+            transport: options.transport ?? approval_channel_adapters_js_1.nodeHttpsTransport,
+            sleep: options.sleep ?? DEFAULT_SLEEP,
+        };
+    }
+    /** Sign and push a single manifest. */
+    async push(manifest) {
+        const signed = (0, signed_manifest_js_1.signManifest)(manifest, this.options.orgId, this.options.privateKey);
+        return this.pushSigned(signed);
+    }
+    /** Push a manifest you have already signed (e.g. signed on a different host). */
+    async pushSigned(signed) {
+        const body = JSON.stringify(signed);
+        const { hostname, path } = parseUrl(this.options.endpoint);
+        let lastErr;
+        let lastStatus;
+        for (let attempt = 0; attempt < this.options.maxRetries + 1; attempt++) {
+            try {
+                const res = await this.options.transport({
+                    method: 'POST',
+                    hostname,
+                    path,
+                    headers: {
+                        'content-type': 'application/json',
+                        'content-length': Buffer.byteLength(body).toString(),
+                        'x-connexum-org': this.options.orgId,
+                    },
+                    body,
+                });
+                if (res.status >= 200 && res.status < 300) {
+                    let receiptId;
+                    try {
+                        const parsed = JSON.parse(res.bodyText);
+                        receiptId = parsed.id ?? parsed.receipt_id;
+                    }
+                    catch {
+                        // tolerate non-JSON success bodies
+                    }
+                    return { ok: true, status: res.status, attempts: attempt + 1, receiptId };
+                }
+                if (res.status >= 400 && res.status < 500) {
+                    // 4xx is a client error -- don't retry
+                    return {
+                        ok: false,
+                        status: res.status,
+                        attempts: attempt + 1,
+                        error: `client error: ${res.bodyText.slice(0, 256)}`,
+                    };
+                }
+                // 5xx -- retry
+                lastStatus = res.status;
+                lastErr = `server status=${res.status}`;
+            }
+            catch (err) {
+                lastErr = `transport error: ${err.message}`;
+            }
+            // Backoff before retry (unless we're out of attempts)
+            if (attempt < this.options.maxRetries) {
+                const backoff = this.options.baseBackoffMs * Math.pow(2, attempt);
+                await this.options.sleep(backoff);
+            }
+        }
+        return {
+            ok: false,
+            status: lastStatus,
+            attempts: this.options.maxRetries + 1,
+            error: lastErr ?? 'exhausted retries',
+        };
+    }
+}
+exports.ManifestPushEmitter = ManifestPushEmitter;
+//# sourceMappingURL=manifest-push-emitter.js.map

package/dist/governance/manifest-push-emitter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-push-emitter.js","sourceRoot":"","sources":["../../src/governance/manifest-push-emitter.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAGH,6DAAyE;AAGzE,iFAAoE;AA2BpE,MAAM,aAAa,GAAG,CAAC,EAAU,EAAiB,EAAE,CAClD,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEpD,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;AAC/D,CAAC;AAED,MAAa,mBAAmB;IACb,OAAO,CAGtB;IAEF,YAAY,OAA2B;QACrC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,OAAO,GAAG;YACb,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,CAAC;YACnC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,GAAG;YAC3C,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,iDAAkB;YAClD,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,aAAa;SACtC,CAAC;IACJ,CAAC;IAED,uCAAuC;IACvC,KAAK,CAAC,IAAI,CAAC,QAAuB;QAChC,MAAM,MAAM,GAAG,IAAA,iCAAY,EAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,UAAU,CAAC,MAAsB;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE3D,IAAI,OAA2B,CAAC;QAChC,IAAI,UAA8B,CAAC;QAEnC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YACvE,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;oBACvC,MAAM,EAAE,MAAM;oBACd,QAAQ;oBACR,IAAI;oBACJ,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;wBACpD,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;qBACrC;oBACD,IAAI;iBACL,CAAC,CAAC;gBAEH,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;oBAC1C,IAAI,SAA6B,CAAC;oBAClC,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAyC,CAAC;wBAChF,SAAS,GAAG,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC;oBAC7C,CAAC;oBAAC,MAAM,CAAC;wBACP,mCAAmC;oBACrC,CAAC;oBACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC;gBAC5E,CAAC;gBAED,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;oBAC1C,uCAAuC;oBACvC,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,QAAQ,EAAE,OAAO,GAAG,CAAC;wBACrB,KAAK,EAAE,iBAAiB,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;qBACrD,CAAC;gBACJ,CAAC;gBAED,eAAe;gBACf,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;gBACxB,OAAO,GAAG,iBAAiB,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,GAAG,oBAAqB,GAAa,CAAC,OAAO,EAAE,CAAC;YACzD,CAAC;YAED,sDAAsD;YACtD,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;gBACtC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBAClE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAED,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,GAAG,CAAC;YACrC,KAAK,EAAE,OAAO,IAAI,mBAAmB;SACtC,CAAC;IACJ,CAAC;CACF;AA9FD,kDA8FC"}

package/dist/governance/manifest-push-emitter.test.d.ts

@@ -0,0 +1,7 @@
+/**
+ * RED-GREEN tests for the manifest push emitter.
+ *
+ * @connexum/ai-governance  manifest-push-emitter
+ */
+export {};
+//# sourceMappingURL=manifest-push-emitter.test.d.ts.map

package/dist/governance/manifest-push-emitter.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-push-emitter.test.d.ts","sourceRoot":"","sources":["../../src/governance/manifest-push-emitter.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}