@connexum/ai-governance 1.0.0-beta.11

package/dist/trust-passport/index.js

@@ -0,0 +1,123 @@
+"use strict";
+/**
+ * Trust passport surface for @connexum/ai-governance.
+ *
+ * Closes CR-CRIT-01 SDK piece (`docs/audits/2026-05-12-client-ready-integration-audit.md`):
+ * before this module, the trust-api package + daemon existed but `grep -rn
+ * 'AgentPassport|/v1/agents/register' --include='*.ts' packages apps src |
+ * grep -v '/trust-api/'` returned zero matches — no customer-installable code
+ * path called the daemon. This module bridges that gap.
+ *
+ * Two operations:
+ *   - `issuePassport(opts)` — HTTP POST to the daemon's /v1/agents/register
+ *     endpoint. Returns the SignedPassport. Requires daemon to be reachable.
+ *   - `verifyInboundPassport(passport, platformCaPublicKey)` — Locked
+ *     Invariant 4 offline verifier. Uses the org public key embedded in the
+ *     passport claims; no daemon contact required.
+ *
+ * Locked Architectural Invariant binding (see CLAUDE.md):
+ *   - 1 (self-sovereign) — daemon issues passports; relying party verifies
+ *     offline against the cached platform CA public key.
+ *   - 2 (advisory) — verifyInboundPassport never throws on a malformed
+ *     passport; returns a discriminated union. SDK callers branch on
+ *     `result.valid` and apply their own policy on `valid:false`.
+ *   - 3 (graceful degradation) — issuePassport accepts a `timeoutMs` (default
+ *     5000) and rejects with a structured error if the daemon is unreachable
+ *     so callers can apply their own fallback policy (cache the last
+ *     passport, retry, surface to operator, etc.).
+ *   - 4 (offline-verifiable) — verifyInboundPassport calls verifyPassportOffline
+ *     from @connexum/trust-api which extracts the org public key from
+ *     `passport.public_key_b64` (signed-in field; tampering invalidates the
+ *     signature).
+ *   - 5 (structured response) — verifyInboundPassport returns a
+ *     VerificationResult discriminated union; never throws.
+ *
+ * @connexum/ai-governance — F-NEW-SDK-PASSPORT-SURFACE-2026-05-12
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.issuePassport = issuePassport;
+exports.verifyInboundPassport = verifyInboundPassport;
+const trust_api_1 = require("@connexum/trust-api");
+/**
+ * Issue a passport for an agent by calling the trust-api daemon's
+ * POST /v1/agents/register endpoint. The org keypair is generated daemon-side
+ * (Locked Invariant 1 self-sovereign); both signatures are returned in the
+ * response.
+ *
+ * Customers cache the returned passport locally and present it to relying
+ * parties. Offline verification uses `verifyInboundPassport()` below.
+ */
+async function issuePassport(opts) {
+    const daemonUrl = (opts.daemonUrl ?? 'http://127.0.0.1:4200').replace(/\/$/, '');
+    const timeoutMs = opts.timeoutMs ?? 5000;
+    const url = `${daemonUrl}/v1/agents/register`;
+    const body = JSON.stringify({
+        display_name: opts.displayName,
+        model_lineage_hash: opts.modelLineageHash,
+        governance_policy_version: opts.governancePolicyVersion,
+        authorized_scope: opts.authorizedScope,
+        pack_binding: opts.packBinding,
+        ttl_seconds: opts.ttlSeconds,
+    });
+    const controller = new AbortController();
+    const timeoutHandle = setTimeout(() => controller.abort(), timeoutMs);
+    let res;
+    try {
+        res = await fetch(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Authorization': `Bearer ${opts.bearerToken}`,
+            },
+            body,
+            signal: controller.signal,
+        });
+    }
+    catch (err) {
+        clearTimeout(timeoutHandle);
+        const message = err instanceof Error ? err.message : String(err);
+        if (controller.signal.aborted) {
+            return { ok: false, reason: 'timeout', detail: `request exceeded ${timeoutMs}ms` };
+        }
+        return { ok: false, reason: 'network', detail: message };
+    }
+    finally {
+        clearTimeout(timeoutHandle);
+    }
+    if (res.status === 401 || res.status === 403) {
+        return { ok: false, reason: 'unauthorized', statusCode: res.status, detail: await res.text().catch(() => '') };
+    }
+    if (res.status >= 400 && res.status < 500) {
+        return { ok: false, reason: 'bad_request', statusCode: res.status, detail: await res.text().catch(() => '') };
+    }
+    if (res.status >= 500) {
+        return { ok: false, reason: 'server_error', statusCode: res.status, detail: await res.text().catch(() => '') };
+    }
+    let parsed;
+    try {
+        parsed = (await res.json());
+    }
+    catch (err) {
+        void err;
+        return { ok: false, reason: 'malformed_response', detail: 'JSON parse failed' };
+    }
+    if (!parsed.passport || typeof parsed.passport !== 'object') {
+        return { ok: false, reason: 'malformed_response', detail: 'response missing `passport` field' };
+    }
+    return { ok: true, passport: parsed.passport };
+}
+/**
+ * Verify a passport using ONLY the platform CA public key (Locked Invariant 4
+ * offline path). Suitable for relying parties who have cached the CA pub key
+ * out-of-band and want to verify inbound passports with no daemon contact.
+ *
+ * `platformCaPublicKey` is the raw 32-byte Ed25519 public key. Operators
+ * fetch + cache it from the daemon at deployment time; rotation is rare and
+ * communicated through the platform's regular channels.
+ *
+ * Returns a structured VerificationResult — never throws (Invariant 5).
+ */
+function verifyInboundPassport(passport, platformCaPublicKey, options = {}) {
+    return (0, trust_api_1.verifyPassportOffline)(passport, platformCaPublicKey, options);
+}
+//# sourceMappingURL=index.js.map

package/dist/trust-passport/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trust-passport/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;;AAwDH,sCA4DC;AAaD,sDAMC;AArID,mDAI6B;AAyC7B;;;;;;;;GAQG;AACI,KAAK,UAAU,aAAa,CAAC,IAA0B;IAC5D,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACzC,MAAM,GAAG,GAAG,GAAG,SAAS,qBAAqB,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,kBAAkB,EAAE,IAAI,CAAC,gBAAgB;QACzC,yBAAyB,EAAE,IAAI,CAAC,uBAAuB;QACvD,gBAAgB,EAAE,IAAI,CAAC,eAAe;QACtC,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,WAAW,EAAE,IAAI,CAAC,UAAU;KAC7B,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAEtE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,eAAe,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;aAC9C;YACD,IAAI;YACJ,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,CAAC,aAAa,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,SAAS,IAAI,EAAE,CAAC;QACrF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC3D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,aAAa,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IACjH,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IAChH,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IACjH,CAAC;IAED,IAAI,MAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,GAAG,CAAC;QACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAClF,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,qBAAqB,CACnC,QAAiB,EACjB,mBAA+B,EAC/B,UAA6D,EAAE;IAE/D,OAAO,IAAA,iCAAqB,EAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;AACvE,CAAC"}

package/dist/util/async-io.d.ts

@@ -0,0 +1,57 @@
+/**
+ * AsyncIO -- Non-blocking file I/O wrappers for governance modules.
+ *
+ * Provides async versions of common file operations used across
+ * the governance framework. Prevents blocking the event loop
+ * during heavy audit/log writes.
+ *
+ * T-027: Async I/O for file-based operations.
+ *
+ * @connexum/ai-governance
+ */
+import * as fs from 'fs';
+/**
+ * Ensure a directory exists (async).
+ */
+export declare function ensureDirAsync(dir: string): Promise<void>;
+/**
+ * Append a JSON line to a JSONL file (async).
+ */
+export declare function appendJsonlAsync(filePath: string, data: unknown): Promise<void>;
+/**
+ * Read all lines from a JSONL file (async).
+ */
+export declare function readJsonlAsync<T = unknown>(filePath: string): Promise<T[]>;
+/**
+ * Load a JSON file (async).
+ */
+export declare function loadJsonAsync<T = unknown>(filePath: string): Promise<T | null>;
+/**
+ * Save a JSON file (async, atomic via temp file + rename).
+ */
+export declare function saveJsonAsync(filePath: string, data: unknown): Promise<void>;
+/**
+ * Compute SHA-256 hash of a file (async, streaming).
+ */
+export declare function sha256FileAsync(filePath: string): Promise<string>;
+/**
+ * Read new bytes from a file starting at offset (async).
+ * Returns the new content and the new offset.
+ */
+export declare function readFromOffsetAsync(filePath: string, offset: number): Promise<{
+    content: string;
+    newOffset: number;
+}>;
+/**
+ * Read the last N lines from a file (async).
+ */
+export declare function readLastLinesAsync(filePath: string, n: number): Promise<string[]>;
+/**
+ * Check if a file exists (async).
+ */
+export declare function fileExistsAsync(filePath: string): Promise<boolean>;
+/**
+ * Get file stats (async). Returns null if file doesn't exist.
+ */
+export declare function fileStatsAsync(filePath: string): Promise<fs.Stats | null>;
+//# sourceMappingURL=async-io.d.ts.map

package/dist/util/async-io.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"async-io.d.ts","sourceRoot":"","sources":["../../src/util/async-io.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAKzB;;GAEG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM/D;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAGrF;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAehF;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAOpF;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAYlF;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASvE;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBjD;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CASvF;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOxE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,CAM/E"}

package/dist/util/async-io.js

@@ -0,0 +1,209 @@
+"use strict";
+/**
+ * AsyncIO -- Non-blocking file I/O wrappers for governance modules.
+ *
+ * Provides async versions of common file operations used across
+ * the governance framework. Prevents blocking the event loop
+ * during heavy audit/log writes.
+ *
+ * T-027: Async I/O for file-based operations.
+ *
+ * @connexum/ai-governance
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureDirAsync = ensureDirAsync;
+exports.appendJsonlAsync = appendJsonlAsync;
+exports.readJsonlAsync = readJsonlAsync;
+exports.loadJsonAsync = loadJsonAsync;
+exports.saveJsonAsync = saveJsonAsync;
+exports.sha256FileAsync = sha256FileAsync;
+exports.readFromOffsetAsync = readFromOffsetAsync;
+exports.readLastLinesAsync = readLastLinesAsync;
+exports.fileExistsAsync = fileExistsAsync;
+exports.fileStatsAsync = fileStatsAsync;
+const fs = __importStar(require("fs"));
+const fsp = __importStar(require("fs/promises"));
+const path = __importStar(require("path"));
+const crypto = __importStar(require("crypto"));
+/**
+ * Ensure a directory exists (async).
+ */
+async function ensureDirAsync(dir) {
+    try {
+        await fsp.mkdir(dir, { recursive: true });
+    }
+    catch (err) {
+        if (err.code !== 'EEXIST')
+            throw err;
+    }
+}
+/**
+ * Append a JSON line to a JSONL file (async).
+ */
+async function appendJsonlAsync(filePath, data) {
+    await ensureDirAsync(path.dirname(filePath));
+    await fsp.appendFile(filePath, JSON.stringify(data) + '\n');
+}
+/**
+ * Read all lines from a JSONL file (async).
+ */
+async function readJsonlAsync(filePath) {
+    try {
+        const content = await fsp.readFile(filePath, 'utf-8');
+        return content
+            .trim()
+            .split('\n')
+            .filter(Boolean)
+            .map(line => {
+            try {
+                return JSON.parse(line);
+            }
+            catch {
+                return null;
+            }
+        })
+            .filter((item) => item !== null);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return [];
+        throw err;
+    }
+}
+/**
+ * Load a JSON file (async).
+ */
+async function loadJsonAsync(filePath) {
+    try {
+        const content = await fsp.readFile(filePath, 'utf-8');
+        return JSON.parse(content);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Save a JSON file (async, atomic via temp file + rename).
+ */
+async function saveJsonAsync(filePath, data) {
+    await ensureDirAsync(path.dirname(filePath));
+    const tmpFile = filePath + `.tmp.${process.pid}`;
+    try {
+        await fsp.writeFile(tmpFile, JSON.stringify(data, null, 2));
+        await fsp.rename(tmpFile, filePath);
+    }
+    catch (err) {
+        // Cleanup temp file on failure
+        try {
+            await fsp.unlink(tmpFile);
+        }
+        catch { /* ignore */ }
+        throw err;
+    }
+}
+/**
+ * Compute SHA-256 hash of a file (async, streaming).
+ */
+async function sha256FileAsync(filePath) {
+    return new Promise((resolve, reject) => {
+        const hash = crypto.createHash('sha256');
+        const stream = fs.createReadStream(filePath);
+        stream.on('data', (chunk) => hash.update(chunk));
+        stream.on('end', () => resolve(hash.digest('hex')));
+        stream.on('error', reject);
+    });
+}
+/**
+ * Read new bytes from a file starting at offset (async).
+ * Returns the new content and the new offset.
+ */
+async function readFromOffsetAsync(filePath, offset) {
+    const handle = await fsp.open(filePath, 'r');
+    try {
+        const stat = await handle.stat();
+        if (stat.size <= offset) {
+            return { content: '', newOffset: offset };
+        }
+        const buf = Buffer.alloc(stat.size - offset);
+        await handle.read(buf, 0, buf.length, offset);
+        return {
+            content: buf.toString('utf-8'),
+            newOffset: stat.size,
+        };
+    }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * Read the last N lines from a file (async).
+ */
+async function readLastLinesAsync(filePath, n) {
+    try {
+        const content = await fsp.readFile(filePath, 'utf-8');
+        const lines = content.trim().split('\n').filter(Boolean);
+        return lines.slice(-n);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return [];
+        throw err;
+    }
+}
+/**
+ * Check if a file exists (async).
+ */
+async function fileExistsAsync(filePath) {
+    try {
+        await fsp.access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Get file stats (async). Returns null if file doesn't exist.
+ */
+async function fileStatsAsync(filePath) {
+    try {
+        return await fsp.stat(filePath);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=async-io.js.map

package/dist/util/async-io.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"async-io.js","sourceRoot":"","sources":["../../src/util/async-io.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUH,wCAMC;AAKD,4CAGC;AAKD,wCAeC;AAKD,sCAOC;AAKD,sCAYC;AAKD,0CASC;AAMD,kDAuBC;AAKD,gDASC;AAKD,0CAOC;AAKD,wCAMC;AAvJD,uCAAyB;AACzB,iDAAmC;AACnC,2CAA6B;AAC7B,+CAAiC;AAEjC;;GAEG;AACI,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,IAAa;IACpE,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7C,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,cAAc,CAAc,QAAgB;IAChE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACtD,OAAO,OAAO;aACX,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,IAAI,CAAC,EAAE;YACV,IAAI,CAAC;gBAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,IAAI,CAAC;YAAC,CAAC;QACzD,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,IAAI,EAAa,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAChE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,aAAa,CAAc,QAAgB;IAC/D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,IAAa;IACjE,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,QAAQ,GAAG,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IAEjD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+BAA+B;QAC/B,IAAI,CAAC;YAAC,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACzD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,eAAe,CAAC,QAAgB;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAE7C,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAEjC,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;YACxB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC5C,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAE9C,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC9B,SAAS,EAAE,IAAI,CAAC,IAAI;SACrB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,CAAS;IAClE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAChE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,eAAe,CAAC,QAAgB;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,cAAc,CAAC,QAAgB;IACnD,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/util/fs.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Shared filesystem utilities.
+ *
+ * Eliminates duplication of ensureDir, sha256, appendJsonl, loadJson, saveJson
+ * across all modules.
+ *
+ * @connexum/ai-governance
+ */
+/**
+ * Ensure a directory exists, creating it recursively if needed.
+ */
+export declare function ensureDir(dir: string): void;
+/**
+ * Compute SHA-256 hash of a file's contents.
+ */
+export declare function sha256File(filePath: string): string;
+/**
+ * Compute SHA-256 hash of a string or buffer.
+ */
+export declare function sha256(input: string | Buffer): string;
+/**
+ * Append a JSON object as a line to a JSONL file.
+ * Creates the file and parent directories if they don't exist.
+ */
+export declare function appendJsonl(filePath: string, data: Record<string, unknown>): void;
+/**
+ * Result type for a single JSONL line parse attempt.
+ * SYSTEMIC-L2: replaces `null as unknown as T` cast with an explicit
+ * discriminated union so callers cannot silently swallow parse errors.
+ */
+export type JsonlParseResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    error: 'not-found' | 'parse-error' | 'io-error';
+    message: string;
+};
+/**
+ * Parse a single line from a JSONL file.
+ * Returns a discriminated union so callers must explicitly handle failures.
+ */
+export declare function parseJsonlLine<T = Record<string, unknown>>(line: string): JsonlParseResult<T>;
+/**
+ * Read all lines from a JSONL file, parsing each as JSON.
+ * Returns empty array if file doesn't exist or is empty.
+ *
+ * SYSTEMIC-L2: Lines that fail JSON.parse are silently skipped to preserve
+ * backwards-compatible return type (T[]). Use `readJsonlWithResults` if
+ * you need to detect and handle parse failures explicitly.
+ */
+export declare function readJsonl<T = Record<string, unknown>>(filePath: string): T[];
+/**
+ * SYSTEMIC-L2: Variant of readJsonl that surfaces parse results explicitly.
+ * Returns one JsonlParseResult per non-empty line. Callers receive full
+ * visibility into parse failures without silent data loss.
+ *
+ * Use this wherever a malformed entry is a meaningful signal (e.g., WAL
+ * replay, audit log ingestion, compliance record loading).
+ */
+export declare function readJsonlWithResults<T = Record<string, unknown>>(filePath: string): JsonlParseResult<T>[];
+/**
+ * Load and parse a JSON file. Returns null if not found or invalid.
+ */
+export declare function loadJson<T = Record<string, unknown>>(filePath: string): T | null;
+/**
+ * Save an object as a formatted JSON file.
+ * Creates parent directories if needed.
+ */
+export declare function saveJson(filePath: string, data: unknown): void;
+/**
+ * Safely read the last N lines from a file without loading the entire file.
+ * Falls back to full read for small files.
+ */
+export declare function readLastLines(filePath: string, n: number): string[];
+/**
+ * Read new bytes from a file starting at a given offset.
+ * Returns the new content and updated offset.
+ */
+export declare function readFromOffset(filePath: string, offset: number): {
+    content: string;
+    newOffset: number;
+};
+//# sourceMappingURL=fs.d.ts.map

package/dist/util/fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../src/util/fs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH;;GAEG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAI3C;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAErD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAGjF;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACtB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,WAAW,GAAG,aAAa,GAAG,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpF;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAM7F;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,CAAC,EAAE,CAoB5E;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9D,QAAQ,EAAE,MAAM,GACf,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAavB;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI,CAQhF;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAG9D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAWnE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAgBvG"}