@dsh-enhanced/assistant-policy 0.1.3

package/lib/index.js

@@ -0,0 +1,16 @@
+import { AssistantPolicyService, Config } from './service.js';
+import { version } from './version.js';
+export const name = 'dsh-enhanced-assistant-policy';
+export { AssistantPolicyService, Config, version };
+export { APPROVAL_REVIEWERS, approvalReviewerOf, foldApprovalReviewer, getApprovalReviewer, setApprovalReviewer, } from './approval-reviewer.js';
+export { waitForApprovalReviewerSessionEventReady } from './session-event-registration.js';
+export { isAutoReviewEscalation } from './auto-review.js';
+export { AUTO_REVIEW_APPROVAL_REASON, HUMAN_APPROVAL_REASON } from './tool-risk.js';
+export { APPROVAL_DISPLAY_BUDGET } from './ledger.js';
+export { ApprovalSettlementConflict, validateApprovalSettlement } from './settlement.js';
+export * from './types.js';
+export function apply(ctx, config) {
+    new AssistantPolicyService(ctx, config);
+}
+export default AssistantPolicyService;
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,MAAM,CAAC,MAAM,IAAI,GAAG,+BAA+B,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AAClD,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAA;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEzD,OAAO,EAAE,2BAA2B,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAEnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAA;AAwBxF,cAAc,YAAY,CAAA;AAE1B,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAAqC;IACvE,IAAI,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AACzC,CAAC;AAED,eAAe,sBAAsB,CAAA"}

package/lib/ledger.d.ts

@@ -0,0 +1,253 @@
+export type PolicyLedgerErrorCode = 'budget-exhausted' | 'idempotency-conflict' | 'invalid-input' | 'invalid-path' | 'invalid-state' | 'not-found' | 'schema-too-new' | 'unauthorized' | 'version-conflict';
+export declare class PolicyLedgerError extends Error {
+    readonly code: PolicyLedgerErrorCode;
+    constructor(code: PolicyLedgerErrorCode, message: string);
+}
+export interface PolicyLedgerOptions {
+    path: string;
+    now?: () => number;
+}
+/** Shared byte contract for Policy, Delivery, and channel approval rendering. */
+export declare const APPROVAL_DISPLAY_BUDGET: Readonly<{
+    maxTextBytes: number;
+    maxSummaryBytes: 120;
+    renderingReserveBytes: number;
+    maxDiffBytes: number;
+}>;
+export interface BudgetReservationInput {
+    scope: string;
+    metric: string;
+    limit: number;
+    amount: number;
+    periodMs: number;
+    idempotencyKey: string;
+}
+export interface BudgetReservationResult {
+    reservationId: string;
+    status: 'finalized' | 'released' | 'reserved';
+    periodStart: number;
+    remaining: number;
+    replayed: boolean;
+}
+export interface EmergencyStopState {
+    enabled: boolean;
+    reason: string | undefined;
+    actor: string | undefined;
+    updatedAt: number | undefined;
+    version: number;
+}
+export interface ApprovalProposalInput {
+    idempotencyKey: string;
+    requester: string;
+    principal: string;
+    action: string;
+    resource: {
+        kind: string;
+        id: string;
+    };
+    diff: string;
+    summary: string;
+    ttlMs: number;
+    dispatch?: Readonly<ApprovalDispatchRoute>;
+}
+/**
+ * Durable-domain creation input with an absolute deadline. Unlike `ttlMs`, the
+ * deadline cannot move forward when a process restarts or loses a cross-database
+ * commit acknowledgement.
+ */
+export interface ApprovalProposalRecoveryInput {
+    idempotencyKey: string;
+    requester: string;
+    principal: string;
+    action: string;
+    resource: {
+        kind: string;
+        id: string;
+    };
+    diff: string;
+    summary: string;
+    notAfter: number;
+    dispatch?: Readonly<ApprovalDispatchRoute>;
+}
+export interface ApprovalDispatchRoute {
+    sourceId: string;
+    bindingId: string;
+    workspace: string;
+    principal: string;
+}
+export type ApprovalProposalStatus = 'approved' | 'expired' | 'pending' | 'rejected';
+export interface ApprovalProposalResult {
+    proposalId: string;
+    status: ApprovalProposalStatus;
+    diffHash: string;
+    expiresAt: number;
+    version: number;
+    replayed: boolean;
+}
+export type ApprovalProposalRecoveryResult = Readonly<{
+    kind: 'proposal';
+    proposal: ApprovalProposalResult;
+}> | Readonly<{
+    kind: 'abandoned';
+    idempotencyKey: string;
+    notAfter: number;
+    abandonedAt: number;
+    replayed: boolean;
+}>;
+export interface ApprovalDecisionInput {
+    proposalId: string;
+    principal: string;
+    expectedVersion: number;
+    decision: 'approved' | 'rejected';
+    reason: string;
+}
+/**
+ * Terminal-decision snapshot of one proposal, exposed so the domain that owns the
+ * pending operation can discover the decision and commit it through its own gate.
+ * Policy never calls back into a domain, so this read seam is the only supported
+ * way to close that loop.
+ */
+export interface ApprovalProposalSnapshot {
+    proposalId: string;
+    requester: string;
+    principal: string;
+    action: string;
+    resource: {
+        kind: string;
+        id: string;
+    };
+    summary: string;
+    status: ApprovalProposalStatus;
+    diffHash: string;
+    expiresAt: number;
+    version: number;
+    decidedBy: string | undefined;
+    decisionReason: string | undefined;
+}
+/**
+ * Exact, authority-scoped identity used by a domain to recover a proposal whose
+ * Policy commit may have succeeded before the domain persisted its proposal ID.
+ * This lookup is deliberately read-only and does not accept proposal content or
+ * TTL, so it can never create, replay, or extend a proposal.
+ */
+export interface ApprovalProposalLookupInput {
+    idempotencyKey: string;
+    requester: string;
+    principal: string;
+    action: string;
+    resource: {
+        kind: string;
+        id: string;
+    };
+}
+export type ApprovalDispatchState = 'enqueued' | 'pending';
+/** Stable high-water mark for a pending-dispatch scan. */
+export interface ApprovalDispatchCursor {
+    createdAt: number;
+    proposalId: string;
+}
+/**
+ * Immutable, policy-derived payload and route for one durable approval delivery.
+ * Callers can choose when to enqueue it, but cannot substitute display content.
+ */
+export interface ApprovalDispatchSnapshot {
+    proposalId: string;
+    sourceId: string;
+    bindingId: string;
+    workspace: string;
+    principal: string;
+    requester: string;
+    action: string;
+    resource: {
+        kind: string;
+        id: string;
+    };
+    summary: string;
+    diff: string;
+    diffHash: string;
+    payloadHash: string;
+    expiresAt: number;
+    proposalVersion: number;
+    state: ApprovalDispatchState;
+    createdAt: number;
+    enqueuedAt: number | undefined;
+    version: number;
+}
+export interface ApprovalDispatchResult {
+    proposalId: string;
+    state: 'enqueued';
+    payloadHash: string;
+    enqueuedAt: number;
+    version: number;
+    replayed: boolean;
+}
+export interface AuditInput {
+    actor: string;
+    action: string;
+    resource: {
+        kind: string;
+        id: string;
+    };
+    outcome: string;
+    reasonCode: string;
+    details: unknown;
+}
+export interface AuditEvent {
+    sequence: number;
+    eventId: string;
+    occurredAt: number;
+    actor: string;
+    action: string;
+    resourceKind: string;
+    resourceHash: string;
+    outcome: string;
+    reasonCode: string;
+    details: unknown;
+}
+export declare class PolicyLedger {
+    #private;
+    constructor(options: PolicyLedgerOptions);
+    close(): void;
+    reserve(input: BudgetReservationInput): BudgetReservationResult;
+    finalize(reservationId: string, actualAmount: number): BudgetReservationResult;
+    release(reservationId: string): BudgetReservationResult;
+    getEmergencyStop(): EmergencyStopState;
+    setEmergencyStop(input: {
+        enabled: boolean;
+        actor: string;
+        reason: string;
+    }): EmergencyStopState;
+    propose(input: ApprovalProposalInput): ApprovalProposalResult;
+    /**
+     * Atomically recover an existing exact proposal, create it under an immutable
+     * absolute deadline, or permanently abandon the idempotency key after that
+     * deadline. `BEGIN IMMEDIATE` serializes this decision across Policy processes,
+     * closing the lookup-then-create orphan-card race.
+     */
+    recoverOrCreateProposal(input: ApprovalProposalRecoveryInput): ApprovalProposalRecoveryResult;
+    decideProposal(input: ApprovalDecisionInput): ApprovalProposalResult;
+    /**
+     * Read one proposal's current status without deciding it. A domain reconciler
+     * uses this to learn that its own pending operation was already approved or
+     * rejected elsewhere, then commits that outcome itself.
+     */
+    getProposal(proposalId: string): ApprovalProposalSnapshot | undefined;
+    /**
+     * Recover an existing proposal by its immutable scoped idempotency identity.
+     * A mismatch is indistinguishable from absence; callers may subsequently try
+     * `propose`, whose normal idempotency conflict check remains fail-closed.
+     */
+    getProposalByIdempotencyKey(input: ApprovalProposalLookupInput): ApprovalProposalSnapshot | undefined;
+    listPendingApprovalDispatches(limit?: number, after?: Readonly<ApprovalDispatchCursor>): ApprovalDispatchSnapshot[];
+    markApprovalDispatchEnqueued(proposalId: string, expectedVersion: number): ApprovalDispatchResult;
+    expireProposals(limit?: number): number;
+    appendAudit(input: AuditInput): AuditEvent;
+    queryAudit(options?: {
+        afterSequence?: number;
+        limit?: number;
+    }): AuditEvent[];
+    health(): {
+        lastAuditSequence: number;
+    };
+}
+//# sourceMappingURL=ledger.d.ts.map

package/lib/ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../src/ledger.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,qBAAqB,GAC7B,kBAAkB,GAClB,sBAAsB,GACtB,eAAe,GACf,cAAc,GACd,eAAe,GACf,WAAW,GACX,gBAAgB,GAChB,cAAc,GACd,kBAAkB,CAAA;AAEtB,qBAAa,iBAAkB,SAAQ,KAAK;IAC9B,QAAQ,CAAC,IAAI,EAAE,qBAAqB;gBAA3B,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM;CAIlE;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED,iFAAiF;AACjF,eAAO,MAAM,uBAAuB;;;;;EAKlC,CAAA;AAEF,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,WAAW,GAAG,UAAU,GAAG,UAAU,CAAA;IAC7C,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1B,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,QAAQ,CAAC,qBAAqB,CAAC,CAAA;CAC3C;AAED;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,QAAQ,CAAC,qBAAqB,CAAC,CAAA;CAC3C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAA;AAEpF,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,sBAAsB,CAAA;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,MAAM,8BAA8B,GACtC,QAAQ,CAAC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,sBAAsB,CAAA;CAAE,CAAC,GAChE,QAAQ,CAAC;IACP,IAAI,EAAE,WAAW,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,OAAO,CAAA;CAClB,CAAC,CAAA;AAEN,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,eAAe,EAAE,MAAM,CAAA;IACvB,QAAQ,EAAE,UAAU,GAAG,UAAU,CAAA;IACjC,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACtC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,sBAAsB,CAAA;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B,cAAc,EAAE,MAAM,GAAG,SAAS,CAAA;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B;IAC1C,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CACvC;AAED,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG,SAAS,CAAA;AAE1D,0DAA0D;AAC1D,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACtC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,eAAe,EAAE,MAAM,CAAA;IACvB,KAAK,EAAE,qBAAqB,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,UAAU,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACtC,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,OAAO,CAAA;CACjB;AAgKD,qBAAa,YAAY;;gBAKX,OAAO,EAAE,mBAAmB;IAYxC,KAAK,IAAI,IAAI;IAuCb,OAAO,CAAC,KAAK,EAAE,sBAAsB,GAAG,uBAAuB;IAmF/D,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,uBAAuB;IAmC9E,OAAO,CAAC,aAAa,EAAE,MAAM,GAAG,uBAAuB;IAiCvD,gBAAgB,IAAI,kBAAkB;IAsBtC,gBAAgB,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,kBAAkB;IAgLhG,OAAO,CAAC,KAAK,EAAE,qBAAqB,GAAG,sBAAsB;IA8B7D;;;;;OAKG;IACH,uBAAuB,CAAC,KAAK,EAAE,6BAA6B,GAAG,8BAA8B;IAgE7F,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,sBAAsB;IA8CpE;;;;OAIG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS;IAyBrE;;;;OAIG;IACH,2BAA2B,CAAC,KAAK,EAAE,2BAA2B,GAAG,wBAAwB,GAAG,SAAS;IAuCrG,6BAA6B,CAAC,KAAK,SAAM,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,GAAG,wBAAwB,EAAE;IAkChH,4BAA4B,CAC1B,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,GACtB,sBAAsB;IA2CzB,eAAe,CAAC,KAAK,SAAM,GAAG,MAAM;IAoIpC,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU;IA+C1C,UAAU,CAAC,OAAO,GAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,UAAU,EAAE;IAuClF,MAAM,IAAI;QAAE,iBAAiB,EAAE,MAAM,CAAA;KAAE;CAKxC"}