@duckcodeailabs/dql-governance 0.1.0

package/LICENSE

@@ -0,0 +1,123 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and
+distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the copyright
+owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other entities
+that control, are controlled by, or are under common control with that entity.
+For the purposes of this definition, "control" means (i) the power, direct or
+indirect, to cause the direction or management of such entity, whether by
+contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the
+outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising
+permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications, including
+but not limited to software source code, documentation source, and configuration
+files.
+
+"Object" form shall mean any form resulting from mechanical transformation or
+translation of a Source form, including but not limited to compiled object code,
+generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form, made
+available under the License, as indicated by a copyright notice that is included
+in or attached to the work.
+
+"Derivative Works" shall mean any work, whether in Source or Object form, that
+is based on (or derived from) the Work and for which the editorial revisions,
+annotations, elaborations, or other modifications represent, as a whole, an
+original work of authorship.
+
+"Contribution" shall mean any work of authorship, including the original version
+of the Work and any modifications or additions to that Work or Derivative Works
+thereof, that is intentionally submitted to Licensor for inclusion in the Work
+by the copyright owner or by an individual or Legal Entity authorized to submit
+on behalf of the copyright owner.
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on behalf
+of whom a Contribution has been received by Licensor and subsequently
+incorporated within the Work.
+
+2. Grant of Copyright License.
+
+Subject to the terms and conditions of this License, each Contributor hereby
+grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,
+irrevocable copyright license to reproduce, prepare Derivative Works of,
+publicly display, publicly perform, sublicense, and distribute the Work and such
+Derivative Works in Source or Object form.
+
+3. Grant of Patent License.
+
+Subject to the terms and conditions of this License, each Contributor hereby
+grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,
+irrevocable patent license to make, have made, use, offer to sell, sell, import,
+and otherwise transfer the Work.
+
+4. Redistribution.
+
+You may reproduce and distribute copies of the Work or Derivative Works thereof
+in any medium, with or without modifications, and in Source or Object form,
+provided that You meet the following conditions:
+
+(a) You must give any other recipients of the Work or Derivative Works a copy of
+this License; and
+
+(b) You must cause any modified files to carry prominent notices stating that
+You changed the files; and
+
+(c) You must retain, in the Source form of any Derivative Works that You
+distribute, all copyright, patent, trademark, and attribution notices from the
+Source form of the Work, excluding those notices that do not pertain to any part
+of the Derivative Works; and
+
+(d) If the Work includes a "NOTICE" text file as part of its distribution, then
+any Derivative Works that You distribute must include a readable copy of the
+attribution notices contained within such NOTICE file, excluding those notices
+that do not pertain to any part of the Derivative Works.
+
+5. Submission of Contributions.
+
+Unless You explicitly state otherwise, any Contribution intentionally submitted
+for inclusion in the Work by You to the Licensor shall be under the terms and
+conditions of this License, without any additional terms or conditions.
+
+6. Trademarks.
+
+This License does not grant permission to use the trade names, trademarks,
+service marks, or product names of the Licensor, except as required for
+reasonable and customary use in describing the origin of the Work.
+
+7. Disclaimer of Warranty.
+
+Unless required by applicable law or agreed to in writing, Licensor provides the
+Work on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+express or implied, including, without limitation, any warranties or conditions
+of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR
+PURPOSE.
+
+8. Limitation of Liability.
+
+In no event and under no legal theory, whether in tort (including negligence),
+contract, or otherwise, unless required by applicable law, shall any Contributor
+be liable to You for damages, including any direct, indirect, special,
+incidental, or consequential damages of any character arising as a result of this
+License or out of the use or inability to use the Work.
+
+9. Accepting Warranty or Additional Liability.
+
+While redistributing the Work or Derivative Works thereof, You may choose to
+offer, and charge a fee for, acceptance of support, warranty, indemnity, or
+other liability obligations and/or rights consistent with this License.
+
+END OF TERMS AND CONDITIONS

package/dist/certifier.d.ts

@@ -0,0 +1,50 @@
+import type { BlockRecord, TestResultSummary } from '@duckcodeailabs/dql-project';
+/**
+ * Certification rule that a block must pass to be certified.
+ */
+export interface CertificationRule {
+    id: string;
+    name: string;
+    description: string;
+    severity: 'error' | 'warning';
+    check: (block: BlockRecord, testResults?: TestResultSummary) => CertificationCheckResult;
+}
+export interface CertificationCheckResult {
+    passed: boolean;
+    message?: string;
+}
+export interface CertificationResult {
+    blockId: string;
+    blockName: string;
+    certified: boolean;
+    errors: Array<{
+        rule: string;
+        message: string;
+    }>;
+    warnings: Array<{
+        rule: string;
+        message: string;
+    }>;
+    checkedAt: Date;
+}
+/**
+ * Built-in certification rules.
+ */
+export declare const BUILTIN_RULES: CertificationRule[];
+export declare const PROMOTABLE_RULES: CertificationRule[];
+/**
+ * Certifier evaluates blocks against certification rules.
+ */
+export declare class Certifier {
+    private rules;
+    constructor(rules?: CertificationRule[]);
+    /**
+     * Add a custom rule.
+     */
+    addRule(rule: CertificationRule): void;
+    /**
+     * Evaluate a block against all rules.
+     */
+    evaluate(block: BlockRecord, testResults?: TestResultSummary): CertificationResult;
+}
+//# sourceMappingURL=certifier.d.ts.map

package/dist/certifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"certifier.d.ts","sourceRoot":"","sources":["../src/certifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAElF;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,KAAK,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,iBAAiB,KAAK,wBAAwB,CAAC;CAC1F;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,iBAAiB,EAuF5C,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,iBAAiB,EAsB/C,CAAC;AAEF;;GAEG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,KAAK,CAAsB;gBAEvB,KAAK,CAAC,EAAE,iBAAiB,EAAE;IAIvC;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI;IAItC;;OAEG;IACH,QAAQ,CACN,KAAK,EAAE,WAAW,EAClB,WAAW,CAAC,EAAE,iBAAiB,GAC9B,mBAAmB;CAyBvB"}

package/dist/certifier.js

@@ -0,0 +1,158 @@
+/**
+ * Built-in certification rules.
+ */
+export const BUILTIN_RULES = [
+    {
+        id: 'has-description',
+        name: 'Block has description',
+        description: 'Every block must have a non-empty description',
+        severity: 'error',
+        check: (block) => ({
+            passed: !!block.description && block.description.trim().length > 0,
+            message: block.description ? undefined : 'Missing description',
+        }),
+    },
+    {
+        id: 'has-owner',
+        name: 'Block has owner',
+        description: 'Every block must have an assigned owner',
+        severity: 'error',
+        check: (block) => ({
+            passed: !!block.owner && block.owner.trim().length > 0,
+            message: block.owner ? undefined : 'Missing owner',
+        }),
+    },
+    {
+        id: 'has-domain',
+        name: 'Block has domain',
+        description: 'Every block must belong to a domain',
+        severity: 'error',
+        check: (block) => ({
+            passed: !!block.domain && block.domain.trim().length > 0,
+            message: block.domain ? undefined : 'Missing domain',
+        }),
+    },
+    {
+        id: 'has-tags',
+        name: 'Block has tags',
+        description: 'Blocks should have at least one tag for discoverability',
+        severity: 'warning',
+        check: (block) => ({
+            passed: block.tags.length > 0,
+            message: block.tags.length > 0 ? undefined : 'No tags specified',
+        }),
+    },
+    {
+        id: 'tests-pass',
+        name: 'All tests pass',
+        description: 'Block tests must all pass for certification',
+        severity: 'error',
+        check: (_block, testResults) => {
+            if (!testResults) {
+                return { passed: false, message: 'No test results available' };
+            }
+            if (testResults.failed > 0) {
+                return {
+                    passed: false,
+                    message: `${testResults.failed} test(s) failed`,
+                };
+            }
+            return { passed: true };
+        },
+    },
+    {
+        id: 'has-tests',
+        name: 'Block has tests',
+        description: 'Blocks should have at least one test assertion',
+        severity: 'warning',
+        check: (_block, testResults) => {
+            if (!testResults || testResults.assertions.length === 0) {
+                return { passed: false, message: 'No test assertions defined' };
+            }
+            return { passed: true };
+        },
+    },
+    {
+        id: 'cost-reasonable',
+        name: 'Query cost is reasonable',
+        description: 'Estimated query cost should be below threshold',
+        severity: 'warning',
+        check: (block) => {
+            if (block.costEstimate == null)
+                return { passed: true };
+            if (block.costEstimate > 100) {
+                return {
+                    passed: false,
+                    message: `Cost estimate ${block.costEstimate} exceeds threshold of 100`,
+                };
+            }
+            return { passed: true };
+        },
+    },
+];
+export const PROMOTABLE_RULES = [
+    ...BUILTIN_RULES,
+    {
+        id: 'canonical-git-path',
+        name: 'Block is in a canonical Git path',
+        description: 'Promotable blocks must not live under draft-only paths',
+        severity: 'error',
+        check: (block) => ({
+            passed: !!block.gitPath && !block.gitPath.includes('/_drafts/') && !block.gitPath.startsWith('blocks/_drafts/'),
+            message: block.gitPath ? 'Block is still stored in a draft-only path' : 'Missing Git path',
+        }),
+    },
+    {
+        id: 'stable-version',
+        name: 'Block has a stable version',
+        description: 'Promotable blocks must have a semantic version',
+        severity: 'error',
+        check: (block) => ({
+            passed: /^\d+\.\d+\.\d+$/.test(block.version),
+            message: `Version "${block.version}" is not a stable semantic version`,
+        }),
+    },
+];
+/**
+ * Certifier evaluates blocks against certification rules.
+ */
+export class Certifier {
+    rules;
+    constructor(rules) {
+        this.rules = rules ?? BUILTIN_RULES;
+    }
+    /**
+     * Add a custom rule.
+     */
+    addRule(rule) {
+        this.rules.push(rule);
+    }
+    /**
+     * Evaluate a block against all rules.
+     */
+    evaluate(block, testResults) {
+        const errors = [];
+        const warnings = [];
+        for (const rule of this.rules) {
+            const result = rule.check(block, testResults);
+            if (!result.passed) {
+                const entry = { rule: rule.name, message: result.message ?? rule.description };
+                if (rule.severity === 'error') {
+                    errors.push(entry);
+                }
+                else {
+                    warnings.push(entry);
+                }
+            }
+        }
+        return {
+            blockId: block.id,
+            blockName: block.name,
+            certified: errors.length === 0,
+            errors,
+            warnings,
+            checkedAt: new Date(),
+        };
+    }
+}
+//# sourceMappingURL=certifier.js.map

package/dist/certifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"certifier.js","sourceRoot":"","sources":["../src/certifier.ts"],"names":[],"mappings":"AA2BA;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAwB;IAChD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EAAE,+CAA+C;QAC5D,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACjB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAClE,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB;SAC/D,CAAC;KACH;IACD;QACE,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,yCAAyC;QACtD,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACjB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YACtD,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe;SACnD,CAAC;KACH;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,qCAAqC;QAClD,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACjB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YACxD,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB;SACrD,CAAC;KACH;IACD;QACE,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,yDAAyD;QACtE,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACjB,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YAC7B,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB;SACjE,CAAC;KACH;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,6CAA6C;QAC1D,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;YAC7B,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;YACjE,CAAC;YACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,OAAO;oBACL,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,GAAG,WAAW,CAAC,MAAM,iBAAiB;iBAChD,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;KACF;IACD;QACE,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,gDAAgD;QAC7D,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;YAC7B,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;YAClE,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;KACF;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,0BAA0B;QAChC,WAAW,EAAE,gDAAgD;QAC7D,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,KAAK,CAAC,YAAY,IAAI,IAAI;gBAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACxD,IAAI,KAAK,CAAC,YAAY,GAAG,GAAG,EAAE,CAAC;gBAC7B,OAAO;oBACL,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,iBAAiB,KAAK,CAAC,YAAY,2BAA2B;iBACxE,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAwB;IACnD,GAAG,aAAa;IAChB;QACE,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,kCAAkC;QACxC,WAAW,EAAE,wDAAwD;QACrE,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACjB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC;YAC/G,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,kBAAkB;SAC3F,CAAC;KACH;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,4BAA4B;QAClC,WAAW,EAAE,gDAAgD;QAC7D,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACjB,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YAC7C,OAAO,EAAE,YAAY,KAAK,CAAC,OAAO,oCAAoC;SACvE,CAAC;KACH;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,OAAO,SAAS;IACZ,KAAK,CAAsB;IAEnC,YAAY,KAA2B;QACrC,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,aAAa,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,IAAuB;QAC7B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,QAAQ,CACN,KAAkB,EAClB,WAA+B;QAE/B,MAAM,MAAM,GAA6C,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAA6C,EAAE,CAAC;QAE9D,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnB,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC/E,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;oBAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,SAAS,EAAE,KAAK,CAAC,IAAI;YACrB,SAAS,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC9B,MAAM;YACN,QAAQ;YACR,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;IACJ,CAAC;CACF"}

package/dist/cost-estimator.d.ts

@@ -0,0 +1,24 @@
+/**
+ * CostEstimator provides heuristic query cost estimation.
+ * In production, this would integrate with database EXPLAIN plans.
+ * For now, it uses SQL analysis heuristics.
+ */
+export interface CostEstimate {
+    score: number;
+    factors: CostFactor[];
+    recommendation?: string;
+}
+export interface CostFactor {
+    name: string;
+    impact: number;
+    description: string;
+}
+export declare class CostEstimator {
+    private maxScore;
+    constructor(maxScore?: number);
+    /**
+     * Estimate the cost of a SQL query using heuristic analysis.
+     */
+    estimate(sql: string): CostEstimate;
+}
+//# sourceMappingURL=cost-estimator.d.ts.map

package/dist/cost-estimator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost-estimator.d.ts","sourceRoot":"","sources":["../src/cost-estimator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAS;gBAEb,QAAQ,SAAM;IAI1B;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY;CAiFpC"}

package/dist/cost-estimator.js

@@ -0,0 +1,85 @@
+/**
+ * CostEstimator provides heuristic query cost estimation.
+ * In production, this would integrate with database EXPLAIN plans.
+ * For now, it uses SQL analysis heuristics.
+ */
+export class CostEstimator {
+    maxScore;
+    constructor(maxScore = 100) {
+        this.maxScore = maxScore;
+    }
+    /**
+     * Estimate the cost of a SQL query using heuristic analysis.
+     */
+    estimate(sql) {
+        const normalized = sql.toUpperCase();
+        const factors = [];
+        let score = 10; // base cost
+        // Full table scan indicator
+        if (!normalized.includes('WHERE') && !normalized.includes('LIMIT')) {
+            factors.push({ name: 'no-filter', impact: 20, description: 'No WHERE clause or LIMIT — potential full table scan' });
+            score += 20;
+        }
+        // JOIN complexity
+        const joinCount = (normalized.match(/\bJOIN\b/g) || []).length;
+        if (joinCount > 0) {
+            const impact = joinCount * 8;
+            factors.push({ name: 'joins', impact, description: `${joinCount} JOIN(s) detected` });
+            score += impact;
+        }
+        // Subquery complexity
+        const subqueryCount = (normalized.match(/\bSELECT\b/g) || []).length - 1;
+        if (subqueryCount > 0) {
+            const impact = subqueryCount * 10;
+            factors.push({ name: 'subqueries', impact, description: `${subqueryCount} subquery/subqueries detected` });
+            score += impact;
+        }
+        // Window functions
+        const windowCount = (normalized.match(/\bOVER\s*\(/g) || []).length;
+        if (windowCount > 0) {
+            const impact = windowCount * 5;
+            factors.push({ name: 'window-functions', impact, description: `${windowCount} window function(s)` });
+            score += impact;
+        }
+        // DISTINCT
+        if (normalized.includes('DISTINCT')) {
+            factors.push({ name: 'distinct', impact: 5, description: 'DISTINCT requires deduplication' });
+            score += 5;
+        }
+        // GROUP BY with many columns
+        const groupByMatch = normalized.match(/GROUP\s+BY\s+(.+?)(?:HAVING|ORDER|LIMIT|$)/);
+        if (groupByMatch) {
+            const groupCols = groupByMatch[1].split(',').length;
+            if (groupCols > 3) {
+                const impact = (groupCols - 3) * 3;
+                factors.push({ name: 'high-cardinality-group', impact, description: `GROUP BY with ${groupCols} columns` });
+                score += impact;
+            }
+        }
+        // ORDER BY without LIMIT
+        if (normalized.includes('ORDER BY') && !normalized.includes('LIMIT')) {
+            factors.push({ name: 'unbounded-sort', impact: 8, description: 'ORDER BY without LIMIT — sorts entire result set' });
+            score += 8;
+        }
+        // CROSS JOIN
+        if (normalized.includes('CROSS JOIN')) {
+            factors.push({ name: 'cross-join', impact: 30, description: 'CROSS JOIN produces cartesian product' });
+            score += 30;
+        }
+        // LIKE with leading wildcard
+        if (normalized.match(/LIKE\s+'%/)) {
+            factors.push({ name: 'leading-wildcard', impact: 10, description: 'LIKE with leading wildcard prevents index usage' });
+            score += 10;
+        }
+        score = Math.min(score, this.maxScore);
+        let recommendation;
+        if (score > 70) {
+            recommendation = 'High cost query — consider adding filters, indexes, or materializing intermediate results.';
+        }
+        else if (score > 40) {
+            recommendation = 'Moderate cost — review JOINs and subqueries for optimization opportunities.';
+        }
+        return { score, factors, recommendation };
+    }
+}
+//# sourceMappingURL=cost-estimator.js.map

package/dist/cost-estimator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost-estimator.js","sourceRoot":"","sources":["../src/cost-estimator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAcH,MAAM,OAAO,aAAa;IAChB,QAAQ,CAAS;IAEzB,YAAY,QAAQ,GAAG,GAAG;QACxB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,GAAW;QAClB,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC,YAAY;QAE5B,4BAA4B;QAC5B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,sDAAsD,EAAE,CAAC,CAAC;YACrH,KAAK,IAAI,EAAE,CAAC;QACd,CAAC;QAED,kBAAkB;QAClB,MAAM,SAAS,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAC/D,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,SAAS,GAAG,CAAC,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,mBAAmB,EAAE,CAAC,CAAC;YACtF,KAAK,IAAI,MAAM,CAAC;QAClB,CAAC;QAED,sBAAsB;QACtB,MAAM,aAAa,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACzE,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,aAAa,GAAG,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,aAAa,+BAA+B,EAAE,CAAC,CAAC;YAC3G,KAAK,IAAI,MAAM,CAAC;QAClB,CAAC;QAED,mBAAmB;QACnB,MAAM,WAAW,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACpE,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,WAAW,GAAG,CAAC,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,WAAW,qBAAqB,EAAE,CAAC,CAAC;YACrG,KAAK,IAAI,MAAM,CAAC;QAClB,CAAC;QAED,WAAW;QACX,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC9F,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;QAED,6BAA6B;QAC7B,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACpF,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YACpD,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,SAAS,UAAU,EAAE,CAAC,CAAC;gBAC5G,KAAK,IAAI,MAAM,CAAC;YAClB,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACrE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC,CAAC;YACrH,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;QAED,aAAa;QACb,IAAI,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACvG,KAAK,IAAI,EAAE,CAAC;QACd,CAAC;QAED,6BAA6B;QAC7B,IAAI,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAC,CAAC;YACvH,KAAK,IAAI,EAAE,CAAC;QACd,CAAC;QAED,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEvC,IAAI,cAAkC,CAAC;QACvC,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;YACf,cAAc,GAAG,4FAA4F,CAAC;QAChH,CAAC;aAAM,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;YACtB,cAAc,GAAG,6EAA6E,CAAC;QACjG,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAC5C,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export { TestRunner } from './test-runner.js';
+export type { BlockTestAssertion, QueryExecutor } from './test-runner.js';
+export { Certifier, BUILTIN_RULES, PROMOTABLE_RULES } from './certifier.js';
+export type { CertificationRule, CertificationCheckResult, CertificationResult } from './certifier.js';
+export { CostEstimator } from './cost-estimator.js';
+export type { CostEstimate, CostFactor } from './cost-estimator.js';
+export { PolicyEngine } from './policy-engine.js';
+export type { AccessPolicy, AccessCheckResult, AccessLevel, DataClassification, UserContext, } from './policy-engine.js';
+export { MultiDomainGovernance } from './multi-domain.js';
+export type { GovernanceModel, DomainConfig, ApprovalRules, PlatformConfig, DomainSyncResult, } from './multi-domain.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE1E,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,YAAY,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAEvG,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEpE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,WAAW,EACX,kBAAkB,EAClB,WAAW,GACZ,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,YAAY,EACV,eAAe,EACf,YAAY,EACZ,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -0,0 +1,6 @@
+export { TestRunner } from './test-runner.js';
+export { Certifier, BUILTIN_RULES, PROMOTABLE_RULES } from './certifier.js';
+export { CostEstimator } from './cost-estimator.js';
+export { PolicyEngine } from './policy-engine.js';
+export { MultiDomainGovernance } from './multi-domain.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAG5E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AASlD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/multi-domain.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Multi-Domain Git Governance — matches architecture spec §8.
+ * Supports single-repo, multi-repo, and hybrid models.
+ */
+export type GovernanceModel = 'single-repo' | 'multi-repo' | 'hybrid';
+export interface DomainConfig {
+    name: string;
+    repo: string;
+    path: string;
+    owner: string;
+    approvalRules: ApprovalRules;
+    costThreshold?: number;
+    tags?: string[];
+}
+export interface ApprovalRules {
+    minReviewers: number;
+    autoCertifyOnMerge: boolean;
+    requirePassingTests: boolean;
+    requiredReviewers?: string[];
+}
+export interface PlatformConfig {
+    model: GovernanceModel;
+    coreRepo?: string;
+    domains: DomainConfig[];
+    globalRules: ApprovalRules;
+    syncSchedule?: string;
+}
+export interface DomainSyncResult {
+    domain: string;
+    repo: string;
+    blocksFound: number;
+    blocksCreated: number;
+    blocksUpdated: number;
+    blocksUnchanged: number;
+    errors: string[];
+}
+/**
+ * MultiDomainGovernance manages governance across multiple repos/domains.
+ */
+export declare class MultiDomainGovernance {
+    private config;
+    constructor(config: PlatformConfig);
+    getModel(): GovernanceModel;
+    getDomains(): DomainConfig[];
+    getDomain(name: string): DomainConfig | undefined;
+    addDomain(domain: DomainConfig): void;
+    removeDomain(name: string): void;
+    /**
+     * Get the effective approval rules for a domain.
+     * Domain rules override global rules where specified.
+     */
+    getEffectiveRules(domainName: string): ApprovalRules;
+    /**
+     * Validate that a block meets the governance requirements for its domain.
+     */
+    validateBlock(blockDomain: string, block: {
+        hasTests: boolean;
+        reviewerCount: number;
+        reviewers: string[];
+        testsPassing: boolean;
+    }): {
+        valid: boolean;
+        violations: string[];
+    };
+    /**
+     * Generate a sync plan for all domains.
+     */
+    getSyncPlan(): Array<{
+        domain: string;
+        repo: string;
+        path: string;
+    }>;
+}
+//# sourceMappingURL=multi-domain.d.ts.map

package/dist/multi-domain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-domain.d.ts","sourceRoot":"","sources":["../src/multi-domain.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,YAAY,GAAG,QAAQ,CAAC;AAEtE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,aAAa,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,WAAW,EAAE,aAAa,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAiB;gBAEnB,MAAM,EAAE,cAAc;IAIlC,QAAQ,IAAI,eAAe;IAI3B,UAAU,IAAI,YAAY,EAAE;IAI5B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAIjD,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IASrC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIhC;;;OAGG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa;IAepD;;OAEG;IACH,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE;QACxC,QAAQ,EAAE,OAAO,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,YAAY,EAAE,OAAO,CAAC;KACvB,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE;IA0B5C;;OAEG;IACH,WAAW,IAAI,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAOrE"}

package/dist/multi-domain.js

@@ -0,0 +1,86 @@
+/**
+ * Multi-Domain Git Governance — matches architecture spec §8.
+ * Supports single-repo, multi-repo, and hybrid models.
+ */
+/**
+ * MultiDomainGovernance manages governance across multiple repos/domains.
+ */
+export class MultiDomainGovernance {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    getModel() {
+        return this.config.model;
+    }
+    getDomains() {
+        return [...this.config.domains];
+    }
+    getDomain(name) {
+        return this.config.domains.find((d) => d.name === name);
+    }
+    addDomain(domain) {
+        const existing = this.config.domains.findIndex((d) => d.name === domain.name);
+        if (existing >= 0) {
+            this.config.domains[existing] = domain;
+        }
+        else {
+            this.config.domains.push(domain);
+        }
+    }
+    removeDomain(name) {
+        this.config.domains = this.config.domains.filter((d) => d.name !== name);
+    }
+    /**
+     * Get the effective approval rules for a domain.
+     * Domain rules override global rules where specified.
+     */
+    getEffectiveRules(domainName) {
+        const domain = this.getDomain(domainName);
+        if (!domain)
+            return { ...this.config.globalRules };
+        return {
+            minReviewers: Math.max(domain.approvalRules.minReviewers, this.config.globalRules.minReviewers),
+            autoCertifyOnMerge: domain.approvalRules.autoCertifyOnMerge && this.config.globalRules.autoCertifyOnMerge,
+            requirePassingTests: domain.approvalRules.requirePassingTests || this.config.globalRules.requirePassingTests,
+            requiredReviewers: [
+                ...(this.config.globalRules.requiredReviewers ?? []),
+                ...(domain.approvalRules.requiredReviewers ?? []),
+            ],
+        };
+    }
+    /**
+     * Validate that a block meets the governance requirements for its domain.
+     */
+    validateBlock(blockDomain, block) {
+        const rules = this.getEffectiveRules(blockDomain);
+        const violations = [];
+        if (rules.requirePassingTests && !block.testsPassing) {
+            violations.push('Block tests must pass before certification');
+        }
+        if (!block.hasTests && rules.requirePassingTests) {
+            violations.push('Block must have at least one test');
+        }
+        if (block.reviewerCount < rules.minReviewers) {
+            violations.push(`Requires ${rules.minReviewers} reviewer(s), got ${block.reviewerCount}`);
+        }
+        if (rules.requiredReviewers && rules.requiredReviewers.length > 0) {
+            const missing = rules.requiredReviewers.filter((r) => !block.reviewers.includes(r));
+            if (missing.length > 0) {
+                violations.push(`Missing required reviewer(s): ${missing.join(', ')}`);
+            }
+        }
+        return { valid: violations.length === 0, violations };
+    }
+    /**
+     * Generate a sync plan for all domains.
+     */
+    getSyncPlan() {
+        return this.config.domains.map((d) => ({
+            domain: d.name,
+            repo: d.repo,
+            path: d.path,
+        }));
+    }
+}
+//# sourceMappingURL=multi-domain.js.map

package/dist/multi-domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-domain.js","sourceRoot":"","sources":["../src/multi-domain.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAuCH;;GAEG;AACH,MAAM,OAAO,qBAAqB;IACxB,MAAM,CAAiB;IAE/B,YAAY,MAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED,UAAU;QACR,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,SAAS,CAAC,MAAoB;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9E,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,YAAY,CAAC,IAAY;QACvB,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC3E,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,UAAkB;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAEnD,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC;YAC/F,kBAAkB,EAAE,MAAM,CAAC,aAAa,CAAC,kBAAkB,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB;YACzG,mBAAmB,EAAE,MAAM,CAAC,aAAa,CAAC,mBAAmB,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,mBAAmB;YAC5G,iBAAiB,EAAE;gBACjB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,iBAAiB,IAAI,EAAE,CAAC;gBACpD,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,iBAAiB,IAAI,EAAE,CAAC;aAClD;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,WAAmB,EAAE,KAKlC;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YACrD,UAAU,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;YACjD,UAAU,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;YAC7C,UAAU,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,YAAY,qBAAqB,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,MAAM,OAAO,GAAG,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACpF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,UAAU,CAAC,IAAI,CAAC,iCAAiC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,MAAM,EAAE,CAAC,CAAC,IAAI;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}

package/dist/policy-engine.d.ts

@@ -0,0 +1,48 @@
+/**
+ * PolicyEngine enforces access policies and data classification rules.
+ */
+export type DataClassification = 'public' | 'internal' | 'confidential' | 'restricted';
+export type AccessLevel = 'read' | 'write' | 'execute' | 'admin';
+export interface AccessPolicy {
+    id: string;
+    name: string;
+    description: string;
+    /** Domain this policy applies to, or '*' for all */
+    domain: string;
+    /** Minimum data classification level required */
+    minClassification: DataClassification;
+    /** Roles that are granted access */
+    allowedRoles: string[];
+    /** Specific users granted access (overrides roles) */
+    allowedUsers: string[];
+    /** Access level granted */
+    accessLevel: AccessLevel;
+    enabled: boolean;
+}
+export interface AccessCheckResult {
+    allowed: boolean;
+    reason?: string;
+    matchedPolicy?: string;
+}
+export interface UserContext {
+    userId: string;
+    roles: string[];
+    department?: string;
+}
+export declare class PolicyEngine {
+    private policies;
+    constructor(policies?: AccessPolicy[]);
+    addPolicy(policy: AccessPolicy): void;
+    removePolicy(id: string): void;
+    listPolicies(): AccessPolicy[];
+    /**
+     * Check if a user can access a block in a given domain with a given classification.
+     */
+    checkAccess(user: UserContext, domain: string, classification: DataClassification, requiredLevel?: AccessLevel): AccessCheckResult;
+    /**
+     * Get the effective classification for a set of table/column references.
+     * In production, this would query a data catalog.
+     */
+    classifyData(tables: string[], classificationMap: Record<string, DataClassification>): DataClassification;
+}
+//# sourceMappingURL=policy-engine.d.ts.map

package/dist/policy-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-engine.d.ts","sourceRoot":"","sources":["../src/policy-engine.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,UAAU,GAAG,cAAc,GAAG,YAAY,CAAC;AAEvF,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC;AAEjE,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,oCAAoC;IACpC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,sDAAsD;IACtD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,2BAA2B;IAC3B,WAAW,EAAE,WAAW,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AASD,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAsB;gBAE1B,QAAQ,CAAC,EAAE,YAAY,EAAE;IAIrC,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAIrC,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAI9B,YAAY,IAAI,YAAY,EAAE;IAI9B;;OAEG;IACH,WAAW,CACT,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,kBAAkB,EAClC,aAAa,GAAE,WAAoB,GAClC,iBAAiB;IAyCpB;;;OAGG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,GAAG,kBAAkB;CAU1G"}

package/dist/policy-engine.js

@@ -0,0 +1,85 @@
+/**
+ * PolicyEngine enforces access policies and data classification rules.
+ */
+const CLASSIFICATION_RANK = {
+    public: 0,
+    internal: 1,
+    confidential: 2,
+    restricted: 3,
+};
+export class PolicyEngine {
+    policies = [];
+    constructor(policies) {
+        if (policies)
+            this.policies = [...policies];
+    }
+    addPolicy(policy) {
+        this.policies.push(policy);
+    }
+    removePolicy(id) {
+        this.policies = this.policies.filter((p) => p.id !== id);
+    }
+    listPolicies() {
+        return [...this.policies];
+    }
+    /**
+     * Check if a user can access a block in a given domain with a given classification.
+     */
+    checkAccess(user, domain, classification, requiredLevel = 'read') {
+        // Find applicable policies (domain match or wildcard)
+        const applicable = this.policies.filter((p) => p.enabled && (p.domain === '*' || p.domain === domain));
+        if (applicable.length === 0) {
+            // No policies = default allow (open by default)
+            return { allowed: true, reason: 'No policies restrict this domain' };
+        }
+        // Check each policy
+        for (const policy of applicable) {
+            // Check classification level
+            if (CLASSIFICATION_RANK[classification] < CLASSIFICATION_RANK[policy.minClassification]) {
+                continue; // This policy doesn't apply to this classification level
+            }
+            // Check if user is explicitly allowed
+            if (policy.allowedUsers.includes(user.userId)) {
+                if (accessLevelSufficient(policy.accessLevel, requiredLevel)) {
+                    return { allowed: true, matchedPolicy: policy.id };
+                }
+            }
+            // Check if user has an allowed role
+            const hasRole = user.roles.some((r) => policy.allowedRoles.includes(r));
+            if (hasRole) {
+                if (accessLevelSufficient(policy.accessLevel, requiredLevel)) {
+                    return { allowed: true, matchedPolicy: policy.id };
+                }
+            }
+        }
+        // If we have policies but none matched, deny
+        return {
+            allowed: false,
+            reason: `No policy grants ${requiredLevel} access to domain "${domain}" with classification "${classification}" for user "${user.userId}"`,
+        };
+    }
+    /**
+     * Get the effective classification for a set of table/column references.
+     * In production, this would query a data catalog.
+     */
+    classifyData(tables, classificationMap) {
+        let highest = 'public';
+        for (const table of tables) {
+            const cls = classificationMap[table];
+            if (cls && CLASSIFICATION_RANK[cls] > CLASSIFICATION_RANK[highest]) {
+                highest = cls;
+            }
+        }
+        return highest;
+    }
+}
+const ACCESS_LEVEL_RANK = {
+    read: 0,
+    write: 1,
+    execute: 2,
+    admin: 3,
+};
+function accessLevelSufficient(granted, required) {
+    return ACCESS_LEVEL_RANK[granted] >= ACCESS_LEVEL_RANK[required];
+}
+//# sourceMappingURL=policy-engine.js.map

package/dist/policy-engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-engine.js","sourceRoot":"","sources":["../src/policy-engine.ts"],"names":[],"mappings":"AAAA;;GAEG;AAmCH,MAAM,mBAAmB,GAAuC;IAC9D,MAAM,EAAE,CAAC;IACT,QAAQ,EAAE,CAAC;IACX,YAAY,EAAE,CAAC;IACf,UAAU,EAAE,CAAC;CACd,CAAC;AAEF,MAAM,OAAO,YAAY;IACf,QAAQ,GAAmB,EAAE,CAAC;IAEtC,YAAY,QAAyB;QACnC,IAAI,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED,SAAS,CAAC,MAAoB;QAC5B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,YAAY,CAAC,EAAU;QACrB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,YAAY;QACV,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,WAAW,CACT,IAAiB,EACjB,MAAc,EACd,cAAkC,EAClC,gBAA6B,MAAM;QAEnC,sDAAsD;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAC9D,CAAC;QAEF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,gDAAgD;YAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;QACvE,CAAC;QAED,oBAAoB;QACpB,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;YAChC,6BAA6B;YAC7B,IAAI,mBAAmB,CAAC,cAAc,CAAC,GAAG,mBAAmB,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACxF,SAAS,CAAC,yDAAyD;YACrE,CAAC;YAED,sCAAsC;YACtC,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9C,IAAI,qBAAqB,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;oBAC7D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;gBACrD,CAAC;YACH,CAAC;YAED,oCAAoC;YACpC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACxE,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,qBAAqB,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;oBAC7D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;gBACrD,CAAC;YACH,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,oBAAoB,aAAa,sBAAsB,MAAM,0BAA0B,cAAc,eAAe,IAAI,CAAC,MAAM,GAAG;SAC3I,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,MAAgB,EAAE,iBAAqD;QAClF,IAAI,OAAO,GAAuB,QAAQ,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,GAAG,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnE,OAAO,GAAG,GAAG,CAAC;YAChB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED,MAAM,iBAAiB,GAAgC;IACrD,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;IACR,OAAO,EAAE,CAAC;IACV,KAAK,EAAE,CAAC;CACT,CAAC;AAEF,SAAS,qBAAqB,CAAC,OAAoB,EAAE,QAAqB;IACxE,OAAO,iBAAiB,CAAC,OAAO,CAAC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AACnE,CAAC"}

package/dist/test-runner.d.ts

@@ -0,0 +1,33 @@
+import type { TestResultSummary } from '@duckcodeailabs/dql-project';
+/**
+ * A block test assertion parsed from DQL `tests { assert ... }` blocks.
+ */
+export interface BlockTestAssertion {
+    name: string;
+    sql: string;
+    operator: '>' | '<' | '>=' | '<=' | '==' | '!=' | 'IN';
+    threshold: number | string | boolean | Array<number | string | boolean>;
+}
+/**
+ * QueryExecutor is an adapter interface for running SQL queries.
+ * Implementations can use DuckDB, Postgres, etc.
+ */
+export interface QueryExecutor {
+    execute(sql: string, params?: Record<string, unknown>): Promise<Record<string, unknown>[]>;
+}
+/**
+ * TestRunner executes block test assertions against a database.
+ */
+export declare class TestRunner {
+    private executor;
+    constructor(executor: QueryExecutor);
+    /**
+     * Run all assertions for a block and return a summary.
+     */
+    runTests(assertions: BlockTestAssertion[], params?: Record<string, unknown>): Promise<TestResultSummary>;
+    /**
+     * Run a single assertion.
+     */
+    private runAssertion;
+}
+//# sourceMappingURL=test-runner.d.ts.map

package/dist/test-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-runner.d.ts","sourceRoot":"","sources":["../src/test-runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAuB,MAAM,6BAA6B,CAAC;AAE1F;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,GAAG,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IACvD,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;CACzE;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;CAC5F;AAED;;GAEG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAgB;gBAEpB,QAAQ,EAAE,aAAa;IAInC;;OAEG;IACG,QAAQ,CACZ,UAAU,EAAE,kBAAkB,EAAE,EAChC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,iBAAiB,CAAC;IAgC7B;;OAEG;YACW,YAAY;CA4B3B"}

package/dist/test-runner.js

@@ -0,0 +1,124 @@
+/**
+ * TestRunner executes block test assertions against a database.
+ */
+export class TestRunner {
+    executor;
+    constructor(executor) {
+        this.executor = executor;
+    }
+    /**
+     * Run all assertions for a block and return a summary.
+     */
+    async runTests(assertions, params) {
+        const start = Date.now();
+        const results = [];
+        let passed = 0;
+        let failed = 0;
+        for (const assertion of assertions) {
+            try {
+                const result = await this.runAssertion(assertion, params);
+                results.push(result);
+                if (result.passed)
+                    passed++;
+                else
+                    failed++;
+            }
+            catch (err) {
+                results.push({
+                    name: assertion.name,
+                    passed: false,
+                    error: err instanceof Error ? err.message : String(err),
+                });
+                failed++;
+            }
+        }
+        return {
+            passed,
+            failed,
+            skipped: 0,
+            duration: Date.now() - start,
+            assertions: results,
+            runAt: new Date(),
+        };
+    }
+    /**
+     * Run a single assertion.
+     */
+    async runAssertion(assertion, params) {
+        const rows = await this.executor.execute(assertion.sql, params);
+        if (rows.length === 0) {
+            return {
+                name: assertion.name,
+                passed: false,
+                error: 'Query returned no rows',
+            };
+        }
+        // The assertion SQL should return a single scalar value
+        const firstRow = rows[0];
+        const keys = Object.keys(firstRow);
+        const rawActual = firstRow[keys[0]];
+        const comparison = compare(rawActual, assertion.operator, assertion.threshold);
+        return {
+            name: assertion.name,
+            passed: comparison.passed,
+            actual: rawActual,
+            expected: assertion.threshold,
+            error: comparison.error,
+        };
+    }
+}
+function compare(actual, op, threshold) {
+    if (op === 'IN') {
+        if (!Array.isArray(threshold)) {
+            return { passed: false, error: 'IN operator requires an array expected value' };
+        }
+        const pass = threshold.some((candidate) => candidate === actual);
+        return {
+            passed: pass,
+            error: pass ? undefined : `${String(actual)} IN ${JSON.stringify(threshold)} is false`,
+        };
+    }
+    const actualNumber = Number(actual);
+    const thresholdNumber = Number(threshold);
+    if (!Number.isFinite(actualNumber) || !Number.isFinite(thresholdNumber)) {
+        return {
+            passed: false,
+            error: `Operator '${op}' requires numeric values (actual=${String(actual)}, expected=${String(threshold)})`,
+        };
+    }
+    switch (op) {
+        case '>':
+            return {
+                passed: actualNumber > thresholdNumber,
+                error: actualNumber > thresholdNumber ? undefined : `${actualNumber} > ${thresholdNumber} is false`,
+            };
+        case '<':
+            return {
+                passed: actualNumber < thresholdNumber,
+                error: actualNumber < thresholdNumber ? undefined : `${actualNumber} < ${thresholdNumber} is false`,
+            };
+        case '>=':
+            return {
+                passed: actualNumber >= thresholdNumber,
+                error: actualNumber >= thresholdNumber ? undefined : `${actualNumber} >= ${thresholdNumber} is false`,
+            };
+        case '<=':
+            return {
+                passed: actualNumber <= thresholdNumber,
+                error: actualNumber <= thresholdNumber ? undefined : `${actualNumber} <= ${thresholdNumber} is false`,
+            };
+        case '==':
+            return {
+                passed: actualNumber === thresholdNumber,
+                error: actualNumber === thresholdNumber ? undefined : `${actualNumber} == ${thresholdNumber} is false`,
+            };
+        case '!=':
+            return {
+                passed: actualNumber !== thresholdNumber,
+                error: actualNumber !== thresholdNumber ? undefined : `${actualNumber} != ${thresholdNumber} is false`,
+            };
+        default:
+            return { passed: false, error: `Unsupported operator '${op}'` };
+    }
+}
+//# sourceMappingURL=test-runner.js.map

package/dist/test-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-runner.js","sourceRoot":"","sources":["../src/test-runner.ts"],"names":[],"mappings":"AAoBA;;GAEG;AACH,MAAM,OAAO,UAAU;IACb,QAAQ,CAAgB;IAEhC,YAAY,QAAuB;QACjC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CACZ,UAAgC,EAChC,MAAgC;QAEhC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,OAAO,GAA0B,EAAE,CAAC;QAC1C,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBAC1D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,IAAI,MAAM,CAAC,MAAM;oBAAE,MAAM,EAAE,CAAC;;oBACvB,MAAM,EAAE,CAAC;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,MAAM,EAAE,KAAK;oBACb,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;gBACH,MAAM,EAAE,CAAC;YACX,CAAC;QACH,CAAC;QAED,OAAO;YACL,MAAM;YACN,MAAM;YACN,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC5B,UAAU,EAAE,OAAO;YACnB,KAAK,EAAE,IAAI,IAAI,EAAE;SAClB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,YAAY,CACxB,SAA6B,EAC7B,MAAgC;QAEhC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAEhE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO;gBACL,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,wBAAwB;aAChC,CAAC;QACJ,CAAC;QAED,wDAAwD;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;QAE/E,OAAO;YACL,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,SAAS,CAAC,SAAS;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC;IACJ,CAAC;CACF;AAED,SAAS,OAAO,CACd,MAAe,EACf,EAAU,EACV,SAAkB;IAElB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAChB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;QAClF,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC;QACjE,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW;SACvF,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACxE,OAAO;YACL,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,aAAa,EAAE,qCAAqC,MAAM,CAAC,MAAM,CAAC,cAAc,MAAM,CAAC,SAAS,CAAC,GAAG;SAC5G,CAAC;IACJ,CAAC;IAED,QAAQ,EAAE,EAAE,CAAC;QACX,KAAK,GAAG;YACN,OAAO;gBACL,MAAM,EAAE,YAAY,GAAG,eAAe;gBACtC,KAAK,EAAE,YAAY,GAAG,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,YAAY,MAAM,eAAe,WAAW;aACpG,CAAC;QACJ,KAAK,GAAG;YACN,OAAO;gBACL,MAAM,EAAE,YAAY,GAAG,eAAe;gBACtC,KAAK,EAAE,YAAY,GAAG,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,YAAY,MAAM,eAAe,WAAW;aACpG,CAAC;QACJ,KAAK,IAAI;YACP,OAAO;gBACL,MAAM,EAAE,YAAY,IAAI,eAAe;gBACvC,KAAK,EAAE,YAAY,IAAI,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,eAAe,WAAW;aACtG,CAAC;QACJ,KAAK,IAAI;YACP,OAAO;gBACL,MAAM,EAAE,YAAY,IAAI,eAAe;gBACvC,KAAK,EAAE,YAAY,IAAI,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,eAAe,WAAW;aACtG,CAAC;QACJ,KAAK,IAAI;YACP,OAAO;gBACL,MAAM,EAAE,YAAY,KAAK,eAAe;gBACxC,KAAK,EAAE,YAAY,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,eAAe,WAAW;aACvG,CAAC;QACJ,KAAK,IAAI;YACP,OAAO;gBACL,MAAM,EAAE,YAAY,KAAK,eAAe;gBACxC,KAAK,EAAE,YAAY,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,eAAe,WAAW;aACvG,CAAC;QACJ;YACE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,GAAG,EAAE,CAAC;IACpE,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@duckcodeailabs/dql-governance",
+  "version": "0.1.0",
+  "description": "DQL Governance: block testing, certification, cost estimation, and access policies",
+  "license": "Apache-2.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/duckcode-ai/dql.git",
+    "directory": "packages/dql-governance"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@duckcodeailabs/dql-core": "0.1.0",
+    "@duckcodeailabs/dql-project": "0.1.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.7.0",
+    "vitest": "^3.0.0"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "build": "rm -rf dist tsconfig.tsbuildinfo && tsc -b",
+    "test": "vitest run --passWithNoTests",
+    "clean": "rm -rf dist tsconfig.tsbuildinfo"
+  }
+}