@enterprise-skills/orchestrator 3.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/__tests__/advisor.test.d.ts +2 -0
- package/dist/__tests__/advisor.test.d.ts.map +1 -0
- package/dist/__tests__/advisor.test.js +92 -0
- package/dist/__tests__/advisor.test.js.map +1 -0
- package/dist/__tests__/audit-logger.test.d.ts +2 -0
- package/dist/__tests__/audit-logger.test.d.ts.map +1 -0
- package/dist/__tests__/audit-logger.test.js +115 -0
- package/dist/__tests__/audit-logger.test.js.map +1 -0
- package/dist/__tests__/dag-resolver.test.d.ts +2 -0
- package/dist/__tests__/dag-resolver.test.d.ts.map +1 -0
- package/dist/__tests__/dag-resolver.test.js +297 -0
- package/dist/__tests__/dag-resolver.test.js.map +1 -0
- package/dist/__tests__/orchestrator.test.d.ts +2 -0
- package/dist/__tests__/orchestrator.test.d.ts.map +1 -0
- package/dist/__tests__/orchestrator.test.js +152 -0
- package/dist/__tests__/orchestrator.test.js.map +1 -0
- package/dist/__tests__/policy-enforcer.test.d.ts +2 -0
- package/dist/__tests__/policy-enforcer.test.d.ts.map +1 -0
- package/dist/__tests__/policy-enforcer.test.js +113 -0
- package/dist/__tests__/policy-enforcer.test.js.map +1 -0
- package/dist/__tests__/signal-router.test.d.ts +2 -0
- package/dist/__tests__/signal-router.test.d.ts.map +1 -0
- package/dist/__tests__/signal-router.test.js +96 -0
- package/dist/__tests__/signal-router.test.js.map +1 -0
- package/dist/__tests__/state-machine.test.d.ts +2 -0
- package/dist/__tests__/state-machine.test.d.ts.map +1 -0
- package/dist/__tests__/state-machine.test.js +278 -0
- package/dist/__tests__/state-machine.test.js.map +1 -0
- package/dist/advisor.d.ts +41 -0
- package/dist/advisor.d.ts.map +1 -0
- package/dist/advisor.js +268 -0
- package/dist/advisor.js.map +1 -0
- package/dist/api/handlers.d.ts +28 -0
- package/dist/api/handlers.d.ts.map +1 -0
- package/dist/api/handlers.js +305 -0
- package/dist/api/handlers.js.map +1 -0
- package/dist/api/index.d.ts +5 -0
- package/dist/api/index.d.ts.map +1 -0
- package/dist/api/index.js +20 -0
- package/dist/api/index.js.map +1 -0
- package/dist/api/routes/complete.d.ts +9 -0
- package/dist/api/routes/complete.d.ts.map +1 -0
- package/dist/api/routes/complete.js +34 -0
- package/dist/api/routes/complete.js.map +1 -0
- package/dist/api/routes/dashboard.d.ts +9 -0
- package/dist/api/routes/dashboard.d.ts.map +1 -0
- package/dist/api/routes/dashboard.js +29 -0
- package/dist/api/routes/dashboard.js.map +1 -0
- package/dist/api/routes/execute.d.ts +10 -0
- package/dist/api/routes/execute.d.ts.map +1 -0
- package/dist/api/routes/execute.js +35 -0
- package/dist/api/routes/execute.js.map +1 -0
- package/dist/api/routes/gate.d.ts +9 -0
- package/dist/api/routes/gate.d.ts.map +1 -0
- package/dist/api/routes/gate.js +34 -0
- package/dist/api/routes/gate.js.map +1 -0
- package/dist/api/routes/index.d.ts +7 -0
- package/dist/api/routes/index.d.ts.map +1 -0
- package/dist/api/routes/index.js +19 -0
- package/dist/api/routes/index.js.map +1 -0
- package/dist/api/routes/middleware.d.ts +13 -0
- package/dist/api/routes/middleware.d.ts.map +1 -0
- package/dist/api/routes/middleware.js +55 -0
- package/dist/api/routes/middleware.js.map +1 -0
- package/dist/api/routes/signal.d.ts +9 -0
- package/dist/api/routes/signal.d.ts.map +1 -0
- package/dist/api/routes/signal.js +34 -0
- package/dist/api/routes/signal.js.map +1 -0
- package/dist/api/types.d.ts +87 -0
- package/dist/api/types.d.ts.map +1 -0
- package/dist/api/types.js +3 -0
- package/dist/api/types.js.map +1 -0
- package/dist/audit-logger.d.ts +20 -0
- package/dist/audit-logger.d.ts.map +1 -0
- package/dist/audit-logger.js +125 -0
- package/dist/audit-logger.js.map +1 -0
- package/dist/builtin-triggers.d.ts +3 -0
- package/dist/builtin-triggers.d.ts.map +1 -0
- package/dist/builtin-triggers.js +235 -0
- package/dist/builtin-triggers.js.map +1 -0
- package/dist/dag-resolver.d.ts +22 -0
- package/dist/dag-resolver.d.ts.map +1 -0
- package/dist/dag-resolver.js +250 -0
- package/dist/dag-resolver.js.map +1 -0
- package/dist/hardening-sensors.d.ts +22 -0
- package/dist/hardening-sensors.d.ts.map +1 -0
- package/dist/hardening-sensors.js +135 -0
- package/dist/hardening-sensors.js.map +1 -0
- package/dist/index.d.ts +87 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +269 -0
- package/dist/index.js.map +1 -0
- package/dist/policy-enforcer.d.ts +27 -0
- package/dist/policy-enforcer.d.ts.map +1 -0
- package/dist/policy-enforcer.js +185 -0
- package/dist/policy-enforcer.js.map +1 -0
- package/dist/signal-router.d.ts +19 -0
- package/dist/signal-router.d.ts.map +1 -0
- package/dist/signal-router.js +206 -0
- package/dist/signal-router.js.map +1 -0
- package/dist/state-machine.d.ts +45 -0
- package/dist/state-machine.d.ts.map +1 -0
- package/dist/state-machine.js +300 -0
- package/dist/state-machine.js.map +1 -0
- package/dist/task-contract.d.ts +46 -0
- package/dist/task-contract.d.ts.map +1 -0
- package/dist/task-contract.js +71 -0
- package/dist/task-contract.js.map +1 -0
- package/dist/types.d.ts +167 -0
- package/dist/types.d.ts.map +1 -0
- package/dist/types.js +3 -0
- package/dist/types.js.map +1 -0
- package/package.json +29 -0
package/dist/index.js
ADDED
|
@@ -0,0 +1,269 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
3
|
+
if (k2 === undefined) k2 = k;
|
|
4
|
+
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
5
|
+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
6
|
+
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
7
|
+
}
|
|
8
|
+
Object.defineProperty(o, k2, desc);
|
|
9
|
+
}) : (function(o, m, k, k2) {
|
|
10
|
+
if (k2 === undefined) k2 = k;
|
|
11
|
+
o[k2] = m[k];
|
|
12
|
+
}));
|
|
13
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
14
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
15
|
+
}) : function(o, v) {
|
|
16
|
+
o["default"] = v;
|
|
17
|
+
});
|
|
18
|
+
var __importStar = (this && this.__importStar) || (function () {
|
|
19
|
+
var ownKeys = function(o) {
|
|
20
|
+
ownKeys = Object.getOwnPropertyNames || function (o) {
|
|
21
|
+
var ar = [];
|
|
22
|
+
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
|
|
23
|
+
return ar;
|
|
24
|
+
};
|
|
25
|
+
return ownKeys(o);
|
|
26
|
+
};
|
|
27
|
+
return function (mod) {
|
|
28
|
+
if (mod && mod.__esModule) return mod;
|
|
29
|
+
var result = {};
|
|
30
|
+
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
|
31
|
+
__setModuleDefault(result, mod);
|
|
32
|
+
return result;
|
|
33
|
+
};
|
|
34
|
+
})();
|
|
35
|
+
var __exportStar = (this && this.__exportStar) || function(m, exports) {
|
|
36
|
+
for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
|
|
37
|
+
};
|
|
38
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
39
|
+
exports.BUILTIN_TRIGGERS = exports.runHardeningSensors = exports.OrchestrationAdvisor = exports.AuditLogger = exports.PolicyEnforcer = exports.SignalRouter = exports.DagResolver = exports.StateMachine = exports.Orchestrator = void 0;
|
|
40
|
+
const path = __importStar(require("path"));
|
|
41
|
+
const fs = __importStar(require("fs"));
|
|
42
|
+
const state_machine_1 = require("./state-machine");
|
|
43
|
+
const dag_resolver_1 = require("./dag-resolver");
|
|
44
|
+
const signal_router_1 = require("./signal-router");
|
|
45
|
+
const policy_enforcer_1 = require("./policy-enforcer");
|
|
46
|
+
const audit_logger_1 = require("./audit-logger");
|
|
47
|
+
const advisor_1 = require("./advisor");
|
|
48
|
+
class Orchestrator {
|
|
49
|
+
state;
|
|
50
|
+
dag;
|
|
51
|
+
signals;
|
|
52
|
+
policy;
|
|
53
|
+
audit;
|
|
54
|
+
advisor;
|
|
55
|
+
config;
|
|
56
|
+
constructor(options) {
|
|
57
|
+
const stateDir = path.join(options.projectRoot, '.project-ai');
|
|
58
|
+
const auditLogPath = path.join(stateDir, 'orchestration-audit.jsonl');
|
|
59
|
+
this.config = {
|
|
60
|
+
project_root: options.projectRoot,
|
|
61
|
+
state_dir: stateDir,
|
|
62
|
+
audit_log_path: auditLogPath,
|
|
63
|
+
session_id: options.sessionId ?? `session-${Date.now()}`,
|
|
64
|
+
};
|
|
65
|
+
this.state = new state_machine_1.StateMachine(this.config);
|
|
66
|
+
this.dag = new dag_resolver_1.DagResolver();
|
|
67
|
+
this.signals = new signal_router_1.SignalRouter(options.triggerRegistryPath ??
|
|
68
|
+
path.join(stateDir, 'trigger-registry.yaml'));
|
|
69
|
+
this.policy = new policy_enforcer_1.PolicyEnforcer(options.policyPath);
|
|
70
|
+
this.audit = new audit_logger_1.AuditLogger(auditLogPath);
|
|
71
|
+
this.advisor = advisor_1.OrchestrationAdvisor.fromRegistry(path.join(options.projectRoot, 'registry', 'canonical-skills.yaml'));
|
|
72
|
+
}
|
|
73
|
+
startSession(project, branch) {
|
|
74
|
+
const ctx = this.state.initSession(project, branch);
|
|
75
|
+
this.audit.log(this.config.session_id, 'skill_start', {
|
|
76
|
+
action: 'session_init',
|
|
77
|
+
project,
|
|
78
|
+
branch,
|
|
79
|
+
});
|
|
80
|
+
return ctx;
|
|
81
|
+
}
|
|
82
|
+
gateCheck(skillId) {
|
|
83
|
+
const ctx = this.state.getSessionContext();
|
|
84
|
+
if (!ctx) {
|
|
85
|
+
return { allowed: false, blockers: ['No active session'], policyGate: null };
|
|
86
|
+
}
|
|
87
|
+
const preCheck = this.policy.checkPreExecution(skillId, ctx);
|
|
88
|
+
this.audit.log(this.config.session_id, 'gate_check', {
|
|
89
|
+
skill_id: skillId,
|
|
90
|
+
allowed: preCheck.allowed,
|
|
91
|
+
blockers: preCheck.blockers,
|
|
92
|
+
}, skillId);
|
|
93
|
+
return {
|
|
94
|
+
allowed: preCheck.allowed,
|
|
95
|
+
blockers: preCheck.blockers,
|
|
96
|
+
policyGate: null,
|
|
97
|
+
};
|
|
98
|
+
}
|
|
99
|
+
policyGateCheck(action) {
|
|
100
|
+
const result = this.policy.checkGate(action);
|
|
101
|
+
this.audit.log(this.config.session_id, 'policy_check', {
|
|
102
|
+
action,
|
|
103
|
+
allowed: result.allowed,
|
|
104
|
+
gate_id: result.gate_id,
|
|
105
|
+
enforcement: result.action,
|
|
106
|
+
});
|
|
107
|
+
return result;
|
|
108
|
+
}
|
|
109
|
+
registerSkillStart(skillId) {
|
|
110
|
+
const check = this.gateCheck(skillId);
|
|
111
|
+
if (!check.allowed) {
|
|
112
|
+
return { allowed: false, reason: check.blockers.join('; ') };
|
|
113
|
+
}
|
|
114
|
+
this.state.recordSkillStart(skillId);
|
|
115
|
+
this.audit.log(this.config.session_id, 'skill_start', { skill_id: skillId }, skillId);
|
|
116
|
+
return { allowed: true, reason: 'Execution approved' };
|
|
117
|
+
}
|
|
118
|
+
registerSkillComplete(output) {
|
|
119
|
+
const ctx = this.state.recordSkillComplete(output);
|
|
120
|
+
this.audit.log(this.config.session_id, 'skill_complete', {
|
|
121
|
+
skill_id: output.skill_id,
|
|
122
|
+
status: output.status,
|
|
123
|
+
grade: output.grade,
|
|
124
|
+
findings_count: output.findings.length,
|
|
125
|
+
duration: output.duration_seconds,
|
|
126
|
+
}, output.skill_id);
|
|
127
|
+
const matched = this.signals.processOutput(output);
|
|
128
|
+
for (const sig of matched) {
|
|
129
|
+
this.audit.log(this.config.session_id, 'signal_emitted', {
|
|
130
|
+
trigger_id: sig.trigger_id,
|
|
131
|
+
from: sig.from,
|
|
132
|
+
to: sig.to,
|
|
133
|
+
signal: sig.signal,
|
|
134
|
+
urgency: sig.urgency,
|
|
135
|
+
message: sig.message,
|
|
136
|
+
}, output.skill_id);
|
|
137
|
+
}
|
|
138
|
+
return { context: ctx, signals: matched };
|
|
139
|
+
}
|
|
140
|
+
startWorkflow(workflow) {
|
|
141
|
+
const validation = this.dag.validateWorkflow(workflow);
|
|
142
|
+
if (!validation.valid) {
|
|
143
|
+
throw new Error(`Invalid workflow: ${validation.errors.join('; ')}`);
|
|
144
|
+
}
|
|
145
|
+
const workflowState = this.dag.initWorkflowState(workflow);
|
|
146
|
+
this.state.writeWorkflowState(workflowState);
|
|
147
|
+
this.audit.log(this.config.session_id, 'workflow_start', {
|
|
148
|
+
workflow: workflow.name,
|
|
149
|
+
steps: workflow.steps.length,
|
|
150
|
+
topological_order: validation.topologicalOrder,
|
|
151
|
+
}, undefined, workflow.name);
|
|
152
|
+
return workflowState;
|
|
153
|
+
}
|
|
154
|
+
getNextWorkflowSteps(workflow) {
|
|
155
|
+
const workflowState = this.state.getWorkflowState();
|
|
156
|
+
if (!workflowState || workflowState.status !== 'running') {
|
|
157
|
+
return { ready: [], workflowState };
|
|
158
|
+
}
|
|
159
|
+
const readySteps = this.dag.getReadySteps(workflow, workflowState);
|
|
160
|
+
return {
|
|
161
|
+
ready: readySteps.map(s => ({
|
|
162
|
+
id: s.id,
|
|
163
|
+
type: s.type,
|
|
164
|
+
skill: s.skill,
|
|
165
|
+
skills: s.skills,
|
|
166
|
+
})),
|
|
167
|
+
workflowState,
|
|
168
|
+
};
|
|
169
|
+
}
|
|
170
|
+
completeWorkflowStep(stepId, status, durationSeconds, skillOutputs) {
|
|
171
|
+
const workflowState = this.state.getWorkflowState();
|
|
172
|
+
if (!workflowState)
|
|
173
|
+
throw new Error('No active workflow');
|
|
174
|
+
const updated = this.dag.completeStep(workflowState, stepId, status, durationSeconds, skillOutputs);
|
|
175
|
+
this.state.writeWorkflowState(updated);
|
|
176
|
+
if (updated.status === 'completed' || updated.status === 'failed') {
|
|
177
|
+
this.audit.log(this.config.session_id, 'workflow_complete', {
|
|
178
|
+
workflow: updated.workflow,
|
|
179
|
+
status: updated.status,
|
|
180
|
+
steps_completed: updated.steps_completed.length,
|
|
181
|
+
}, undefined, updated.workflow);
|
|
182
|
+
}
|
|
183
|
+
return updated;
|
|
184
|
+
}
|
|
185
|
+
adviseUserInput(request, options = {}) {
|
|
186
|
+
const session = this.state.getSessionContext();
|
|
187
|
+
const decision = this.advisor.advise({
|
|
188
|
+
request,
|
|
189
|
+
tier: options.tier,
|
|
190
|
+
projectType: options.projectType,
|
|
191
|
+
hasActiveSession: Boolean(session),
|
|
192
|
+
hasAuthorityPack: this.hasAuthorityPackEvidence(),
|
|
193
|
+
pendingSignals: this.state.getPendingSignals().map(signal => ({
|
|
194
|
+
signal: signal.signal,
|
|
195
|
+
condition: signal.condition,
|
|
196
|
+
})),
|
|
197
|
+
});
|
|
198
|
+
this.audit.log(this.config.session_id, 'policy_check', {
|
|
199
|
+
action: 'advisor_decision',
|
|
200
|
+
request,
|
|
201
|
+
intent: decision.intent,
|
|
202
|
+
risk_level: decision.risk_level,
|
|
203
|
+
decision: decision.decision,
|
|
204
|
+
recommended_skills: decision.recommended_skills,
|
|
205
|
+
required_skills: decision.required_skills,
|
|
206
|
+
sensor_count: decision.sensors.length,
|
|
207
|
+
});
|
|
208
|
+
return decision;
|
|
209
|
+
}
|
|
210
|
+
startTaskContract(request, options = {}) {
|
|
211
|
+
const decision = this.adviseUserInput(request, options);
|
|
212
|
+
this.state.writeTaskContract(decision.task_contract);
|
|
213
|
+
this.audit.log(this.config.session_id, 'workflow_start', {
|
|
214
|
+
action: 'task_contract_start',
|
|
215
|
+
task_id: decision.task_contract.task_id,
|
|
216
|
+
decision: decision.decision,
|
|
217
|
+
intent: decision.intent,
|
|
218
|
+
risk_level: decision.risk_level,
|
|
219
|
+
}, undefined, decision.task_contract.task_id);
|
|
220
|
+
return decision.task_contract;
|
|
221
|
+
}
|
|
222
|
+
hasAuthorityPackEvidence() {
|
|
223
|
+
return ['ACTIVE_SKILLS.yaml', 'SESSION_POLICY.yaml', 'MODEL_ROUTING.yaml']
|
|
224
|
+
.every(file => {
|
|
225
|
+
return fs.existsSync(path.join(this.config.state_dir, file));
|
|
226
|
+
});
|
|
227
|
+
}
|
|
228
|
+
getActiveSkillId() {
|
|
229
|
+
return this.state.getActiveSkillId();
|
|
230
|
+
}
|
|
231
|
+
getPendingSignals(target) {
|
|
232
|
+
return this.state.getPendingSignals(target);
|
|
233
|
+
}
|
|
234
|
+
getBlockingSignals() {
|
|
235
|
+
return this.state.getBlockingSignals();
|
|
236
|
+
}
|
|
237
|
+
getStatus() {
|
|
238
|
+
return {
|
|
239
|
+
session: this.state.getSessionContext(),
|
|
240
|
+
workflow: this.state.getWorkflowState(),
|
|
241
|
+
pendingSignals: this.state.getPendingSignals(),
|
|
242
|
+
blockingSignals: this.state.getBlockingSignals(),
|
|
243
|
+
auditIntegrity: this.audit.verify(),
|
|
244
|
+
};
|
|
245
|
+
}
|
|
246
|
+
}
|
|
247
|
+
exports.Orchestrator = Orchestrator;
|
|
248
|
+
var state_machine_2 = require("./state-machine");
|
|
249
|
+
Object.defineProperty(exports, "StateMachine", { enumerable: true, get: function () { return state_machine_2.StateMachine; } });
|
|
250
|
+
var dag_resolver_2 = require("./dag-resolver");
|
|
251
|
+
Object.defineProperty(exports, "DagResolver", { enumerable: true, get: function () { return dag_resolver_2.DagResolver; } });
|
|
252
|
+
var signal_router_2 = require("./signal-router");
|
|
253
|
+
Object.defineProperty(exports, "SignalRouter", { enumerable: true, get: function () { return signal_router_2.SignalRouter; } });
|
|
254
|
+
var policy_enforcer_2 = require("./policy-enforcer");
|
|
255
|
+
Object.defineProperty(exports, "PolicyEnforcer", { enumerable: true, get: function () { return policy_enforcer_2.PolicyEnforcer; } });
|
|
256
|
+
var audit_logger_2 = require("./audit-logger");
|
|
257
|
+
Object.defineProperty(exports, "AuditLogger", { enumerable: true, get: function () { return audit_logger_2.AuditLogger; } });
|
|
258
|
+
var advisor_2 = require("./advisor");
|
|
259
|
+
Object.defineProperty(exports, "OrchestrationAdvisor", { enumerable: true, get: function () { return advisor_2.OrchestrationAdvisor; } });
|
|
260
|
+
var hardening_sensors_1 = require("./hardening-sensors");
|
|
261
|
+
Object.defineProperty(exports, "runHardeningSensors", { enumerable: true, get: function () { return hardening_sensors_1.runHardeningSensors; } });
|
|
262
|
+
var builtin_triggers_1 = require("./builtin-triggers");
|
|
263
|
+
Object.defineProperty(exports, "BUILTIN_TRIGGERS", { enumerable: true, get: function () { return builtin_triggers_1.BUILTIN_TRIGGERS; } });
|
|
264
|
+
__exportStar(require("./task-contract"), exports);
|
|
265
|
+
__exportStar(require("./advisor"), exports);
|
|
266
|
+
__exportStar(require("./hardening-sensors"), exports);
|
|
267
|
+
__exportStar(require("./types"), exports);
|
|
268
|
+
__exportStar(require("./api"), exports);
|
|
269
|
+
//# sourceMappingURL=index.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAC7B,uCAAyB;AACzB,mDAA+C;AAC/C,iDAA6C;AAC7C,mDAAmE;AACnE,uDAAyE;AACzE,iDAA6C;AAC7C,uCAAuE;AAkBvE,MAAa,YAAY;IACd,KAAK,CAAe;IACpB,GAAG,CAAc;IACjB,OAAO,CAAe;IACtB,MAAM,CAAiB;IACvB,KAAK,CAAc;IACnB,OAAO,CAAuB;IAE/B,MAAM,CAAqB;IAEnC,YAAY,OAA4B;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;QAEtE,IAAI,CAAC,MAAM,GAAG;YACZ,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,SAAS,EAAE,QAAQ;YACnB,cAAc,EAAE,YAAY;YAC5B,UAAU,EAAE,OAAO,CAAC,SAAS,IAAI,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE;SACzD,CAAC;QAEF,IAAI,CAAC,KAAK,GAAG,IAAI,4BAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,GAAG,IAAI,0BAAW,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,IAAI,4BAAY,CAC7B,OAAO,CAAC,mBAAmB;YACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAC/C,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,gCAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,GAAG,IAAI,0BAAW,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,GAAG,8BAAoB,CAAC,YAAY,CAC9C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,EAAE,uBAAuB,CAAC,CACpE,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,OAAe,EAAE,MAAc;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,EAAE;YACpD,MAAM,EAAE,cAAc;YACtB,OAAO;YACP,MAAM;SACP,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAED,SAAS,CAAC,OAAe;QAKvB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAC/E,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAE7D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE;YACnD,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC5B,EAAE,OAAO,CAAC,CAAC;QAEZ,OAAO;YACL,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,MAAc;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAE7C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE;YACrD,MAAM;YACN,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,MAAM;SAC3B,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kBAAkB,CAAC,OAAe;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;QACtF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACzD,CAAC;IAED,qBAAqB,CAAC,MAAmB;QAIvC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEnD,IAAI,CAAC,KAAK,CAAC,GAAG,CACZ,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,gBAAgB,EAChB;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;YACtC,QAAQ,EAAE,MAAM,CAAC,gBAAgB;SAClC,EACD,MAAM,CAAC,QAAQ,CAChB,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAEnD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CACZ,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,gBAAgB,EAChB;gBACE,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,OAAO,EAAE,GAAG,CAAC,OAAO;aACrB,EACD,MAAM,CAAC,QAAQ,CAChB,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC5C,CAAC;IAED,aAAa,CAAC,QAA4B;QACxC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,qBAAqB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QAE7C,IAAI,CAAC,KAAK,CAAC,GAAG,CACZ,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,gBAAgB,EAChB;YACE,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;YAC5B,iBAAiB,EAAE,UAAU,CAAC,gBAAgB;SAC/C,EACD,SAAS,EACT,QAAQ,CAAC,IAAI,CACd,CAAC;QAEF,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,oBAAoB,CAAC,QAA4B;QAI/C,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QACpD,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACzD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACnE,OAAO;YACL,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC1B,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB,CAAC,CAAC;YACH,aAAa;SACd,CAAC;IACJ,CAAC;IAED,oBAAoB,CAClB,MAAc,EACd,MAA0C,EAC1C,eAAuB,EACvB,YAAsB;QAEtB,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QACpD,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAE1D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;QACpG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEvC,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClE,IAAI,CAAC,KAAK,CAAC,GAAG,CACZ,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,mBAAmB,EACnB;gBACE,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,MAAM;aAChD,EACD,SAAS,EACT,OAAO,CAAC,QAAQ,CACjB,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,eAAe,CAAC,OAAe,EAAE,UAA6D,EAAE;QAC9F,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACnC,OAAO;YACP,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC;YAClC,gBAAgB,EAAE,IAAI,CAAC,wBAAwB,EAAE;YACjD,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC5D,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CAAC;SACJ,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE;YACrD,MAAM,EAAE,kBAAkB;YAC1B,OAAO;YACP,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;SACtC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,iBAAiB,CAAC,OAAe,EAAE,UAA6D,EAAE;QAChG,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,EAAE;YACvD,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,OAAO;YACvC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;SAChC,EAAE,SAAS,EAAE,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,QAAQ,CAAC,aAAa,CAAC;IAChC,CAAC;IAEO,wBAAwB;QAC9B,OAAO,CAAC,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,CAAC;aACvE,KAAK,CAAC,IAAI,CAAC,EAAE;YACZ,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACP,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;IACvC,CAAC;IAED,iBAAiB,CAAC,MAAe;QAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;IACzC,CAAC;IAED,SAAS;QAOP,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE;YACvC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE;YACvC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE;YAC9C,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE;YAChD,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;SACpC,CAAC;IACJ,CAAC;CACF;AA1RD,oCA0RC;AAED,iDAA+C;AAAtC,6GAAA,YAAY,OAAA;AACrB,+CAA6C;AAApC,2GAAA,WAAW,OAAA;AACpB,iDAA+C;AAAtC,6GAAA,YAAY,OAAA;AAErB,qDAAmD;AAA1C,iHAAA,cAAc,OAAA;AACvB,+CAA6C;AAApC,2GAAA,WAAW,OAAA;AACpB,qCAAiD;AAAxC,+GAAA,oBAAoB,OAAA;AAC7B,yDAA0D;AAAjD,wHAAA,mBAAmB,OAAA;AAC5B,uDAAsD;AAA7C,oHAAA,gBAAgB,OAAA;AACzB,kDAAgC;AAChC,4CAA0B;AAC1B,sDAAoC;AACpC,0CAAwB;AACxB,wCAAsB"}
|
|
@@ -0,0 +1,27 @@
|
|
|
1
|
+
import type { PolicyGate, SessionContext, SignalAction } from './types';
|
|
2
|
+
export interface GateCheckResult {
|
|
3
|
+
allowed: boolean;
|
|
4
|
+
gate_id: string | null;
|
|
5
|
+
action: SignalAction | null;
|
|
6
|
+
reason: string;
|
|
7
|
+
evidence_required: boolean;
|
|
8
|
+
bypass_available: boolean;
|
|
9
|
+
}
|
|
10
|
+
export declare class PolicyEnforcer {
|
|
11
|
+
private policyPack;
|
|
12
|
+
private bypassCount;
|
|
13
|
+
constructor(policyPath?: string);
|
|
14
|
+
private defaultPolicyPack;
|
|
15
|
+
checkGate(action: string): GateCheckResult;
|
|
16
|
+
bypass(gateId: string, justification: string): {
|
|
17
|
+
accepted: boolean;
|
|
18
|
+
reason: string;
|
|
19
|
+
};
|
|
20
|
+
checkPreExecution(skillId: string, context: SessionContext): {
|
|
21
|
+
allowed: boolean;
|
|
22
|
+
blockers: string[];
|
|
23
|
+
};
|
|
24
|
+
getGates(): PolicyGate[];
|
|
25
|
+
getBypassCount(): number;
|
|
26
|
+
}
|
|
27
|
+
//# sourceMappingURL=policy-enforcer.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"policy-enforcer.d.ts","sourceRoot":"","sources":["../src/policy-enforcer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAEV,UAAU,EACV,cAAc,EACd,YAAY,EACb,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,OAAO,CAAC;IAC3B,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,WAAW,CAAa;gBAEpB,UAAU,CAAC,EAAE,MAAM;IAQ/B,OAAO,CAAC,iBAAiB;IAkEzB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe;IA6B1C,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IA0BpF,iBAAiB,CACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,cAAc,GACtB;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE;IA0B3C,QAAQ,IAAI,UAAU,EAAE;IAIxB,cAAc,IAAI,MAAM;CAGzB"}
|
|
@@ -0,0 +1,185 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
3
|
+
if (k2 === undefined) k2 = k;
|
|
4
|
+
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
5
|
+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
6
|
+
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
7
|
+
}
|
|
8
|
+
Object.defineProperty(o, k2, desc);
|
|
9
|
+
}) : (function(o, m, k, k2) {
|
|
10
|
+
if (k2 === undefined) k2 = k;
|
|
11
|
+
o[k2] = m[k];
|
|
12
|
+
}));
|
|
13
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
14
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
15
|
+
}) : function(o, v) {
|
|
16
|
+
o["default"] = v;
|
|
17
|
+
});
|
|
18
|
+
var __importStar = (this && this.__importStar) || (function () {
|
|
19
|
+
var ownKeys = function(o) {
|
|
20
|
+
ownKeys = Object.getOwnPropertyNames || function (o) {
|
|
21
|
+
var ar = [];
|
|
22
|
+
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
|
|
23
|
+
return ar;
|
|
24
|
+
};
|
|
25
|
+
return ownKeys(o);
|
|
26
|
+
};
|
|
27
|
+
return function (mod) {
|
|
28
|
+
if (mod && mod.__esModule) return mod;
|
|
29
|
+
var result = {};
|
|
30
|
+
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
|
31
|
+
__setModuleDefault(result, mod);
|
|
32
|
+
return result;
|
|
33
|
+
};
|
|
34
|
+
})();
|
|
35
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
36
|
+
exports.PolicyEnforcer = void 0;
|
|
37
|
+
const fs = __importStar(require("fs"));
|
|
38
|
+
const yaml = __importStar(require("js-yaml"));
|
|
39
|
+
class PolicyEnforcer {
|
|
40
|
+
policyPack;
|
|
41
|
+
bypassCount = 0;
|
|
42
|
+
constructor(policyPath) {
|
|
43
|
+
if (policyPath && fs.existsSync(policyPath)) {
|
|
44
|
+
this.policyPack = yaml.load(fs.readFileSync(policyPath, 'utf-8'));
|
|
45
|
+
}
|
|
46
|
+
else {
|
|
47
|
+
this.policyPack = this.defaultPolicyPack();
|
|
48
|
+
}
|
|
49
|
+
}
|
|
50
|
+
defaultPolicyPack() {
|
|
51
|
+
return {
|
|
52
|
+
gates: [
|
|
53
|
+
{
|
|
54
|
+
id: 'gate-destructive-db',
|
|
55
|
+
action: 'schema_migration_destructive',
|
|
56
|
+
risk_level: 'critical',
|
|
57
|
+
required_approver: 'user',
|
|
58
|
+
enforcement: 'require',
|
|
59
|
+
evidence_required: true,
|
|
60
|
+
description: 'Destructive database migrations (DROP TABLE, DROP COLUMN)',
|
|
61
|
+
},
|
|
62
|
+
{
|
|
63
|
+
id: 'gate-prod-deploy',
|
|
64
|
+
action: 'production_deploy',
|
|
65
|
+
risk_level: 'high',
|
|
66
|
+
required_approver: 'user',
|
|
67
|
+
enforcement: 'require',
|
|
68
|
+
evidence_required: true,
|
|
69
|
+
description: 'Production deployments',
|
|
70
|
+
},
|
|
71
|
+
{
|
|
72
|
+
id: 'gate-secret-rotation',
|
|
73
|
+
action: 'secret_rotation',
|
|
74
|
+
risk_level: 'high',
|
|
75
|
+
required_approver: 'user',
|
|
76
|
+
enforcement: 'require',
|
|
77
|
+
evidence_required: true,
|
|
78
|
+
description: 'Secret rotation or credential changes',
|
|
79
|
+
},
|
|
80
|
+
{
|
|
81
|
+
id: 'gate-auth-change',
|
|
82
|
+
action: 'auth_middleware_change',
|
|
83
|
+
risk_level: 'high',
|
|
84
|
+
required_approver: 'user',
|
|
85
|
+
enforcement: 'require',
|
|
86
|
+
evidence_required: false,
|
|
87
|
+
description: 'Changes to authentication or authorization middleware',
|
|
88
|
+
},
|
|
89
|
+
{
|
|
90
|
+
id: 'gate-rls-change',
|
|
91
|
+
action: 'rls_policy_change',
|
|
92
|
+
risk_level: 'critical',
|
|
93
|
+
required_approver: 'user',
|
|
94
|
+
enforcement: 'block',
|
|
95
|
+
evidence_required: true,
|
|
96
|
+
description: 'Changes to row-level security policies',
|
|
97
|
+
},
|
|
98
|
+
{
|
|
99
|
+
id: 'gate-workflow-auto-exec',
|
|
100
|
+
action: 'workflow_auto_execute',
|
|
101
|
+
risk_level: 'medium',
|
|
102
|
+
required_approver: 'user',
|
|
103
|
+
enforcement: 'suggest',
|
|
104
|
+
evidence_required: false,
|
|
105
|
+
description: 'Automatic workflow execution without explicit user trigger',
|
|
106
|
+
},
|
|
107
|
+
],
|
|
108
|
+
bypass_policy: {
|
|
109
|
+
allowed: true,
|
|
110
|
+
requires_justification: true,
|
|
111
|
+
max_bypass_per_session: 3,
|
|
112
|
+
},
|
|
113
|
+
};
|
|
114
|
+
}
|
|
115
|
+
checkGate(action) {
|
|
116
|
+
const gate = this.policyPack.gates.find(g => g.action === action);
|
|
117
|
+
if (!gate) {
|
|
118
|
+
return {
|
|
119
|
+
allowed: true,
|
|
120
|
+
gate_id: null,
|
|
121
|
+
action: null,
|
|
122
|
+
reason: `No gate defined for action "${action}"`,
|
|
123
|
+
evidence_required: false,
|
|
124
|
+
bypass_available: false,
|
|
125
|
+
};
|
|
126
|
+
}
|
|
127
|
+
const canBypass = this.policyPack.bypass_policy.allowed &&
|
|
128
|
+
this.bypassCount < this.policyPack.bypass_policy.max_bypass_per_session &&
|
|
129
|
+
gate.enforcement !== 'block';
|
|
130
|
+
return {
|
|
131
|
+
allowed: gate.enforcement === 'suggest',
|
|
132
|
+
gate_id: gate.id,
|
|
133
|
+
action: gate.enforcement,
|
|
134
|
+
reason: gate.description,
|
|
135
|
+
evidence_required: gate.evidence_required,
|
|
136
|
+
bypass_available: canBypass,
|
|
137
|
+
};
|
|
138
|
+
}
|
|
139
|
+
bypass(gateId, justification) {
|
|
140
|
+
const gate = this.policyPack.gates.find(g => g.id === gateId);
|
|
141
|
+
if (!gate) {
|
|
142
|
+
return { accepted: false, reason: `Unknown gate "${gateId}"` };
|
|
143
|
+
}
|
|
144
|
+
if (gate.enforcement === 'block') {
|
|
145
|
+
return { accepted: false, reason: `Gate "${gateId}" uses "block" enforcement and cannot be bypassed` };
|
|
146
|
+
}
|
|
147
|
+
if (!this.policyPack.bypass_policy.allowed) {
|
|
148
|
+
return { accepted: false, reason: 'Bypass policy does not allow bypasses' };
|
|
149
|
+
}
|
|
150
|
+
if (this.bypassCount >= this.policyPack.bypass_policy.max_bypass_per_session) {
|
|
151
|
+
return { accepted: false, reason: `Maximum bypasses per session reached (${this.policyPack.bypass_policy.max_bypass_per_session})` };
|
|
152
|
+
}
|
|
153
|
+
if (this.policyPack.bypass_policy.requires_justification && !justification.trim()) {
|
|
154
|
+
return { accepted: false, reason: 'Justification is required for bypass' };
|
|
155
|
+
}
|
|
156
|
+
this.bypassCount++;
|
|
157
|
+
return { accepted: true, reason: `Bypass accepted (${this.bypassCount}/${this.policyPack.bypass_policy.max_bypass_per_session}). Justification: ${justification}` };
|
|
158
|
+
}
|
|
159
|
+
checkPreExecution(skillId, context) {
|
|
160
|
+
const blockers = [];
|
|
161
|
+
const blockSignals = context.pending_signals.filter(s => s.to === skillId && s.signal === 'block');
|
|
162
|
+
for (const sig of blockSignals) {
|
|
163
|
+
blockers.push(`Blocked by signal from "${sig.from}": ${sig.condition}`);
|
|
164
|
+
}
|
|
165
|
+
const requireSignals = context.pending_signals.filter(s => s.signal === 'require' && s.to !== skillId);
|
|
166
|
+
for (const sig of requireSignals) {
|
|
167
|
+
const alreadyRan = context.skills_executed.some(e => e.skill_id === sig.to);
|
|
168
|
+
if (!alreadyRan) {
|
|
169
|
+
blockers.push(`Required skill "${sig.to}" must run first (triggered by "${sig.from}")`);
|
|
170
|
+
}
|
|
171
|
+
}
|
|
172
|
+
return {
|
|
173
|
+
allowed: blockers.length === 0,
|
|
174
|
+
blockers,
|
|
175
|
+
};
|
|
176
|
+
}
|
|
177
|
+
getGates() {
|
|
178
|
+
return [...this.policyPack.gates];
|
|
179
|
+
}
|
|
180
|
+
getBypassCount() {
|
|
181
|
+
return this.bypassCount;
|
|
182
|
+
}
|
|
183
|
+
}
|
|
184
|
+
exports.PolicyEnforcer = PolicyEnforcer;
|
|
185
|
+
//# sourceMappingURL=policy-enforcer.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"policy-enforcer.js","sourceRoot":"","sources":["../src/policy-enforcer.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,8CAAgC;AAiBhC,MAAa,cAAc;IACjB,UAAU,CAAa;IACvB,WAAW,GAAW,CAAC,CAAC;IAEhC,YAAY,UAAmB;QAC7B,IAAI,UAAU,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAe,CAAC;QAClF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IAEO,iBAAiB;QACvB,OAAO;YACL,KAAK,EAAE;gBACL;oBACE,EAAE,EAAE,qBAAqB;oBACzB,MAAM,EAAE,8BAA8B;oBACtC,UAAU,EAAE,UAAU;oBACtB,iBAAiB,EAAE,MAAM;oBACzB,WAAW,EAAE,SAAS;oBACtB,iBAAiB,EAAE,IAAI;oBACvB,WAAW,EAAE,2DAA2D;iBACzE;gBACD;oBACE,EAAE,EAAE,kBAAkB;oBACtB,MAAM,EAAE,mBAAmB;oBAC3B,UAAU,EAAE,MAAM;oBAClB,iBAAiB,EAAE,MAAM;oBACzB,WAAW,EAAE,SAAS;oBACtB,iBAAiB,EAAE,IAAI;oBACvB,WAAW,EAAE,wBAAwB;iBACtC;gBACD;oBACE,EAAE,EAAE,sBAAsB;oBAC1B,MAAM,EAAE,iBAAiB;oBACzB,UAAU,EAAE,MAAM;oBAClB,iBAAiB,EAAE,MAAM;oBACzB,WAAW,EAAE,SAAS;oBACtB,iBAAiB,EAAE,IAAI;oBACvB,WAAW,EAAE,uCAAuC;iBACrD;gBACD;oBACE,EAAE,EAAE,kBAAkB;oBACtB,MAAM,EAAE,wBAAwB;oBAChC,UAAU,EAAE,MAAM;oBAClB,iBAAiB,EAAE,MAAM;oBACzB,WAAW,EAAE,SAAS;oBACtB,iBAAiB,EAAE,KAAK;oBACxB,WAAW,EAAE,uDAAuD;iBACrE;gBACD;oBACE,EAAE,EAAE,iBAAiB;oBACrB,MAAM,EAAE,mBAAmB;oBAC3B,UAAU,EAAE,UAAU;oBACtB,iBAAiB,EAAE,MAAM;oBACzB,WAAW,EAAE,OAAO;oBACpB,iBAAiB,EAAE,IAAI;oBACvB,WAAW,EAAE,wCAAwC;iBACtD;gBACD;oBACE,EAAE,EAAE,yBAAyB;oBAC7B,MAAM,EAAE,uBAAuB;oBAC/B,UAAU,EAAE,QAAQ;oBACpB,iBAAiB,EAAE,MAAM;oBACzB,WAAW,EAAE,SAAS;oBACtB,iBAAiB,EAAE,KAAK;oBACxB,WAAW,EAAE,4DAA4D;iBAC1E;aACF;YACD,aAAa,EAAE;gBACb,OAAO,EAAE,IAAI;gBACb,sBAAsB,EAAE,IAAI;gBAC5B,sBAAsB,EAAE,CAAC;aAC1B;SACF,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,MAAc;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAElE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,+BAA+B,MAAM,GAAG;gBAChD,iBAAiB,EAAE,KAAK;gBACxB,gBAAgB,EAAE,KAAK;aACxB,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GACb,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,OAAO;YACrC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,sBAAsB;YACvE,IAAI,CAAC,WAAW,KAAK,OAAO,CAAC;QAE/B,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,WAAW,KAAK,SAAS;YACvC,OAAO,EAAE,IAAI,CAAC,EAAE;YAChB,MAAM,EAAE,IAAI,CAAC,WAAW;YACxB,MAAM,EAAE,IAAI,CAAC,WAAW;YACxB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,gBAAgB,EAAE,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,aAAqB;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,MAAM,GAAG,EAAE,CAAC;QACjE,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;YACjC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,MAAM,mDAAmD,EAAE,CAAC;QACzG,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;QAC9E,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,sBAAsB,EAAE,CAAC;YAC7E,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,sBAAsB,GAAG,EAAE,CAAC;QACvI,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,sBAAsB,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;YAClF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;QAC7E,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,sBAAsB,qBAAqB,aAAa,EAAE,EAAE,CAAC;IACtK,CAAC;IAED,iBAAiB,CACf,OAAe,EACf,OAAuB;QAEvB,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CACjD,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,CAC9C,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,2BAA2B,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CACnD,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,OAAO,CAChD,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,MAAM,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5E,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,QAAQ,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,EAAE,mCAAmC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;YAC9B,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,QAAQ;QACN,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAzKD,wCAyKC"}
|
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
import type { SkillOutput, PendingSignal, Urgency } from './types';
|
|
2
|
+
export interface MatchedSignal extends PendingSignal {
|
|
3
|
+
trigger_id: string;
|
|
4
|
+
urgency: Urgency;
|
|
5
|
+
message: string;
|
|
6
|
+
}
|
|
7
|
+
export declare class SignalRouter {
|
|
8
|
+
private triggers;
|
|
9
|
+
constructor(registryPath?: string);
|
|
10
|
+
processOutput(output: SkillOutput): MatchedSignal[];
|
|
11
|
+
private matchesTriggerCondition;
|
|
12
|
+
private evaluateCondition;
|
|
13
|
+
private evaluateFindingsCondition;
|
|
14
|
+
private matchSingleFindingCondition;
|
|
15
|
+
private evaluateMetricsCondition;
|
|
16
|
+
private prioritize;
|
|
17
|
+
getTriggerCount(): number;
|
|
18
|
+
}
|
|
19
|
+
//# sourceMappingURL=signal-router.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"signal-router.d.ts","sourceRoot":"","sources":["../src/signal-router.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAGV,WAAW,EACX,aAAa,EACb,OAAO,EACR,MAAM,SAAS,CAAC;AAGjB,MAAM,WAAW,aAAc,SAAQ,aAAa;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAA2B;gBAE/B,YAAY,CAAC,EAAE,MAAM;IAoBjC,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,aAAa,EAAE;IAmDnD,OAAO,CAAC,uBAAuB;IAO/B,OAAO,CAAC,iBAAiB;IAoCzB,OAAO,CAAC,yBAAyB;IAWjC,OAAO,CAAC,2BAA2B;IAuBnC,OAAO,CAAC,wBAAwB;IAoBhC,OAAO,CAAC,UAAU;IAoBlB,eAAe,IAAI,MAAM;CAG1B"}
|