@hachej/boring-governance 0.1.64

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 boringdata
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,33 @@
+# @hachej/boring-governance
+
+Reusable tenant governance wiring for boring-ui apps: YAML policy loading, model filtering, budget metering, company-context bindings, routes, and Company Admin rendering.
+
+## Server wiring
+
+Call `createGovernance(config)` after loading core config and before `createCoreWorkspaceAgentServer` so invalid production policy still refuses boot early.
+
+```ts
+const governance = await createGovernance(config)
+const credits = buildCreditsWiring()
+let appDb: unknown
+const app = await createCoreWorkspaceAgentServer({
+  config,
+  plugins: createAppPlugins([governance.serverPlugin]),
+  metering: governance.createMeteringSink(credits.meteringSink, () => appDb as never),
+  filterModels: governance.filterModels,
+  getFilesystemBindings: governance.getFilesystemBindings(),
+  pi: governance.pi,
+})
+appDb = app.db
+credits.attach(app)
+```
+
+## Front wiring
+
+```tsx
+const governanceCompanyAdmin = createGovernanceCompanyAdmin()
+
+<CoreWorkspaceAgentFront companyAdmin={governanceCompanyAdmin} />
+```
+
+Policy source is configured with `BORING_GOVERNANCE_POLICY_PATH`. Company context source roots use `BORING_GOVERNANCE_COMPANY_CONTEXT_ROOT` or the default workspace root resolver outside sandbox mode.

package/dist/front/index.d.ts

@@ -0,0 +1,60 @@
+import { LoadCompanyAdminStatus, RenderCompanyAdminContent, CompanyAdminLabels } from '@hachej/boring-core/front';
+import * as react from 'react';
+
+interface GovernancePolicyStatus {
+    state: 'disabled' | 'active' | 'invalid';
+    reason?: string;
+    path?: string | null;
+    message?: string;
+    tenantId?: string;
+    userCount?: number;
+}
+interface GovernanceMeResponse {
+    enabled: boolean;
+    role: 'admin' | 'user' | null;
+    admin: boolean;
+    policyStatus?: GovernancePolicyStatus;
+    tenant?: {
+        id: string;
+        companyContextWorkspaceId: string | null;
+        defaultMonthlyModelBudgetEur: number;
+        perRunHoldEur: number;
+    };
+    users?: Array<{
+        email: string;
+        role: 'admin' | 'user';
+        modelCount: number;
+        contextRuleCount: number;
+    }>;
+    models?: Array<{
+        email: string;
+        provider: string;
+        id: string;
+        monthlyBudgetEur: number;
+        monthlyBudgetMicros: number;
+    }>;
+    companyContextRules?: Array<{
+        email: string;
+        pattern: string;
+    }>;
+}
+declare function GovernanceAdminView({ status }: {
+    status: GovernanceMeResponse;
+}): react.JSX.Element;
+
+interface CreateGovernanceCompanyAdminOptions {
+    fetchImpl?: typeof fetch;
+}
+interface GovernanceCompanyAdminProvider {
+    loadStatus: LoadCompanyAdminStatus;
+    renderContent: RenderCompanyAdminContent;
+    labels: CompanyAdminLabels;
+}
+declare function createGovernanceCompanyAdmin({ fetchImpl }?: CreateGovernanceCompanyAdminOptions): GovernanceCompanyAdminProvider;
+type GovernanceFrontPlugin = ((api: unknown) => void) & {
+    pluginId: string;
+    pluginLabel?: string;
+};
+declare const governanceFrontPlugin: GovernanceFrontPlugin;
+
+export { type CreateGovernanceCompanyAdminOptions, GovernanceAdminView, type GovernanceCompanyAdminProvider, type GovernanceMeResponse, type GovernancePolicyStatus, createGovernanceCompanyAdmin, governanceFrontPlugin as default };

package/dist/front/index.js

@@ -0,0 +1,137 @@
+"use client";
+
+// src/front/GovernanceAdminView.tsx
+import { Button, Tabs, TabsContent, TabsList, TabsTrigger } from "@hachej/boring-ui-kit";
+import { jsx, jsxs } from "react/jsx-runtime";
+function GovernanceAdminView({ status }) {
+  return /* @__PURE__ */ jsx("main", { className: "min-h-screen bg-background px-4 py-8 text-foreground sm:px-6 lg:px-8", children: /* @__PURE__ */ jsxs("div", { className: "mx-auto flex max-w-6xl flex-col gap-6", children: [
+    /* @__PURE__ */ jsxs("header", { className: "rounded-2xl border border-border bg-card p-6 shadow-sm", children: [
+      /* @__PURE__ */ jsx("p", { className: "text-xs font-semibold uppercase tracking-[0.18em] text-muted-foreground", children: "Company admin" }),
+      /* @__PURE__ */ jsxs("div", { className: "mt-3 flex flex-col gap-2 sm:flex-row sm:items-end sm:justify-between", children: [
+        /* @__PURE__ */ jsxs("div", { children: [
+          /* @__PURE__ */ jsx("h1", { className: "text-3xl font-semibold tracking-tight", children: "Tenant governance" }),
+          /* @__PURE__ */ jsx("p", { className: "mt-2 max-w-2xl text-sm text-muted-foreground", children: "YAML-managed in v1. Review effective tenant roles, exact model grants, monthly EUR budgets, and company-context rules." })
+        ] }),
+        /* @__PURE__ */ jsx(Button, { asChild: true, variant: "outline", children: /* @__PURE__ */ jsx("a", { href: "/", children: "Back to workspace" }) })
+      ] })
+    ] }),
+    /* @__PURE__ */ jsxs("section", { className: "grid gap-4 rounded-2xl border border-border bg-card p-6 shadow-sm md:grid-cols-3", children: [
+      /* @__PURE__ */ jsxs("div", { children: [
+        /* @__PURE__ */ jsx("p", { className: "text-xs font-semibold uppercase tracking-[0.16em] text-muted-foreground", children: "Policy source" }),
+        /* @__PURE__ */ jsx("p", { className: "mt-2 text-sm font-medium text-foreground", children: "YAML-managed in v1" }),
+        /* @__PURE__ */ jsx("p", { className: "mt-1 text-xs text-muted-foreground", children: "Edit the host policy file and restart to reload." })
+      ] }),
+      /* @__PURE__ */ jsxs("div", { children: [
+        /* @__PURE__ */ jsx("p", { className: "text-xs font-semibold uppercase tracking-[0.16em] text-muted-foreground", children: "Tenant" }),
+        /* @__PURE__ */ jsx("p", { className: "mt-2 text-sm font-medium text-foreground", children: status.tenant?.id ?? status.policyStatus?.tenantId ?? "\u2014" }),
+        /* @__PURE__ */ jsxs("p", { className: "mt-1 text-xs text-muted-foreground", children: [
+          "Role: ",
+          status.role ?? "none"
+        ] })
+      ] }),
+      /* @__PURE__ */ jsxs("div", { children: [
+        /* @__PURE__ */ jsx("p", { className: "text-xs font-semibold uppercase tracking-[0.16em] text-muted-foreground", children: "Policy status" }),
+        /* @__PURE__ */ jsx("p", { className: "mt-2 text-sm font-medium text-foreground", children: status.policyStatus?.state ?? "active" }),
+        /* @__PURE__ */ jsx("p", { className: "mt-1 text-xs text-muted-foreground", children: "Tenant invites are deferred/not implemented in v1." })
+      ] })
+    ] }),
+    /* @__PURE__ */ jsx("section", { className: "rounded-2xl border border-border bg-card p-4 shadow-sm sm:p-6", children: /* @__PURE__ */ jsxs(Tabs, { defaultValue: "context", className: "gap-4", children: [
+      /* @__PURE__ */ jsxs(TabsList, { "aria-label": "Company admin tabs", variant: "line", className: "flex-wrap justify-start", children: [
+        /* @__PURE__ */ jsx(TabsTrigger, { value: "context", children: "Context access" }),
+        /* @__PURE__ */ jsx(TabsTrigger, { value: "models", children: "Model control" }),
+        /* @__PURE__ */ jsx(TabsTrigger, { value: "users", children: "Users" })
+      ] }),
+      /* @__PURE__ */ jsx(TabsContent, { value: "context", children: /* @__PURE__ */ jsxs("div", { className: "rounded-xl border border-dashed border-border bg-muted/20 p-6", children: [
+        /* @__PURE__ */ jsx("h2", { className: "text-xl font-semibold tracking-tight", children: "Context access" }),
+        /* @__PURE__ */ jsx("p", { className: "mt-2 max-w-2xl text-sm text-muted-foreground", children: "Read-only effective company-context path grants from the YAML policy." }),
+        /* @__PURE__ */ jsx("div", { className: "mt-5 overflow-hidden rounded-lg border border-border bg-background", children: /* @__PURE__ */ jsxs("table", { className: "w-full text-left text-sm", children: [
+          /* @__PURE__ */ jsx("thead", { className: "bg-muted/60 text-xs uppercase tracking-[0.12em] text-muted-foreground", children: /* @__PURE__ */ jsxs("tr", { children: [
+            /* @__PURE__ */ jsx("th", { className: "px-3 py-2 font-medium", children: "User" }),
+            /* @__PURE__ */ jsx("th", { className: "px-3 py-2 font-medium", children: "Allowed pattern" })
+          ] }) }),
+          /* @__PURE__ */ jsx("tbody", { children: (status.companyContextRules ?? []).length > 0 ? status.companyContextRules.map((rule, index) => /* @__PURE__ */ jsxs("tr", { className: "border-t border-border", children: [
+            /* @__PURE__ */ jsx("td", { className: "px-3 py-2 font-medium", children: rule.email }),
+            /* @__PURE__ */ jsx("td", { className: "px-3 py-2 font-mono text-xs text-muted-foreground", children: rule.pattern })
+          ] }, `${rule.email}-${index}`)) : /* @__PURE__ */ jsx("tr", { children: /* @__PURE__ */ jsx("td", { colSpan: 2, className: "px-3 py-4 text-muted-foreground", children: "No company-context rules in policy." }) }) })
+        ] }) })
+      ] }) }),
+      /* @__PURE__ */ jsx(TabsContent, { value: "models", children: /* @__PURE__ */ jsxs("div", { className: "rounded-xl border border-dashed border-border bg-muted/20 p-6", children: [
+        /* @__PURE__ */ jsx("h2", { className: "text-xl font-semibold tracking-tight", children: "Model control" }),
+        /* @__PURE__ */ jsx("p", { className: "mt-2 max-w-2xl text-sm text-muted-foreground", children: "Read-only exact model grants and monthly EUR budgets from the YAML policy." }),
+        /* @__PURE__ */ jsx("div", { className: "mt-5 overflow-hidden rounded-lg border border-border bg-background", children: /* @__PURE__ */ jsxs("table", { className: "w-full text-left text-sm", children: [
+          /* @__PURE__ */ jsx("thead", { className: "bg-muted/60 text-xs uppercase tracking-[0.12em] text-muted-foreground", children: /* @__PURE__ */ jsxs("tr", { children: [
+            /* @__PURE__ */ jsx("th", { className: "px-3 py-2 font-medium", children: "User" }),
+            /* @__PURE__ */ jsx("th", { className: "px-3 py-2 font-medium", children: "Model" }),
+            /* @__PURE__ */ jsx("th", { className: "px-3 py-2 font-medium", children: "Monthly budget" })
+          ] }) }),
+          /* @__PURE__ */ jsx("tbody", { children: (status.models ?? []).length > 0 ? status.models.map((model) => /* @__PURE__ */ jsxs("tr", { className: "border-t border-border", children: [
+            /* @__PURE__ */ jsx("td", { className: "px-3 py-2 font-medium", children: model.email }),
+            /* @__PURE__ */ jsxs("td", { className: "px-3 py-2 font-mono text-xs text-muted-foreground", children: [
+              model.provider,
+              "/",
+              model.id
+            ] }),
+            /* @__PURE__ */ jsxs("td", { className: "px-3 py-2", children: [
+              "\u20AC",
+              model.monthlyBudgetEur
+            ] })
+          ] }, `${model.email}-${model.provider}-${model.id}`)) : /* @__PURE__ */ jsx("tr", { children: /* @__PURE__ */ jsx("td", { colSpan: 3, className: "px-3 py-4 text-muted-foreground", children: "No model grants in policy." }) }) })
+        ] }) })
+      ] }) }),
+      /* @__PURE__ */ jsx(TabsContent, { value: "users", children: /* @__PURE__ */ jsxs("div", { className: "rounded-xl border border-dashed border-border bg-muted/20 p-6", children: [
+        /* @__PURE__ */ jsx("h2", { className: "text-xl font-semibold tracking-tight", children: "Users" }),
+        /* @__PURE__ */ jsx("p", { className: "mt-2 max-w-2xl text-sm text-muted-foreground", children: "Read-only tenant users from the YAML policy. Tenant invites are not implemented in v1." }),
+        /* @__PURE__ */ jsx("div", { className: "mt-5 overflow-hidden rounded-lg border border-border bg-background", children: /* @__PURE__ */ jsxs("table", { className: "w-full text-left text-sm", children: [
+          /* @__PURE__ */ jsx("thead", { className: "bg-muted/60 text-xs uppercase tracking-[0.12em] text-muted-foreground", children: /* @__PURE__ */ jsxs("tr", { children: [
+            /* @__PURE__ */ jsx("th", { className: "px-3 py-2 font-medium", children: "User" }),
+            /* @__PURE__ */ jsx("th", { className: "px-3 py-2 font-medium", children: "Role" }),
+            /* @__PURE__ */ jsx("th", { className: "px-3 py-2 font-medium", children: "Models" }),
+            /* @__PURE__ */ jsx("th", { className: "px-3 py-2 font-medium", children: "Context rules" })
+          ] }) }),
+          /* @__PURE__ */ jsx("tbody", { children: (status.users ?? []).length > 0 ? status.users.map((user) => /* @__PURE__ */ jsxs("tr", { className: "border-t border-border", children: [
+            /* @__PURE__ */ jsx("td", { className: "px-3 py-2 font-medium", children: user.email }),
+            /* @__PURE__ */ jsx("td", { className: "px-3 py-2", children: user.role }),
+            /* @__PURE__ */ jsx("td", { className: "px-3 py-2", children: user.modelCount }),
+            /* @__PURE__ */ jsx("td", { className: "px-3 py-2", children: user.contextRuleCount })
+          ] }, user.email)) : /* @__PURE__ */ jsx("tr", { children: /* @__PURE__ */ jsx("td", { colSpan: 4, className: "px-3 py-4 text-muted-foreground", children: "No users in policy." }) }) })
+        ] }) })
+      ] }) })
+    ] }) })
+  ] }) });
+}
+
+// src/front/index.tsx
+import { jsx as jsx2 } from "react/jsx-runtime";
+function createGovernanceCompanyAdmin({ fetchImpl = fetch } = {}) {
+  const loadStatus = async () => {
+    const response = await fetchImpl("/api/v1/governance/me", { credentials: "include" });
+    if (response.status === 404) return null;
+    if (!response.ok) throw new Error(`Company admin status failed: HTTP ${response.status}`);
+    const body = await response.json();
+    if (body.policyStatus?.state === "invalid") {
+      throw new Error(body.policyStatus.message ?? "Governance policy is invalid");
+    }
+    return {
+      enabled: body.enabled,
+      admin: body.admin,
+      role: body.role,
+      details: body
+    };
+  };
+  const renderContent = (status) => /* @__PURE__ */ jsx2(GovernanceAdminView, { status: status.details });
+  const labels = {
+    menuLabel: "Company Admin",
+    pageTitle: "Company Admin",
+    deniedMessage: "You do not have access to Company Admin."
+  };
+  return { loadStatus, renderContent, labels };
+}
+var governanceFrontPlugin = (() => void 0);
+Object.defineProperty(governanceFrontPlugin, "pluginId", { value: "boring-governance", enumerable: true });
+Object.defineProperty(governanceFrontPlugin, "pluginLabel", { value: "Governance", enumerable: true });
+var front_default = governanceFrontPlugin;
+export {
+  GovernanceAdminView,
+  createGovernanceCompanyAdmin,
+  front_default as default
+};

package/dist/server/index.d.ts

@@ -0,0 +1,176 @@
+import * as _hachej_boring_agent_server from '@hachej/boring-agent/server';
+import { AgentMeteringSink, RegisterAgentRoutesOptions } from '@hachej/boring-agent/server';
+import { CoreConfig } from '@hachej/boring-core/shared';
+import { CoreWorkspaceAgentServerPlugin } from '@hachej/boring-core/app/server';
+import { FastifyRequest } from 'fastify';
+
+type TenantRole = 'admin' | 'user';
+interface GovernanceModelGrant {
+    provider: string;
+    id: string;
+    monthlyBudgetEur: number;
+    monthlyBudgetMicros: number;
+}
+interface GovernanceUserPolicy {
+    email: string;
+    role: TenantRole;
+    models: GovernanceModelGrant[];
+    companyContext: {
+        allow: string[];
+    };
+}
+interface GovernancePolicy {
+    tenant: {
+        id: string;
+        companyContextWorkspaceId: string | null;
+        defaultMonthlyModelBudgetEur: number;
+        perRunHoldEur: number;
+        perRunHoldMicros: number;
+    };
+    users: GovernanceUserPolicy[];
+    usersByEmail: Map<string, GovernanceUserPolicy>;
+}
+type GovernancePolicyStatus = {
+    state: 'disabled';
+    reason: 'missing-env' | 'missing-file';
+    path: string | null;
+} | {
+    state: 'active';
+    path: string;
+    tenantId: string;
+    userCount: number;
+} | {
+    state: 'invalid';
+    path: string;
+    message: string;
+};
+interface GovernanceLoadResult {
+    enabled: boolean;
+    policy: GovernancePolicy | null;
+    status: GovernancePolicyStatus;
+}
+interface GovernanceUserLike {
+    id?: string;
+    email: string;
+    emailVerified: boolean;
+}
+interface ServedModelLike {
+    provider: string;
+    id: string;
+}
+
+declare const GOVERNANCE_POLICY_PATH_ENV = "BORING_GOVERNANCE_POLICY_PATH";
+declare const GOVERNANCE_DEV_EMAIL_VERIFICATION_OVERRIDE_ENV = "BORING_GOVERNANCE_ALLOW_UNVERIFIED_EMAIL_DEV";
+interface LoadGovernancePolicyOptions {
+    env?: NodeJS.ProcessEnv;
+    nodeEnv?: string;
+    config?: Pick<CoreConfig, 'auth'>;
+}
+declare function loadGovernancePolicy({ env, nodeEnv, config, }?: LoadGovernancePolicyOptions): Promise<GovernanceLoadResult>;
+
+type GovernancePolicyErrorCode = 'disabled' | 'invalid' | 'denied' | 'not_allowed';
+declare class GovernancePolicyError extends Error {
+    readonly code: GovernancePolicyErrorCode;
+    constructor(message: string, code: GovernancePolicyErrorCode);
+}
+interface GovernanceMeResponse {
+    enabled: boolean;
+    role: TenantRole | null;
+    admin: boolean;
+    policyStatus?: GovernancePolicyStatus;
+    tenant?: {
+        id: string;
+        companyContextWorkspaceId: string | null;
+        defaultMonthlyModelBudgetEur: number;
+        perRunHoldEur: number;
+    };
+    users?: Array<{
+        email: string;
+        role: TenantRole;
+        modelCount: number;
+        contextRuleCount: number;
+    }>;
+    models?: Array<GovernanceModelGrant & {
+        email: string;
+    }>;
+    companyContextRules?: Array<{
+        email: string;
+        pattern: string;
+    }>;
+}
+declare class GovernanceService {
+    private readonly loaded;
+    constructor(loaded: GovernanceLoadResult);
+    isEnabled(): boolean;
+    policyStatus(): GovernancePolicyStatus;
+    policy(): GovernancePolicy | null;
+    private enabledPolicy;
+    private userPolicy;
+    roleForUser(user: GovernanceUserLike | null | undefined): TenantRole | null;
+    isAdmin(user: GovernanceUserLike | null | undefined): boolean;
+    allowedModelsForUser<TModel extends ServedModelLike>(user: GovernanceUserLike, servedModels: readonly TModel[]): TModel[];
+    assertModelAllowed(user: GovernanceUserLike, model: ServedModelLike): void;
+    monthlyBudgetMicros(user: GovernanceUserLike, model: ServedModelLike): number | null;
+    companyContextRules(user: GovernanceUserLike): string[];
+    companyContextWorkspaceId(): string | null;
+    me(user: GovernanceUserLike | null | undefined): GovernanceMeResponse;
+}
+
+declare const PostgresModelBudgetStore: new (db: unknown) => {
+    reserve(input: unknown): Promise<{
+        reservationId: string;
+    }>;
+    settle(input: unknown): Promise<void>;
+    release(input: unknown): Promise<void>;
+};
+type ModelBudgetDb = ConstructorParameters<typeof PostgresModelBudgetStore>[0];
+declare function createGovernanceMeteringSink(options: {
+    service: GovernanceService;
+    getDb: () => ModelBudgetDb;
+    delegate: AgentMeteringSink;
+    holdTtlSeconds?: number;
+}): AgentMeteringSink;
+
+interface GovernanceFilesystemBindingContext {
+    request?: FastifyRequest;
+    workspaceId: string;
+    workspaceRoot: string;
+    sessionId?: string;
+    userId?: string;
+    userEmail?: string;
+    userEmailVerified?: boolean;
+    requestId?: string;
+}
+type CompanyContextRootResolver = (ctx: GovernanceFilesystemBindingContext, companyContextWorkspaceId: string) => string | null | undefined | Promise<string | null | undefined>;
+interface CreateGovernanceFilesystemBindingsOptions {
+    /** Explicit source root resolver for the tenant company-context workspace. */
+    resolveCompanyContextRoot?: CompanyContextRootResolver;
+    projectionRootParent?: string;
+}
+declare function createDefaultCompanyContextRootResolver(env?: NodeJS.ProcessEnv): CompanyContextRootResolver | undefined;
+declare function createGovernanceFilesystemBindings(service: GovernanceService, options?: CreateGovernanceFilesystemBindingsOptions): NonNullable<_hachej_boring_agent_server.RegisterAgentRoutesOptions['getFilesystemBindings']>;
+
+declare function normalizePolicyEmail(value: string): string;
+declare function validateGovernancePolicy(input: unknown): GovernancePolicy;
+
+interface BuildGovernanceOptions extends Omit<LoadGovernancePolicyOptions, 'config'> {
+    config?: Pick<CoreConfig, 'auth'>;
+}
+declare function buildGovernanceService(options?: BuildGovernanceOptions): Promise<GovernanceService>;
+type GovernanceMeteringOptions = Parameters<typeof createGovernanceMeteringSink>[0];
+interface CreateGovernanceResult {
+    service: GovernanceService;
+    status: ReturnType<GovernanceService['policyStatus']>;
+    serverPlugin: CoreWorkspaceAgentServerPlugin;
+    filterModels: RegisterAgentRoutesOptions['filterModels'];
+    createMeteringSink(delegate: AgentMeteringSink, getDb: GovernanceMeteringOptions['getDb']): AgentMeteringSink;
+    getFilesystemBindings(options?: CreateGovernanceFilesystemBindingsOptions): NonNullable<RegisterAgentRoutesOptions['getFilesystemBindings']>;
+    pi: {
+        strictModelResolution: boolean;
+    };
+}
+declare function createGovernance(config: CoreConfig): Promise<CreateGovernanceResult>;
+declare function createGovernanceModelFilter(service: GovernanceService): RegisterAgentRoutesOptions['filterModels'];
+declare function createGovernanceServerPlugin(service: GovernanceService): CoreWorkspaceAgentServerPlugin;
+
+export { type BuildGovernanceOptions, type CompanyContextRootResolver, type CreateGovernanceFilesystemBindingsOptions, type CreateGovernanceResult, GOVERNANCE_DEV_EMAIL_VERIFICATION_OVERRIDE_ENV, GOVERNANCE_POLICY_PATH_ENV, type GovernanceFilesystemBindingContext, type GovernanceLoadResult, type GovernanceMeResponse, type GovernanceModelGrant, type GovernancePolicy, GovernancePolicyError, type GovernancePolicyErrorCode, type GovernancePolicyStatus, GovernanceService, type GovernanceUserLike, type GovernanceUserPolicy, type ServedModelLike, type TenantRole, buildGovernanceService, createDefaultCompanyContextRootResolver, createGovernance, createGovernanceFilesystemBindings, createGovernanceMeteringSink, createGovernanceModelFilter, createGovernanceServerPlugin, loadGovernancePolicy, normalizePolicyEmail, validateGovernancePolicy };