@llm-dev-ops/agentics-cli 1.4.26 → 1.4.29

package/dist/bundled-agents/data-vault-agents/dist/agents/data-access-control/handler.js

@@ -0,0 +1,346 @@
+/**
+ * LLM-Data-Vault: Data Access Control Edge Function Handler
+ *
+ * Google Cloud Edge Function handler for the Data Access Control Agent.
+ * Handles HTTP requests, validates input, invokes the agent, and
+ * emits telemetry.
+ *
+ * CRITICAL:
+ * - Exactly ONE DecisionEvent MUST be emitted per invocation
+ * - Handler MUST persist DecisionEvent to ruvector-service
+ * - Handler MUST return deterministic, machine-readable output
+ *
+ * @module agents/data-access-control/handler
+ */
+import { z } from 'zod';
+import { createDataAccessControlAgent, AGENT_ID, AGENT_VERSION, } from './agent.js';
+import { createDataAccessRuVectorClient, } from './ruvector-client.js';
+import { getTelemetry, initTelemetry } from '../../telemetry/index.js';
+/**
+ * Request validation schema (for quick validation before full agent processing)
+ */
+const RequestValidationSchema = z.object({
+    request_id: z.string().uuid(),
+    subject: z.object({
+        subject_id: z.string(),
+        subject_type: z.enum(['user', 'service', 'agent', 'system']),
+        roles: z.array(z.string()),
+        tenant_id: z.string(),
+    }).passthrough(),
+    resource: z.object({
+        resource_id: z.string(),
+        resource_type: z.enum(['dataset', 'record', 'field', 'schema', 'policy', 'tenant']),
+        tenant_id: z.string(),
+    }).passthrough(),
+    permission: z.enum(['read', 'write', 'delete', 'admin', 'export', 'anonymize', 'share']),
+    context: z.object({
+        timestamp: z.string().datetime(),
+        request_id: z.string().uuid(),
+    }).passthrough(),
+});
+/**
+ * Global state (initialized once per cold start)
+ */
+let agent = null;
+let ruvectorClient = null;
+let isInitialized = false;
+/**
+ * Initialize the handler
+ */
+function initializeHandler(config) {
+    if (isInitialized)
+        return;
+    // Initialize telemetry
+    if (config.enableTelemetry) {
+        initTelemetry({
+            service_name: `llm-data-vault-${AGENT_ID}`,
+            environment: config.environment ?? process.env['NODE_ENV'] ?? 'production',
+            version: AGENT_VERSION,
+            otlp_endpoint: process.env['OTLP_ENDPOINT'],
+            log_level: process.env['LOG_LEVEL'] ?? 'info',
+        });
+    }
+    // Initialize RuVector client
+    try {
+        ruvectorClient = createDataAccessRuVectorClient();
+    }
+    catch (error) {
+        console.warn('RuVector client not configured:', error);
+        // Continue without persistence in development
+        if (config.environment === 'production') {
+            throw error;
+        }
+    }
+    // Initialize agent
+    agent = createDataAccessControlAgent(config.policies, 
+    // Pass base client if available (the agent expects RuVectorClient, not our extended client)
+    undefined);
+    isInitialized = true;
+}
+/**
+ * Main Edge Function handler
+ *
+ * This is the entry point for Google Cloud Functions.
+ *
+ * @param req - Express-compatible request object
+ * @param res - Express-compatible response object
+ * @param config - Handler configuration
+ */
+export async function handleDataAccessControl(req, res, config) {
+    const startTime = performance.now();
+    const executionRef = crypto.randomUUID();
+    const timestamp = new Date().toISOString();
+    // Initialize on first request
+    initializeHandler(config);
+    // Set response headers
+    res.setHeader('Content-Type', 'application/json');
+    res.setHeader('X-Agent-Id', AGENT_ID);
+    res.setHeader('X-Agent-Version', AGENT_VERSION);
+    res.setHeader('X-Execution-Ref', executionRef);
+    try {
+        // Validate HTTP method
+        if (req.method !== 'POST') {
+            res.status(405).json(createErrorResponse('METHOD_NOT_ALLOWED', `Method ${req.method} not allowed. Use POST.`, executionRef, timestamp, startTime));
+            return;
+        }
+        // Parse request body
+        const body = req.body;
+        if (!body || typeof body !== 'object') {
+            res.status(400).json(createErrorResponse('INVALID_REQUEST_BODY', 'Request body must be a valid JSON object', executionRef, timestamp, startTime));
+            return;
+        }
+        // Quick validation (before full agent processing)
+        if (config.enableValidation !== false) {
+            const validationResult = RequestValidationSchema.safeParse(body);
+            if (!validationResult.success) {
+                res.status(400).json(createErrorResponse('VALIDATION_FAILED', 'Request validation failed', executionRef, timestamp, startTime, validationResult.error.errors));
+                return;
+            }
+        }
+        // Build execution context
+        const context = {
+            execution_ref: executionRef,
+            correlation_id: req.headers['x-correlation-id'] ?? undefined,
+            parent_execution_ref: req.headers['x-parent-execution-ref'] ?? undefined,
+            tenant_id: body.subject?.tenant_id ?? req.headers['x-tenant-id'],
+            request_source: mapRequestSource(req),
+            timestamp,
+        };
+        // Ensure agent is initialized
+        if (!agent) {
+            res.status(500).json(createErrorResponse('AGENT_NOT_INITIALIZED', 'Agent failed to initialize', executionRef, timestamp, startTime));
+            return;
+        }
+        // Invoke the agent
+        const result = await agent.invoke(body, context);
+        // CRITICAL: Persist DecisionEvent to ruvector-service
+        // This MUST happen for every invocation
+        await persistDecisionEvent(result.decision_event, executionRef);
+        // Build response
+        const processingTimeMs = Math.round(performance.now() - startTime);
+        if (result.success && result.data) {
+            // Set caching headers if enabled and decision is cacheable
+            if (config.enableCaching && result.data.cache_ttl_seconds) {
+                res.setHeader('Cache-Control', `private, max-age=${result.data.cache_ttl_seconds}`);
+            }
+            const response = {
+                success: true,
+                data: {
+                    request_id: result.data.request_id,
+                    decision: result.data.decision,
+                    granted_permissions: result.data.granted_permissions,
+                    denial_reasons: result.data.denial_reasons,
+                    conditions: result.data.conditions,
+                    cache_ttl_seconds: result.data.cache_ttl_seconds,
+                },
+                metadata: {
+                    agent_id: AGENT_ID,
+                    agent_version: AGENT_VERSION,
+                    execution_ref: executionRef,
+                    timestamp,
+                    processing_time_ms: processingTimeMs,
+                },
+            };
+            // Return appropriate status code based on decision
+            const statusCode = result.data.decision === 'deny' ? 403 : 200;
+            res.status(statusCode).json(response);
+        }
+        else {
+            // Agent execution failed
+            res.status(500).json(createErrorResponse(result.error?.code ?? 'AGENT_ERROR', result.error?.message ?? 'Agent execution failed', executionRef, timestamp, startTime, result.error?.details));
+        }
+    }
+    catch (error) {
+        // Unexpected error
+        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+        // Emit error telemetry
+        getTelemetry().recordInvocationComplete(AGENT_ID, AGENT_VERSION, executionRef, performance.now() - startTime, false, { error: errorMessage });
+        res.status(500).json(createErrorResponse('INTERNAL_ERROR', errorMessage, executionRef, timestamp, startTime));
+    }
+}
+/**
+ * Persist decision event to ruvector-service
+ *
+ * This is CRITICAL - exactly ONE DecisionEvent must be emitted per invocation.
+ */
+async function persistDecisionEvent(event, executionRef) {
+    if (!ruvectorClient) {
+        // Log warning but don't fail (for development)
+        console.warn(`[${executionRef}] RuVector client not available - decision event not persisted`);
+        getTelemetry().emit({
+            event_type: 'decision_event_persist_failed',
+            timestamp: new Date().toISOString(),
+            agent_id: AGENT_ID,
+            agent_version: AGENT_VERSION,
+            execution_ref: executionRef,
+            metadata: { reason: 'client_not_configured' },
+        });
+        return;
+    }
+    try {
+        const result = await ruvectorClient.persistDecision(event);
+        if (result.success) {
+            getTelemetry().emit({
+                event_type: 'decision_event_persisted',
+                timestamp: new Date().toISOString(),
+                agent_id: AGENT_ID,
+                agent_version: AGENT_VERSION,
+                execution_ref: executionRef,
+                metadata: { event_id: result.event_id },
+            });
+        }
+        else {
+            getTelemetry().emit({
+                event_type: 'decision_event_persist_failed',
+                timestamp: new Date().toISOString(),
+                agent_id: AGENT_ID,
+                agent_version: AGENT_VERSION,
+                execution_ref: executionRef,
+                metadata: {
+                    error_code: result.error?.code,
+                    error_message: result.error?.message,
+                    retryable: result.error?.retryable,
+                },
+            });
+        }
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+        getTelemetry().emit({
+            event_type: 'decision_event_persist_failed',
+            timestamp: new Date().toISOString(),
+            agent_id: AGENT_ID,
+            agent_version: AGENT_VERSION,
+            execution_ref: executionRef,
+            metadata: { error: errorMessage },
+        });
+        // Re-throw in production to ensure persistence failures are not silently ignored
+        if (process.env['NODE_ENV'] === 'production') {
+            throw error;
+        }
+    }
+}
+/**
+ * Create error response
+ */
+function createErrorResponse(code, message, executionRef, timestamp, startTime, details) {
+    return {
+        success: false,
+        error: {
+            code,
+            message,
+            details,
+        },
+        metadata: {
+            agent_id: AGENT_ID,
+            agent_version: AGENT_VERSION,
+            execution_ref: executionRef,
+            timestamp,
+            processing_time_ms: Math.round(performance.now() - startTime),
+        },
+    };
+}
+/**
+ * Map request to source type
+ */
+function mapRequestSource(req) {
+    const source = req.headers['x-request-source'];
+    switch (source?.toLowerCase()) {
+        case 'orchestrator':
+            return 'orchestrator';
+        case 'inference_gateway':
+        case 'inference-gateway':
+            return 'inference_gateway';
+        case 'policy_engine':
+        case 'policy-engine':
+            return 'policy_engine';
+        case 'governance':
+            return 'governance';
+        case 'cli':
+            return 'cli';
+        case 'api':
+        default:
+            return 'api';
+    }
+}
+/**
+ * Create handler factory for Google Cloud Functions
+ *
+ * Usage:
+ * ```typescript
+ * import { createHandler } from './handler';
+ *
+ * export const dataAccessControl = createHandler({
+ *   policies: loadPolicies(),
+ *   enableTelemetry: true,
+ * });
+ * ```
+ */
+export function createHandler(config) {
+    return async (req, res) => {
+        await handleDataAccessControl(req, res, config);
+    };
+}
+/**
+ * Health check handler
+ */
+export async function handleHealthCheck(_req, res) {
+    const health = {
+        status: 'healthy',
+        agent_id: AGENT_ID,
+        agent_version: AGENT_VERSION,
+        timestamp: new Date().toISOString(),
+        checks: {
+            agent_initialized: isInitialized,
+            ruvector_available: ruvectorClient !== null,
+        },
+    };
+    // Check RuVector health if available
+    if (ruvectorClient) {
+        try {
+            const ruvectorHealth = await ruvectorClient.healthCheck();
+            health.checks = {
+                ...health.checks,
+                ruvector_healthy: ruvectorHealth.healthy,
+                ruvector_latency_ms: ruvectorHealth.latencyMs,
+                ruvector_circuit_state: ruvectorHealth.circuitState,
+            };
+            if (!ruvectorHealth.healthy) {
+                health.status = 'degraded';
+            }
+        }
+        catch {
+            health.status = 'degraded';
+        }
+    }
+    res.status(health.status === 'healthy' ? 200 : 503).json(health);
+}
+/**
+ * Reset handler state (for testing)
+ */
+export function resetHandlerState() {
+    agent = null;
+    ruvectorClient = null;
+    isInitialized = false;
+}
+//# sourceMappingURL=handler.js.map

package/dist/bundled-agents/data-vault-agents/dist/agents/data-access-control/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../src/agents/data-access-control/handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,4BAA4B,EAC5B,QAAQ,EACR,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAEL,8BAA8B,GAC/B,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AA0DvE;;GAEG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5D,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;KACtB,CAAC,CAAC,WAAW,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;KACtB,CAAC,CAAC,WAAW,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACxF,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;KAC9B,CAAC,CAAC,WAAW,EAAE;CACjB,CAAC,CAAC;AAEH;;GAEG;AACH,IAAI,KAAK,GAAkC,IAAI,CAAC;AAChD,IAAI,cAAc,GAAoC,IAAI,CAAC;AAC3D,IAAI,aAAa,GAAG,KAAK,CAAC;AAE1B;;GAEG;AACH,SAAS,iBAAiB,CAAC,MAAqB;IAC9C,IAAI,aAAa;QAAE,OAAO;IAE1B,uBAAuB;IACvB,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,aAAa,CAAC;YACZ,YAAY,EAAE,kBAAkB,QAAQ,EAAE;YAC1C,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,YAAY;YAC1E,OAAO,EAAE,aAAa;YACtB,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAC3C,SAAS,EAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAyC,IAAI,MAAM;SACvF,CAAC,CAAC;IACL,CAAC;IAED,6BAA6B;IAC7B,IAAI,CAAC;QACH,cAAc,GAAG,8BAA8B,EAAE,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;QACvD,8CAA8C;QAC9C,IAAI,MAAM,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;YACxC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,mBAAmB;IACnB,KAAK,GAAG,4BAA4B,CAClC,MAAM,CAAC,QAAQ;IACf,4FAA4F;IAC5F,SAAS,CACV,CAAC;IAEF,aAAa,GAAG,IAAI,CAAC;AACvB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAY,EACZ,GAAa,EACb,MAAqB;IAErB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,8BAA8B;IAC9B,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE1B,uBAAuB;IACvB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAClD,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACtC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAChD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IAE/C,IAAI,CAAC;QACH,uBAAuB;QACvB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CACtC,oBAAoB,EACpB,UAAU,GAAG,CAAC,MAAM,yBAAyB,EAC7C,YAAY,EACZ,SAAS,EACT,SAAS,CACV,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,qBAAqB;QACrB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CACtC,sBAAsB,EACtB,0CAA0C,EAC1C,YAAY,EACZ,SAAS,EACT,SAAS,CACV,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,kDAAkD;QAClD,IAAI,MAAM,CAAC,gBAAgB,KAAK,KAAK,EAAE,CAAC;YACtC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACjE,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CACtC,mBAAmB,EACnB,2BAA2B,EAC3B,YAAY,EACZ,SAAS,EACT,SAAS,EACT,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAC9B,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;QACH,CAAC;QAED,0BAA0B;QAC1B,MAAM,OAAO,GAAqB;YAChC,aAAa,EAAE,YAAY;YAC3B,cAAc,EAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAY,IAAI,SAAS;YACxE,oBAAoB,EAAG,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAY,IAAI,SAAS;YACpF,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,IAAK,GAAG,CAAC,OAAO,CAAC,aAAa,CAAY;YAC5E,cAAc,EAAE,gBAAgB,CAAC,GAAG,CAAC;YACrC,SAAS;SACV,CAAC;QAEF,8BAA8B;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CACtC,uBAAuB,EACvB,4BAA4B,EAC5B,YAAY,EACZ,SAAS,EACT,SAAS,CACV,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,mBAAmB;QACnB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAe,EAAE,OAAO,CAAC,CAAC;QAE5D,sDAAsD;QACtD,wCAAwC;QACxC,MAAM,oBAAoB,CAAC,MAAM,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;QAEhE,iBAAiB;QACjB,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;QAEnE,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,2DAA2D;YAC3D,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC1D,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,oBAAoB,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;YACtF,CAAC;YAED,MAAM,QAAQ,GAAoB;gBAChC,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;oBAClC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;oBAC9B,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB;oBACpD,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc;oBAC1C,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;oBAClC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB;iBACjD;gBACD,QAAQ,EAAE;oBACR,QAAQ,EAAE,QAAQ;oBAClB,aAAa,EAAE,aAAa;oBAC5B,aAAa,EAAE,YAAY;oBAC3B,SAAS;oBACT,kBAAkB,EAAE,gBAAgB;iBACrC;aACF,CAAC;YAEF,mDAAmD;YACnD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,yBAAyB;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CACtC,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,aAAa,EACnC,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,wBAAwB,EACjD,YAAY,EACZ,SAAS,EACT,SAAS,EACT,MAAM,CAAC,KAAK,EAAE,OAAO,CACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mBAAmB;QACnB,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QAE9E,uBAAuB;QACvB,YAAY,EAAE,CAAC,wBAAwB,CACrC,QAAQ,EACR,aAAa,EACb,YAAY,EACZ,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,EAC7B,KAAK,EACL,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB,CAAC;QAEF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CACtC,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,SAAS,CACV,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CACjC,KAAoB,EACpB,YAAoB;IAEpB,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,+CAA+C;QAC/C,OAAO,CAAC,IAAI,CAAC,IAAI,YAAY,gEAAgE,CAAC,CAAC;QAC/F,YAAY,EAAE,CAAC,IAAI,CAAC;YAClB,UAAU,EAAE,+BAA+B;YAC3C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,QAAQ,EAAE,QAAQ;YAClB,aAAa,EAAE,aAAa;YAC5B,aAAa,EAAE,YAAY;YAC3B,QAAQ,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE;SAC9C,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAE3D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,YAAY,EAAE,CAAC,IAAI,CAAC;gBAClB,UAAU,EAAE,0BAA0B;gBACtC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,QAAQ,EAAE,QAAQ;gBAClB,aAAa,EAAE,aAAa;gBAC5B,aAAa,EAAE,YAAY;gBAC3B,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,YAAY,EAAE,CAAC,IAAI,CAAC;gBAClB,UAAU,EAAE,+BAA+B;gBAC3C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,QAAQ,EAAE,QAAQ;gBAClB,aAAa,EAAE,aAAa;gBAC5B,aAAa,EAAE,YAAY;gBAC3B,QAAQ,EAAE;oBACR,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI;oBAC9B,aAAa,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO;oBACpC,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS;iBACnC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QAC9E,YAAY,EAAE,CAAC,IAAI,CAAC;YAClB,UAAU,EAAE,+BAA+B;YAC3C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,QAAQ,EAAE,QAAQ;YAClB,aAAa,EAAE,aAAa;YAC5B,aAAa,EAAE,YAAY;YAC3B,QAAQ,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;SAClC,CAAC,CAAC;QAEH,iFAAiF;QACjF,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,EAAE,CAAC;YAC7C,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,IAAY,EACZ,OAAe,EACf,YAAoB,EACpB,SAAiB,EACjB,SAAiB,EACjB,OAAiB;IAEjB,OAAO;QACL,OAAO,EAAE,KAAK;QACd,KAAK,EAAE;YACL,IAAI;YACJ,OAAO;YACP,OAAO;SACR;QACD,QAAQ,EAAE;YACR,QAAQ,EAAE,QAAQ;YAClB,aAAa,EAAE,aAAa;YAC5B,aAAa,EAAE,YAAY;YAC3B,SAAS;YACT,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;SAC9D;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CACvB,GAAY;IAEZ,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAW,CAAC;IAEzD,QAAQ,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC;QAC9B,KAAK,cAAc;YACjB,OAAO,cAAc,CAAC;QACxB,KAAK,mBAAmB,CAAC;QACzB,KAAK,mBAAmB;YACtB,OAAO,mBAAmB,CAAC;QAC7B,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe;YAClB,OAAO,eAAe,CAAC;QACzB,KAAK,YAAY;YACf,OAAO,YAAY,CAAC;QACtB,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf,KAAK,KAAK,CAAC;QACX;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAqB;IAErB,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;QAC1D,MAAM,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAa,EACb,GAAa;IAEb,MAAM,MAAM,GAAG;QACb,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,QAAQ;QAClB,aAAa,EAAE,aAAa;QAC5B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,MAAM,EAAE;YACN,iBAAiB,EAAE,aAAa;YAChC,kBAAkB,EAAE,cAAc,KAAK,IAAI;SAC5C;KACF,CAAC;IAEF,qCAAqC;IACrC,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,CAAC;YAC1D,MAAM,CAAC,MAAM,GAAG;gBACd,GAAG,MAAM,CAAC,MAAM;gBAChB,gBAAgB,EAAE,cAAc,CAAC,OAAO;gBACxC,mBAAmB,EAAE,cAAc,CAAC,SAAS;gBAC7C,sBAAsB,EAAE,cAAc,CAAC,YAAY;aAKpD,CAAC;YAEF,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;gBAC5B,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC;YAC7B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACnE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,KAAK,GAAG,IAAI,CAAC;IACb,cAAc,GAAG,IAAI,CAAC;IACtB,aAAa,GAAG,KAAK,CAAC;AACxB,CAAC"}

package/dist/bundled-agents/data-vault-agents/dist/agents/data-access-control/index.d.ts

@@ -0,0 +1,36 @@
+/**
+ * LLM-Data-Vault: Data Access Control Agent
+ *
+ * Main export module for the Data Access Control Agent.
+ * This agent evaluates data access requests using RBAC/ABAC policies
+ * and regulatory constraints (GDPR, CCPA, HIPAA).
+ *
+ * @example
+ * ```typescript
+ * import {
+ *   DataAccessControlAgent,
+ *   createDataAccessControlAgent,
+ *   createHandler,
+ *   PolicyEvaluator,
+ * } from '@llm-data-vault/agents/data-access-control';
+ *
+ * // Create agent with policies
+ * const agent = createDataAccessControlAgent(policies);
+ *
+ * // Or create Edge Function handler
+ * export const dataAccessControl = createHandler({
+ *   policies,
+ *   enableTelemetry: true,
+ * });
+ * ```
+ *
+ * @module agents/data-access-control
+ */
+export { DataAccessControlAgent, createDataAccessControlAgent, AGENT_ID, AGENT_VERSION, type DataAccessControlAgentConfig, } from './agent.js';
+export { PolicyEvaluator, createDefaultPolicyEvaluator, createGDPRConstraints, createHIPAAConstraints, createCCPAConstraints, DEFAULT_CONFIG as DEFAULT_EVALUATOR_CONFIG, type PolicyEvaluatorConfig, type RegulatoryFramework, type RegulatoryConstraint, type RegulatoryRequirement, type RBACEvaluationResult, type ABACEvaluationResult, type RegulatoryEvaluationResult, type PolicyEvaluationSummary, } from './policy-evaluator.js';
+export { DataAccessRuVectorClient, createDataAccessRuVectorClient, type DataAccessRuVectorConfig, } from './ruvector-client.js';
+export { handleDataAccessControl, handleHealthCheck, createHandler, resetHandlerState, type HandlerConfig, } from './handler.js';
+export type { AccessAuthorizationRequest, AccessAuthorizationResponse, AccessPolicy, AccessPolicyRule, PolicyCondition, PolicyEvaluationResult, Subject, Resource, AccessContext, PermissionType, ResourceType, AccessDecision, } from '../../contracts/index.js';
+export type { AgentMetadata, ExecutionContext, AgentResult, } from '../../runtime/agent-base.js';
+export type { DecisionEvent, DecisionType, AppliedConstraint, ConfidenceBreakdown, } from '../../contracts/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/bundled-agents/data-vault-agents/dist/agents/data-access-control/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/agents/data-access-control/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAC5B,QAAQ,EACR,aAAa,EACb,KAAK,4BAA4B,GAClC,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,4BAA4B,EAC5B,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,cAAc,IAAI,wBAAwB,EAC1C,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,uBAAuB,GAC7B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AAGtB,YAAY,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,OAAO,EACP,QAAQ,EACR,aAAa,EACb,cAAc,EACd,YAAY,EACZ,cAAc,GACf,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,WAAW,GACZ,MAAM,6BAA6B,CAAC;AAGrC,YAAY,EACV,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC"}

package/dist/bundled-agents/data-vault-agents/dist/agents/data-access-control/index.js

@@ -0,0 +1,37 @@
+/**
+ * LLM-Data-Vault: Data Access Control Agent
+ *
+ * Main export module for the Data Access Control Agent.
+ * This agent evaluates data access requests using RBAC/ABAC policies
+ * and regulatory constraints (GDPR, CCPA, HIPAA).
+ *
+ * @example
+ * ```typescript
+ * import {
+ *   DataAccessControlAgent,
+ *   createDataAccessControlAgent,
+ *   createHandler,
+ *   PolicyEvaluator,
+ * } from '@llm-data-vault/agents/data-access-control';
+ *
+ * // Create agent with policies
+ * const agent = createDataAccessControlAgent(policies);
+ *
+ * // Or create Edge Function handler
+ * export const dataAccessControl = createHandler({
+ *   policies,
+ *   enableTelemetry: true,
+ * });
+ * ```
+ *
+ * @module agents/data-access-control
+ */
+// Agent exports
+export { DataAccessControlAgent, createDataAccessControlAgent, AGENT_ID, AGENT_VERSION, } from './agent.js';
+// Policy evaluator exports
+export { PolicyEvaluator, createDefaultPolicyEvaluator, createGDPRConstraints, createHIPAAConstraints, createCCPAConstraints, DEFAULT_CONFIG as DEFAULT_EVALUATOR_CONFIG, } from './policy-evaluator.js';
+// RuVector client exports
+export { DataAccessRuVectorClient, createDataAccessRuVectorClient, } from './ruvector-client.js';
+// Handler exports
+export { handleDataAccessControl, handleHealthCheck, createHandler, resetHandlerState, } from './handler.js';
+//# sourceMappingURL=index.js.map

package/dist/bundled-agents/data-vault-agents/dist/agents/data-access-control/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/agents/data-access-control/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,gBAAgB;AAChB,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAC5B,QAAQ,EACR,aAAa,GAEd,MAAM,YAAY,CAAC;AAEpB,2BAA2B;AAC3B,OAAO,EACL,eAAe,EACf,4BAA4B,EAC5B,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,cAAc,IAAI,wBAAwB,GAS3C,MAAM,uBAAuB,CAAC;AAE/B,0BAA0B;AAC1B,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAE/B,MAAM,sBAAsB,CAAC;AAE9B,kBAAkB;AAClB,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,GAElB,MAAM,cAAc,CAAC"}

package/dist/bundled-agents/data-vault-agents/dist/agents/data-access-control/policy-evaluator.d.ts

@@ -0,0 +1,234 @@
+/**
+ * LLM-Data-Vault: Policy Evaluator
+ *
+ * Evaluates RBAC/ABAC policies for data access control decisions.
+ * Supports regulatory constraints (GDPR, CCPA, HIPAA).
+ *
+ * CRITICAL CONSTRAINTS:
+ * - Evaluator MUST be stateless
+ * - Evaluator MUST NOT execute inference
+ * - Evaluator MUST return deterministic results
+ *
+ * @module agents/data-access-control/policy-evaluator
+ */
+import type { Subject, Resource, AccessContext, AccessPolicy, PermissionType } from '../../contracts/index.js';
+/**
+ * Regulatory framework types
+ */
+export type RegulatoryFramework = 'GDPR' | 'CCPA' | 'HIPAA' | 'SOX' | 'PCI_DSS' | 'FERPA';
+/**
+ * Regulatory constraint configuration
+ */
+export interface RegulatoryConstraint {
+    /** Regulatory framework */
+    framework: RegulatoryFramework;
+    /** Whether this constraint is enforced */
+    enforced: boolean;
+    /** Requirements for this framework */
+    requirements: RegulatoryRequirement[];
+}
+/**
+ * Individual regulatory requirement
+ */
+export interface RegulatoryRequirement {
+    /** Requirement identifier */
+    id: string;
+    /** Human-readable description */
+    description: string;
+    /** Condition function */
+    condition: (subject: Subject, resource: Resource, context: AccessContext) => boolean;
+    /** Effect when requirement is not met */
+    effect: 'deny' | 'warn' | 'audit';
+    /** Priority (higher = evaluated first) */
+    priority: number;
+}
+/**
+ * RBAC evaluation result
+ */
+export interface RBACEvaluationResult {
+    /** Whether access is allowed by RBAC */
+    allowed: boolean;
+    /** Matching roles */
+    matchingRoles: string[];
+    /** Granted permissions */
+    grantedPermissions: PermissionType[];
+    /** Reason for decision */
+    reason: string;
+    /** Confidence score (0-1) */
+    confidence: number;
+}
+/**
+ * ABAC evaluation result
+ */
+export interface ABACEvaluationResult {
+    /** Whether access is allowed by ABAC */
+    allowed: boolean;
+    /** Matching rules */
+    matchingRules: string[];
+    /** Evaluated conditions */
+    evaluatedConditions: Array<{
+        condition: string;
+        result: boolean;
+    }>;
+    /** Reason for decision */
+    reason: string;
+    /** Confidence score (0-1) */
+    confidence: number;
+}
+/**
+ * Regulatory evaluation result
+ */
+export interface RegulatoryEvaluationResult {
+    /** Whether access is allowed by regulatory constraints */
+    allowed: boolean;
+    /** Applicable frameworks */
+    applicableFrameworks: RegulatoryFramework[];
+    /** Violations detected */
+    violations: Array<{
+        framework: RegulatoryFramework;
+        requirementId: string;
+        description: string;
+        severity: 'deny' | 'warn' | 'audit';
+    }>;
+    /** Confidence score (0-1) */
+    confidence: number;
+}
+/**
+ * Combined policy evaluation result
+ */
+export interface PolicyEvaluationSummary {
+    /** Final decision */
+    decision: 'allow' | 'deny';
+    /** Overall confidence (weighted average) */
+    confidence: number;
+    /** RBAC evaluation details */
+    rbac: RBACEvaluationResult;
+    /** ABAC evaluation details */
+    abac: ABACEvaluationResult;
+    /** Regulatory evaluation details */
+    regulatory: RegulatoryEvaluationResult;
+    /** Combined reasons */
+    reasons: string[];
+    /** Decision source */
+    decisionSource: 'rbac' | 'abac' | 'regulatory' | 'combined' | 'default';
+}
+/**
+ * Policy evaluator configuration
+ */
+export interface PolicyEvaluatorConfig {
+    /** Default effect when no policy matches */
+    defaultEffect: 'allow' | 'deny';
+    /** Enable RBAC evaluation */
+    enableRBAC: boolean;
+    /** Enable ABAC evaluation */
+    enableABAC: boolean;
+    /** Enable regulatory constraint checking */
+    enableRegulatory: boolean;
+    /** Weight for RBAC in confidence calculation */
+    rbacWeight: number;
+    /** Weight for ABAC in confidence calculation */
+    abacWeight: number;
+    /** Weight for regulatory in confidence calculation */
+    regulatoryWeight: number;
+}
+/**
+ * Default policy evaluator configuration
+ */
+export declare const DEFAULT_CONFIG: PolicyEvaluatorConfig;
+/**
+ * Policy Evaluator
+ *
+ * Evaluates RBAC, ABAC, and regulatory policies to make access control decisions.
+ */
+export declare class PolicyEvaluator {
+    private readonly config;
+    private readonly policies;
+    private readonly regulatoryConstraints;
+    /**
+     * Creates a new PolicyEvaluator
+     *
+     * @param policies - Access policies to evaluate
+     * @param regulatoryConstraints - Regulatory constraints to enforce
+     * @param config - Evaluator configuration
+     */
+    constructor(policies: AccessPolicy[], regulatoryConstraints?: RegulatoryConstraint[], config?: Partial<PolicyEvaluatorConfig>);
+    /**
+     * Evaluate all policies for an access request
+     *
+     * @param subject - Who is requesting access
+     * @param resource - What resource is being accessed
+     * @param permission - What permission is requested
+     * @param context - Environmental context
+     * @returns Combined evaluation result
+     */
+    evaluate(subject: Subject, resource: Resource, permission: PermissionType, context: AccessContext): PolicyEvaluationSummary;
+    /**
+     * Evaluate RBAC policies
+     */
+    private evaluateRBAC;
+    /**
+     * Evaluate ABAC policies
+     */
+    private evaluateABAC;
+    /**
+     * Evaluate regulatory constraints
+     */
+    private evaluateRegulatory;
+    /**
+     * Combine RBAC, ABAC, and regulatory results into final decision
+     */
+    private combineResults;
+    /**
+     * Match subject roles against rule
+     */
+    private matchSubjectRoles;
+    /**
+     * Match resource against rule
+     */
+    private matchResource;
+    /**
+     * Evaluate policy conditions against attributes
+     */
+    private evaluateConditions;
+    /**
+     * Evaluate a single condition
+     */
+    private evaluateCondition;
+    /**
+     * Get nested value from object using dot notation
+     */
+    private getNestedValue;
+    /**
+     * Match a glob pattern against a value
+     */
+    private matchPattern;
+    /**
+     * Calculate confidence score for a rule match
+     */
+    private calculateRuleConfidence;
+    /**
+     * Calculate confidence based on number of satisfied conditions
+     */
+    private calculateConditionConfidence;
+    /**
+     * Calculate combined confidence from all evaluation results
+     */
+    private calculateCombinedConfidence;
+}
+/**
+ * Create default GDPR regulatory constraints
+ */
+export declare function createGDPRConstraints(): RegulatoryConstraint;
+/**
+ * Create default HIPAA regulatory constraints
+ */
+export declare function createHIPAAConstraints(): RegulatoryConstraint;
+/**
+ * Create default CCPA regulatory constraints
+ */
+export declare function createCCPAConstraints(): RegulatoryConstraint;
+/**
+ * Create a PolicyEvaluator with all default regulatory constraints
+ */
+export declare function createDefaultPolicyEvaluator(policies: AccessPolicy[], config?: Partial<PolicyEvaluatorConfig>): PolicyEvaluator;
+//# sourceMappingURL=policy-evaluator.d.ts.map