@llm-dev-ops/agentics-cli 1.4.32 → 1.4.35

package/dist/bundled-agents/policy-engine-agents/dist/api/routes/evaluations.js

@@ -0,0 +1,311 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Hardened Evaluation Routes
+ *
+ * Enterprise-grade policy evaluation endpoints with:
+ * - Agentics-only identity verification
+ * - Post-auth rate limiting
+ * - Correlation ID tracking
+ * - Enterprise metrics
+ */
+const express_1 = require("express");
+const policy_repository_1 = require("@db/models/policy-repository");
+const evaluation_repository_1 = require("@db/models/evaluation-repository");
+const policy_engine_1 = require("@core/engine/policy-engine");
+const cache_manager_1 = require("@cache/cache-manager");
+const error_handler_1 = require("../middleware/error-handler");
+const logger_1 = __importDefault(require("@utils/logger"));
+const uuid_1 = require("uuid");
+const crypto_1 = __importDefault(require("crypto"));
+// Security modules
+const agentics_identity_1 = require("../../security/agentics-identity");
+const rate_limiter_1 = require("../../security/rate-limiter");
+const metrics_1 = require("../../security/metrics");
+const router = (0, express_1.Router)();
+const policyRepository = new policy_repository_1.PolicyRepository();
+const evaluationRepository = new evaluation_repository_1.EvaluationRepository();
+/**
+ * Add correlation ID to all requests
+ */
+function addCorrelationId(req, _res, next) {
+    const authReq = req;
+    if (!authReq.correlationId) {
+        authReq.correlationId = req.get('x-correlation-id') || (0, uuid_1.v4)();
+    }
+    next();
+}
+router.use(addCorrelationId);
+/**
+ * POST /api/evaluate
+ * Evaluate policies against context
+ */
+router.post('/', agentics_identity_1.requireAgenticsIdentity, agentics_identity_1.requireReadScope, rate_limiter_1.evaluationRateLimiter, (0, error_handler_1.asyncHandler)(async (req, res) => {
+    const authReq = req;
+    const { context, policies, trace = false, dryRun = false, useCache = true } = req.body;
+    if (!context) {
+        res.status(400).json({
+            error: 'MISSING_CONTEXT',
+            message: 'Evaluation context is required',
+            correlationId: authReq.correlationId,
+        });
+        return;
+    }
+    const requestId = (0, uuid_1.v4)();
+    const startTime = Date.now();
+    const request = {
+        requestId,
+        context,
+        policies,
+        trace,
+        dryRun,
+    };
+    let response;
+    let cached = false;
+    if (useCache && !trace && !dryRun) {
+        const cacheKey = generateCacheKey(context, policies);
+        const cachedResult = await cache_manager_1.cacheManager.get(cacheKey);
+        if (cachedResult) {
+            logger_1.default.info({
+                correlationId: authReq.correlationId,
+                requestId,
+                cached: true,
+                actor: (0, agentics_identity_1.getActorIdentity)(authReq.identity),
+            }, 'Returning cached evaluation');
+            res.json({
+                ...cachedResult,
+                requestId,
+                cached: true,
+                correlationId: authReq.correlationId,
+            });
+            return;
+        }
+        const activePolicies = await policyRepository.findActive();
+        const engine = new policy_engine_1.PolicyEngine(activePolicies);
+        response = await engine.evaluate(request);
+        cached = true;
+        await cache_manager_1.cacheManager.set(cacheKey, response, 60);
+    }
+    else {
+        const activePolicies = await policyRepository.findActive();
+        const engine = new policy_engine_1.PolicyEngine(activePolicies);
+        response = await engine.evaluate(request);
+    }
+    const evaluationTimeMs = Date.now() - startTime;
+    if (!dryRun) {
+        await evaluationRepository.log(request, response);
+    }
+    // Record metrics
+    for (const policyId of response.decision.matchedPolicies || []) {
+        (0, metrics_1.recordEvaluation)(policyId, response.decision.decision, 'default', // namespace
+        evaluationTimeMs, cached);
+    }
+    (0, metrics_1.recordDecision)(response.decision.decision, 'default', // namespace
+    'evaluation');
+    logger_1.default.info({
+        correlationId: authReq.correlationId,
+        requestId,
+        decision: response.decision.decision,
+        allowed: response.decision.allowed,
+        evaluationTimeMs,
+        matchedPolicies: response.decision.matchedPolicies?.length || 0,
+        actor: (0, agentics_identity_1.getActorIdentity)(authReq.identity),
+    }, 'Policy evaluation completed');
+    res.json({
+        ...response,
+        correlationId: authReq.correlationId,
+    });
+}));
+/**
+ * POST /api/evaluate/batch
+ * Batch evaluate multiple contexts
+ */
+router.post('/batch', agentics_identity_1.requireAgenticsIdentity, agentics_identity_1.requireReadScope, rate_limiter_1.evaluationRateLimiter, (0, error_handler_1.asyncHandler)(async (req, res) => {
+    const authReq = req;
+    const { contexts, policies, trace = false, dryRun = false } = req.body;
+    if (!contexts || !Array.isArray(contexts)) {
+        res.status(400).json({
+            error: 'INVALID_REQUEST',
+            message: 'contexts must be an array',
+            correlationId: authReq.correlationId,
+        });
+        return;
+    }
+    if (contexts.length > 100) {
+        res.status(400).json({
+            error: 'BATCH_SIZE_EXCEEDED',
+            message: 'Maximum batch size is 100',
+            correlationId: authReq.correlationId,
+        });
+        return;
+    }
+    const startTime = Date.now();
+    const activePolicies = await policyRepository.findActive();
+    const engine = new policy_engine_1.PolicyEngine(activePolicies);
+    const results = await Promise.all(contexts.map(async (context) => {
+        const requestId = (0, uuid_1.v4)();
+        const request = {
+            requestId,
+            context,
+            policies,
+            trace,
+            dryRun,
+        };
+        const response = await engine.evaluate(request);
+        if (!dryRun) {
+            await evaluationRepository.log(request, response);
+        }
+        return response;
+    }));
+    const evaluationTimeMs = Date.now() - startTime;
+    // Record aggregated metrics
+    const allowedCount = results.filter(r => r.decision.allowed).length;
+    const deniedCount = results.length - allowedCount;
+    logger_1.default.info({
+        correlationId: authReq.correlationId,
+        batchSize: contexts.length,
+        evaluationTimeMs,
+        allowedCount,
+        deniedCount,
+        actor: (0, agentics_identity_1.getActorIdentity)(authReq.identity),
+    }, 'Batch evaluation completed');
+    res.json({
+        results,
+        count: results.length,
+        summary: {
+            allowed: allowedCount,
+            denied: deniedCount,
+            evaluationTimeMs,
+        },
+        correlationId: authReq.correlationId,
+    });
+}));
+/**
+ * GET /api/evaluate/history
+ * Get evaluation history
+ */
+router.get('/history', agentics_identity_1.requireAgenticsIdentity, agentics_identity_1.requireReadScope, rate_limiter_1.readRateLimiter, (0, error_handler_1.asyncHandler)(async (req, res) => {
+    const authReq = req;
+    const { requestId, policyId, decision, allowed, startDate, endDate, limit = '100', offset = '0', } = req.query;
+    const filters = {
+        limit: parseInt(limit, 10),
+        offset: parseInt(offset, 10),
+    };
+    if (requestId)
+        filters.requestId = requestId;
+    if (policyId)
+        filters.policyIds = [policyId];
+    if (decision)
+        filters.decision = decision;
+    if (allowed !== undefined)
+        filters.allowed = allowed === 'true';
+    if (startDate)
+        filters.startDate = new Date(startDate);
+    if (endDate)
+        filters.endDate = new Date(endDate);
+    const evaluations = await evaluationRepository.find(filters);
+    logger_1.default.info({
+        correlationId: authReq.correlationId,
+        count: evaluations.length,
+        filters: { requestId, policyId, decision, allowed },
+        actor: (0, agentics_identity_1.getActorIdentity)(authReq.identity),
+    }, 'Evaluation history retrieved');
+    res.json({
+        evaluations,
+        count: evaluations.length,
+        limit: filters.limit,
+        offset: filters.offset,
+        correlationId: authReq.correlationId,
+    });
+}));
+/**
+ * GET /api/evaluate/history/:requestId
+ * Get specific evaluation by request ID
+ */
+router.get('/history/:requestId', agentics_identity_1.requireAgenticsIdentity, agentics_identity_1.requireReadScope, rate_limiter_1.readRateLimiter, (0, error_handler_1.asyncHandler)(async (req, res) => {
+    const authReq = req;
+    const { requestId } = req.params;
+    const evaluation = await evaluationRepository.findByRequestId(requestId);
+    if (!evaluation) {
+        res.status(404).json({
+            error: 'EVALUATION_NOT_FOUND',
+            message: `Evaluation not found: ${requestId}`,
+            correlationId: authReq.correlationId,
+        });
+        return;
+    }
+    logger_1.default.info({
+        correlationId: authReq.correlationId,
+        requestId,
+        actor: (0, agentics_identity_1.getActorIdentity)(authReq.identity),
+    }, 'Evaluation retrieved');
+    res.json({
+        evaluation,
+        correlationId: authReq.correlationId,
+    });
+}));
+/**
+ * GET /api/evaluate/stats
+ * Get evaluation statistics
+ */
+router.get('/stats', agentics_identity_1.requireAgenticsIdentity, agentics_identity_1.requireReadScope, rate_limiter_1.readRateLimiter, (0, error_handler_1.asyncHandler)(async (req, res) => {
+    const authReq = req;
+    const { days = '7' } = req.query;
+    const daysNum = parseInt(days, 10);
+    const startDate = new Date();
+    startDate.setDate(startDate.getDate() - daysNum);
+    const stats = await evaluationRepository.getStats(startDate);
+    logger_1.default.info({
+        correlationId: authReq.correlationId,
+        days: daysNum,
+        actor: (0, agentics_identity_1.getActorIdentity)(authReq.identity),
+    }, 'Evaluation stats retrieved');
+    res.json({
+        stats,
+        period: { days: daysNum, startDate },
+        correlationId: authReq.correlationId,
+    });
+}));
+/**
+ * DELETE /api/evaluate/history
+ * Delete old evaluation history (admin only)
+ */
+router.delete('/history', agentics_identity_1.requireAgenticsIdentity, agentics_identity_1.requireAdminScope, rate_limiter_1.strictRateLimiter, (0, error_handler_1.asyncHandler)(async (req, res) => {
+    const authReq = req;
+    const { days = '90' } = req.query;
+    const daysNum = parseInt(days, 10);
+    // Safety check: don't delete less than 30 days old data
+    if (daysNum < 30) {
+        res.status(400).json({
+            error: 'INVALID_RETENTION_PERIOD',
+            message: 'Minimum retention period is 30 days',
+            correlationId: authReq.correlationId,
+        });
+        return;
+    }
+    const deletedCount = await evaluationRepository.deleteOlderThan(daysNum);
+    logger_1.default.info({
+        correlationId: authReq.correlationId,
+        deletedCount,
+        days: daysNum,
+        actor: (0, agentics_identity_1.getActorIdentity)(authReq.identity),
+    }, 'Old evaluations deleted');
+    res.json({
+        deletedCount,
+        days: daysNum,
+        correlationId: authReq.correlationId,
+    });
+}));
+/**
+ * Generate cache key for evaluation
+ */
+function generateCacheKey(context, policies) {
+    const data = JSON.stringify({ context, policies: policies?.sort() });
+    const hash = crypto_1.default.createHash('sha256').update(data).digest('hex');
+    return `evaluation:${hash}`;
+}
+exports.default = router;
+//# sourceMappingURL=evaluations.js.map

package/dist/bundled-agents/policy-engine-agents/dist/api/routes/evaluations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluations.js","sourceRoot":"","sources":["../../../src/api/routes/evaluations.ts"],"names":[],"mappings":";;;;;AAAA;;;;;;;;GAQG;AACH,qCAAkE;AAClE,oEAAgE;AAChE,4EAAwE;AACxE,8DAA0D;AAC1D,wDAAoD;AACpD,+DAA2D;AAC3D,2DAAmC;AAEnC,+BAAoC;AACpC,oDAA4B;AAE5B,mBAAmB;AACnB,wEAM0C;AAC1C,8DAIqC;AACrC,oDAGgC;AAEhC,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;AACxB,MAAM,gBAAgB,GAAG,IAAI,oCAAgB,EAAE,CAAC;AAChD,MAAM,oBAAoB,GAAG,IAAI,4CAAoB,EAAE,CAAC;AAExD;;GAEG;AACH,SAAS,gBAAgB,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB;IACxE,MAAM,OAAO,GAAG,GAA2B,CAAC;IAC5C,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,OAAO,CAAC,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,IAAA,SAAM,GAAE,CAAC;IAClE,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC;AAED,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAE7B;;;GAGG;AACH,MAAM,CAAC,IAAI,CACT,GAAG,EACH,2CAAuB,EACvB,oCAAgB,EAChB,oCAAqB,EACrB,IAAA,4BAAY,EAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACjD,MAAM,OAAO,GAAG,GAA2B,CAAC;IAC5C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,GAAG,KAAK,EAAE,MAAM,GAAG,KAAK,EAAE,QAAQ,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;IAEvF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,iBAAiB;YACxB,OAAO,EAAE,gCAAgC;YACzC,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,IAAA,SAAM,GAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,MAAM,OAAO,GAA4B;QACvC,SAAS;QACT,OAAO;QACP,QAAQ;QACR,KAAK;QACL,MAAM;KACP,CAAC;IAEF,IAAI,QAAkC,CAAC;IACvC,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,IAAI,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,MAAM,4BAAY,CAAC,GAAG,CAA2B,QAAQ,CAAC,CAAC;QAEhF,IAAI,YAAY,EAAE,CAAC;YACjB,gBAAM,CAAC,IAAI,CAAC;gBACV,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,SAAS;gBACT,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,IAAA,oCAAgB,EAAC,OAAO,CAAC,QAAQ,CAAC;aAC1C,EAAE,6BAA6B,CAAC,CAAC;YAElC,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,YAAY;gBACf,SAAS;gBACT,MAAM,EAAE,IAAI;gBACZ,aAAa,EAAE,OAAO,CAAC,aAAa;aACrC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,4BAAY,CAAC,cAAc,CAAC,CAAC;QAChD,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,GAAG,IAAI,CAAC;QAEd,MAAM,4BAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,4BAAY,CAAC,cAAc,CAAC,CAAC;QAChD,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAEhD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;IAED,iBAAiB;IACjB,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;QAC/D,IAAA,0BAAgB,EACd,QAAQ,EACR,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAC1B,SAAS,EAAE,YAAY;QACvB,gBAAgB,EAChB,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAA,wBAAc,EACZ,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAC1B,SAAS,EAAE,YAAY;IACvB,YAAY,CACb,CAAC;IAEF,gBAAM,CAAC,IAAI,CAAC;QACV,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,SAAS;QACT,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ;QACpC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO;QAClC,gBAAgB;QAChB,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,IAAI,CAAC;QAC/D,KAAK,EAAE,IAAA,oCAAgB,EAAC,OAAO,CAAC,QAAQ,CAAC;KAC1C,EAAE,6BAA6B,CAAC,CAAC;IAElC,GAAG,CAAC,IAAI,CAAC;QACP,GAAG,QAAQ;QACX,aAAa,EAAE,OAAO,CAAC,aAAa;KACrC,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,IAAI,CACT,QAAQ,EACR,2CAAuB,EACvB,oCAAgB,EAChB,oCAAqB,EACrB,IAAA,4BAAY,EAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACjD,MAAM,OAAO,GAAG,GAA2B,CAAC;IAC5C,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,GAAG,KAAK,EAAE,MAAM,GAAG,KAAK,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;IAEvE,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,iBAAiB;YACxB,OAAO,EAAE,2BAA2B;YACpC,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,2BAA2B;YACpC,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,4BAAY,CAAC,cAAc,CAAC,CAAC;IAEhD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7B,MAAM,SAAS,GAAG,IAAA,SAAM,GAAE,CAAC;QAC3B,MAAM,OAAO,GAA4B;YACvC,SAAS;YACT,OAAO;YACP,QAAQ;YACR,KAAK;YACL,MAAM;SACP,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAEhD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAEhD,4BAA4B;IAC5B,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACpE,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC;IAElD,gBAAM,CAAC,IAAI,CAAC;QACV,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,SAAS,EAAE,QAAQ,CAAC,MAAM;QAC1B,gBAAgB;QAChB,YAAY;QACZ,WAAW;QACX,KAAK,EAAE,IAAA,oCAAgB,EAAC,OAAO,CAAC,QAAQ,CAAC;KAC1C,EAAE,4BAA4B,CAAC,CAAC;IAEjC,GAAG,CAAC,IAAI,CAAC;QACP,OAAO;QACP,KAAK,EAAE,OAAO,CAAC,MAAM;QACrB,OAAO,EAAE;YACP,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,WAAW;YACnB,gBAAgB;SACjB;QACD,aAAa,EAAE,OAAO,CAAC,aAAa;KACrC,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,GAAG,CACR,UAAU,EACV,2CAAuB,EACvB,oCAAgB,EAChB,8BAAe,EACf,IAAA,4BAAY,EAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACjD,MAAM,OAAO,GAAG,GAA2B,CAAC;IAC5C,MAAM,EACJ,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,OAAO,EACP,SAAS,EACT,OAAO,EACP,KAAK,GAAG,KAAK,EACb,MAAM,GAAG,GAAG,GACb,GAAG,GAAG,CAAC,KAAK,CAAC;IAEd,MAAM,OAAO,GAAQ;QACnB,KAAK,EAAE,QAAQ,CAAC,KAAe,EAAE,EAAE,CAAC;QACpC,MAAM,EAAE,QAAQ,CAAC,MAAgB,EAAE,EAAE,CAAC;KACvC,CAAC;IAEF,IAAI,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,SAAmB,CAAC;IACvD,IAAI,QAAQ;QAAE,OAAO,CAAC,SAAS,GAAG,CAAC,QAAkB,CAAC,CAAC;IACvD,IAAI,QAAQ;QAAE,OAAO,CAAC,QAAQ,GAAG,QAAkB,CAAC;IACpD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,OAAO,GAAG,OAAO,KAAK,MAAM,CAAC;IAChE,IAAI,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,SAAmB,CAAC,CAAC;IACjE,IAAI,OAAO;QAAE,OAAO,CAAC,OAAO,GAAG,IAAI,IAAI,CAAC,OAAiB,CAAC,CAAC;IAE3D,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAE7D,gBAAM,CAAC,IAAI,CAAC;QACV,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,KAAK,EAAE,WAAW,CAAC,MAAM;QACzB,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE;QACnD,KAAK,EAAE,IAAA,oCAAgB,EAAC,OAAO,CAAC,QAAQ,CAAC;KAC1C,EAAE,8BAA8B,CAAC,CAAC;IAEnC,GAAG,CAAC,IAAI,CAAC;QACP,WAAW;QACX,KAAK,EAAE,WAAW,CAAC,MAAM;QACzB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,aAAa,EAAE,OAAO,CAAC,aAAa;KACrC,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,GAAG,CACR,qBAAqB,EACrB,2CAAuB,EACvB,oCAAgB,EAChB,8BAAe,EACf,IAAA,4BAAY,EAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACjD,MAAM,OAAO,GAAG,GAA2B,CAAC;IAC5C,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;IAEjC,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IAEzE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,yBAAyB,SAAS,EAAE;YAC7C,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,gBAAM,CAAC,IAAI,CAAC;QACV,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,SAAS;QACT,KAAK,EAAE,IAAA,oCAAgB,EAAC,OAAO,CAAC,QAAQ,CAAC;KAC1C,EAAE,sBAAsB,CAAC,CAAC;IAE3B,GAAG,CAAC,IAAI,CAAC;QACP,UAAU;QACV,aAAa,EAAE,OAAO,CAAC,aAAa;KACrC,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,GAAG,CACR,QAAQ,EACR,2CAAuB,EACvB,oCAAgB,EAChB,8BAAe,EACf,IAAA,4BAAY,EAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACjD,MAAM,OAAO,GAAG,GAA2B,CAAC;IAC5C,MAAM,EAAE,IAAI,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;IAEjC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAc,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;IAEjD,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAE7D,gBAAM,CAAC,IAAI,CAAC;QACV,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,IAAA,oCAAgB,EAAC,OAAO,CAAC,QAAQ,CAAC;KAC1C,EAAE,4BAA4B,CAAC,CAAC;IAEjC,GAAG,CAAC,IAAI,CAAC;QACP,KAAK;QACL,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE;QACpC,aAAa,EAAE,OAAO,CAAC,aAAa;KACrC,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,CACX,UAAU,EACV,2CAAuB,EACvB,qCAAiB,EACjB,gCAAiB,EACjB,IAAA,4BAAY,EAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACjD,MAAM,OAAO,GAAG,GAA2B,CAAC;IAC5C,MAAM,EAAE,IAAI,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;IAElC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAc,EAAE,EAAE,CAAC,CAAC;IAE7C,wDAAwD;IACxD,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC;QACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,0BAA0B;YACjC,OAAO,EAAE,qCAAqC;YAC9C,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IAEzE,gBAAM,CAAC,IAAI,CAAC;QACV,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,YAAY;QACZ,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,IAAA,oCAAgB,EAAC,OAAO,CAAC,QAAQ,CAAC;KAC1C,EAAE,yBAAyB,CAAC,CAAC;IAE9B,GAAG,CAAC,IAAI,CAAC;QACP,YAAY;QACZ,IAAI,EAAE,OAAO;QACb,aAAa,EAAE,OAAO,CAAC,aAAa;KACrC,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC;AAEF;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAY,EAAE,QAAmB;IACzD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,gBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,cAAc,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,kBAAe,MAAM,CAAC"}

package/dist/bundled-agents/policy-engine-agents/dist/api/routes/internal-evaluate.d.ts

@@ -0,0 +1,3 @@
+declare const router: any;
+export default router;
+//# sourceMappingURL=internal-evaluate.d.ts.map

package/dist/bundled-agents/policy-engine-agents/dist/api/routes/internal-evaluate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-evaluate.d.ts","sourceRoot":"","sources":["../../../src/api/routes/internal-evaluate.ts"],"names":[],"mappings":"AAsBA,QAAA,MAAM,MAAM,KAAW,CAAC;AAiJxB,eAAe,MAAM,CAAC"}

package/dist/bundled-agents/policy-engine-agents/dist/api/routes/internal-evaluate.js

@@ -0,0 +1,133 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Internal Evaluation Routes
+ *
+ * Unauthenticated endpoint for internal Cloud Run-to-Cloud Run calls.
+ * Perimeter security is handled by Cloud Run IAM — these endpoints
+ * MUST NOT be exposed to the public internet without IAM ingress controls.
+ *
+ * Mirrors the evaluation logic of /api/evaluate without Agentics identity
+ * verification or scope checks.
+ */
+const express_1 = require("express");
+const policy_repository_1 = require("@db/models/policy-repository");
+const evaluation_repository_1 = require("@db/models/evaluation-repository");
+const policy_engine_1 = require("@core/engine/policy-engine");
+const cache_manager_1 = require("@cache/cache-manager");
+const error_handler_1 = require("../middleware/error-handler");
+const logger_1 = __importDefault(require("@utils/logger"));
+const uuid_1 = require("uuid");
+const crypto_1 = __importDefault(require("crypto"));
+const metrics_1 = require("../../security/metrics");
+const router = (0, express_1.Router)();
+const policyRepository = new policy_repository_1.PolicyRepository();
+const evaluationRepository = new evaluation_repository_1.EvaluationRepository();
+/**
+ * Add correlation ID to all internal requests
+ */
+function addCorrelationId(req, _res, next) {
+    req.correlationId =
+        req.get('x-correlation-id') || req.get('x-request-id') || `pe-internal-${(0, uuid_1.v4)()}`;
+    next();
+}
+router.use(addCorrelationId);
+/**
+ * POST /api/v1/internal/evaluate
+ *
+ * Internal policy evaluation — no auth required.
+ * Cloud Run IAM handles perimeter security.
+ */
+router.post('/evaluate', (0, error_handler_1.asyncHandler)(async (req, res) => {
+    const correlationId = req.correlationId;
+    const internalSource = req.get('x-internal-source') || 'unknown';
+    logger_1.default.info({
+        correlationId,
+        source: internalSource,
+        path: req.originalUrl,
+    }, 'Internal policy evaluation request');
+    const { context, policies, trace = false, dryRun = false, useCache = true } = req.body;
+    if (!context) {
+        res.status(400).json({
+            error: 'MISSING_CONTEXT',
+            message: 'Evaluation context is required',
+            correlationId,
+        });
+        return;
+    }
+    const requestId = (0, uuid_1.v4)();
+    const startTime = Date.now();
+    const request = {
+        requestId,
+        context,
+        policies,
+        trace,
+        dryRun,
+    };
+    let response;
+    let cached = false;
+    if (useCache && !trace && !dryRun) {
+        const cacheKey = generateCacheKey(context, policies);
+        const cachedResult = await cache_manager_1.cacheManager.get(cacheKey);
+        if (cachedResult) {
+            logger_1.default.info({
+                correlationId,
+                requestId,
+                cached: true,
+                source: internalSource,
+            }, 'Returning cached internal evaluation');
+            res.json({
+                ...cachedResult,
+                requestId,
+                cached: true,
+                correlationId,
+            });
+            return;
+        }
+        const activePolicies = await policyRepository.findActive();
+        const engine = new policy_engine_1.PolicyEngine(activePolicies);
+        response = await engine.evaluate(request);
+        cached = true;
+        await cache_manager_1.cacheManager.set(cacheKey, response, 60);
+    }
+    else {
+        const activePolicies = await policyRepository.findActive();
+        const engine = new policy_engine_1.PolicyEngine(activePolicies);
+        response = await engine.evaluate(request);
+    }
+    const evaluationTimeMs = Date.now() - startTime;
+    if (!dryRun) {
+        await evaluationRepository.log(request, response);
+    }
+    // Record metrics
+    for (const policyId of response.decision.matchedPolicies || []) {
+        (0, metrics_1.recordEvaluation)(policyId, response.decision.decision, 'internal', evaluationTimeMs, cached);
+    }
+    (0, metrics_1.recordDecision)(response.decision.decision, 'internal', 'evaluation');
+    logger_1.default.info({
+        correlationId,
+        requestId,
+        decision: response.decision.decision,
+        allowed: response.decision.allowed,
+        evaluationTimeMs,
+        matchedPolicies: response.decision.matchedPolicies?.length || 0,
+        source: internalSource,
+    }, 'Internal policy evaluation completed');
+    res.json({
+        ...response,
+        correlationId,
+    });
+}));
+/**
+ * Generate cache key for evaluation
+ */
+function generateCacheKey(context, policies) {
+    const data = JSON.stringify({ context, policies: policies?.sort() });
+    const hash = crypto_1.default.createHash('sha256').update(data).digest('hex');
+    return `evaluation:${hash}`;
+}
+exports.default = router;
+//# sourceMappingURL=internal-evaluate.js.map

package/dist/bundled-agents/policy-engine-agents/dist/api/routes/internal-evaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-evaluate.js","sourceRoot":"","sources":["../../../src/api/routes/internal-evaluate.ts"],"names":[],"mappings":";;;;;AAAA;;;;;;;;;GASG;AACH,qCAAkE;AAClE,oEAAgE;AAChE,4EAAwE;AACxE,8DAA0D;AAC1D,wDAAoD;AACpD,+DAA2D;AAC3D,2DAAmC;AAEnC,+BAAoC;AACpC,oDAA4B;AAC5B,oDAA0E;AAE1E,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;AACxB,MAAM,gBAAgB,GAAG,IAAI,oCAAgB,EAAE,CAAC;AAChD,MAAM,oBAAoB,GAAG,IAAI,4CAAoB,EAAE,CAAC;AAExD;;GAEG;AACH,SAAS,gBAAgB,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB;IACvE,GAAW,CAAC,aAAa;QACxB,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,eAAe,IAAA,SAAM,GAAE,EAAE,CAAC;IACtF,IAAI,EAAE,CAAC;AACT,CAAC;AAED,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,CAAC,IAAI,CACT,WAAW,EACX,IAAA,4BAAY,EAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACjD,MAAM,aAAa,GAAI,GAAW,CAAC,aAAa,CAAC;IACjD,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,SAAS,CAAC;IAEjE,gBAAM,CAAC,IAAI,CACT;QACE,aAAa;QACb,MAAM,EAAE,cAAc;QACtB,IAAI,EAAE,GAAG,CAAC,WAAW;KACtB,EACD,oCAAoC,CACrC,CAAC;IAEF,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,GAAG,KAAK,EAAE,MAAM,GAAG,KAAK,EAAE,QAAQ,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;IAEvF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,iBAAiB;YACxB,OAAO,EAAE,gCAAgC;YACzC,aAAa;SACd,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,IAAA,SAAM,GAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,MAAM,OAAO,GAA4B;QACvC,SAAS;QACT,OAAO;QACP,QAAQ;QACR,KAAK;QACL,MAAM;KACP,CAAC;IAEF,IAAI,QAAkC,CAAC;IACvC,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,IAAI,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,MAAM,4BAAY,CAAC,GAAG,CAA2B,QAAQ,CAAC,CAAC;QAEhF,IAAI,YAAY,EAAE,CAAC;YACjB,gBAAM,CAAC,IAAI,CACT;gBACE,aAAa;gBACb,SAAS;gBACT,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,cAAc;aACvB,EACD,sCAAsC,CACvC,CAAC;YAEF,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,YAAY;gBACf,SAAS;gBACT,MAAM,EAAE,IAAI;gBACZ,aAAa;aACd,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,4BAAY,CAAC,cAAc,CAAC,CAAC;QAChD,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,GAAG,IAAI,CAAC;QAEd,MAAM,4BAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,4BAAY,CAAC,cAAc,CAAC,CAAC;QAChD,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAEhD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;IAED,iBAAiB;IACjB,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;QAC/D,IAAA,0BAAgB,EACd,QAAQ,EACR,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAC1B,UAAU,EACV,gBAAgB,EAChB,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAA,wBAAc,EAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IAErE,gBAAM,CAAC,IAAI,CACT;QACE,aAAa;QACb,SAAS;QACT,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ;QACpC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO;QAClC,gBAAgB;QAChB,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,IAAI,CAAC;QAC/D,MAAM,EAAE,cAAc;KACvB,EACD,sCAAsC,CACvC,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC;QACP,GAAG,QAAQ;QACX,aAAa;KACd,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC;AAEF;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAY,EAAE,QAAmB;IACzD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,gBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,cAAc,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,kBAAe,MAAM,CAAC"}

package/dist/bundled-agents/policy-engine-agents/dist/api/routes/policies.d.ts

@@ -0,0 +1,3 @@
+declare const router: any;
+export default router;
+//# sourceMappingURL=policies.d.ts.map

package/dist/bundled-agents/policy-engine-agents/dist/api/routes/policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.d.ts","sourceRoot":"","sources":["../../../src/api/routes/policies.ts"],"names":[],"mappings":"AA2DA,QAAA,MAAM,MAAM,KAAW,CAAC;AA4uBxB,eAAe,MAAM,CAAC"}