@llm-dev-ops/agentics-cli 1.4.32 → 1.4.35

package/dist/bundled-agents/policy-engine-agents/dist/security/rate-limiter.js

@@ -0,0 +1,147 @@
+"use strict";
+/**
+ * Post-Authentication Rate Limiter
+ *
+ * Rate limiting that applies AFTER authentication.
+ * Limits are per-identity, not per-IP.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.strictRateLimiter = exports.readRateLimiter = exports.mutationRateLimiter = exports.evaluationRateLimiter = void 0;
+exports.createPostAuthRateLimiter = createPostAuthRateLimiter;
+const logger_1 = __importDefault(require("@utils/logger"));
+const metrics_1 = require("./metrics");
+/**
+ * In-memory rate limit store
+ * In production, use Redis for distributed rate limiting
+ */
+const rateLimitStore = new Map();
+/**
+ * Clean up expired entries periodically
+ */
+setInterval(() => {
+    const now = Date.now();
+    for (const [key, value] of rateLimitStore.entries()) {
+        if (value.resetAt <= now) {
+            rateLimitStore.delete(key);
+        }
+    }
+}, 60000); // Clean up every minute
+/**
+ * Get rate limit key for identity
+ */
+function getRateLimitKey(identity, prefix) {
+    return `${prefix}:${identity.type}:${identity.subject}`;
+}
+/**
+ * Check and update rate limit
+ */
+function checkRateLimit(key, config) {
+    const now = Date.now();
+    let entry = rateLimitStore.get(key);
+    if (!entry || entry.resetAt <= now) {
+        // Start new window
+        entry = {
+            count: 1,
+            resetAt: now + config.windowMs,
+        };
+        rateLimitStore.set(key, entry);
+        return {
+            allowed: true,
+            remaining: config.maxRequests - 1,
+            resetAt: entry.resetAt,
+        };
+    }
+    // Increment count
+    entry.count++;
+    if (entry.count > config.maxRequests) {
+        return {
+            allowed: false,
+            remaining: 0,
+            resetAt: entry.resetAt,
+        };
+    }
+    return {
+        allowed: true,
+        remaining: config.maxRequests - entry.count,
+        resetAt: entry.resetAt,
+    };
+}
+/**
+ * Create post-auth rate limiter middleware
+ */
+function createPostAuthRateLimiter(config = {}) {
+    const fullConfig = {
+        windowMs: config.windowMs || 60000, // 1 minute default
+        maxRequests: config.maxRequests || 100, // 100 requests per minute default
+        keyPrefix: config.keyPrefix || 'rl',
+    };
+    return (req, res, next) => {
+        // Skip if no identity (shouldn't happen after auth middleware)
+        if (!req.identity) {
+            next();
+            return;
+        }
+        const key = getRateLimitKey(req.identity, fullConfig.keyPrefix);
+        const result = checkRateLimit(key, fullConfig);
+        // Set rate limit headers
+        res.setHeader('X-RateLimit-Limit', fullConfig.maxRequests);
+        res.setHeader('X-RateLimit-Remaining', result.remaining);
+        res.setHeader('X-RateLimit-Reset', Math.ceil(result.resetAt / 1000));
+        if (!result.allowed) {
+            logger_1.default.warn({
+                correlationId: req.correlationId,
+                subject: req.identity.subject,
+                path: req.path,
+                limit: fullConfig.maxRequests,
+                windowMs: fullConfig.windowMs,
+            }, 'Rate limit exceeded');
+            (0, metrics_1.recordRateLimitHit)(req.path, req.identity.subject);
+            res.status(429).json({
+                error: 'RATE_LIMIT_EXCEEDED',
+                message: 'Too many requests. Please try again later.',
+                correlationId: req.correlationId,
+                retryAfter: Math.ceil((result.resetAt - Date.now()) / 1000),
+            });
+            return;
+        }
+        next();
+    };
+}
+/**
+ * Evaluation endpoint rate limiter
+ * More restrictive for evaluation to prevent abuse
+ */
+exports.evaluationRateLimiter = createPostAuthRateLimiter({
+    windowMs: 60000, // 1 minute
+    maxRequests: 1000, // 1000 evaluations per minute
+    keyPrefix: 'eval',
+});
+/**
+ * Mutation endpoint rate limiter
+ * More restrictive for mutations
+ */
+exports.mutationRateLimiter = createPostAuthRateLimiter({
+    windowMs: 60000, // 1 minute
+    maxRequests: 50, // 50 mutations per minute
+    keyPrefix: 'mutate',
+});
+/**
+ * Read endpoint rate limiter
+ */
+exports.readRateLimiter = createPostAuthRateLimiter({
+    windowMs: 60000, // 1 minute
+    maxRequests: 500, // 500 reads per minute
+    keyPrefix: 'read',
+});
+/**
+ * Strict rate limiter for sensitive operations
+ */
+exports.strictRateLimiter = createPostAuthRateLimiter({
+    windowMs: 3600000, // 1 hour
+    maxRequests: 10, // 10 per hour
+    keyPrefix: 'strict',
+});
+//# sourceMappingURL=rate-limiter.js.map

package/dist/bundled-agents/policy-engine-agents/dist/security/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../src/security/rate-limiter.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;AAsFH,8DA4CC;AA/HD,2DAAmC;AAEnC,uCAA+C;AAW/C;;;GAGG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,EAA8C,CAAC;AAE7E;;GAEG;AACH,WAAW,CAAC,GAAG,EAAE;IACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YACzB,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;AACH,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,wBAAwB;AAEnC;;GAEG;AACH,SAAS,eAAe,CAAC,QAA0B,EAAE,MAAc;IACjE,OAAO,GAAG,MAAM,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;AAC1D,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CACrB,GAAW,EACX,MAAuB;IAEvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAEpC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;QACnC,mBAAmB;QACnB,KAAK,GAAG;YACN,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,GAAG,GAAG,MAAM,CAAC,QAAQ;SAC/B,CAAC;QACF,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,MAAM,CAAC,WAAW,GAAG,CAAC;YACjC,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;IACJ,CAAC;IAED,kBAAkB;IAClB,KAAK,CAAC,KAAK,EAAE,CAAC;IAEd,IAAI,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACrC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,KAAK;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,yBAAyB,CAAC,SAAmC,EAAE;IAC7E,MAAM,UAAU,GAAoB;QAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,KAAK,EAAO,mBAAmB;QAC5D,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,GAAG,EAAG,kCAAkC;QAC3E,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;KACpC,CAAC;IAEF,OAAO,CAAC,GAAyB,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC5E,+DAA+D;QAC/D,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAE/C,yBAAyB;QACzB,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;QAC3D,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACzD,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC;QAErE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,gBAAM,CAAC,IAAI,CAAC;gBACV,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;gBAC7B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,KAAK,EAAE,UAAU,CAAC,WAAW;gBAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;aAC9B,EAAE,qBAAqB,CAAC,CAAC;YAE1B,IAAA,4BAAkB,EAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAEnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,qBAAqB;gBAC5B,OAAO,EAAE,4CAA4C;gBACrD,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;aAC5D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACU,QAAA,qBAAqB,GAAG,yBAAyB,CAAC;IAC7D,QAAQ,EAAE,KAAK,EAAQ,WAAW;IAClC,WAAW,EAAE,IAAI,EAAM,8BAA8B;IACrD,SAAS,EAAE,MAAM;CAClB,CAAC,CAAC;AAEH;;;GAGG;AACU,QAAA,mBAAmB,GAAG,yBAAyB,CAAC;IAC3D,QAAQ,EAAE,KAAK,EAAQ,WAAW;IAClC,WAAW,EAAE,EAAE,EAAQ,0BAA0B;IACjD,SAAS,EAAE,QAAQ;CACpB,CAAC,CAAC;AAEH;;GAEG;AACU,QAAA,eAAe,GAAG,yBAAyB,CAAC;IACvD,QAAQ,EAAE,KAAK,EAAQ,WAAW;IAClC,WAAW,EAAE,GAAG,EAAO,uBAAuB;IAC9C,SAAS,EAAE,MAAM;CAClB,CAAC,CAAC;AAEH;;GAEG;AACU,QAAA,iBAAiB,GAAG,yBAAyB,CAAC;IACzD,QAAQ,EAAE,OAAO,EAAM,SAAS;IAChC,WAAW,EAAE,EAAE,EAAQ,cAAc;IACrC,SAAS,EAAE,QAAQ;CACpB,CAAC,CAAC"}

package/dist/bundled-agents/policy-engine-agents/dist/security/versioned-policy-repository.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Versioned Policy Repository
+ *
+ * Extends base repository with:
+ * - Automatic version incrementing
+ * - Version history tracking
+ * - Version-specific retrieval
+ * - Audit trail integration
+ */
+import { Policy, PolicyStatus } from '../types/policy';
+import { AgenticsIdentity } from './agentics-identity';
+/**
+ * Policy with version metadata
+ */
+export interface VersionedPolicy extends Policy {
+    internalVersion: number;
+    previousVersionId?: string;
+}
+/**
+ * Version query options
+ */
+export interface VersionQueryOptions {
+    version?: number;
+    latest?: boolean;
+}
+/**
+ * Versioned Policy Repository
+ */
+export declare class VersionedPolicyRepository {
+    /**
+     * Create a new policy with version 1
+     */
+    create(policy: Policy, identity: AgenticsIdentity, correlationId: string): Promise<VersionedPolicy>;
+    /**
+     * Get policy by ID with optional version
+     */
+    findById(id: string, options?: VersionQueryOptions): Promise<VersionedPolicy | null>;
+    /**
+     * Get all active policies
+     */
+    findActive(): Promise<VersionedPolicy[]>;
+    /**
+     * Get policies by namespace
+     */
+    findByNamespace(namespace: string): Promise<VersionedPolicy[]>;
+    /**
+     * Update policy with version increment
+     */
+    update(id: string, updates: Partial<Policy>, identity: AgenticsIdentity, correlationId: string, options?: {
+        hasApproval?: boolean;
+    }): Promise<VersionedPolicy>;
+    /**
+     * Delete policy (soft delete - marks as deprecated)
+     */
+    delete(id: string, identity: AgenticsIdentity, correlationId: string): Promise<void>;
+    /**
+     * Get version history for a policy
+     */
+    getVersionHistory(id: string): Promise<VersionedPolicy[]>;
+    /**
+     * Toggle policy status with proper governance
+     */
+    toggleStatus(id: string, newStatus: PolicyStatus, identity: AgenticsIdentity, correlationId: string, options?: {
+        hasApproval?: boolean;
+        approvalReason?: string;
+    }): Promise<VersionedPolicy>;
+    private mapRowToVersionedPolicy;
+}
+export declare const versionedPolicyRepository: VersionedPolicyRepository;
+//# sourceMappingURL=versioned-policy-repository.d.ts.map

package/dist/bundled-agents/policy-engine-agents/dist/security/versioned-policy-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"versioned-policy-repository.d.ts","sourceRoot":"","sources":["../../src/security/versioned-policy-repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAKvD,OAAO,EAAE,gBAAgB,EAAwB,MAAM,qBAAqB,CAAC;AAE7E;;GAEG;AACH,MAAM,WAAW,eAAgB,SAAQ,MAAM;IAC7C,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,qBAAa,yBAAyB;IACpC;;OAEG;IACG,MAAM,CACV,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,EAC1B,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,eAAe,CAAC;IA4D3B;;OAEG;IACG,QAAQ,CACZ,EAAE,EAAE,MAAM,EACV,OAAO,GAAE,mBAAsC,GAC9C,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAwClC;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAe9C;;OAEG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAepE;;OAEG;IACG,MAAM,CACV,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,EACxB,QAAQ,EAAE,gBAAgB,EAC1B,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAO,GACtC,OAAO,CAAC,eAAe,CAAC;IAkH3B;;OAEG;IACG,MAAM,CACV,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,gBAAgB,EAC1B,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IA+ChB;;OAEG;IACG,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAe/D;;OAEG;IACG,YAAY,CAChB,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,YAAY,EACvB,QAAQ,EAAE,gBAAgB,EAC1B,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAO,GAC/D,OAAO,CAAC,eAAe,CAAC;IAsC3B,OAAO,CAAC,uBAAuB;CAoBhC;AAGD,eAAO,MAAM,yBAAyB,2BAAkC,CAAC"}

package/dist/bundled-agents/policy-engine-agents/dist/security/versioned-policy-repository.js

@@ -0,0 +1,336 @@
+"use strict";
+/**
+ * Versioned Policy Repository
+ *
+ * Extends base repository with:
+ * - Automatic version incrementing
+ * - Version history tracking
+ * - Version-specific retrieval
+ * - Audit trail integration
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.versionedPolicyRepository = exports.VersionedPolicyRepository = void 0;
+const client_1 = require("@db/client");
+const policy_1 = require("../types/policy");
+const errors_1 = require("@utils/errors");
+const logger_1 = __importDefault(require("@utils/logger"));
+const audit_trail_1 = require("./audit-trail");
+const policy_governance_1 = require("./policy-governance");
+const agentics_identity_1 = require("./agentics-identity");
+/**
+ * Versioned Policy Repository
+ */
+class VersionedPolicyRepository {
+    /**
+     * Create a new policy with version 1
+     */
+    async create(policy, identity, correlationId) {
+        // Enforce governance before creation
+        (0, policy_governance_1.enforceGovernance)(policy, { isEnabling: policy.status === policy_1.PolicyStatus.ACTIVE });
+        try {
+            const result = await client_1.db.query(`INSERT INTO policies (
+          id, name, description, version, namespace, tags, priority,
+          status, rules, created_by, internal_version
+        ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+        RETURNING *`, [
+                policy.metadata.id,
+                policy.metadata.name,
+                policy.metadata.description,
+                policy.metadata.version,
+                policy.metadata.namespace,
+                policy.metadata.tags || [],
+                policy.metadata.priority || 0,
+                policy.status,
+                JSON.stringify(policy.rules),
+                identity.subject,
+                1, // Initial version
+            ]);
+            const created = this.mapRowToVersionedPolicy(result.rows[0]);
+            // Record audit entry
+            await audit_trail_1.auditTrail.record({
+                policyId: created.metadata.id,
+                policyVersion: created.internalVersion,
+                action: 'create',
+                actorIdentity: `${identity.type}:${identity.subject}`,
+                correlationId,
+                beforeState: null,
+                afterState: created,
+                metadata: {
+                    policyName: created.metadata.name,
+                    namespace: created.metadata.namespace,
+                },
+            });
+            logger_1.default.info({
+                policyId: created.metadata.id,
+                version: created.internalVersion,
+                correlationId,
+            }, 'Policy created');
+            return created;
+        }
+        catch (error) {
+            if (error instanceof errors_1.PolicyValidationError) {
+                throw error;
+            }
+            throw new errors_1.DatabaseError(`Failed to create policy: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * Get policy by ID with optional version
+     */
+    async findById(id, options = { latest: true }) {
+        try {
+            let result;
+            if (options.version !== undefined) {
+                // Get specific version from history
+                result = await client_1.db.query(`SELECT * FROM policy_versions
+           WHERE policy_id = $1 AND internal_version = $2`, [id, options.version]);
+                if (result.rows.length === 0) {
+                    throw new errors_1.PolicyValidationError(`Policy version ${options.version} not found for policy ${id}`);
+                }
+            }
+            else {
+                // Get latest from main table
+                result = await client_1.db.query('SELECT * FROM policies WHERE id = $1', [id]);
+            }
+            if (result.rows.length === 0) {
+                return null;
+            }
+            return this.mapRowToVersionedPolicy(result.rows[0]);
+        }
+        catch (error) {
+            if (error instanceof errors_1.PolicyValidationError) {
+                throw error;
+            }
+            throw new errors_1.DatabaseError(`Failed to find policy: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * Get all active policies
+     */
+    async findActive() {
+        try {
+            const result = await client_1.db.query(`SELECT * FROM policies
+         WHERE status = $1
+         ORDER BY priority DESC, created_at DESC`, ['active']);
+            return result.rows.map(row => this.mapRowToVersionedPolicy(row));
+        }
+        catch (error) {
+            throw new errors_1.DatabaseError('Failed to find active policies');
+        }
+    }
+    /**
+     * Get policies by namespace
+     */
+    async findByNamespace(namespace) {
+        try {
+            const result = await client_1.db.query(`SELECT * FROM policies
+         WHERE namespace = $1
+         ORDER BY priority DESC, created_at DESC`, [namespace]);
+            return result.rows.map(row => this.mapRowToVersionedPolicy(row));
+        }
+        catch (error) {
+            throw new errors_1.DatabaseError('Failed to find policies by namespace');
+        }
+    }
+    /**
+     * Update policy with version increment
+     */
+    async update(id, updates, identity, correlationId, options = {}) {
+        const existing = await this.findById(id);
+        if (!existing) {
+            throw new errors_1.PolicyNotFoundError(id);
+        }
+        // Merge updates
+        const updatedPolicy = {
+            metadata: {
+                ...existing.metadata,
+                ...updates.metadata,
+            },
+            rules: updates.rules || existing.rules,
+            status: updates.status || existing.status,
+        };
+        // Check if this is an enable operation
+        const isEnabling = updates.status === policy_1.PolicyStatus.ACTIVE &&
+            existing.status !== policy_1.PolicyStatus.ACTIVE;
+        // Enforce governance
+        (0, policy_governance_1.enforceGovernance)(updatedPolicy, {
+            isEnabling,
+            hasApproval: options.hasApproval || (0, agentics_identity_1.hasApprovalAuthority)(identity),
+        });
+        const newVersion = existing.internalVersion + 1;
+        try {
+            // Start transaction
+            await client_1.db.query('BEGIN');
+            // Archive current version
+            await client_1.db.query(`INSERT INTO policy_versions (
+          policy_id, name, description, version, namespace, tags, priority,
+          status, rules, created_by, internal_version, archived_at
+        )
+        SELECT id, name, description, version, namespace, tags, priority,
+               status, rules, created_by, internal_version, NOW()
+        FROM policies WHERE id = $1`, [id]);
+            // Update policy with new version
+            const result = await client_1.db.query(`UPDATE policies SET
+          name = $1, description = $2, version = $3, namespace = $4,
+          tags = $5, priority = $6, status = $7, rules = $8,
+          internal_version = $9, updated_at = NOW()
+        WHERE id = $10
+        RETURNING *`, [
+                updatedPolicy.metadata.name,
+                updatedPolicy.metadata.description,
+                updatedPolicy.metadata.version,
+                updatedPolicy.metadata.namespace,
+                updatedPolicy.metadata.tags || [],
+                updatedPolicy.metadata.priority || 0,
+                updatedPolicy.status,
+                JSON.stringify(updatedPolicy.rules),
+                newVersion,
+                id,
+            ]);
+            await client_1.db.query('COMMIT');
+            const updated = this.mapRowToVersionedPolicy(result.rows[0]);
+            // Determine audit action
+            let action = 'edit';
+            if (isEnabling) {
+                action = 'enable';
+            }
+            else if (updates.status === policy_1.PolicyStatus.DEPRECATED) {
+                action = 'disable';
+            }
+            // Record audit entry
+            await audit_trail_1.auditTrail.record({
+                policyId: id,
+                policyVersion: newVersion,
+                action,
+                actorIdentity: `${identity.type}:${identity.subject}`,
+                correlationId,
+                beforeState: existing,
+                afterState: updated,
+                metadata: {
+                    previousVersion: existing.internalVersion,
+                    changes: Object.keys(updates),
+                },
+            });
+            logger_1.default.info({
+                policyId: id,
+                previousVersion: existing.internalVersion,
+                newVersion,
+                action,
+                correlationId,
+            }, 'Policy updated');
+            return updated;
+        }
+        catch (error) {
+            await client_1.db.query('ROLLBACK');
+            if (error instanceof errors_1.PolicyValidationError) {
+                throw error;
+            }
+            throw new errors_1.DatabaseError(`Failed to update policy: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * Delete policy (soft delete - marks as deprecated)
+     */
+    async delete(id, identity, correlationId) {
+        const existing = await this.findById(id);
+        if (!existing) {
+            throw new errors_1.PolicyNotFoundError(id);
+        }
+        try {
+            // Archive before delete
+            await client_1.db.query(`INSERT INTO policy_versions (
+          policy_id, name, description, version, namespace, tags, priority,
+          status, rules, created_by, internal_version, archived_at, deleted
+        )
+        SELECT id, name, description, version, namespace, tags, priority,
+               status, rules, created_by, internal_version, NOW(), true
+        FROM policies WHERE id = $1`, [id]);
+            await client_1.db.query('DELETE FROM policies WHERE id = $1', [id]);
+            // Record audit entry
+            await audit_trail_1.auditTrail.record({
+                policyId: id,
+                policyVersion: existing.internalVersion,
+                action: 'delete',
+                actorIdentity: `${identity.type}:${identity.subject}`,
+                correlationId,
+                beforeState: existing,
+                afterState: null,
+                metadata: {
+                    deletedAt: new Date().toISOString(),
+                },
+            });
+            logger_1.default.info({
+                policyId: id,
+                version: existing.internalVersion,
+                correlationId,
+            }, 'Policy deleted');
+        }
+        catch (error) {
+            throw new errors_1.DatabaseError(`Failed to delete policy: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * Get version history for a policy
+     */
+    async getVersionHistory(id) {
+        try {
+            const result = await client_1.db.query(`SELECT * FROM policy_versions
+         WHERE policy_id = $1
+         ORDER BY internal_version DESC`, [id]);
+            return result.rows.map(row => this.mapRowToVersionedPolicy(row));
+        }
+        catch (error) {
+            throw new errors_1.DatabaseError('Failed to get version history');
+        }
+    }
+    /**
+     * Toggle policy status with proper governance
+     */
+    async toggleStatus(id, newStatus, identity, correlationId, options = {}) {
+        const existing = await this.findById(id);
+        if (!existing) {
+            throw new errors_1.PolicyNotFoundError(id);
+        }
+        const isEnabling = newStatus === policy_1.PolicyStatus.ACTIVE &&
+            existing.status !== policy_1.PolicyStatus.ACTIVE;
+        // Check governance
+        const governance = (0, policy_governance_1.validatePolicyGovernance)(existing, {
+            isEnabling,
+            hasApproval: options.hasApproval || (0, agentics_identity_1.hasApprovalAuthority)(identity),
+        });
+        if (!governance.valid) {
+            throw new errors_1.PolicyValidationError('Cannot change policy status due to governance violations', { violations: governance.violations });
+        }
+        if (governance.requiresApproval && !options.hasApproval && !(0, agentics_identity_1.hasApprovalAuthority)(identity)) {
+            throw new errors_1.PolicyValidationError(governance.approvalReason || 'This status change requires approval', { requiresApproval: true });
+        }
+        return this.update(id, { status: newStatus }, identity, correlationId, options);
+    }
+    mapRowToVersionedPolicy(row) {
+        return {
+            metadata: {
+                id: row.policy_id || row.id,
+                name: row.name,
+                description: row.description,
+                version: row.version,
+                namespace: row.namespace,
+                tags: row.tags || [],
+                createdAt: row.created_at,
+                updatedAt: row.updated_at,
+                createdBy: row.created_by,
+                priority: row.priority,
+            },
+            rules: typeof row.rules === 'string' ? JSON.parse(row.rules) : row.rules,
+            status: row.status,
+            internalVersion: row.internal_version || 1,
+            previousVersionId: row.previous_version_id,
+        };
+    }
+}
+exports.VersionedPolicyRepository = VersionedPolicyRepository;
+// Singleton instance
+exports.versionedPolicyRepository = new VersionedPolicyRepository();
+//# sourceMappingURL=versioned-policy-repository.js.map

package/dist/bundled-agents/policy-engine-agents/dist/security/versioned-policy-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"versioned-policy-repository.js","sourceRoot":"","sources":["../../src/security/versioned-policy-repository.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;;;;AAEH,uCAAgC;AAChC,4CAAuD;AACvD,0CAA0F;AAC1F,2DAAmC;AACnC,+CAAwD;AACxD,2DAAkF;AAClF,2DAA6E;AAkB7E;;GAEG;AACH,MAAa,yBAAyB;IACpC;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,MAAc,EACd,QAA0B,EAC1B,aAAqB;QAErB,qCAAqC;QACrC,IAAA,qCAAiB,EAAC,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,KAAK,qBAAY,CAAC,MAAM,EAAE,CAAC,CAAC;QAEjF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAE,CAAC,KAAK,CAC3B;;;;oBAIY,EACZ;gBACE,MAAM,CAAC,QAAQ,CAAC,EAAE;gBAClB,MAAM,CAAC,QAAQ,CAAC,IAAI;gBACpB,MAAM,CAAC,QAAQ,CAAC,WAAW;gBAC3B,MAAM,CAAC,QAAQ,CAAC,OAAO;gBACvB,MAAM,CAAC,QAAQ,CAAC,SAAS;gBACzB,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE;gBAC1B,MAAM,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC;gBAC7B,MAAM,CAAC,MAAM;gBACb,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC5B,QAAQ,CAAC,OAAO;gBAChB,CAAC,EAAE,kBAAkB;aACtB,CACF,CAAC;YAEF,MAAM,OAAO,GAAG,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAE7D,qBAAqB;YACrB,MAAM,wBAAU,CAAC,MAAM,CAAC;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAC7B,aAAa,EAAE,OAAO,CAAC,eAAe;gBACtC,MAAM,EAAE,QAAQ;gBAChB,aAAa,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE;gBACrD,aAAa;gBACb,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,OAAO;gBACnB,QAAQ,EAAE;oBACR,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;oBACjC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS;iBACtC;aACF,CAAC,CAAC;YAEH,gBAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAC7B,OAAO,EAAE,OAAO,CAAC,eAAe;gBAChC,aAAa;aACd,EAAE,gBAAgB,CAAC,CAAC;YAErB,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;gBAC3C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,sBAAa,CACrB,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACrF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CACZ,EAAU,EACV,UAA+B,EAAE,MAAM,EAAE,IAAI,EAAE;QAE/C,IAAI,CAAC;YACH,IAAI,MAAM,CAAC;YAEX,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAClC,oCAAoC;gBACpC,MAAM,GAAG,MAAM,WAAE,CAAC,KAAK,CACrB;0DACgD,EAChD,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CACtB,CAAC;gBAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,8BAAqB,CAC7B,kBAAkB,OAAO,CAAC,OAAO,yBAAyB,EAAE,EAAE,CAC/D,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,6BAA6B;gBAC7B,MAAM,GAAG,MAAM,WAAE,CAAC,KAAK,CACrB,sCAAsC,EACtC,CAAC,EAAE,CAAC,CACL,CAAC;YACJ,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;gBAC3C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,sBAAa,CACrB,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAE,CAAC,KAAK,CAC3B;;iDAEyC,EACzC,CAAC,QAAQ,CAAC,CACX,CAAC;YAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,sBAAa,CAAC,gCAAgC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CAAC,SAAiB;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAE,CAAC,KAAK,CAC3B;;iDAEyC,EACzC,CAAC,SAAS,CAAC,CACZ,CAAC;YAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,sBAAa,CAAC,sCAAsC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,EAAU,EACV,OAAwB,EACxB,QAA0B,EAC1B,aAAqB,EACrB,UAAqC,EAAE;QAEvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,4BAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,gBAAgB;QAChB,MAAM,aAAa,GAAW;YAC5B,QAAQ,EAAE;gBACR,GAAG,QAAQ,CAAC,QAAQ;gBACpB,GAAG,OAAO,CAAC,QAAQ;aACpB;YACD,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK;YACtC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM;SAC1C,CAAC;QAEF,uCAAuC;QACvC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,KAAK,qBAAY,CAAC,MAAM;YACtC,QAAQ,CAAC,MAAM,KAAK,qBAAY,CAAC,MAAM,CAAC;QAE3D,qBAAqB;QACrB,IAAA,qCAAiB,EAAC,aAAa,EAAE;YAC/B,UAAU;YACV,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAA,wCAAoB,EAAC,QAAQ,CAAC;SACnE,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,QAAQ,CAAC,eAAe,GAAG,CAAC,CAAC;QAEhD,IAAI,CAAC;YACH,oBAAoB;YACpB,MAAM,WAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAExB,0BAA0B;YAC1B,MAAM,WAAE,CAAC,KAAK,CACZ;;;;;;oCAM4B,EAC5B,CAAC,EAAE,CAAC,CACL,CAAC;YAEF,iCAAiC;YACjC,MAAM,MAAM,GAAG,MAAM,WAAE,CAAC,KAAK,CAC3B;;;;;oBAKY,EACZ;gBACE,aAAa,CAAC,QAAQ,CAAC,IAAI;gBAC3B,aAAa,CAAC,QAAQ,CAAC,WAAW;gBAClC,aAAa,CAAC,QAAQ,CAAC,OAAO;gBAC9B,aAAa,CAAC,QAAQ,CAAC,SAAS;gBAChC,aAAa,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE;gBACjC,aAAa,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC;gBACpC,aAAa,CAAC,MAAM;gBACpB,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC;gBACnC,UAAU;gBACV,EAAE;aACH,CACF,CAAC;YAEF,MAAM,WAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAE7D,yBAAyB;YACzB,IAAI,MAAM,GAAgB,MAAM,CAAC;YACjC,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,GAAG,QAAQ,CAAC;YACpB,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,KAAK,qBAAY,CAAC,UAAU,EAAE,CAAC;gBACtD,MAAM,GAAG,SAAS,CAAC;YACrB,CAAC;YAED,qBAAqB;YACrB,MAAM,wBAAU,CAAC,MAAM,CAAC;gBACtB,QAAQ,EAAE,EAAE;gBACZ,aAAa,EAAE,UAAU;gBACzB,MAAM;gBACN,aAAa,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE;gBACrD,aAAa;gBACb,WAAW,EAAE,QAAQ;gBACrB,UAAU,EAAE,OAAO;gBACnB,QAAQ,EAAE;oBACR,eAAe,EAAE,QAAQ,CAAC,eAAe;oBACzC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;iBAC9B;aACF,CAAC,CAAC;YAEH,gBAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,EAAE;gBACZ,eAAe,EAAE,QAAQ,CAAC,eAAe;gBACzC,UAAU;gBACV,MAAM;gBACN,aAAa;aACd,EAAE,gBAAgB,CAAC,CAAC;YAErB,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAE3B,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;gBAC3C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,sBAAa,CACrB,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACrF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,EAAU,EACV,QAA0B,EAC1B,aAAqB;QAErB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,4BAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,CAAC;YACH,wBAAwB;YACxB,MAAM,WAAE,CAAC,KAAK,CACZ;;;;;;oCAM4B,EAC5B,CAAC,EAAE,CAAC,CACL,CAAC;YAEF,MAAM,WAAE,CAAC,KAAK,CAAC,oCAAoC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAE3D,qBAAqB;YACrB,MAAM,wBAAU,CAAC,MAAM,CAAC;gBACtB,QAAQ,EAAE,EAAE;gBACZ,aAAa,EAAE,QAAQ,CAAC,eAAe;gBACvC,MAAM,EAAE,QAAQ;gBAChB,aAAa,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE;gBACrD,aAAa;gBACb,WAAW,EAAE,QAAQ;gBACrB,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE;oBACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC;aACF,CAAC,CAAC;YAEH,gBAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,QAAQ,CAAC,eAAe;gBACjC,aAAa;aACd,EAAE,gBAAgB,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,sBAAa,CACrB,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACrF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,EAAU;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAE,CAAC,KAAK,CAC3B;;wCAEgC,EAChC,CAAC,EAAE,CAAC,CACL,CAAC;YAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,sBAAa,CAAC,+BAA+B,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,EAAU,EACV,SAAuB,EACvB,QAA0B,EAC1B,aAAqB,EACrB,UAA8D,EAAE;QAEhE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,4BAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,UAAU,GAAG,SAAS,KAAK,qBAAY,CAAC,MAAM;YACjC,QAAQ,CAAC,MAAM,KAAK,qBAAY,CAAC,MAAM,CAAC;QAE3D,mBAAmB;QACnB,MAAM,UAAU,GAAG,IAAA,4CAAwB,EAAC,QAAQ,EAAE;YACpD,UAAU;YACV,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAA,wCAAoB,EAAC,QAAQ,CAAC;SACnE,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,8BAAqB,CAC7B,0DAA0D,EAC1D,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CACtC,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,IAAA,wCAAoB,EAAC,QAAQ,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,8BAAqB,CAC7B,UAAU,CAAC,cAAc,IAAI,sCAAsC,EACnE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAC3B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAChB,EAAE,EACF,EAAE,MAAM,EAAE,SAAS,EAAE,EACrB,QAAQ,EACR,aAAa,EACb,OAAO,CACR,CAAC;IACJ,CAAC;IAEO,uBAAuB,CAAC,GAAQ;QACtC,OAAO;YACL,QAAQ,EAAE;gBACR,EAAE,EAAE,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,EAAE;gBAC3B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;gBACpB,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,QAAQ,EAAE,GAAG,CAAC,QAAQ;aACvB;YACD,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK;YACxE,MAAM,EAAE,GAAG,CAAC,MAAsB;YAClC,eAAe,EAAE,GAAG,CAAC,gBAAgB,IAAI,CAAC;YAC1C,iBAAiB,EAAE,GAAG,CAAC,mBAAmB;SAC3C,CAAC;IACJ,CAAC;CACF;AA5ZD,8DA4ZC;AAED,qBAAqB;AACR,QAAA,yBAAyB,GAAG,IAAI,yBAAyB,EAAE,CAAC"}

package/dist/bundled-agents/policy-engine-agents/dist/synthesis/builder.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Executive Synthesis Builder
+ * Builds executive summaries for policy operations
+ */
+import { ExecutiveSummary, DeployReference, IterationMetrics, BlockingIssue, DecisionPacket, ConflictAnalysis, EnforcementImpact, RollbackInstructions, ViolationPrediction } from './types';
+import { Policy, PolicyStatus } from '../types/policy';
+/**
+ * Build an executive summary for policy operations
+ */
+export declare function buildExecutiveSummary(deployRef: Partial<DeployReference>, metrics: Partial<IterationMetrics>, stepsExecuted: string[]): ExecutiveSummary;
+/**
+ * Elevate risk level for production environments
+ */
+export declare function elevateRiskForProduction(summary: ExecutiveSummary): void;
+/**
+ * Elevate risk for security and compliance policy types
+ */
+export declare function elevateRiskForPolicyType(summary: ExecutiveSummary, policyType: string | undefined): void;
+/**
+ * Elevate risk when enabling a policy (vs creating draft)
+ */
+export declare function elevateRiskForEnabling(summary: ExecutiveSummary): void;
+/**
+ * Extract blocking issues from policy validation
+ */
+export declare function extractBlockingIssues(policy: Policy, validationErrors: string[]): BlockingIssue[];
+/**
+ * Build synthesis for policy creation
+ */
+export declare function buildPolicyCreateSynthesis(policy: Policy, validationErrors: string[], success: boolean): ExecutiveSummary;
+/**
+ * Build synthesis for policy edit
+ */
+export declare function buildPolicyEditSynthesis(policy: Policy, validationErrors: string[], success: boolean): ExecutiveSummary;
+/**
+ * Build synthesis for policy status toggle
+ */
+export declare function buildPolicyToggleSynthesis(policy: Policy, previousStatus: PolicyStatus, newStatus: PolicyStatus): ExecutiveSummary;
+/**
+ * Calculate success rate based on validation results
+ */
+export declare function calculateSuccessRate(validationErrors: string[], totalRules: number): number;
+/**
+ * Determine if this is a production target
+ */
+export declare function isProductionTarget(namespace: string | undefined): boolean;
+/**
+ * Build a complete Decision Packet for policy operations
+ */
+export declare function buildDecisionPacket(policy: Policy, existingPolicies?: Policy[], options?: {
+    includeRollback?: boolean;
+    previousStatus?: PolicyStatus;
+    operationType?: 'create' | 'edit' | 'enable' | 'disable' | 'dry-run';
+}): DecisionPacket;
+/**
+ * Build conflict analysis for a policy against existing policies
+ */
+export declare function buildConflictAnalysis(policy: Policy, existingPolicies?: Policy[]): ConflictAnalysis;
+/**
+ * Build enforcement impact projection for a policy
+ */
+export declare function buildEnforcementImpact(policy: Policy): EnforcementImpact;
+/**
+ * Build rollback instructions for enable/disable operations
+ */
+export declare function buildRollbackInstructions(policy: Policy, previousStatus: PolicyStatus, operationType: string): RollbackInstructions;
+/**
+ * Build violation predictions for dry-run analysis
+ */
+export declare function buildViolationPredictions(policy: Policy): ViolationPrediction[];
+/**
+ * Build synthesis for policy dry-run operation
+ */
+export declare function buildPolicyDryRunSynthesis(policy: Policy, validationErrors: string[], existingPolicies?: Policy[]): {
+    canApply: boolean;
+    violationPredictions: ViolationPrediction[];
+    decisionPacket: DecisionPacket;
+    synthesis: ExecutiveSummary;
+};
+//# sourceMappingURL=builder.d.ts.map

package/dist/bundled-agents/policy-engine-agents/dist/synthesis/builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../../src/synthesis/builder.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAGhB,aAAa,EACb,cAAc,EACd,gBAAgB,EAEhB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAA4B,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEjF;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,OAAO,CAAC,eAAe,CAAC,EACnC,OAAO,EAAE,OAAO,CAAC,gBAAgB,CAAC,EAClC,aAAa,EAAE,MAAM,EAAE,GACtB,gBAAgB,CA0BlB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CASxE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,IAAI,CASN;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAOtE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,CAmDjG;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,MAAM,EAAE,EAC1B,OAAO,EAAE,OAAO,GACf,gBAAgB,CA2BlB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,MAAM,EAAE,EAC1B,OAAO,EAAE,OAAO,GACf,gBAAgB,CAyBlB;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,YAAY,EAC5B,SAAS,EAAE,YAAY,GACtB,gBAAgB,CAwClB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAI3F;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAMzE;AA+JD;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,gBAAgB,GAAE,MAAM,EAAO,EAC/B,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,aAAa,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;CACjE,GACL,cAAc,CAqBhB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,gBAAgB,GAAE,MAAM,EAAO,GAC9B,gBAAgB,CA2ClB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAyCxE;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,YAAY,EAC5B,aAAa,EAAE,MAAM,GACpB,oBAAoB,CAmDtB;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,EAAE,CA4B/E;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,MAAM,EAAE,EAC1B,gBAAgB,GAAE,MAAM,EAAO,GAC9B;IACD,QAAQ,EAAE,OAAO,CAAC;IAClB,oBAAoB,EAAE,mBAAmB,EAAE,CAAC;IAC5C,cAAc,EAAE,cAAc,CAAC;IAC/B,SAAS,EAAE,gBAAgB,CAAC;CAC7B,CA4DA"}