@mondaydotcomorg/atp-compiler 0.18.4-rc.0 → 0.19.1

package/dist/provenance/src/policies/dynamic.js

@@ -0,0 +1,75 @@
+import { createDeclarativePolicy } from './declarative.js';
+/**
+ * A dynamic registry that manages multiple policies and acts as a single SecurityPolicy.
+ * This allows policies to be updated at runtime (e.g. from a UI or database) without restarting the server.
+ */
+export class DynamicPolicyRegistry {
+    name = 'dynamic-policy-registry';
+    description = 'Container for dynamically managed security policies';
+    policies = new Map();
+    constructor(initialPolicies = []) {
+        for (const policy of initialPolicies) {
+            this.policies.set(policy.name, policy);
+        }
+    }
+    /**
+     * Add or update a policy
+     */
+    addPolicy(policy) {
+        this.policies.set(policy.name, policy);
+    }
+    /**
+     * Remove a policy by name
+     */
+    removePolicy(name) {
+        this.policies.delete(name);
+    }
+    /**
+     * clear all policies
+     */
+    clear() {
+        this.policies.clear();
+    }
+    /**
+     * Load policies from declarative configurations (JSON)
+     * This is useful for loading policies saved from a UI
+     */
+    loadFromConfigs(configs, replace = false) {
+        if (replace) {
+            this.policies.clear();
+        }
+        for (const config of configs) {
+            const policy = createDeclarativePolicy(config);
+            this.policies.set(policy.name, policy);
+        }
+    }
+    /**
+     * Get all registered policies
+     */
+    getPolicies() {
+        return Array.from(this.policies.values());
+    }
+    /**
+     * Implementation of the SecurityPolicy check interface.
+     * Delegates to all registered policies.
+     */
+    async check(toolName, args, getProvenance) {
+        let requiresApproval = null;
+        for (const policy of this.policies.values()) {
+            const result = await policy.check(toolName, args, getProvenance);
+            if (result.action === 'block') {
+                return result;
+            }
+            if (result.action === 'approve') {
+                if (!requiresApproval) {
+                    requiresApproval = result;
+                }
+            }
+        }
+        if (requiresApproval) {
+            return requiresApproval;
+        }
+        return { action: 'log' };
+    }
+}
+//# sourceMappingURL=dynamic.js.map

package/dist/provenance/src/policies/dynamic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dynamic.js","sourceRoot":"","sources":["../../../../../provenance/src/policies/dynamic.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAgC,MAAM,kBAAkB,CAAC;AAEzF;;;GAGG;AACH,MAAM,OAAO,qBAAqB;IACjC,IAAI,GAAG,yBAAyB,CAAC;IACjC,WAAW,GAAG,qDAAqD,CAAC;IAE5D,QAAQ,GAAgC,IAAI,GAAG,EAAE,CAAC;IAE1D,YAAY,kBAAoC,EAAE;QACjD,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAsB;QAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,IAAY;QACxB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK;QACJ,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,OAAkC,EAAE,OAAO,GAAG,KAAK;QAClE,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAED;;OAEG;IACH,WAAW;QACV,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CACV,QAAgB,EAChB,IAA6B,EAC7B,aAA4D;QAE5D,IAAI,gBAAgB,GAAwB,IAAI,CAAC;QAEjD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;YAEjE,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC/B,OAAO,MAAM,CAAC;YACf,CAAC;YAED,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACvB,gBAAgB,GAAG,MAAM,CAAC;gBAC3B,CAAC;YACF,CAAC;QACF,CAAC;QAED,IAAI,gBAAgB,EAAE,CAAC;YACtB,OAAO,gBAAgB,CAAC;QACzB,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;CACD"}

package/dist/provenance/src/policies/schema.d.ts

@@ -0,0 +1,270 @@
+import { z } from 'zod';
+export declare const OperatorSchema: z.ZodEnum<["equals", "notEquals", "contains", "notContains", "startsWith", "notStartsWith", "endsWith", "notEndsWith", "matches", "in", "notIn"]>;
+export type Operator = z.infer<typeof OperatorSchema>;
+export declare const ConditionSchema: z.ZodObject<{
+    field: z.ZodString;
+    operator: z.ZodEnum<["equals", "notEquals", "contains", "notContains", "startsWith", "notStartsWith", "endsWith", "notEndsWith", "matches", "in", "notIn"]>;
+    value: z.ZodAny;
+}, "strip", z.ZodTypeAny, {
+    field: string;
+    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "notStartsWith" | "endsWith" | "notEndsWith" | "matches" | "in" | "notIn";
+    value?: any;
+}, {
+    field: string;
+    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "notStartsWith" | "endsWith" | "notEndsWith" | "matches" | "in" | "notIn";
+    value?: any;
+}>;
+export type Condition = z.infer<typeof ConditionSchema>;
+export declare const PolicyActionSchema: z.ZodEnum<["log", "approve", "block"]>;
+export type PolicyAction = z.infer<typeof PolicyActionSchema>;
+export declare const PolicyRuleSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    action: z.ZodEnum<["log", "approve", "block"]>;
+    conditions: z.ZodArray<z.ZodObject<{
+        field: z.ZodString;
+        operator: z.ZodEnum<["equals", "notEquals", "contains", "notContains", "startsWith", "notStartsWith", "endsWith", "notEndsWith", "matches", "in", "notIn"]>;
+        value: z.ZodAny;
+    }, "strip", z.ZodTypeAny, {
+        field: string;
+        operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "notStartsWith" | "endsWith" | "notEndsWith" | "matches" | "in" | "notIn";
+        value?: any;
+    }, {
+        field: string;
+        operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "notStartsWith" | "endsWith" | "notEndsWith" | "matches" | "in" | "notIn";
+        value?: any;
+    }>, "many">;
+    reason: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    action: "log" | "approve" | "block";
+    conditions: {
+        field: string;
+        operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "notStartsWith" | "endsWith" | "notEndsWith" | "matches" | "in" | "notIn";
+        value?: any;
+    }[];
+    id?: string | undefined;
+    reason?: string | undefined;
+}, {
+    action: "log" | "approve" | "block";
+    conditions: {
+        field: string;
+        operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "notStartsWith" | "endsWith" | "notEndsWith" | "matches" | "in" | "notIn";
+        value?: any;
+    }[];
+    id?: string | undefined;
+    reason?: string | undefined;
+}>;
+export type PolicyRule = z.infer<typeof PolicyRuleSchema>;
+export declare const DeclarativePolicyConfigSchema: z.ZodObject<{
+    id: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    scope: z.ZodObject<{
+        toolName: z.ZodOptional<z.ZodString>;
+        apiGroup: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        apiGroup?: string | undefined;
+        toolName?: string | undefined;
+    }, {
+        apiGroup?: string | undefined;
+        toolName?: string | undefined;
+    }>;
+    rules: z.ZodArray<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        action: z.ZodEnum<["log", "approve", "block"]>;
+        conditions: z.ZodArray<z.ZodObject<{
+            field: z.ZodString;
+            operator: z.ZodEnum<["equals", "notEquals", "contains", "notContains", "startsWith", "notStartsWith", "endsWith", "notEndsWith", "matches", "in", "notIn"]>;
+            value: z.ZodAny;
+        }, "strip", z.ZodTypeAny, {
+            field: string;
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "notStartsWith" | "endsWith" | "notEndsWith" | "matches" | "in" | "notIn";
+            value?: any;
+        }, {
+            field: string;
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "notStartsWith" | "endsWith" | "notEndsWith" | "matches" | "in" | "notIn";
+            value?: any;
+        }>, "many">;
+        reason: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        action: "log" | "approve" | "block";
+        conditions: {
+            field: string;
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "notStartsWith" | "endsWith" | "notEndsWith" | "matches" | "in" | "notIn";
+            value?: any;
+        }[];
+        id?: string | undefined;
+        reason?: string | undefined;
+    }, {
+        action: "log" | "approve" | "block";
+        conditions: {
+            field: string;
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "notStartsWith" | "endsWith" | "notEndsWith" | "matches" | "in" | "notIn";
+            value?: any;
+        }[];
+        id?: string | undefined;
+        reason?: string | undefined;
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    scope: {
+        apiGroup?: string | undefined;
+        toolName?: string | undefined;
+    };
+    rules: {
+        action: "log" | "approve" | "block";
+        conditions: {
+            field: string;
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "notStartsWith" | "endsWith" | "notEndsWith" | "matches" | "in" | "notIn";
+            value?: any;
+        }[];
+        id?: string | undefined;
+        reason?: string | undefined;
+    }[];
+    description?: string | undefined;
+}, {
+    id: string;
+    scope: {
+        apiGroup?: string | undefined;
+        toolName?: string | undefined;
+    };
+    rules: {
+        action: "log" | "approve" | "block";
+        conditions: {
+            field: string;
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "notStartsWith" | "endsWith" | "notEndsWith" | "matches" | "in" | "notIn";
+            value?: any;
+        }[];
+        id?: string | undefined;
+        reason?: string | undefined;
+    }[];
+    description?: string | undefined;
+}>;
+export type DeclarativePolicyConfig = z.infer<typeof DeclarativePolicyConfigSchema>;
+export declare const PolicyConfigurationSchema: z.ZodObject<{
+    version: z.ZodString;
+    policies: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        scope: z.ZodObject<{
+            toolName: z.ZodOptional<z.ZodString>;
+            apiGroup: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            apiGroup?: string | undefined;
+            toolName?: string | undefined;
+        }, {
+            apiGroup?: string | undefined;
+            toolName?: string | undefined;
+        }>;
+        rules: z.ZodArray<z.ZodObject<{
+            id: z.ZodOptional<z.ZodString>;
+            action: z.ZodEnum<["log", "approve", "block"]>;
+            conditions: z.ZodArray<z.ZodObject<{
+                field: z.ZodString;
+                operator: z.ZodEnum<["equals", "notEquals", "contains", "notContains", "startsWith", "notStartsWith", "endsWith", "notEndsWith", "matches", "in", "notIn"]>;
+                value: z.ZodAny;
+            }, "strip", z.ZodTypeAny, {
+                field: string;
+                operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "notStartsWith" | "endsWith" | "notEndsWith" | "matches" | "in" | "notIn";
+                value?: any;
+            }, {
+                field: string;
+                operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "notStartsWith" | "endsWith" | "notEndsWith" | "matches" | "in" | "notIn";
+                value?: any;
+            }>, "many">;
+            reason: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            action: "log" | "approve" | "block";
+            conditions: {
+                field: string;
+                operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "notStartsWith" | "endsWith" | "notEndsWith" | "matches" | "in" | "notIn";
+                value?: any;
+            }[];
+            id?: string | undefined;
+            reason?: string | undefined;
+        }, {
+            action: "log" | "approve" | "block";
+            conditions: {
+                field: string;
+                operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "notStartsWith" | "endsWith" | "notEndsWith" | "matches" | "in" | "notIn";
+                value?: any;
+            }[];
+            id?: string | undefined;
+            reason?: string | undefined;
+        }>, "many">;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        scope: {
+            apiGroup?: string | undefined;
+            toolName?: string | undefined;
+        };
+        rules: {
+            action: "log" | "approve" | "block";
+            conditions: {
+                field: string;
+                operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "notStartsWith" | "endsWith" | "notEndsWith" | "matches" | "in" | "notIn";
+                value?: any;
+            }[];
+            id?: string | undefined;
+            reason?: string | undefined;
+        }[];
+        description?: string | undefined;
+    }, {
+        id: string;
+        scope: {
+            apiGroup?: string | undefined;
+            toolName?: string | undefined;
+        };
+        rules: {
+            action: "log" | "approve" | "block";
+            conditions: {
+                field: string;
+                operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "notStartsWith" | "endsWith" | "notEndsWith" | "matches" | "in" | "notIn";
+                value?: any;
+            }[];
+            id?: string | undefined;
+            reason?: string | undefined;
+        }[];
+        description?: string | undefined;
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    version: string;
+    policies: {
+        id: string;
+        scope: {
+            apiGroup?: string | undefined;
+            toolName?: string | undefined;
+        };
+        rules: {
+            action: "log" | "approve" | "block";
+            conditions: {
+                field: string;
+                operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "notStartsWith" | "endsWith" | "notEndsWith" | "matches" | "in" | "notIn";
+                value?: any;
+            }[];
+            id?: string | undefined;
+            reason?: string | undefined;
+        }[];
+        description?: string | undefined;
+    }[];
+}, {
+    version: string;
+    policies: {
+        id: string;
+        scope: {
+            apiGroup?: string | undefined;
+            toolName?: string | undefined;
+        };
+        rules: {
+            action: "log" | "approve" | "block";
+            conditions: {
+                field: string;
+                operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "notStartsWith" | "endsWith" | "notEndsWith" | "matches" | "in" | "notIn";
+                value?: any;
+            }[];
+            id?: string | undefined;
+            reason?: string | undefined;
+        }[];
+        description?: string | undefined;
+    }[];
+}>;
+export type PolicyConfiguration = z.infer<typeof PolicyConfigurationSchema>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/provenance/src/policies/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../../provenance/src/policies/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,cAAc,mJAYzB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,eAAO,MAAM,eAAe;;;;;;;;;;;;EAM1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,kBAAkB,wCAAsC,CAAC;AAEtE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAK3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/provenance/src/policies/schema.js

@@ -0,0 +1,42 @@
+import { z } from 'zod';
+export const OperatorSchema = z.enum([
+    'equals',
+    'notEquals',
+    'contains',
+    'notContains',
+    'startsWith',
+    'notStartsWith',
+    'endsWith',
+    'notEndsWith',
+    'matches',
+    'in',
+    'notIn',
+]);
+export const ConditionSchema = z.object({
+    field: z
+        .string()
+        .describe('Field to check (e.g. args.paramName, provenance.args.param.source.type)'),
+    operator: OperatorSchema,
+    value: z.any().describe('Value to compare against'),
+});
+export const PolicyActionSchema = z.enum(['log', 'approve', 'block']);
+export const PolicyRuleSchema = z.object({
+    id: z.string().optional(),
+    action: PolicyActionSchema,
+    conditions: z.array(ConditionSchema).describe('All conditions must match (implicit AND)'),
+    reason: z.string().optional(),
+});
+export const DeclarativePolicyConfigSchema = z.object({
+    id: z.string(),
+    description: z.string().optional(),
+    scope: z.object({
+        toolName: z.string().optional().describe('Regex pattern or exact match for tool name'),
+        apiGroup: z.string().optional().describe('Regex pattern or exact match for API group'),
+    }),
+    rules: z.array(PolicyRuleSchema).describe('Rules are evaluated in order. First match wins.'),
+});
+export const PolicyConfigurationSchema = z.object({
+    version: z.string(),
+    policies: z.array(DeclarativePolicyConfigSchema),
+});
+//# sourceMappingURL=schema.js.map

package/dist/provenance/src/policies/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../../../provenance/src/policies/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC;IACpC,QAAQ;IACR,WAAW;IACX,UAAU;IACV,aAAa;IACb,YAAY;IACZ,eAAe;IACf,UAAU;IACV,aAAa;IACb,SAAS;IACT,IAAI;IACJ,OAAO;CACP,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,CAAC,yEAAyE,CAAC;IACrF,QAAQ,EAAE,cAAc;IACxB,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;CACnD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAItE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,MAAM,EAAE,kBAAkB;IAC1B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACzF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;QACtF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;KACtF,CAAC;IACF,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC;CAC5F,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC;CAChD,CAAC,CAAC"}

package/dist/provenance/src/registry.d.ts

@@ -1,4 +1,9 @@
 import type { ProvenanceMetadata, SourceMetadata, ReaderPermissions } from './types.js';
+import { type ProvenanceStore } from './store.js';
+/**
+ * Set the global provenance store implementation
+ */
+export declare function setGlobalProvenanceStore(store: ProvenanceStore): void;
 /**
  * Mark a primitive value as tainted (derived from tool data)
  * Used by AST mode to track derived values
@@ -17,6 +22,16 @@ export declare function setProvenanceExecutionId(executionId: string): void;
  * Clear the current execution ID
  */
 export declare function clearProvenanceExecutionId(): void;
+/**
+ * Hydrate provenance metadata for an execution (Multi-pod support)
+ * Call this when resuming an execution on a new pod to warm up the local cache
+ */
+export declare function hydrateProvenance(ids: string[]): Promise<void>;
+/**
+ * Hydrate all provenance for a specific execution ID (if store supports tracking by execution)
+ * Note: Standard InMemoryProvenanceStore tracks execution IDs, but Redis implementations might need explicit sets
+ */
+export declare function hydrateExecutionProvenance(executionId: string): Promise<void>;
 /**
  * Register provenance metadata directly (for AST tracking in isolated-vm)
  */

package/dist/provenance/src/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../../provenance/src/registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EAEjB,MAAM,YAAY,CAAC;AAiBpB;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,kBAAkB,GAAG,IAAI,CAc7F;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAa1D;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAQlE;AAED;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACzC,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,kBAAkB,EAC5B,WAAW,CAAC,EAAE,MAAM,GAClB,IAAI,CA2BN;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAmBvE;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,GAAG,IAAI,CAwCnF;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAY3F;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG;IAC/D,QAAQ,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC9C,UAAU,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;CAChD,CA6BA;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACrC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACpC,IAAI,CAQN;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACxC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE;IACT,QAAQ,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC9C,UAAU,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;CAChD,GACC,IAAI,CAiBN;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EACtC,KAAK,EAAE,CAAC,EACR,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,iBAAsC,EAC/C,YAAY,GAAE,MAAM,EAAO,GACzB,CAAC,CA+DH;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,GAAG,IAAI,CAgCvE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAErD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,WAAiB,GAAG,kBAAkB,EAAE,CAkC/F;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC3B,QAAQ,EAAE,iBAAiB,EAC3B,QAAQ,EAAE,iBAAiB,GACzB,iBAAiB,CAUnB;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,GAAG,OAAO,CAK/E;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAqCjC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CACnC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC9C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,IAAI,CAON"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../../provenance/src/registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EAEjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,KAAK,eAAe,EAA2B,MAAM,YAAY,CAAC;AAkB3E;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAErE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,kBAAkB,GAAG,IAAI,CAkB7F;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAa1D;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAQlE;AAED;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAapE;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBnF;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACzC,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,kBAAkB,EAC5B,WAAW,CAAC,EAAE,MAAM,GAClB,IAAI,CAkCN;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAwBvE;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,GAAG,IAAI,CAwCnF;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAY3F;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG;IAC/D,QAAQ,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC9C,UAAU,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;CAChD,CA6BA;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACrC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACpC,IAAI,CASN;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACxC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE;IACT,QAAQ,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC9C,UAAU,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;CAChD,GACC,IAAI,CAkBN;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EACtC,KAAK,EAAE,CAAC,EACR,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,iBAAsC,EAC/C,YAAY,GAAE,MAAM,EAAO,GACzB,CAAC,CAwEH;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,GAAG,IAAI,CAgCvE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAErD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,WAAiB,GAAG,kBAAkB,EAAE,CAkC/F;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC3B,QAAQ,EAAE,iBAAiB,EAC3B,QAAQ,EAAE,iBAAiB,GACzB,iBAAiB,CAUnB;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,GAAG,OAAO,CAK/E;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAqCjC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CACnC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC9C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,IAAI,CAON"}

package/dist/provenance/src/registry.js

@@ -1,5 +1,6 @@
 import { nanoid } from 'nanoid';
 import { computeDigest } from './tokens.js';
+import { InMemoryProvenanceStore } from './store.js';
 const PROVENANCE_KEY = '__provenance__';
 const PROVENANCE_ID_KEY = '__prov_id__';
 const provenanceStore = new WeakMap();
@@ -8,6 +9,13 @@ const executionProvenanceIds = new Map();
 let currentExecutionId = null;
 const primitiveProvenanceMap = new Map();
 const executionTaintedPrimitives = new Map();
+let globalStore = new InMemoryProvenanceStore();
+/**
+ * Set the global provenance store implementation
+ */
+export function setGlobalProvenanceStore(store) {
+    globalStore = store;
+}
 /**
  * Mark a primitive value as tainted (derived from tool data)
  * Used by AST mode to track derived values
@@ -24,6 +32,9 @@ export function markPrimitiveTainted(value, sourceMetadata) {
     }
     const key = `tainted:${String(value)}`;
     primitiveProvenanceMap.set(key, sourceMetadata);
+    globalStore.setPrimitive(key, sourceMetadata, currentExecutionId || undefined).catch((err) => {
+        console.warn('Failed to save primitive taint to provenance store', err);
+    });
 }
 /**
  * Check if a primitive is tainted (derived from tool data)
@@ -59,12 +70,57 @@ export function setProvenanceExecutionId(executionId) {
 export function clearProvenanceExecutionId() {
     currentExecutionId = null;
 }
+/**
+ * Hydrate provenance metadata for an execution (Multi-pod support)
+ * Call this when resuming an execution on a new pod to warm up the local cache
+ */
+export async function hydrateProvenance(ids) {
+    const batch = await globalStore.getBatch(ids);
+    for (const [id, metadata] of batch.entries()) {
+        provenanceRegistry.set(id, metadata);
+        if (currentExecutionId) {
+            let execIds = executionProvenanceIds.get(currentExecutionId);
+            if (!execIds) {
+                execIds = new Set();
+                executionProvenanceIds.set(currentExecutionId, execIds);
+            }
+            execIds.add(id);
+        }
+    }
+}
+/**
+ * Hydrate all provenance for a specific execution ID (if store supports tracking by execution)
+ * Note: Standard InMemoryProvenanceStore tracks execution IDs, but Redis implementations might need explicit sets
+ */
+export async function hydrateExecutionProvenance(executionId) {
+    const batch = await globalStore.getExecution(executionId);
+    for (const [id, metadata] of batch.entries()) {
+        provenanceRegistry.set(id, metadata);
+        // Also track in current execution context (re-bind to new execution scope if needed)
+        // Or just ensure it's in registry for reading.
+        // Typically, we just want it available for reading.
+        // If we want to ensure cleanup works for the *new* resumed execution, we might need to track it.
+        // But usually resumed execution has same ID?
+        // If executionId passed here IS the currentExecutionId, we track it.
+        if (currentExecutionId === executionId) {
+            let executionSet = executionProvenanceIds.get(executionId);
+            if (!executionSet) {
+                executionSet = new Set();
+                executionProvenanceIds.set(executionId, executionSet);
+            }
+            executionSet.add(id);
+        }
+    }
+}
 /**
  * Register provenance metadata directly (for AST tracking in isolated-vm)
  */
 export function registerProvenanceMetadata(id, metadata, executionId) {
     if (id.startsWith('tainted:') || id.includes(':')) {
         primitiveProvenanceMap.set(id, metadata);
+        globalStore.setPrimitive(id, metadata, executionId).catch((err) => {
+            console.warn('Failed to save primitive provenance to store', err);
+        });
         if (id.startsWith('tainted:')) {
             const value = id.slice('tainted:'.length);
             if (executionId) {
@@ -79,6 +135,9 @@ export function registerProvenanceMetadata(id, metadata, executionId) {
     }
     else {
         provenanceRegistry.set(id, metadata);
+        globalStore.set(id, metadata, executionId).catch((err) => {
+            console.warn('Failed to save provenance to store', err);
+        });
     }
     if (executionId) {
         let ids = executionProvenanceIds.get(executionId);
@@ -111,6 +170,10 @@ export function cleanupProvenanceForExecution(executionId) {
         executionProvenanceIds.delete(executionId);
     }
     executionTaintedPrimitives.delete(executionId);
+    // Cleanup from persistent store
+    globalStore.cleanupExecution(executionId).catch((err) => {
+        console.warn('Failed to cleanup provenance store', err);
+    });
 }
 /**
  * Check if a primitive value was extracted from a provenance-tracked object
@@ -206,6 +269,7 @@ export function restoreProvenanceState(executionId, state) {
     for (const [id, metadata] of state) {
         provenanceRegistry.set(id, metadata);
         ids.add(id);
+        globalStore.set(id, metadata, executionId).catch(console.error);
     }
 }
 /**
@@ -216,6 +280,7 @@ export function restoreProvenanceSnapshot(executionId, snapshot) {
     restoreProvenanceState(executionId, registryMap);
     for (const [key, meta] of snapshot.primitives) {
         primitiveProvenanceMap.set(key, meta);
+        globalStore.setPrimitive(key, meta, executionId).catch(console.error);
         if (key.startsWith('tainted:')) {
             const value = key.slice('tainted:'.length);
             let set = executionTaintedPrimitives.get(executionId);
@@ -256,12 +321,17 @@ export function createProvenanceProxy(value, source, readers = { type: 'public'
             ids.add(id);
         }
     }
+    globalStore.set(id, metadata, currentExecutionId || undefined).catch((err) => {
+        console.warn('Failed to persist provenance to store', err);
+    });
     try {
         Object.defineProperty(value, PROVENANCE_ID_KEY, {
             value: id,
             writable: false,
             enumerable: true,
             configurable: true,
+            // @ts-ignore
+            __proto__: null,
         });
     }
     catch (e) {
@@ -286,6 +356,9 @@ export function createProvenanceProxy(value, source, readers = { type: 'public'
                 else if (typeof nestedValue === 'string' || typeof nestedValue === 'number') {
                     const primitiveKey = `${id}:${key}:${String(nestedValue)}`;
                     primitiveProvenanceMap.set(primitiveKey, metadata);
+                    globalStore
+                        .setPrimitive(primitiveKey, metadata, currentExecutionId || undefined)
+                        .catch(console.error);
                 }
             }
         }