@plumbus/core 0.1.0

package/dist/governance/overrides.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"overrides.d.ts","sourceRoot":"","sources":["../../src/governance/overrides.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAGnF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAGD,MAAM,WAAW,aAAa;IAC5B,YAAY,IAAI,kBAAkB,EAAE,CAAC;IACrC,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,kBAAkB,CAAC;IACtD,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACtD,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACnD,UAAU,IAAI,kBAAkB,EAAE,CAAC;IACnC,SAAS,IAAI,aAAa,EAAE,CAAC;CAC9B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,aAAa,EAAO,GAAG,aAAa,CAgEhF;AAED,4FAA4F;AAC5F,wBAAgB,cAAc,CAC5B,OAAO,EAAE,gBAAgB,EAAE,EAC3B,SAAS,EAAE,kBAAkB,EAAE,GAC9B;IAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAAC,UAAU,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAYnE"}

package/dist/governance/overrides.js

@@ -0,0 +1,74 @@
+// ── Governance Override System ──
+// Developers override governance warnings with structured justifications.
+// Overrides are stored as structured data and recorded in governance metadata.
+export function createOverrideStore(entries = []) {
+    const overrides = entries.map((e) => ({
+        rule: e.rule,
+        justification: e.justification,
+        author: e.author,
+        timestamp: new Date(e.timestamp),
+        scope: e.scope,
+        expiresAt: e.expiresAt ? new Date(e.expiresAt) : undefined,
+    }));
+    return {
+        getOverrides() {
+            const now = new Date();
+            return overrides.filter((o) => !o.expiresAt || o.expiresAt > now);
+        },
+        addOverride(entry) {
+            const override = {
+                rule: entry.rule,
+                justification: entry.justification,
+                author: entry.author,
+                timestamp: new Date(entry.timestamp),
+                scope: entry.scope,
+                expiresAt: entry.expiresAt ? new Date(entry.expiresAt) : undefined,
+            };
+            overrides.push(override);
+            return override;
+        },
+        removeOverride(rule, scope) {
+            const idx = overrides.findIndex((o) => o.rule === rule && o.scope === scope);
+            if (idx === -1)
+                return false;
+            overrides.splice(idx, 1);
+            return true;
+        },
+        hasOverride(rule, scope) {
+            const now = new Date();
+            return overrides.some((o) => o.rule === rule &&
+                (!scope || o.scope === scope || !o.scope) &&
+                (!o.expiresAt || o.expiresAt > now));
+        },
+        getExpired() {
+            const now = new Date();
+            return overrides.filter((o) => o.expiresAt && o.expiresAt <= now);
+        },
+        serialize() {
+            return overrides.map((o) => ({
+                rule: o.rule,
+                justification: o.justification,
+                author: o.author,
+                timestamp: o.timestamp.toISOString(),
+                scope: o.scope,
+                expiresAt: o.expiresAt?.toISOString(),
+            }));
+        },
+    };
+}
+/** Filter governance signals by applying overrides — returns only non-overridden signals */
+export function applyOverrides(signals, overrides) {
+    const overrideRules = new Set(overrides.map((o) => o.rule));
+    const effective = [];
+    const overridden = [];
+    for (const signal of signals) {
+        if (overrideRules.has(signal.rule)) {
+            overridden.push(signal);
+        }
+        else {
+            effective.push(signal);
+        }
+    }
+    return { effective, overridden };
+}
+//# sourceMappingURL=overrides.js.map

package/dist/governance/overrides.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"overrides.js","sourceRoot":"","sources":["../../src/governance/overrides.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,0EAA0E;AAC1E,+EAA+E;AAwB/E,MAAM,UAAU,mBAAmB,CAAC,UAA2B,EAAE;IAC/D,MAAM,SAAS,GAAqE,OAAO,CAAC,GAAG,CAC7F,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAChC,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;KAC3D,CAAC,CACH,CAAC;IAEF,OAAO;QACL,YAAY;YACV,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;QACpE,CAAC;QAED,WAAW,CAAC,KAAK;YACf,MAAM,QAAQ,GAA8D;gBAC1E,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;gBACpC,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;aACnE,CAAC;YACF,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,cAAc,CAAC,IAAI,EAAE,KAAK;YACxB,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;YAC7E,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC7B,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,WAAW,CAAC,IAAI,EAAE,KAAK;YACrB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC,IAAI,CACnB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,IAAI,KAAK,IAAI;gBACf,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;gBACzC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CACtC,CAAC;QACJ,CAAC;QAED,UAAU;YACR,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC;QACpE,CAAC;QAED,SAAS;YACP,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,aAAa,EAAE,CAAC,CAAC,aAAa;gBAC9B,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;gBACpC,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE;aACtC,CAAC,CAAC,CAAC;QACN,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAC5B,OAA2B,EAC3B,SAA+B;IAE/B,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,MAAM,UAAU,GAAuB,EAAE,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AACnC,CAAC"}

package/dist/governance/policies.d.ts

@@ -0,0 +1,22 @@
+import { GovernanceSeverity, PolicyProfile, RuleStatus } from '../types/enums.js';
+import type { GovernanceOverride, RuleEvaluation } from '../types/governance.js';
+import type { SystemInventory } from './rule-engine.js';
+export interface PolicyProfileRule {
+    name: string;
+    severity: GovernanceSeverity;
+    description: string;
+    remediation?: string;
+    evaluate: (inventory: SystemInventory, overrides: GovernanceOverride[]) => RuleStatus;
+}
+export interface PolicyProfileDefinition {
+    name: PolicyProfile | string;
+    description: string;
+    rules: PolicyProfileRule[];
+}
+export declare const builtInProfiles: Record<string, PolicyProfileDefinition>;
+/** Evaluate a policy profile against a system inventory */
+export declare function evaluatePolicyProfile(profileName: string, inventory: SystemInventory, overrides?: GovernanceOverride[]): {
+    results: RuleEvaluation[];
+    score: number;
+};
+//# sourceMappingURL=policies.d.ts.map

package/dist/governance/policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.d.ts","sourceRoot":"","sources":["../../src/governance/policies.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,kBAAkB,EAClB,aAAa,EACb,UAAU,EACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGxD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,kBAAkB,EAAE,KAAK,UAAU,CAAC;CACvF;AAGD,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,aAAa,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,iBAAiB,EAAE,CAAC;CAC5B;AAkOD,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAwDnE,CAAC;AAEF,2DAA2D;AAC3D,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,eAAe,EAC1B,SAAS,GAAE,kBAAkB,EAAO,GACnC;IAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA2B9C"}

package/dist/governance/policies.js

@@ -0,0 +1,279 @@
+// ── Policy Profiles ──
+// Define policy rule sets for compliance frameworks: PCI DSS, GDPR, SOC2, HIPAA, internal baseline.
+// Each profile contains rules that evaluate against the system inventory.
+import { FieldClassification, GovernanceSeverity, PolicyProfile, RuleStatus, } from '../types/enums.js';
+// ── Common Rules (shared across profiles) ──
+const ruleAccessControlRequired = {
+    name: 'access-control-required',
+    severity: GovernanceSeverity.High,
+    description: 'All capabilities must have access policies',
+    remediation: 'Add access policies to all capabilities',
+    evaluate(inventory) {
+        return inventory.capabilities.every((c) => c.access && (c.access.roles?.length || c.access.scopes?.length || c.access.public))
+            ? RuleStatus.Pass
+            : RuleStatus.Fail;
+    },
+};
+const ruleTenantIsolation = {
+    name: 'tenant-isolation',
+    severity: GovernanceSeverity.High,
+    description: 'All data entities must enforce tenant isolation',
+    remediation: 'Set tenantScoped: true on all entities',
+    evaluate(inventory) {
+        if (inventory.entities.length === 0)
+            return RuleStatus.Pass;
+        return inventory.entities.every((e) => e.tenantScoped) ? RuleStatus.Pass : RuleStatus.Partial;
+    },
+};
+const ruleAuditLogging = {
+    name: 'audit-logging',
+    severity: GovernanceSeverity.High,
+    description: 'All action/job capabilities must have audit enabled',
+    remediation: 'Enable audit settings on action and job capabilities',
+    evaluate(inventory) {
+        const actionCaps = inventory.capabilities.filter((c) => c.kind === 'action' || c.kind === 'job');
+        if (actionCaps.length === 0)
+            return RuleStatus.Pass;
+        return actionCaps.every((c) => c.audit?.enabled !== false) ? RuleStatus.Pass : RuleStatus.Fail;
+    },
+};
+// ── PCI DSS ──
+const pciEncryptionRequired = {
+    name: 'pci-encryption-required',
+    severity: GovernanceSeverity.High,
+    description: 'Sensitive and highly_sensitive fields must be encrypted',
+    remediation: 'Add encrypted: true to all sensitive/highly_sensitive fields',
+    evaluate(inventory) {
+        for (const entity of inventory.entities) {
+            for (const field of Object.values(entity.fields)) {
+                const cls = field.options.classification;
+                if ((cls === FieldClassification.Sensitive || cls === FieldClassification.HighlySensitive) &&
+                    !field.options.encrypted) {
+                    return RuleStatus.Fail;
+                }
+            }
+        }
+        return RuleStatus.Pass;
+    },
+};
+// ── GDPR ──
+const gdprDataClassification = {
+    name: 'gdpr-data-classification',
+    severity: GovernanceSeverity.High,
+    description: 'All personal data fields must have classification metadata',
+    remediation: 'Add classification to fields containing personal data',
+    evaluate(inventory) {
+        for (const entity of inventory.entities) {
+            for (const field of Object.values(entity.fields)) {
+                if (!field.options.classification)
+                    return RuleStatus.Partial;
+            }
+        }
+        return RuleStatus.Pass;
+    },
+};
+const gdprRetentionPolicy = {
+    name: 'gdpr-retention-policy',
+    severity: GovernanceSeverity.Warning,
+    description: 'Entities with personal data should define retention policies',
+    remediation: 'Add retention configuration to entities with personal data',
+    evaluate(inventory) {
+        const entitiesWithPersonal = inventory.entities.filter((e) => Object.values(e.fields).some((f) => f.options.classification === FieldClassification.Personal ||
+            f.options.classification === FieldClassification.Sensitive));
+        if (entitiesWithPersonal.length === 0)
+            return RuleStatus.Pass;
+        return entitiesWithPersonal.every((e) => e.retention) ? RuleStatus.Pass : RuleStatus.Partial;
+    },
+};
+const gdprDataMinimization = {
+    name: 'gdpr-data-minimization',
+    severity: GovernanceSeverity.Info,
+    description: 'Capabilities should not expose unnecessary personal data fields',
+    remediation: 'Review capability outputs to exclude unnecessary personal data',
+    evaluate(inventory) {
+        // Passes if all capabilities with AI usage have explanation enabled (proxy for data governance awareness)
+        const aiCaps = inventory.capabilities.filter((c) => c.effects.ai);
+        if (aiCaps.length === 0)
+            return RuleStatus.Pass;
+        return aiCaps.every((c) => c.explanation?.enabled) ? RuleStatus.Pass : RuleStatus.Partial;
+    },
+};
+// ── SOC2 ──
+const soc2ComprehensiveAudit = {
+    name: 'soc2-comprehensive-audit',
+    severity: GovernanceSeverity.High,
+    description: 'All capabilities must have audit trails enabled',
+    remediation: 'Enable audit on all capabilities',
+    evaluate(inventory) {
+        if (inventory.capabilities.length === 0)
+            return RuleStatus.Pass;
+        return inventory.capabilities.every((c) => c.audit?.enabled !== false)
+            ? RuleStatus.Pass
+            : RuleStatus.Fail;
+    },
+};
+const soc2ChangeManagement = {
+    name: 'soc2-change-management',
+    severity: GovernanceSeverity.Warning,
+    description: 'All capabilities should declare their effects for change tracking',
+    remediation: 'Ensure all capabilities declare complete effects (data, events, external)',
+    evaluate(inventory) {
+        return inventory.capabilities.every((c) => c.effects) ? RuleStatus.Pass : RuleStatus.Partial;
+    },
+};
+// ── HIPAA ──
+const hipaaPhiEncryption = {
+    name: 'hipaa-phi-encryption',
+    severity: GovernanceSeverity.High,
+    description: 'All personal and sensitive fields must be encrypted (PHI protection)',
+    remediation: 'Encrypt all fields classified as personal, sensitive, or highly_sensitive',
+    evaluate(inventory) {
+        const protectedClassifications = [
+            FieldClassification.Personal,
+            FieldClassification.Sensitive,
+            FieldClassification.HighlySensitive,
+        ];
+        for (const entity of inventory.entities) {
+            for (const field of Object.values(entity.fields)) {
+                if (field.options.classification &&
+                    protectedClassifications.includes(field.options.classification) &&
+                    !field.options.encrypted) {
+                    return RuleStatus.Fail;
+                }
+            }
+        }
+        return RuleStatus.Pass;
+    },
+};
+const hipaaFieldMasking = {
+    name: 'hipaa-field-masking',
+    severity: GovernanceSeverity.High,
+    description: 'Sensitive fields must be masked in logs',
+    remediation: 'Add maskedInLogs: true to sensitive fields',
+    evaluate(inventory) {
+        for (const entity of inventory.entities) {
+            for (const field of Object.values(entity.fields)) {
+                const cls = field.options.classification;
+                if ((cls === FieldClassification.Sensitive || cls === FieldClassification.HighlySensitive) &&
+                    !field.options.maskedInLogs) {
+                    return RuleStatus.Fail;
+                }
+            }
+        }
+        return RuleStatus.Pass;
+    },
+};
+const hipaaAccessControls = {
+    name: 'hipaa-access-controls',
+    severity: GovernanceSeverity.High,
+    description: 'All capabilities accessing patient data must use role-based access control',
+    remediation: 'Add specific roles to capabilities that access patient/health data',
+    evaluate(inventory) {
+        return inventory.capabilities
+            .filter((c) => c.access?.tenantScoped)
+            .every((c) => c.access?.roles?.length)
+            ? RuleStatus.Pass
+            : RuleStatus.Partial;
+    },
+};
+// ── Internal Security Baseline ──
+const internalFieldEncryption = {
+    name: 'internal-field-encryption',
+    severity: GovernanceSeverity.Warning,
+    description: 'Highly sensitive fields should be encrypted',
+    remediation: 'Add encrypted: true to highly_sensitive fields',
+    evaluate(inventory) {
+        for (const entity of inventory.entities) {
+            for (const field of Object.values(entity.fields)) {
+                if (field.options.classification === FieldClassification.HighlySensitive &&
+                    !field.options.encrypted) {
+                    return RuleStatus.Fail;
+                }
+            }
+        }
+        return RuleStatus.Pass;
+    },
+};
+// ── Built-in Profile Definitions ──
+export const builtInProfiles = {
+    [PolicyProfile.PciDss]: {
+        name: PolicyProfile.PciDss,
+        description: 'Payment Card Industry Data Security Standard',
+        rules: [
+            ruleAccessControlRequired,
+            ruleTenantIsolation,
+            ruleAuditLogging,
+            pciEncryptionRequired,
+        ],
+    },
+    [PolicyProfile.Gdpr]: {
+        name: PolicyProfile.Gdpr,
+        description: 'General Data Protection Regulation',
+        rules: [
+            ruleAccessControlRequired,
+            ruleTenantIsolation,
+            ruleAuditLogging,
+            gdprDataClassification,
+            gdprRetentionPolicy,
+            gdprDataMinimization,
+        ],
+    },
+    [PolicyProfile.Soc2]: {
+        name: PolicyProfile.Soc2,
+        description: 'Service Organization Control 2',
+        rules: [
+            ruleAccessControlRequired,
+            ruleTenantIsolation,
+            ruleAuditLogging,
+            soc2ComprehensiveAudit,
+            soc2ChangeManagement,
+        ],
+    },
+    [PolicyProfile.Hipaa]: {
+        name: PolicyProfile.Hipaa,
+        description: 'Health Insurance Portability and Accountability Act',
+        rules: [
+            ruleAccessControlRequired,
+            ruleTenantIsolation,
+            ruleAuditLogging,
+            hipaaPhiEncryption,
+            hipaaFieldMasking,
+            hipaaAccessControls,
+        ],
+    },
+    [PolicyProfile.InternalSecurityBaseline]: {
+        name: PolicyProfile.InternalSecurityBaseline,
+        description: 'Organization internal security baseline',
+        rules: [
+            ruleAccessControlRequired,
+            ruleTenantIsolation,
+            ruleAuditLogging,
+            internalFieldEncryption,
+        ],
+    },
+};
+/** Evaluate a policy profile against a system inventory */
+export function evaluatePolicyProfile(profileName, inventory, overrides = []) {
+    const profile = builtInProfiles[profileName];
+    const rules = profile?.rules ?? [
+        ruleAccessControlRequired,
+        ruleTenantIsolation,
+        ruleAuditLogging,
+    ];
+    const results = rules.map((rule) => {
+        const overridden = overrides.some((o) => o.rule === rule.name);
+        const status = overridden ? RuleStatus.Override : rule.evaluate(inventory, overrides);
+        return {
+            rule: rule.name,
+            status,
+            severity: rule.severity,
+            description: rule.description,
+            remediation: rule.remediation,
+        };
+    });
+    const total = results.length;
+    const passCount = results.filter((r) => r.status === RuleStatus.Pass || r.status === RuleStatus.Override).length;
+    const score = total > 0 ? Math.round((passCount / total) * 100) : 100;
+    return { results, score };
+}
+//# sourceMappingURL=policies.js.map

package/dist/governance/policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../src/governance/policies.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,oGAAoG;AACpG,0EAA0E;AAE1E,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,UAAU,GACX,MAAM,mBAAmB,CAAC;AAoB3B,8CAA8C;AAE9C,MAAM,yBAAyB,GAAsB;IACnD,IAAI,EAAE,yBAAyB;IAC/B,QAAQ,EAAE,kBAAkB,CAAC,IAAI;IACjC,WAAW,EAAE,4CAA4C;IACzD,WAAW,EAAE,yCAAyC;IACtD,QAAQ,CAAC,SAAS;QAChB,OAAO,SAAS,CAAC,YAAY,CAAC,KAAK,CACjC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAC1F;YACC,CAAC,CAAC,UAAU,CAAC,IAAI;YACjB,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;IACtB,CAAC;CACF,CAAC;AAEF,MAAM,mBAAmB,GAAsB;IAC7C,IAAI,EAAE,kBAAkB;IACxB,QAAQ,EAAE,kBAAkB,CAAC,IAAI;IACjC,WAAW,EAAE,iDAAiD;IAC9D,WAAW,EAAE,wCAAwC;IACrD,QAAQ,CAAC,SAAS;QAChB,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC,IAAI,CAAC;QAC5D,OAAO,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;IAChG,CAAC;CACF,CAAC;AAEF,MAAM,gBAAgB,GAAsB;IAC1C,IAAI,EAAE,eAAe;IACrB,QAAQ,EAAE,kBAAkB,CAAC,IAAI;IACjC,WAAW,EAAE,qDAAqD;IAClE,WAAW,EAAE,sDAAsD;IACnE,QAAQ,CAAC,SAAS;QAChB,MAAM,UAAU,GAAG,SAAS,CAAC,YAAY,CAAC,MAAM,CAC9C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,CAC/C,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC,IAAI,CAAC;QACpD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;IACjG,CAAC;CACF,CAAC;AAEF,gBAAgB;AAEhB,MAAM,qBAAqB,GAAsB;IAC/C,IAAI,EAAE,yBAAyB;IAC/B,QAAQ,EAAE,kBAAkB,CAAC,IAAI;IACjC,WAAW,EAAE,yDAAyD;IACtE,WAAW,EAAE,8DAA8D;IAC3E,QAAQ,CAAC,SAAS;QAChB,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACxC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;gBACzC,IACE,CAAC,GAAG,KAAK,mBAAmB,CAAC,SAAS,IAAI,GAAG,KAAK,mBAAmB,CAAC,eAAe,CAAC;oBACtF,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EACxB,CAAC;oBACD,OAAO,UAAU,CAAC,IAAI,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC,IAAI,CAAC;IACzB,CAAC;CACF,CAAC;AAEF,aAAa;AAEb,MAAM,sBAAsB,GAAsB;IAChD,IAAI,EAAE,0BAA0B;IAChC,QAAQ,EAAE,kBAAkB,CAAC,IAAI;IACjC,WAAW,EAAE,4DAA4D;IACzE,WAAW,EAAE,uDAAuD;IACpE,QAAQ,CAAC,SAAS;QAChB,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACxC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc;oBAAE,OAAO,UAAU,CAAC,OAAO,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC,IAAI,CAAC;IACzB,CAAC;CACF,CAAC;AAEF,MAAM,mBAAmB,GAAsB;IAC7C,IAAI,EAAE,uBAAuB;IAC7B,QAAQ,EAAE,kBAAkB,CAAC,OAAO;IACpC,WAAW,EAAE,8DAA8D;IAC3E,WAAW,EAAE,4DAA4D;IACzE,QAAQ,CAAC,SAAS;QAChB,MAAM,oBAAoB,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,OAAO,CAAC,cAAc,KAAK,mBAAmB,CAAC,QAAQ;YACzD,CAAC,CAAC,OAAO,CAAC,cAAc,KAAK,mBAAmB,CAAC,SAAS,CAC7D,CACF,CAAC;QACF,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC,IAAI,CAAC;QAC9D,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;IAC/F,CAAC;CACF,CAAC;AAEF,MAAM,oBAAoB,GAAsB;IAC9C,IAAI,EAAE,wBAAwB;IAC9B,QAAQ,EAAE,kBAAkB,CAAC,IAAI;IACjC,WAAW,EAAE,iEAAiE;IAC9E,WAAW,EAAE,gEAAgE;IAC7E,QAAQ,CAAC,SAAS;QAChB,0GAA0G;QAC1G,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC,IAAI,CAAC;QAChD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;IAC5F,CAAC;CACF,CAAC;AAEF,aAAa;AAEb,MAAM,sBAAsB,GAAsB;IAChD,IAAI,EAAE,0BAA0B;IAChC,QAAQ,EAAE,kBAAkB,CAAC,IAAI;IACjC,WAAW,EAAE,iDAAiD;IAC9D,WAAW,EAAE,kCAAkC;IAC/C,QAAQ,CAAC,SAAS;QAChB,IAAI,SAAS,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC,IAAI,CAAC;QAChE,OAAO,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,CAAC;YACpE,CAAC,CAAC,UAAU,CAAC,IAAI;YACjB,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;IACtB,CAAC;CACF,CAAC;AAEF,MAAM,oBAAoB,GAAsB;IAC9C,IAAI,EAAE,wBAAwB;IAC9B,QAAQ,EAAE,kBAAkB,CAAC,OAAO;IACpC,WAAW,EAAE,mEAAmE;IAChF,WAAW,EAAE,2EAA2E;IACxF,QAAQ,CAAC,SAAS;QAChB,OAAO,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;IAC/F,CAAC;CACF,CAAC;AAEF,cAAc;AAEd,MAAM,kBAAkB,GAAsB;IAC5C,IAAI,EAAE,sBAAsB;IAC5B,QAAQ,EAAE,kBAAkB,CAAC,IAAI;IACjC,WAAW,EAAE,sEAAsE;IACnF,WAAW,EAAE,2EAA2E;IACxF,QAAQ,CAAC,SAAS;QAChB,MAAM,wBAAwB,GAA0B;YACtD,mBAAmB,CAAC,QAAQ;YAC5B,mBAAmB,CAAC,SAAS;YAC7B,mBAAmB,CAAC,eAAe;SACpC,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACxC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjD,IACE,KAAK,CAAC,OAAO,CAAC,cAAc;oBAC5B,wBAAwB,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;oBAC/D,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EACxB,CAAC;oBACD,OAAO,UAAU,CAAC,IAAI,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC,IAAI,CAAC;IACzB,CAAC;CACF,CAAC;AAEF,MAAM,iBAAiB,GAAsB;IAC3C,IAAI,EAAE,qBAAqB;IAC3B,QAAQ,EAAE,kBAAkB,CAAC,IAAI;IACjC,WAAW,EAAE,yCAAyC;IACtD,WAAW,EAAE,4CAA4C;IACzD,QAAQ,CAAC,SAAS;QAChB,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACxC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;gBACzC,IACE,CAAC,GAAG,KAAK,mBAAmB,CAAC,SAAS,IAAI,GAAG,KAAK,mBAAmB,CAAC,eAAe,CAAC;oBACtF,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,EAC3B,CAAC;oBACD,OAAO,UAAU,CAAC,IAAI,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC,IAAI,CAAC;IACzB,CAAC;CACF,CAAC;AAEF,MAAM,mBAAmB,GAAsB;IAC7C,IAAI,EAAE,uBAAuB;IAC7B,QAAQ,EAAE,kBAAkB,CAAC,IAAI;IACjC,WAAW,EAAE,4EAA4E;IACzF,WAAW,EAAE,oEAAoE;IACjF,QAAQ,CAAC,SAAS;QAChB,OAAO,SAAS,CAAC,YAAY;aAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC;aACrC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC;YACtC,CAAC,CAAC,UAAU,CAAC,IAAI;YACjB,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;IACzB,CAAC;CACF,CAAC;AAEF,mCAAmC;AAEnC,MAAM,uBAAuB,GAAsB;IACjD,IAAI,EAAE,2BAA2B;IACjC,QAAQ,EAAE,kBAAkB,CAAC,OAAO;IACpC,WAAW,EAAE,6CAA6C;IAC1D,WAAW,EAAE,gDAAgD;IAC7D,QAAQ,CAAC,SAAS;QAChB,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACxC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjD,IACE,KAAK,CAAC,OAAO,CAAC,cAAc,KAAK,mBAAmB,CAAC,eAAe;oBACpE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EACxB,CAAC;oBACD,OAAO,UAAU,CAAC,IAAI,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC,IAAI,CAAC;IACzB,CAAC;CACF,CAAC;AAEF,qCAAqC;AAErC,MAAM,CAAC,MAAM,eAAe,GAA4C;IACtE,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE;QACtB,IAAI,EAAE,aAAa,CAAC,MAAM;QAC1B,WAAW,EAAE,8CAA8C;QAC3D,KAAK,EAAE;YACL,yBAAyB;YACzB,mBAAmB;YACnB,gBAAgB;YAChB,qBAAqB;SACtB;KACF;IACD,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE;QACpB,IAAI,EAAE,aAAa,CAAC,IAAI;QACxB,WAAW,EAAE,oCAAoC;QACjD,KAAK,EAAE;YACL,yBAAyB;YACzB,mBAAmB;YACnB,gBAAgB;YAChB,sBAAsB;YACtB,mBAAmB;YACnB,oBAAoB;SACrB;KACF;IACD,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE;QACpB,IAAI,EAAE,aAAa,CAAC,IAAI;QACxB,WAAW,EAAE,gCAAgC;QAC7C,KAAK,EAAE;YACL,yBAAyB;YACzB,mBAAmB;YACnB,gBAAgB;YAChB,sBAAsB;YACtB,oBAAoB;SACrB;KACF;IACD,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QACrB,IAAI,EAAE,aAAa,CAAC,KAAK;QACzB,WAAW,EAAE,qDAAqD;QAClE,KAAK,EAAE;YACL,yBAAyB;YACzB,mBAAmB;YACnB,gBAAgB;YAChB,kBAAkB;YAClB,iBAAiB;YACjB,mBAAmB;SACpB;KACF;IACD,CAAC,aAAa,CAAC,wBAAwB,CAAC,EAAE;QACxC,IAAI,EAAE,aAAa,CAAC,wBAAwB;QAC5C,WAAW,EAAE,yCAAyC;QACtD,KAAK,EAAE;YACL,yBAAyB;YACzB,mBAAmB;YACnB,gBAAgB;YAChB,uBAAuB;SACxB;KACF;CACF,CAAC;AAEF,2DAA2D;AAC3D,MAAM,UAAU,qBAAqB,CACnC,WAAmB,EACnB,SAA0B,EAC1B,YAAkC,EAAE;IAEpC,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI;QAC9B,yBAAyB;QACzB,mBAAmB;QACnB,gBAAgB;KACjB,CAAC;IAEF,MAAM,OAAO,GAAqB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACnD,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACtF,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC;IAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,CACxE,CAAC,MAAM,CAAC;IACT,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAEtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC"}

package/dist/governance/reports.d.ts

@@ -0,0 +1,15 @@
+import type { GovernanceOverride, PolicyReport } from '../types/governance.js';
+import type { SystemInventory } from './rule-engine.js';
+export interface ReportOptions {
+    /** Include remediation recommendations in the report */
+    includeRemediation?: boolean;
+    /** Include overridden rules in recommendations */
+    includeOverriddenRecommendations?: boolean;
+}
+/** Generate a full policy compatibility report */
+export declare function generatePolicyReport(profileName: string, inventory: SystemInventory, overrides?: GovernanceOverride[], options?: ReportOptions): PolicyReport;
+/** Generate reports for all built-in policy profiles */
+export declare function generateAllPolicyReports(inventory: SystemInventory, overrides?: GovernanceOverride[], options?: ReportOptions): PolicyReport[];
+/** Format a policy report as human-readable text */
+export declare function formatPolicyReport(report: PolicyReport): string;
+//# sourceMappingURL=reports.d.ts.map

package/dist/governance/reports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reports.d.ts","sourceRoot":"","sources":["../../src/governance/reports.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAkB,MAAM,wBAAwB,CAAC;AAE/F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGxD,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,kDAAkD;IAClD,gCAAgC,CAAC,EAAE,OAAO,CAAC;CAC5C;AAED,kDAAkD;AAClD,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,eAAe,EAC1B,SAAS,GAAE,kBAAkB,EAAO,EACpC,OAAO,GAAE,aAAkB,GAC1B,YAAY,CAiCd;AAED,wDAAwD;AACxD,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,eAAe,EAC1B,SAAS,GAAE,kBAAkB,EAAO,EACpC,OAAO,GAAE,aAAkB,GAC1B,YAAY,EAAE,CAIhB;AAED,oDAAoD;AACpD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CA8B/D"}

package/dist/governance/reports.js

@@ -0,0 +1,79 @@
+// ── Policy Compatibility Report Generator ──
+// Evaluates all rules in a policy profile, produces structured report with
+// compatibility score, per-rule results, override list, and remediation recommendations.
+import { builtInProfiles, evaluatePolicyProfile } from './policies.js';
+/** Generate a full policy compatibility report */
+export function generatePolicyReport(profileName, inventory, overrides = [], options = {}) {
+    const { results, score } = evaluatePolicyProfile(profileName, inventory, overrides);
+    const recommendations = [];
+    if (options.includeRemediation !== false) {
+        for (const result of results) {
+            if (result.status === 'fail' || result.status === 'partial') {
+                if (result.remediation) {
+                    recommendations.push(`[${result.rule}] ${result.remediation}`);
+                }
+            }
+            if (options.includeOverriddenRecommendations &&
+                result.status === 'override' &&
+                result.remediation) {
+                recommendations.push(`[${result.rule}] (overridden) ${result.remediation}`);
+            }
+        }
+    }
+    const appliedOverrides = overrides.filter((o) => results.some((r) => r.rule === o.rule && r.status === 'override'));
+    return {
+        policy: profileName,
+        timestamp: new Date(),
+        compatibilityScore: score,
+        results,
+        overrides: appliedOverrides,
+        recommendations,
+    };
+}
+/** Generate reports for all built-in policy profiles */
+export function generateAllPolicyReports(inventory, overrides = [], options = {}) {
+    return Object.keys(builtInProfiles).map((profileName) => generatePolicyReport(profileName, inventory, overrides, options));
+}
+/** Format a policy report as human-readable text */
+export function formatPolicyReport(report) {
+    const lines = [];
+    lines.push(`Policy: ${report.policy}`);
+    lines.push(`Compatibility Score: ${report.compatibilityScore}%`);
+    lines.push(`Evaluated: ${report.timestamp.toISOString()}`);
+    lines.push('');
+    lines.push('Results:');
+    for (const result of report.results) {
+        const icon = formatStatusIcon(result.status);
+        lines.push(`  ${icon} ${result.rule}: ${result.description ?? ''} [${result.status}]`);
+    }
+    if (report.overrides && report.overrides.length > 0) {
+        lines.push('');
+        lines.push('Overrides:');
+        for (const override of report.overrides) {
+            lines.push(`  - ${override.rule}: ${override.justification} (by ${override.author})`);
+        }
+    }
+    if (report.recommendations && report.recommendations.length > 0) {
+        lines.push('');
+        lines.push('Recommendations:');
+        for (const rec of report.recommendations) {
+            lines.push(`  - ${rec}`);
+        }
+    }
+    return lines.join('\n');
+}
+function formatStatusIcon(status) {
+    switch (status) {
+        case 'pass':
+            return '✓';
+        case 'partial':
+            return '~';
+        case 'fail':
+            return '✗';
+        case 'override':
+            return '⊘';
+        default:
+            return '?';
+    }
+}
+//# sourceMappingURL=reports.js.map

package/dist/governance/reports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reports.js","sourceRoot":"","sources":["../../src/governance/reports.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,2EAA2E;AAC3E,yFAAyF;AAGzF,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAWvE,kDAAkD;AAClD,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,SAA0B,EAC1B,YAAkC,EAAE,EACpC,UAAyB,EAAE;IAE3B,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,qBAAqB,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAEpF,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,kBAAkB,KAAK,KAAK,EAAE,CAAC;QACzC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC5D,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACvB,eAAe,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;YACD,IACE,OAAO,CAAC,gCAAgC;gBACxC,MAAM,CAAC,MAAM,KAAK,UAAU;gBAC5B,MAAM,CAAC,WAAW,EAClB,CAAC;gBACD,eAAe,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,kBAAkB,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAClE,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,IAAI,IAAI,EAAE;QACrB,kBAAkB,EAAE,KAAK;QACzB,OAAO;QACP,SAAS,EAAE,gBAAgB;QAC3B,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,wBAAwB,CACtC,SAA0B,EAC1B,YAAkC,EAAE,EACpC,UAAyB,EAAE;IAE3B,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CACtD,oBAAoB,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,kBAAkB,CAAC,MAAoB;IACrD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,KAAK,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,kBAAkB,GAAG,CAAC,CAAC;IACjE,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAEvB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,WAAW,IAAI,EAAE,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzB,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,KAAK,CAAC,IAAI,CAAC,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,aAAa,QAAQ,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAgC;IACxD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,GAAG,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,GAAG,CAAC;QACb,KAAK,MAAM;YACT,OAAO,GAAG,CAAC;QACb,KAAK,UAAU;YACb,OAAO,GAAG,CAAC;QACb;YACE,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/governance/rule-engine.d.ts

@@ -0,0 +1,45 @@
+import type { CapabilityContract } from '../types/capability.js';
+import type { EntityDefinition } from '../types/entity.js';
+import type { GovernanceSeverity } from '../types/enums.js';
+import type { EventDefinition } from '../types/event.js';
+import type { FlowDefinition } from '../types/flow.js';
+import type { GovernanceOverride, GovernanceSignal } from '../types/governance.js';
+import type { PromptDefinition } from '../types/prompt.js';
+export type RuleCategory = 'security' | 'privacy' | 'architecture' | 'ai';
+export interface SystemInventory {
+    capabilities: CapabilityContract[];
+    entities: EntityDefinition[];
+    flows: FlowDefinition[];
+    events: EventDefinition[];
+    prompts: PromptDefinition[];
+}
+export interface GovernanceRule {
+    id: string;
+    category: RuleCategory;
+    severity: GovernanceSeverity;
+    description: string;
+    evaluate: (inventory: SystemInventory) => GovernanceSignal[];
+}
+export interface GovernanceResult {
+    signals: GovernanceSignal[];
+    overrideApplied: GovernanceOverride[];
+    /** Signals that remain after overrides */
+    effective: GovernanceSignal[];
+    summary: {
+        total: number;
+        high: number;
+        warning: number;
+        info: number;
+        overridden: number;
+    };
+}
+export interface GovernanceRuleEngine {
+    register(rule: GovernanceRule): void;
+    registerMany(rules: GovernanceRule[]): void;
+    unregister(ruleId: string): void;
+    getRules(): GovernanceRule[];
+    getRulesByCategory(category: RuleCategory): GovernanceRule[];
+    evaluate(inventory: SystemInventory, overrides?: GovernanceOverride[]): GovernanceResult;
+}
+export declare function createGovernanceRuleEngine(): GovernanceRuleEngine;
+//# sourceMappingURL=rule-engine.d.ts.map

package/dist/governance/rule-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-engine.d.ts","sourceRoot":"","sources":["../../src/governance/rule-engine.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG3D,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,cAAc,GAAG,IAAI,CAAC;AAG1E,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,OAAO,EAAE,gBAAgB,EAAE,CAAC;CAC7B;AAGD,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,CAAC,SAAS,EAAE,eAAe,KAAK,gBAAgB,EAAE,CAAC;CAC9D;AAGD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,eAAe,EAAE,kBAAkB,EAAE,CAAC;IACtC,0CAA0C;IAC1C,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAGD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;IACrC,YAAY,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAC5C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,IAAI,cAAc,EAAE,CAAC;IAC7B,kBAAkB,CAAC,QAAQ,EAAE,YAAY,GAAG,cAAc,EAAE,CAAC;IAC7D,QAAQ,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,CAAC,EAAE,kBAAkB,EAAE,GAAG,gBAAgB,CAAC;CAC1F;AAED,wBAAgB,0BAA0B,IAAI,oBAAoB,CA+DjE"}

package/dist/governance/rule-engine.js

@@ -0,0 +1,60 @@
+// ── Governance Rule Engine ──
+// Evaluates rules against system metadata (entities, capabilities, flows, events, prompts, AI config)
+// Each rule produces GovernanceSignals
+export function createGovernanceRuleEngine() {
+    const rules = new Map();
+    return {
+        register(rule) {
+            rules.set(rule.id, rule);
+        },
+        registerMany(newRules) {
+            for (const rule of newRules) {
+                rules.set(rule.id, rule);
+            }
+        },
+        unregister(ruleId) {
+            rules.delete(ruleId);
+        },
+        getRules() {
+            return [...rules.values()];
+        },
+        getRulesByCategory(category) {
+            return [...rules.values()].filter((r) => r.category === category);
+        },
+        evaluate(inventory, overrides = []) {
+            const allSignals = [];
+            for (const rule of rules.values()) {
+                const signals = rule.evaluate(inventory);
+                allSignals.push(...signals);
+            }
+            // Determine which signals are overridden
+            const overrideRules = new Set(overrides.map((o) => o.rule));
+            const overrideApplied = [];
+            const effective = [];
+            for (const signal of allSignals) {
+                if (overrideRules.has(signal.rule)) {
+                    const override = overrides.find((o) => o.rule === signal.rule);
+                    if (override && !overrideApplied.includes(override)) {
+                        overrideApplied.push(override);
+                    }
+                }
+                else {
+                    effective.push(signal);
+                }
+            }
+            return {
+                signals: allSignals,
+                overrideApplied,
+                effective,
+                summary: {
+                    total: allSignals.length,
+                    high: effective.filter((s) => s.severity === 'high').length,
+                    warning: effective.filter((s) => s.severity === 'warning').length,
+                    info: effective.filter((s) => s.severity === 'info').length,
+                    overridden: allSignals.length - effective.length,
+                },
+            };
+        },
+    };
+}
+//# sourceMappingURL=rule-engine.js.map

package/dist/governance/rule-engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-engine.js","sourceRoot":"","sources":["../../src/governance/rule-engine.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,sGAAsG;AACtG,uCAAuC;AAwDvC,MAAM,UAAU,0BAA0B;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEhD,OAAO;QACL,QAAQ,CAAC,IAAI;YACX,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3B,CAAC;QAED,YAAY,CAAC,QAAQ;YACnB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,UAAU,CAAC,MAAM;YACf,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QAED,QAAQ;YACN,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7B,CAAC;QAED,kBAAkB,CAAC,QAAQ;YACzB,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACpE,CAAC;QAED,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,EAAE;YAChC,MAAM,UAAU,GAAuB,EAAE,CAAC;YAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACzC,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;YAC9B,CAAC;YAED,yCAAyC;YACzC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5D,MAAM,eAAe,GAAyB,EAAE,CAAC;YACjD,MAAM,SAAS,GAAuB,EAAE,CAAC;YAEzC,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;gBAChC,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;oBAC/D,IAAI,QAAQ,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;wBACpD,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACjC,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,UAAU;gBACnB,eAAe;gBACf,SAAS;gBACT,OAAO,EAAE;oBACP,KAAK,EAAE,UAAU,CAAC,MAAM;oBACxB,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;oBAC3D,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM;oBACjE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;oBAC3D,UAAU,EAAE,UAAU,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM;iBACjD;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/governance/rules/ai.d.ts

@@ -0,0 +1,11 @@
+import type { GovernanceRule } from '../rule-engine.js';
+/** Prompts without output validation schemas */
+export declare const rulePromptMissingOutputSchema: GovernanceRule;
+/** Prompts without model configuration */
+export declare const rulePromptMissingModelConfig: GovernanceRule;
+/** Capabilities using AI without explanation enabled */
+export declare const ruleAIWithoutExplanation: GovernanceRule;
+/** Excessive AI usage — too many capabilities relying on AI */
+export declare const ruleExcessiveAIUsage: GovernanceRule;
+export declare const aiRules: GovernanceRule[];
+//# sourceMappingURL=ai.d.ts.map

package/dist/governance/rules/ai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai.d.ts","sourceRoot":"","sources":["../../../src/governance/rules/ai.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,gDAAgD;AAChD,eAAO,MAAM,6BAA6B,EAAE,cAgB3C,CAAC;AAEF,0CAA0C;AAC1C,eAAO,MAAM,4BAA4B,EAAE,cAgB1C,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,wBAAwB,EAAE,cAgBtC,CAAC;AAEF,+DAA+D;AAC/D,eAAO,MAAM,oBAAoB,EAAE,cAsBlC,CAAC;AAEF,eAAO,MAAM,OAAO,EAAE,cAAc,EAKnC,CAAC"}