@vorionsys/platform-core 0.1.0

package/dist/policy/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Policy Engine
+ *
+ * Provides policy-based access control for intent governance.
+ *
+ * @packageDocumentation
+ */
+export type { PolicyStatus, ConditionOperator, LogicalOperator, FieldCondition, CompoundCondition, TrustCondition, TimeCondition, PolicyCondition, PolicyAction, PolicyRule, PolicyTarget, PolicyDefinition, Policy, PolicyVersion, PolicyEvaluationContext, RuleEvaluationResult, PolicyEvaluationResult, MultiPolicyEvaluationResult, CreatePolicyInput, UpdatePolicyInput, PolicyListFilters, PolicyValidationError, PolicyValidationResult, } from './types.js';
+export { POLICY_STATUSES, CONDITION_OPERATORS, LOGICAL_OPERATORS, } from './types.js';
+export { PolicyService, PolicyValidationException, createPolicyService, validatePolicyDefinition, } from './service.js';
+export { PolicyEvaluator, createPolicyEvaluator, } from './evaluator.js';
+export { PolicyLoader, getPolicyLoader, createPolicyLoader, resetPolicyLoader, } from './loader.js';
+export { VisualPolicyBuilder, createVisualPolicyBuilder, FieldDataType, FIELD_REGISTRY, OPERATOR_REGISTRY, } from './visual-builder/index.js';
+export type { FieldDefinition, OperatorDefinition, VisualConditionBlock, VisualActionBlock, VisualRuleBlock, VisualPolicyBlock, BuilderValidationError, BuilderValidationResult, } from './visual-builder/index.js';
+export { PolicySimulator, createPolicySimulator, } from './visual-builder/simulator.js';
+export type { HistoricalIntent, IntentSimulationResult, ActionImpact, EntityImpact, SimulationReport, SimulationOptions, ImpactAnalysis, } from './visual-builder/simulator.js';
+export { PolicyTemplateService, createPolicyTemplateService, TemplateCategory, POLICY_TEMPLATES, } from './visual-builder/templates.js';
+export type { PolicyTemplate, TemplateVariable, } from './visual-builder/templates.js';
+export { PolicyInheritanceService, createPolicyInheritanceService, } from './visual-builder/inheritance.js';
+export type { PolicyInheritance, PolicyHierarchyNode, MergedPolicy, PolicyConflict, InheritanceValidationResult, } from './visual-builder/inheritance.js';
+export { PolicyPropagationService, createPolicyPropagationService, } from './visual-builder/propagation.js';
+export type { PolicyUpdateEvent, PolicyAcknowledgment, PropagationStatus, PropagationOptions, AgentConnection, } from './visual-builder/propagation.js';
+export { registerVisualPolicyBuilderRoutes } from './visual-builder/routes.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,eAAe,EACf,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,MAAM,EACN,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,eAAe,EACf,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,aAAa,EACb,cAAc,EACd,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,eAAe,EACf,qBAAqB,GACtB,MAAM,+BAA+B,CAAC;AAEvC,YAAY,EACV,gBAAgB,EAChB,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,GACf,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AAEvC,YAAY,EACV,cAAc,EACd,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,iCAAiC,CAAC;AAEzC,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,EACZ,cAAc,EACd,2BAA2B,GAC5B,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,iCAAiC,CAAC;AAEzC,YAAY,EACV,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,GAChB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/policy/index.js

@@ -0,0 +1,27 @@
+/**
+ * Policy Engine
+ *
+ * Provides policy-based access control for intent governance.
+ *
+ * @packageDocumentation
+ */
+export { POLICY_STATUSES, CONDITION_OPERATORS, LOGICAL_OPERATORS, } from './types.js';
+// Service
+export { PolicyService, PolicyValidationException, createPolicyService, validatePolicyDefinition, } from './service.js';
+// Evaluator
+export { PolicyEvaluator, createPolicyEvaluator, } from './evaluator.js';
+// Loader
+export { PolicyLoader, getPolicyLoader, createPolicyLoader, resetPolicyLoader, } from './loader.js';
+// Visual Policy Builder (Epic 4: FR144-150)
+export { VisualPolicyBuilder, createVisualPolicyBuilder, FieldDataType, FIELD_REGISTRY, OPERATOR_REGISTRY, } from './visual-builder/index.js';
+// Policy Simulator
+export { PolicySimulator, createPolicySimulator, } from './visual-builder/simulator.js';
+// Policy Templates
+export { PolicyTemplateService, createPolicyTemplateService, TemplateCategory, POLICY_TEMPLATES, } from './visual-builder/templates.js';
+// Policy Inheritance
+export { PolicyInheritanceService, createPolicyInheritanceService, } from './visual-builder/inheritance.js';
+// Policy Propagation
+export { PolicyPropagationService, createPolicyPropagationService, } from './visual-builder/propagation.js';
+// Visual Builder Routes
+export { registerVisualPolicyBuilderRoutes } from './visual-builder/routes.js';
+//# sourceMappingURL=index.js.map

package/dist/policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA6BH,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAEpB,UAAU;AACV,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAEtB,YAAY;AACZ,OAAO,EACL,eAAe,EACf,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAExB,SAAS;AACT,OAAO,EACL,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,4CAA4C;AAC5C,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,aAAa,EACb,cAAc,EACd,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AAanC,mBAAmB;AACnB,OAAO,EACL,eAAe,EACf,qBAAqB,GACtB,MAAM,+BAA+B,CAAC;AAYvC,mBAAmB;AACnB,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AAOvC,qBAAqB;AACrB,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,iCAAiC,CAAC;AAUzC,qBAAqB;AACrB,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,iCAAiC,CAAC;AAUzC,wBAAwB;AACxB,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/policy/loader.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Policy Loader
+ *
+ * Loads and caches policies from the database for runtime evaluation.
+ *
+ * @packageDocumentation
+ */
+import type { Policy } from './types.js';
+import type { ID } from '../common/types.js';
+/**
+ * Policy Loader service for fetching and caching policies
+ */
+export declare class PolicyLoader {
+    private policyService;
+    private localCache;
+    private cacheTtl;
+    constructor(options?: {
+        cacheTtl?: number;
+    });
+    /**
+     * Get published policies for a tenant, with caching
+     */
+    getPolicies(tenantId: ID, namespace?: string): Promise<Policy[]>;
+    /**
+     * Get a specific policy by ID
+     */
+    getPolicy(id: ID, tenantId: ID): Promise<Policy | null>;
+    /**
+     * Invalidate cache for a tenant (call after policy updates)
+     */
+    invalidateCache(tenantId: ID, namespace?: string): Promise<void>;
+    /**
+     * Invalidate all caches (call on policy hot-reload)
+     */
+    invalidateAll(): Promise<void>;
+    /**
+     * Preload policies for a tenant (warm the cache)
+     */
+    preload(tenantId: ID, namespaces?: string[]): Promise<void>;
+    /**
+     * Get cache key for a tenant/namespace
+     */
+    private getCacheKey;
+    /**
+     * Update both local and Redis caches
+     */
+    private updateCache;
+}
+/**
+ * Get the shared policy loader instance
+ */
+export declare function getPolicyLoader(): PolicyLoader;
+/**
+ * Create a new policy loader instance
+ */
+export declare function createPolicyLoader(options?: {
+    cacheTtl?: number;
+}): PolicyLoader;
+/**
+ * Reset the singleton (for testing)
+ */
+export declare function resetPolicyLoader(): void;
+//# sourceMappingURL=loader.d.ts.map

package/dist/policy/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/policy/loader.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAoB,MAAM,YAAY,CAAC;AAC3D,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AAU7C;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,UAAU,CAAuD;IACzE,OAAO,CAAC,QAAQ,CAAS;gBAEb,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;IAM3C;;OAEG;IACG,WAAW,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgDtE;;OAEG;IACG,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAK7D;;OAEG;IACG,eAAe,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBtE;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAepC;;OAEG;IACG,OAAO,CAAC,QAAQ,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IASjE;;OAEG;IACH,OAAO,CAAC,WAAW;IAInB;;OAEG;IACH,OAAO,CAAC,WAAW;CAepB;AAOD;;GAEG;AACH,wBAAgB,eAAe,IAAI,YAAY,CAK9C;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,YAAY,CAEhF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAExC"}

package/dist/policy/loader.js

@@ -0,0 +1,176 @@
+/**
+ * Policy Loader
+ *
+ * Loads and caches policies from the database for runtime evaluation.
+ *
+ * @packageDocumentation
+ */
+import { createLogger } from '../common/logger.js';
+import { getRedis } from '../common/redis.js';
+import { createPolicyService } from './service.js';
+import { recordPolicyCacheHit, recordPolicyCacheMiss } from '../intent/metrics.js';
+import { createSystemTenantContext } from '../common/tenant-context.js';
+const logger = createLogger({ component: 'policy-loader' });
+// Cache TTL in seconds
+const DEFAULT_CACHE_TTL = 300; // 5 minutes
+const CACHE_PREFIX = 'policy:cache:';
+/**
+ * Policy Loader service for fetching and caching policies
+ */
+export class PolicyLoader {
+    policyService;
+    localCache;
+    cacheTtl;
+    constructor(options) {
+        this.policyService = createPolicyService();
+        this.localCache = new Map();
+        this.cacheTtl = options?.cacheTtl ?? DEFAULT_CACHE_TTL;
+    }
+    /**
+     * Get published policies for a tenant, with caching
+     */
+    async getPolicies(tenantId, namespace) {
+        const cacheKey = this.getCacheKey(tenantId, namespace);
+        const effectiveNamespace = namespace ?? 'default';
+        // Check local memory cache first (fastest)
+        const localCached = this.localCache.get(cacheKey);
+        if (localCached && localCached.expires > Date.now()) {
+            logger.debug({ tenantId, namespace, source: 'local' }, 'Policy cache hit');
+            recordPolicyCacheHit(tenantId, effectiveNamespace);
+            return localCached.policies;
+        }
+        // Check Redis cache (distributed)
+        try {
+            const redis = getRedis();
+            const redisCached = await redis.get(CACHE_PREFIX + cacheKey);
+            if (redisCached) {
+                const policies = JSON.parse(redisCached);
+                // Update local cache
+                this.localCache.set(cacheKey, {
+                    policies,
+                    expires: Date.now() + this.cacheTtl * 1000,
+                });
+                logger.debug({ tenantId, namespace, source: 'redis' }, 'Policy cache hit');
+                recordPolicyCacheHit(tenantId, effectiveNamespace);
+                return policies;
+            }
+        }
+        catch (error) {
+            logger.warn({ error }, 'Failed to check Redis policy cache');
+        }
+        // Cache miss - fetch from database
+        recordPolicyCacheMiss(tenantId, effectiveNamespace);
+        const ctx = createSystemTenantContext(tenantId, { userId: 'system:policy-loader' });
+        const policies = await this.policyService.getPublishedPolicies(ctx, namespace);
+        // Update caches
+        this.updateCache(cacheKey, policies);
+        logger.debug({ tenantId, namespace, count: policies.length, source: 'database' }, 'Policies loaded from database');
+        return policies;
+    }
+    /**
+     * Get a specific policy by ID
+     */
+    async getPolicy(id, tenantId) {
+        const ctx = createSystemTenantContext(tenantId, { userId: 'system:policy-loader' });
+        return this.policyService.findById(id, ctx);
+    }
+    /**
+     * Invalidate cache for a tenant (call after policy updates)
+     */
+    async invalidateCache(tenantId, namespace) {
+        const cacheKey = this.getCacheKey(tenantId, namespace);
+        // Clear local cache
+        this.localCache.delete(cacheKey);
+        // Clear Redis cache
+        try {
+            const redis = getRedis();
+            await redis.del(CACHE_PREFIX + cacheKey);
+            logger.info({ tenantId, namespace }, 'Policy cache invalidated');
+        }
+        catch (error) {
+            logger.warn({ error }, 'Failed to invalidate Redis policy cache');
+        }
+        // Also invalidate the "all namespaces" cache for this tenant
+        if (namespace) {
+            await this.invalidateCache(tenantId);
+        }
+    }
+    /**
+     * Invalidate all caches (call on policy hot-reload)
+     */
+    async invalidateAll() {
+        this.localCache.clear();
+        try {
+            const redis = getRedis();
+            const keys = await redis.keys(CACHE_PREFIX + '*');
+            if (keys.length > 0) {
+                await redis.del(...keys);
+            }
+            logger.info({ keysCleared: keys.length }, 'All policy caches invalidated');
+        }
+        catch (error) {
+            logger.warn({ error }, 'Failed to invalidate all Redis policy caches');
+        }
+    }
+    /**
+     * Preload policies for a tenant (warm the cache)
+     */
+    async preload(tenantId, namespaces) {
+        if (namespaces && namespaces.length > 0) {
+            await Promise.all(namespaces.map((ns) => this.getPolicies(tenantId, ns)));
+        }
+        else {
+            await this.getPolicies(tenantId);
+        }
+        logger.info({ tenantId, namespaces }, 'Policies preloaded');
+    }
+    /**
+     * Get cache key for a tenant/namespace
+     */
+    getCacheKey(tenantId, namespace) {
+        return namespace ? `${tenantId}:${namespace}` : tenantId;
+    }
+    /**
+     * Update both local and Redis caches
+     */
+    updateCache(cacheKey, policies) {
+        // Update local cache
+        this.localCache.set(cacheKey, {
+            policies,
+            expires: Date.now() + this.cacheTtl * 1000,
+        });
+        // Update Redis cache (fire and forget)
+        const redis = getRedis();
+        redis
+            .setex(CACHE_PREFIX + cacheKey, this.cacheTtl, JSON.stringify(policies))
+            .catch((error) => {
+            logger.warn({ error }, 'Failed to update Redis policy cache');
+        });
+    }
+}
+/**
+ * Singleton instance for shared use
+ */
+let loaderInstance = null;
+/**
+ * Get the shared policy loader instance
+ */
+export function getPolicyLoader() {
+    if (!loaderInstance) {
+        loaderInstance = new PolicyLoader();
+    }
+    return loaderInstance;
+}
+/**
+ * Create a new policy loader instance
+ */
+export function createPolicyLoader(options) {
+    return new PolicyLoader(options);
+}
+/**
+ * Reset the singleton (for testing)
+ */
+export function resetPolicyLoader() {
+    loaderInstance = null;
+}
+//# sourceMappingURL=loader.js.map

package/dist/policy/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/policy/loader.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAiB,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGlE,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAExE,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;AAE5D,uBAAuB;AACvB,MAAM,iBAAiB,GAAG,GAAG,CAAC,CAAC,YAAY;AAC3C,MAAM,YAAY,GAAG,eAAe,CAAC;AAErC;;GAEG;AACH,MAAM,OAAO,YAAY;IACf,aAAa,CAAgB;IAC7B,UAAU,CAAuD;IACjE,QAAQ,CAAS;IAEzB,YAAY,OAA+B;QACzC,IAAI,CAAC,aAAa,GAAG,mBAAmB,EAAE,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,iBAAiB,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,QAAY,EAAE,SAAkB;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACvD,MAAM,kBAAkB,GAAG,SAAS,IAAI,SAAS,CAAC;QAElD,2CAA2C;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,WAAW,IAAI,WAAW,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACpD,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,kBAAkB,CAAC,CAAC;YAC3E,oBAAoB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YACnD,OAAO,WAAW,CAAC,QAAQ,CAAC;QAC9B,CAAC;QAED,kCAAkC;QAClC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,YAAY,GAAG,QAAQ,CAAC,CAAC;YAE7D,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAa,CAAC;gBACrD,qBAAqB;gBACrB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE;oBAC5B,QAAQ;oBACR,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI;iBAC3C,CAAC,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,kBAAkB,CAAC,CAAC;gBAC3E,oBAAoB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;gBACnD,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,oCAAoC,CAAC,CAAC;QAC/D,CAAC;QAED,mCAAmC;QACnC,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,yBAAyB,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACpF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAE/E,gBAAgB;QAChB,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAErC,MAAM,CAAC,KAAK,CACV,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EACnE,+BAA+B,CAChC,CAAC;QAEF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,EAAM,EAAE,QAAY;QAClC,MAAM,GAAG,GAAG,yBAAyB,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CAAC,QAAY,EAAE,SAAkB;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAEvD,oBAAoB;QACpB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEjC,oBAAoB;QACpB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,KAAK,CAAC,GAAG,CAAC,YAAY,GAAG,QAAQ,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,0BAA0B,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,yCAAyC,CAAC,CAAC;QACpE,CAAC;QAED,6DAA6D;QAC7D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAExB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC;YAClD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YAC3B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC;QAC7E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,8CAA8C,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,QAAY,EAAE,UAAqB;QAC/C,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,QAAY,EAAE,SAAkB;QAClD,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC3D,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,QAAgB,EAAE,QAAkB;QACtD,qBAAqB;QACrB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE;YAC5B,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI;SAC3C,CAAC,CAAC;QAEH,uCAAuC;QACvC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,KAAK;aACF,KAAK,CAAC,YAAY,GAAG,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;aACvE,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,qCAAqC,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;IACP,CAAC;CACF;AAED;;GAEG;AACH,IAAI,cAAc,GAAwB,IAAI,CAAC;AAE/C;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,IAAI,YAAY,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA+B;IAChE,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,cAAc,GAAG,IAAI,CAAC;AACxB,CAAC"}

package/dist/policy/service.d.ts

@@ -0,0 +1,240 @@
+/**
+ * Policy Service
+ *
+ * Handles CRUD operations for policies with versioning and validation.
+ * Supports full version history, rollback, and diff capabilities.
+ *
+ * @packageDocumentation
+ */
+import type { ID } from '../common/types.js';
+import { type PolicyDiffResult } from './diff.js';
+import type { TenantContext } from '../common/tenant-context.js';
+import type { Policy, PolicyVersion, PolicyDefinition, PolicyStatus, CreatePolicyInput, UpdatePolicyInput, PolicyListFilters, PolicyValidationResult, PolicyValidationError } from './types.js';
+/**
+ * Input for updating a policy with versioning
+ */
+export interface UpdateWithVersioningInput {
+    definition?: PolicyDefinition;
+    description?: string;
+    status?: PolicyStatus;
+    changeSummary?: string;
+    changedBy?: string;
+}
+/**
+ * Extended policy version with additional metadata
+ */
+export interface PolicyVersionWithMeta extends PolicyVersion {
+    isCurrent: boolean;
+}
+/**
+ * Result of comparing two policy versions
+ */
+export interface PolicyVersionCompareResult {
+    policyId: ID;
+    version1: number;
+    version2: number;
+    diff: PolicyDiffResult;
+}
+/**
+ * Validate a policy definition
+ */
+export declare function validatePolicyDefinition(definition: unknown): PolicyValidationResult;
+/**
+ * Policy Service class
+ *
+ * SECURITY: All methods now accept TenantContext instead of raw tenantId.
+ * TenantContext can only be created from validated JWT tokens, preventing
+ * tenant ID injection attacks.
+ *
+ * SECURITY: Uses distributed locking and 2-phase cache invalidation to
+ * prevent race conditions where concurrent requests read stale policy data
+ * (MEDIUM vulnerability fix).
+ *
+ * @see TenantContext in ../common/tenant-context.ts
+ * @see distributed-cache.ts for locking and cache implementation
+ */
+export declare class PolicyService {
+    private distributedCache;
+    /**
+     * Create a new policy with write-through caching
+     *
+     * SECURITY: Atomically updates distributed cache after DB commit.
+     *
+     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
+     * @param input - Policy creation input
+     * @returns Created policy
+     */
+    create(ctx: TenantContext, input: CreatePolicyInput): Promise<Policy>;
+    /**
+     * Get a policy by ID with distributed cache support
+     *
+     * SECURITY: Checks distributed cache first with stale detection.
+     * Rejects stale cache entries to prevent reading outdated policies.
+     *
+     * @param id - Policy ID
+     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
+     * @returns Policy or null if not found
+     */
+    findById(id: ID, ctx: TenantContext): Promise<Policy | null>;
+    /**
+     * Get a policy by name and namespace
+     *
+     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
+     * @param name - Policy name
+     * @param namespace - Policy namespace (default: 'default')
+     * @returns Policy or null if not found
+     */
+    findByName(ctx: TenantContext, name: string, namespace?: string): Promise<Policy | null>;
+    /**
+     * Update a policy with distributed locking and 2-phase cache invalidation
+     *
+     * SECURITY FIX: Uses distributed locking and 2-phase cache invalidation
+     * to prevent race conditions where concurrent requests read stale policies.
+     *
+     * Flow:
+     * 1. Acquire distributed lock on policy
+     * 2. Mark cache as stale (2-phase step 1) - BEFORE DB commit
+     * 3. Perform database transaction
+     * 4. Invalidate local in-memory cache
+     * 5. Write to distributed cache atomically (write-through, 2-phase step 2)
+     * 6. Release lock
+     *
+     * @param id - Policy ID
+     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
+     * @param input - Policy update input
+     * @returns Updated policy or null if not found
+     */
+    update(id: ID, ctx: TenantContext, input: UpdatePolicyInput): Promise<Policy | null>;
+    /**
+     * Publish a policy (makes it active)
+     *
+     * @param id - Policy ID
+     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
+     * @returns Published policy or null if not found
+     */
+    publish(id: ID, ctx: TenantContext): Promise<Policy | null>;
+    /**
+     * Deprecate a policy
+     *
+     * @param id - Policy ID
+     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
+     * @returns Deprecated policy or null if not found
+     */
+    deprecate(id: ID, ctx: TenantContext): Promise<Policy | null>;
+    /**
+     * Archive a policy
+     *
+     * @param id - Policy ID
+     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
+     * @returns Archived policy or null if not found
+     */
+    archive(id: ID, ctx: TenantContext): Promise<Policy | null>;
+    /**
+     * List policies with filters
+     *
+     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
+     * @param filters - Optional filters (namespace, status, etc.)
+     * @returns Array of policies
+     */
+    list(ctx: TenantContext, filters?: Omit<PolicyListFilters, 'tenantId'>): Promise<Policy[]>;
+    /**
+     * Get published policies for evaluation
+     *
+     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
+     * @param namespace - Optional namespace filter
+     * @returns Array of published policies
+     */
+    getPublishedPolicies(ctx: TenantContext, namespace?: string): Promise<Policy[]>;
+    /**
+     * Update a policy with explicit versioning and distributed locking.
+     * Creates a new version record before applying changes.
+     *
+     * SECURITY FIX: Uses distributed locking and 2-phase cache invalidation.
+     *
+     * @param id - Policy ID
+     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
+     * @param changes - Changes to apply
+     * @returns Updated policy with new version number
+     */
+    updateWithVersioning(id: ID, ctx: TenantContext, changes: UpdateWithVersioningInput): Promise<Policy | null>;
+    /**
+     * Get complete version history for a policy.
+     * Returns all historical versions plus the current version.
+     *
+     * @param id - Policy ID
+     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
+     * @returns List of all versions, newest first
+     */
+    getVersionHistory(id: ID, ctx: TenantContext): Promise<PolicyVersionWithMeta[]>;
+    /**
+     * Get a specific version of a policy.
+     *
+     * @param id - Policy ID
+     * @param version - Version number to retrieve
+     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
+     * @returns The policy version or null if not found
+     */
+    getVersion(id: ID, version: number, ctx: TenantContext): Promise<PolicyVersion | null>;
+    /**
+     * Rollback a policy to a previous version with distributed locking.
+     * Creates a new version with the definition from the target version.
+     *
+     * SECURITY FIX: Uses distributed locking and 2-phase cache invalidation.
+     *
+     * @param id - Policy ID
+     * @param targetVersion - Version number to rollback to
+     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
+     * @returns Updated policy with new version number
+     */
+    rollbackToVersion(id: ID, targetVersion: number, ctx: TenantContext): Promise<Policy | null>;
+    /**
+     * Compare two versions of a policy.
+     *
+     * @param id - Policy ID
+     * @param version1 - First version to compare
+     * @param version2 - Second version to compare
+     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
+     * @returns Diff result between the two versions
+     */
+    compareVersions(id: ID, version1: number, version2: number, ctx: TenantContext): Promise<PolicyVersionCompareResult | null>;
+    /**
+     * Delete a policy with distributed locking (soft delete - archives it)
+     *
+     * SECURITY FIX: Uses distributed locking and 2-phase cache invalidation.
+     *
+     * @param id - Policy ID
+     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
+     * @returns True if deleted successfully
+     */
+    delete(id: ID, ctx: TenantContext): Promise<boolean>;
+    /**
+     * Get policies for evaluation with stale cache rejection
+     *
+     * This method is used by the policy evaluator to get policies for
+     * evaluation. It validates cache versions and rejects stale data.
+     *
+     * SECURITY: Ensures policy evaluation always uses fresh data.
+     *
+     * @param ctx - Validated tenant context from JWT
+     * @param policyIds - Policy IDs to evaluate
+     * @returns Array of policies (refreshed if stale)
+     */
+    getPoliciesForEvaluation(ctx: TenantContext, policyIds: ID[]): Promise<Policy[]>;
+    /**
+     * Convert database row to Policy object
+     */
+    private rowToPolicy;
+}
+/**
+ * Custom error for policy validation failures
+ */
+export declare class PolicyValidationException extends Error {
+    readonly errors: PolicyValidationError[];
+    constructor(message: string, errors: PolicyValidationError[]);
+}
+/**
+ * Create a new policy service instance
+ */
+export declare function createPolicyService(): PolicyService;
+export { withPolicyLock, PolicyLockError } from './distributed-cache.js';
+//# sourceMappingURL=service.d.ts.map

package/dist/policy/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/policy/service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AAG7C,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAOzE,OAAO,KAAK,EACV,aAAa,EAEd,MAAM,6BAA6B,CAAC;AAErC,OAAO,KAAK,EACV,MAAM,EACN,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,EAKtB,MAAM,YAAY,CAAC;AAEpB;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,EAAE,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAYD;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,OAAO,GAAG,sBAAsB,CAoDpF;AAqKD;;;;;;;;;;;;;GAaG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,gBAAgB,CAA+B;IACvD;;;;;;;;OAQG;IACG,MAAM,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC;IAqE3E;;;;;;;;;OASG;IACG,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA+ClE;;;;;;;OAOG;IACG,UAAU,CACd,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,MAAkB,GAC5B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA6BzB;;;;;;;;;;;;;;;;;;OAkBG;IACG,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAwH1F;;;;;;OAMG;IACG,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIjE;;;;;;OAMG;IACG,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAInE;;;;;;OAMG;IACG,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIjE;;;;;;OAMG;IACG,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAmChG;;;;;;OAMG;IACG,oBAAoB,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAOrF;;;;;;;;;;OAUG;IACG,oBAAoB,CACxB,EAAE,EAAE,EAAE,EACN,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAyHzB;;;;;;;OAOG;IACG,iBAAiB,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC;IA2CrF;;;;;;;OAOG;IACG,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA0C5F;;;;;;;;;;OAUG;IACG,iBAAiB,CACrB,EAAE,EAAE,EAAE,EACN,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA6JzB;;;;;;;;OAQG;IACG,eAAe,CACnB,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAsB7C;;;;;;;;OAQG;IACG,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAwC1D;;;;;;;;;;;OAWG;IACG,wBAAwB,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAqBtF;;OAEG;IACH,OAAO,CAAC,WAAW;CAiBpB;AAED;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,SAAgB,MAAM,EAAE,qBAAqB,EAAE,CAAC;gBAEpC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,EAAE;CAK7D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,aAAa,CAEnD;AAGD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC"}