@vorionsys/security 1.0.0

package/dist/policy/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Policy Engine
+ *
+ * Provides policy-based access control for intent governance.
+ *
+ * @packageDocumentation
+ */
+export type { PolicyStatus, ConditionOperator, LogicalOperator, FieldCondition, CompoundCondition, TrustCondition, TimeCondition, PolicyCondition, PolicyAction, PolicyRule, PolicyTarget, PolicyDefinition, Policy, PolicyVersion, PolicyEvaluationContext, RuleEvaluationResult, PolicyEvaluationResult, MultiPolicyEvaluationResult, CreatePolicyInput, UpdatePolicyInput, PolicyListFilters, PolicyValidationError, PolicyValidationResult, } from './types.js';
+export { POLICY_STATUSES, CONDITION_OPERATORS, LOGICAL_OPERATORS, } from './types.js';
+export { PolicyService, PolicyValidationException, createPolicyService, validatePolicyDefinition, } from './service.js';
+export type { UpdateWithVersioningInput, PolicyVersionWithMeta, PolicyVersionCompareResult, } from './service.js';
+export { diffPolicyDefinitions, formatChange, formatDiff, getChangeSummary, arePoliciesEquivalent, getRuleChanges, } from './diff.js';
+export type { ChangeType, DiffChange, PolicyDiffResult, } from './diff.js';
+export { PolicyEvaluator, createPolicyEvaluator, invalidatePolicyCache, getPolicyCacheMetrics, clearPolicyCache, stopPolicyCache, type PolicyCacheMetrics, } from './evaluator.js';
+export { PolicyLoader, getPolicyLoader, createPolicyLoader, resetPolicyLoader, } from './loader.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,eAAe,EACf,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,MAAM,EACN,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAEtB,YAAY,EACV,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,qBAAqB,EACrB,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,GACf,MAAM,WAAW,CAAC;AAEnB,YAAY,EACV,UAAU,EACV,UAAU,EACV,gBAAgB,GACjB,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,eAAe,EACf,qBAAqB,EAErB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,KAAK,kBAAkB,GACxB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,aAAa,CAAC"}

package/dist/policy/index.js

@@ -0,0 +1,19 @@
+/**
+ * Policy Engine
+ *
+ * Provides policy-based access control for intent governance.
+ *
+ * @packageDocumentation
+ */
+export { POLICY_STATUSES, CONDITION_OPERATORS, LOGICAL_OPERATORS, } from './types.js';
+// Service
+export { PolicyService, PolicyValidationException, createPolicyService, validatePolicyDefinition, } from './service.js';
+// Diff utility
+export { diffPolicyDefinitions, formatChange, formatDiff, getChangeSummary, arePoliciesEquivalent, getRuleChanges, } from './diff.js';
+// Evaluator
+export { PolicyEvaluator, createPolicyEvaluator, 
+// Cache management exports
+invalidatePolicyCache, getPolicyCacheMetrics, clearPolicyCache, stopPolicyCache, } from './evaluator.js';
+// Loader
+export { PolicyLoader, getPolicyLoader, createPolicyLoader, resetPolicyLoader, } from './loader.js';
+//# sourceMappingURL=index.js.map

package/dist/policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA6BH,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAEpB,UAAU;AACV,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAQtB,eAAe;AACf,OAAO,EACL,qBAAqB,EACrB,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,GACf,MAAM,WAAW,CAAC;AAQnB,YAAY;AACZ,OAAO,EACL,eAAe,EACf,qBAAqB;AACrB,2BAA2B;AAC3B,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,GAEhB,MAAM,gBAAgB,CAAC;AAExB,SAAS;AACT,OAAO,EACL,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,aAAa,CAAC"}

package/dist/policy/loader.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Policy Loader
+ *
+ * Loads and caches policies from the database for runtime evaluation.
+ *
+ * @packageDocumentation
+ */
+import type { Policy } from './types.js';
+import type { ID } from '../common/types.js';
+/**
+ * Policy Loader service for fetching and caching policies
+ */
+export declare class PolicyLoader {
+    private policyService;
+    private localCache;
+    private cacheTtl;
+    constructor(options?: {
+        cacheTtl?: number;
+    });
+    /**
+     * Get published policies for a tenant, with caching
+     */
+    getPolicies(tenantId: ID, namespace?: string): Promise<Policy[]>;
+    /**
+     * Get a specific policy by ID
+     */
+    getPolicy(id: ID, tenantId: ID): Promise<Policy | null>;
+    /**
+     * Invalidate cache for a tenant (call after policy updates)
+     */
+    invalidateCache(tenantId: ID, namespace?: string): Promise<void>;
+    /**
+     * Invalidate all caches (call on policy hot-reload)
+     */
+    invalidateAll(): Promise<void>;
+    /**
+     * Preload policies for a tenant (warm the cache)
+     */
+    preload(tenantId: ID, namespaces?: string[]): Promise<void>;
+    /**
+     * Get cache key for a tenant/namespace
+     */
+    private getCacheKey;
+    /**
+     * Update both local and Redis caches
+     */
+    private updateCache;
+}
+/**
+ * Get the shared policy loader instance
+ */
+export declare function getPolicyLoader(): PolicyLoader;
+/**
+ * Create a new policy loader instance
+ */
+export declare function createPolicyLoader(options?: {
+    cacheTtl?: number;
+}): PolicyLoader;
+/**
+ * Reset the singleton (for testing)
+ */
+export declare function resetPolicyLoader(): void;
+//# sourceMappingURL=loader.d.ts.map

package/dist/policy/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/policy/loader.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAoB,MAAM,YAAY,CAAC;AAC3D,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AAS7C;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,UAAU,CAAuD;IACzE,OAAO,CAAC,QAAQ,CAAS;gBAEb,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;IAM3C;;OAEG;IACG,WAAW,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA+CtE;;OAEG;IACG,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI7D;;OAEG;IACG,eAAe,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBtE;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAepC;;OAEG;IACG,OAAO,CAAC,QAAQ,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IASjE;;OAEG;IACH,OAAO,CAAC,WAAW;IAInB;;OAEG;IACH,OAAO,CAAC,WAAW;CAepB;AAOD;;GAEG;AACH,wBAAgB,eAAe,IAAI,YAAY,CAK9C;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,YAAY,CAEhF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAExC"}

package/dist/policy/loader.js

@@ -0,0 +1,173 @@
+/**
+ * Policy Loader
+ *
+ * Loads and caches policies from the database for runtime evaluation.
+ *
+ * @packageDocumentation
+ */
+import { createLogger } from '../common/logger.js';
+import { getRedis } from '../common/redis.js';
+import { createPolicyService } from './service.js';
+import { recordPolicyCacheHit, recordPolicyCacheMiss } from '../intent/metrics.js';
+const logger = createLogger({ component: 'policy-loader' });
+// Cache TTL in seconds
+const DEFAULT_CACHE_TTL = 300; // 5 minutes
+const CACHE_PREFIX = 'policy:cache:';
+/**
+ * Policy Loader service for fetching and caching policies
+ */
+export class PolicyLoader {
+    policyService;
+    localCache;
+    cacheTtl;
+    constructor(options) {
+        this.policyService = createPolicyService();
+        this.localCache = new Map();
+        this.cacheTtl = options?.cacheTtl ?? DEFAULT_CACHE_TTL;
+    }
+    /**
+     * Get published policies for a tenant, with caching
+     */
+    async getPolicies(tenantId, namespace) {
+        const cacheKey = this.getCacheKey(tenantId, namespace);
+        const effectiveNamespace = namespace ?? 'default';
+        // Check local memory cache first (fastest)
+        const localCached = this.localCache.get(cacheKey);
+        if (localCached && localCached.expires > Date.now()) {
+            logger.debug({ tenantId, namespace, source: 'local' }, 'Policy cache hit');
+            recordPolicyCacheHit(tenantId, effectiveNamespace);
+            return localCached.policies;
+        }
+        // Check Redis cache (distributed)
+        try {
+            const redis = getRedis();
+            const redisCached = await redis.get(CACHE_PREFIX + cacheKey);
+            if (redisCached) {
+                const policies = JSON.parse(redisCached);
+                // Update local cache
+                this.localCache.set(cacheKey, {
+                    policies,
+                    expires: Date.now() + this.cacheTtl * 1000,
+                });
+                logger.debug({ tenantId, namespace, source: 'redis' }, 'Policy cache hit');
+                recordPolicyCacheHit(tenantId, effectiveNamespace);
+                return policies;
+            }
+        }
+        catch (error) {
+            logger.warn({ error }, 'Failed to check Redis policy cache');
+        }
+        // Cache miss - fetch from database
+        recordPolicyCacheMiss(tenantId, effectiveNamespace);
+        const policies = await this.policyService.getPublishedPolicies(tenantId, namespace);
+        // Update caches
+        this.updateCache(cacheKey, policies);
+        logger.debug({ tenantId, namespace, count: policies.length, source: 'database' }, 'Policies loaded from database');
+        return policies;
+    }
+    /**
+     * Get a specific policy by ID
+     */
+    async getPolicy(id, tenantId) {
+        return this.policyService.findById(id, tenantId);
+    }
+    /**
+     * Invalidate cache for a tenant (call after policy updates)
+     */
+    async invalidateCache(tenantId, namespace) {
+        const cacheKey = this.getCacheKey(tenantId, namespace);
+        // Clear local cache
+        this.localCache.delete(cacheKey);
+        // Clear Redis cache
+        try {
+            const redis = getRedis();
+            await redis.del(CACHE_PREFIX + cacheKey);
+            logger.info({ tenantId, namespace }, 'Policy cache invalidated');
+        }
+        catch (error) {
+            logger.warn({ error }, 'Failed to invalidate Redis policy cache');
+        }
+        // Also invalidate the "all namespaces" cache for this tenant
+        if (namespace) {
+            await this.invalidateCache(tenantId);
+        }
+    }
+    /**
+     * Invalidate all caches (call on policy hot-reload)
+     */
+    async invalidateAll() {
+        this.localCache.clear();
+        try {
+            const redis = getRedis();
+            const keys = await redis.keys(CACHE_PREFIX + '*');
+            if (keys.length > 0) {
+                await redis.del(...keys);
+            }
+            logger.info({ keysCleared: keys.length }, 'All policy caches invalidated');
+        }
+        catch (error) {
+            logger.warn({ error }, 'Failed to invalidate all Redis policy caches');
+        }
+    }
+    /**
+     * Preload policies for a tenant (warm the cache)
+     */
+    async preload(tenantId, namespaces) {
+        if (namespaces && namespaces.length > 0) {
+            await Promise.all(namespaces.map((ns) => this.getPolicies(tenantId, ns)));
+        }
+        else {
+            await this.getPolicies(tenantId);
+        }
+        logger.info({ tenantId, namespaces }, 'Policies preloaded');
+    }
+    /**
+     * Get cache key for a tenant/namespace
+     */
+    getCacheKey(tenantId, namespace) {
+        return namespace ? `${tenantId}:${namespace}` : tenantId;
+    }
+    /**
+     * Update both local and Redis caches
+     */
+    updateCache(cacheKey, policies) {
+        // Update local cache
+        this.localCache.set(cacheKey, {
+            policies,
+            expires: Date.now() + this.cacheTtl * 1000,
+        });
+        // Update Redis cache (fire and forget)
+        const redis = getRedis();
+        redis
+            .setex(CACHE_PREFIX + cacheKey, this.cacheTtl, JSON.stringify(policies))
+            .catch((error) => {
+            logger.warn({ error }, 'Failed to update Redis policy cache');
+        });
+    }
+}
+/**
+ * Singleton instance for shared use
+ */
+let loaderInstance = null;
+/**
+ * Get the shared policy loader instance
+ */
+export function getPolicyLoader() {
+    if (!loaderInstance) {
+        loaderInstance = new PolicyLoader();
+    }
+    return loaderInstance;
+}
+/**
+ * Create a new policy loader instance
+ */
+export function createPolicyLoader(options) {
+    return new PolicyLoader(options);
+}
+/**
+ * Reset the singleton (for testing)
+ */
+export function resetPolicyLoader() {
+    loaderInstance = null;
+}
+//# sourceMappingURL=loader.js.map

package/dist/policy/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/policy/loader.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAiB,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGlE,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAEnF,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;AAE5D,uBAAuB;AACvB,MAAM,iBAAiB,GAAG,GAAG,CAAC,CAAC,YAAY;AAC3C,MAAM,YAAY,GAAG,eAAe,CAAC;AAErC;;GAEG;AACH,MAAM,OAAO,YAAY;IACf,aAAa,CAAgB;IAC7B,UAAU,CAAuD;IACjE,QAAQ,CAAS;IAEzB,YAAY,OAA+B;QACzC,IAAI,CAAC,aAAa,GAAG,mBAAmB,EAAE,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,iBAAiB,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,QAAY,EAAE,SAAkB;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACvD,MAAM,kBAAkB,GAAG,SAAS,IAAI,SAAS,CAAC;QAElD,2CAA2C;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,WAAW,IAAI,WAAW,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACpD,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,kBAAkB,CAAC,CAAC;YAC3E,oBAAoB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YACnD,OAAO,WAAW,CAAC,QAAQ,CAAC;QAC9B,CAAC;QAED,kCAAkC;QAClC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,YAAY,GAAG,QAAQ,CAAC,CAAC;YAE7D,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAa,CAAC;gBACrD,qBAAqB;gBACrB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE;oBAC5B,QAAQ;oBACR,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI;iBAC3C,CAAC,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,kBAAkB,CAAC,CAAC;gBAC3E,oBAAoB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;gBACnD,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,oCAAoC,CAAC,CAAC;QAC/D,CAAC;QAED,mCAAmC;QACnC,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAEpF,gBAAgB;QAChB,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAErC,MAAM,CAAC,KAAK,CACV,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EACnE,+BAA+B,CAChC,CAAC;QAEF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,EAAM,EAAE,QAAY;QAClC,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CAAC,QAAY,EAAE,SAAkB;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAEvD,oBAAoB;QACpB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEjC,oBAAoB;QACpB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,KAAK,CAAC,GAAG,CAAC,YAAY,GAAG,QAAQ,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,0BAA0B,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,yCAAyC,CAAC,CAAC;QACpE,CAAC;QAED,6DAA6D;QAC7D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAExB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC;YAClD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YAC3B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC;QAC7E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,8CAA8C,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,QAAY,EAAE,UAAqB;QAC/C,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,QAAY,EAAE,SAAkB;QAClD,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC3D,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,QAAgB,EAAE,QAAkB;QACtD,qBAAqB;QACrB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE;YAC5B,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI;SAC3C,CAAC,CAAC;QAEH,uCAAuC;QACvC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,KAAK;aACF,KAAK,CAAC,YAAY,GAAG,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;aACvE,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,qCAAqC,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;IACP,CAAC;CACF;AAED;;GAEG;AACH,IAAI,cAAc,GAAwB,IAAI,CAAC;AAE/C;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,IAAI,YAAY,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA+B;IAChE,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,cAAc,GAAG,IAAI,CAAC;AACxB,CAAC"}

package/dist/policy/service.d.ts

@@ -0,0 +1,150 @@
+/**
+ * Policy Service
+ *
+ * Handles CRUD operations for policies with versioning and validation.
+ * Supports full version history, rollback, and diff capabilities.
+ *
+ * @packageDocumentation
+ */
+import type { ID } from '../common/types.js';
+import { type PolicyDiffResult } from './diff.js';
+import type { Policy, PolicyVersion, PolicyDefinition, PolicyStatus, CreatePolicyInput, UpdatePolicyInput, PolicyListFilters, PolicyValidationResult, PolicyValidationError } from './types.js';
+/**
+ * Input for updating a policy with versioning
+ */
+export interface UpdateWithVersioningInput {
+    definition?: PolicyDefinition;
+    description?: string;
+    status?: PolicyStatus;
+    changeSummary?: string;
+    changedBy?: string;
+}
+/**
+ * Extended policy version with additional metadata
+ */
+export interface PolicyVersionWithMeta extends PolicyVersion {
+    isCurrent: boolean;
+}
+/**
+ * Result of comparing two policy versions
+ */
+export interface PolicyVersionCompareResult {
+    policyId: ID;
+    version1: number;
+    version2: number;
+    diff: PolicyDiffResult;
+}
+/**
+ * Validate a policy definition
+ */
+export declare function validatePolicyDefinition(definition: unknown): PolicyValidationResult;
+/**
+ * Policy Service class
+ */
+export declare class PolicyService {
+    /**
+     * Create a new policy
+     */
+    create(tenantId: ID, input: CreatePolicyInput): Promise<Policy>;
+    /**
+     * Get a policy by ID
+     */
+    findById(id: ID, tenantId: ID): Promise<Policy | null>;
+    /**
+     * Get a policy by name and namespace
+     */
+    findByName(tenantId: ID, name: string, namespace?: string): Promise<Policy | null>;
+    /**
+     * Update a policy (creates new version)
+     */
+    update(id: ID, tenantId: ID, input: UpdatePolicyInput): Promise<Policy | null>;
+    /**
+     * Publish a policy (makes it active)
+     */
+    publish(id: ID, tenantId: ID): Promise<Policy | null>;
+    /**
+     * Deprecate a policy
+     */
+    deprecate(id: ID, tenantId: ID): Promise<Policy | null>;
+    /**
+     * Archive a policy
+     */
+    archive(id: ID, tenantId: ID): Promise<Policy | null>;
+    /**
+     * List policies with filters
+     */
+    list(filters: PolicyListFilters): Promise<Policy[]>;
+    /**
+     * Get published policies for evaluation
+     */
+    getPublishedPolicies(tenantId: ID, namespace?: string): Promise<Policy[]>;
+    /**
+     * Update a policy with explicit versioning.
+     * Creates a new version record before applying changes.
+     *
+     * @param id - Policy ID
+     * @param tenantId - Tenant ID for access control
+     * @param changes - Changes to apply
+     * @returns Updated policy with new version number
+     */
+    updateWithVersioning(id: ID, tenantId: ID, changes: UpdateWithVersioningInput): Promise<Policy | null>;
+    /**
+     * Get complete version history for a policy.
+     * Returns all historical versions plus the current version.
+     *
+     * @param id - Policy ID
+     * @param tenantId - Tenant ID for access control
+     * @returns List of all versions, newest first
+     */
+    getVersionHistory(id: ID, tenantId: ID): Promise<PolicyVersionWithMeta[]>;
+    /**
+     * Get a specific version of a policy.
+     *
+     * @param id - Policy ID
+     * @param version - Version number to retrieve
+     * @param tenantId - Tenant ID for access control
+     * @returns The policy version or null if not found
+     */
+    getVersion(id: ID, version: number, tenantId: ID): Promise<PolicyVersion | null>;
+    /**
+     * Rollback a policy to a previous version.
+     * Creates a new version with the definition from the target version.
+     *
+     * @param id - Policy ID
+     * @param targetVersion - Version number to rollback to
+     * @param tenantId - Tenant ID for access control
+     * @param userId - User performing the rollback
+     * @returns Updated policy with new version number
+     */
+    rollbackToVersion(id: ID, targetVersion: number, tenantId: ID, userId?: string): Promise<Policy | null>;
+    /**
+     * Compare two versions of a policy.
+     *
+     * @param id - Policy ID
+     * @param version1 - First version to compare
+     * @param version2 - Second version to compare
+     * @param tenantId - Tenant ID for access control
+     * @returns Diff result between the two versions
+     */
+    compareVersions(id: ID, version1: number, version2: number, tenantId: ID): Promise<PolicyVersionCompareResult | null>;
+    /**
+     * Delete a policy (soft delete - archives it)
+     */
+    delete(id: ID, tenantId: ID): Promise<boolean>;
+    /**
+     * Convert database row to Policy object
+     */
+    private rowToPolicy;
+}
+/**
+ * Custom error for policy validation failures
+ */
+export declare class PolicyValidationException extends Error {
+    readonly errors: PolicyValidationError[];
+    constructor(message: string, errors: PolicyValidationError[]);
+}
+/**
+ * Create a new policy service instance
+ */
+export declare function createPolicyService(): PolicyService;
+//# sourceMappingURL=service.d.ts.map

package/dist/policy/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/policy/service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AAG7C,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,KAAK,EACV,MAAM,EACN,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,EAKtB,MAAM,YAAY,CAAC;AAEpB;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,EAAE,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAYD;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,OAAO,GAAG,sBAAsB,CAoDpF;AAqKD;;GAEG;AACH,qBAAa,aAAa;IACxB;;OAEG;IACG,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC;IAqDrE;;OAEG;IACG,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAoB5D;;OAEG;IACG,UAAU,CACd,QAAQ,EAAE,EAAE,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,MAAkB,GAC5B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA2BzB;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA+EpF;;OAEG;IACG,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI3D;;OAEG;IACG,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI7D;;OAEG;IACG,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI3D;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAiCzD;;OAEG;IACG,oBAAoB,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAQ/E;;;;;;;;OAQG;IACG,oBAAoB,CACxB,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,EAAE,EACZ,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAsFzB;;;;;;;OAOG;IACG,iBAAiB,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC;IA2C/E;;;;;;;OAOG;IACG,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA0CtF;;;;;;;;;OASG;IACG,iBAAiB,CACrB,EAAE,EAAE,EAAE,EACN,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,EAAE,EACZ,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAyHzB;;;;;;;;OAQG;IACG,eAAe,CACnB,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,EAAE,GACX,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAsB7C;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAKpD;;OAEG;IACH,OAAO,CAAC,WAAW;CAiBpB;AAED;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,SAAgB,MAAM,EAAE,qBAAqB,EAAE,CAAC;gBAEpC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,EAAE;CAK7D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,aAAa,CAEnD"}