anantham-v2 2.0.0-alpha.1

package/dist/plugins/plugin-registry.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Anantham V2 — Plugin Registry
+ *
+ * Authoritative registry managing plugin installations, project-level version pinning,
+ * and discovery across projects.
+ */
+import { type PluginRecord, type PluginPinMap } from "../domain/plugin.js";
+import { PluginManager } from "./plugin-manager.js";
+export declare class PluginRegistry {
+    private readonly manager;
+    private readonly projectPins;
+    constructor(manager?: PluginManager);
+    getManager(): PluginManager;
+    /**
+     * Sets project-level plugin version locks.
+     */
+    setProjectPins(projectId: string, pins: PluginPinMap): void;
+    getProjectPins(projectId: string): PluginPinMap;
+    /**
+     * Retrieves effective plugin for a project respecting version pinning.
+     */
+    getEffectivePlugin(pluginId: string, projectId?: string): PluginRecord | undefined;
+}
+//# sourceMappingURL=plugin-registry.d.ts.map

package/dist/plugins/plugin-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-registry.d.ts","sourceRoot":"","sources":["../../src/plugins/plugin-registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmC;gBAEnD,OAAO,CAAC,EAAE,aAAa;IAI5B,UAAU,IAAI,aAAa;IAIlC;;OAEG;IACI,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI;IAK3D,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY;IAItD;;OAEG;IACI,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;CAkB1F"}

package/dist/plugins/plugin-registry.js

@@ -0,0 +1,49 @@
+/**
+ * Anantham V2 — Plugin Registry
+ *
+ * Authoritative registry managing plugin installations, project-level version pinning,
+ * and discovery across projects.
+ */
+import { PluginPinMapSchema, } from "../domain/plugin.js";
+import { PluginManager } from "./plugin-manager.js";
+export class PluginRegistry {
+    manager;
+    projectPins = new Map();
+    constructor(manager) {
+        this.manager = manager || new PluginManager();
+    }
+    getManager() {
+        return this.manager;
+    }
+    /**
+     * Sets project-level plugin version locks.
+     */
+    setProjectPins(projectId, pins) {
+        const validated = PluginPinMapSchema.parse(pins);
+        this.projectPins.set(projectId, validated);
+    }
+    getProjectPins(projectId) {
+        return this.projectPins.get(projectId) || {};
+    }
+    /**
+     * Retrieves effective plugin for a project respecting version pinning.
+     */
+    getEffectivePlugin(pluginId, projectId) {
+        const plugin = this.manager.getPlugin(pluginId);
+        if (!plugin)
+            return undefined;
+        if (projectId) {
+            const pins = this.getProjectPins(projectId);
+            const pinnedVersion = pins[pluginId];
+            if (pinnedVersion && plugin.manifest.version !== pinnedVersion) {
+                // Pinned version differs from currently active global version
+                return {
+                    ...plugin,
+                    projectPin: pinnedVersion,
+                };
+            }
+        }
+        return plugin;
+    }
+}
+//# sourceMappingURL=plugin-registry.js.map

package/dist/plugins/plugin-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-registry.js","sourceRoot":"","sources":["../../src/plugins/plugin-registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAGL,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,MAAM,OAAO,cAAc;IACR,OAAO,CAAgB;IACvB,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;IAE/D,YAAY,OAAuB;QACjC,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,IAAI,aAAa,EAAE,CAAC;IAChD,CAAC;IAEM,UAAU;QACf,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACI,cAAc,CAAC,SAAiB,EAAE,IAAkB;QACzD,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC;IAEM,cAAc,CAAC,SAAiB;QACrC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED;;OAEG;IACI,kBAAkB,CAAC,QAAgB,EAAE,SAAkB;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAE9B,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;YAC5C,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,aAAa,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;gBAC/D,8DAA8D;gBAC9D,OAAO;oBACL,GAAG,MAAM;oBACT,UAAU,EAAE,aAAa;iBAC1B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/plugins/plugin-state.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Anantham V2 — Plugin State Manager
+ *
+ * Provides scoped persistent key-value storage and schema migrations for plugins.
+ */
+export interface StateMigration {
+    fromVersion: number;
+    toVersion: number;
+    migrate: (oldState: Record<string, unknown>) => Record<string, unknown>;
+}
+export declare class PluginStateManager {
+    private readonly store;
+    private readonly versions;
+    private readonly migrations;
+    setState(pluginId: string, state: Record<string, unknown>, version?: number): void;
+    getState(pluginId: string): Record<string, unknown> | undefined;
+    getStateVersion(pluginId: string): number;
+    registerMigration(pluginId: string, migration: StateMigration): void;
+    migrateState(pluginId: string, targetVersion: number): Record<string, unknown>;
+}
+//# sourceMappingURL=plugin-state.d.ts.map

package/dist/plugins/plugin-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-state.d.ts","sourceRoot":"","sources":["../../src/plugins/plugin-state.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzE;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA8C;IACpE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuC;IAE3D,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAE,MAAU,GAAG,IAAI;IAKrF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAI/D,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAIzC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,GAAG,IAAI;IAMpE,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAoBtF"}

package/dist/plugins/plugin-state.js

@@ -0,0 +1,41 @@
+/**
+ * Anantham V2 — Plugin State Manager
+ *
+ * Provides scoped persistent key-value storage and schema migrations for plugins.
+ */
+export class PluginStateManager {
+    store = new Map();
+    versions = new Map();
+    migrations = new Map();
+    setState(pluginId, state, version = 1) {
+        this.store.set(pluginId, { ...state });
+        this.versions.set(pluginId, version);
+    }
+    getState(pluginId) {
+        return this.store.get(pluginId);
+    }
+    getStateVersion(pluginId) {
+        return this.versions.get(pluginId) || 1;
+    }
+    registerMigration(pluginId, migration) {
+        const list = this.migrations.get(pluginId) || [];
+        list.push(migration);
+        this.migrations.set(pluginId, list);
+    }
+    migrateState(pluginId, targetVersion) {
+        let currentState = this.getState(pluginId) || {};
+        let currentVersion = this.getStateVersion(pluginId);
+        const pluginMigrations = this.migrations.get(pluginId) || [];
+        while (currentVersion < targetVersion) {
+            const step = pluginMigrations.find((m) => m.fromVersion === currentVersion);
+            if (!step) {
+                throw new Error(`Missing migration step for plugin "${pluginId}" from version ${currentVersion} to ${targetVersion}.`);
+            }
+            currentState = step.migrate(currentState);
+            currentVersion = step.toVersion;
+        }
+        this.setState(pluginId, currentState, targetVersion);
+        return currentState;
+    }
+}
+//# sourceMappingURL=plugin-state.js.map

package/dist/plugins/plugin-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-state.js","sourceRoot":"","sources":["../../src/plugins/plugin-state.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,MAAM,OAAO,kBAAkB;IACZ,KAAK,GAAG,IAAI,GAAG,EAAmC,CAAC;IACnD,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrC,UAAU,GAAG,IAAI,GAAG,EAA4B,CAAC;IAE3D,QAAQ,CAAC,QAAgB,EAAE,KAA8B,EAAE,UAAkB,CAAC;QACnF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAEM,QAAQ,CAAC,QAAgB;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAEM,eAAe,CAAC,QAAgB;QACrC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAEM,iBAAiB,CAAC,QAAgB,EAAE,SAAyB;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAEM,YAAY,CAAC,QAAgB,EAAE,aAAqB;QACzD,IAAI,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAEpD,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE7D,OAAO,cAAc,GAAG,aAAa,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,cAAc,CAAC,CAAC;YAC5E,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CACb,sCAAsC,QAAQ,kBAAkB,cAAc,OAAO,aAAa,GAAG,CACtG,CAAC;YACJ,CAAC;YACD,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC1C,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC;QAClC,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;QACrD,OAAO,YAAY,CAAC;IACtB,CAAC;CACF"}

package/dist/plugins/plugin-trust.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Anantham V2 — Plugin Trust Manager
+ *
+ * Implements deterministic trust state transitions and prevents self-promotion.
+ */
+import { type PluginTrustState } from "../domain/plugin.js";
+export declare class PluginTrustManager {
+    private readonly trustMap;
+    constructor(initialTrust?: Record<string, PluginTrustState>);
+    getTrust(pluginId: string): PluginTrustState;
+    /**
+     * Promotes or changes plugin trust state.
+     * Invariant: Requires explicit caller authority (cannot be invoked by plugin code).
+     */
+    setTrust(pluginId: string, newState: PluginTrustState, caller: string): void;
+    isBlocked(pluginId: string): boolean;
+    isTrusted(pluginId: string): boolean;
+}
+//# sourceMappingURL=plugin-trust.d.ts.map

package/dist/plugins/plugin-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-trust.d.ts","sourceRoot":"","sources":["../../src/plugins/plugin-trust.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuC;gBAEpD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAQpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB;IAInD;;;OAGG;IACI,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAQ5E,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;CAG5C"}

package/dist/plugins/plugin-trust.js

@@ -0,0 +1,35 @@
+/**
+ * Anantham V2 — Plugin Trust Manager
+ *
+ * Implements deterministic trust state transitions and prevents self-promotion.
+ */
+export class PluginTrustManager {
+    trustMap = new Map();
+    constructor(initialTrust) {
+        if (initialTrust) {
+            for (const [id, state] of Object.entries(initialTrust)) {
+                this.trustMap.set(id, state);
+            }
+        }
+    }
+    getTrust(pluginId) {
+        return this.trustMap.get(pluginId) || "unknown";
+    }
+    /**
+     * Promotes or changes plugin trust state.
+     * Invariant: Requires explicit caller authority (cannot be invoked by plugin code).
+     */
+    setTrust(pluginId, newState, caller) {
+        if (caller === "plugin") {
+            throw new Error(`Permission Denied: Plugin "${pluginId}" cannot self-promote its trust state.`);
+        }
+        this.trustMap.set(pluginId, newState);
+    }
+    isBlocked(pluginId) {
+        return this.getTrust(pluginId) === "blocked";
+    }
+    isTrusted(pluginId) {
+        return this.getTrust(pluginId) === "trusted";
+    }
+}
+//# sourceMappingURL=plugin-trust.js.map

package/dist/plugins/plugin-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-trust.js","sourceRoot":"","sources":["../../src/plugins/plugin-trust.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,OAAO,kBAAkB;IACZ,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEhE,YAAY,YAA+C;QACzD,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBACvD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IAEM,QAAQ,CAAC,QAAgB;QAC9B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IAClD,CAAC;IAED;;;OAGG;IACI,QAAQ,CAAC,QAAgB,EAAE,QAA0B,EAAE,MAAc;QAC1E,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,wCAAwC,CAAC,CAAC;QAClG,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;IAEM,SAAS,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;IAC/C,CAAC;IAEM,SAAS,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;IAC/C,CAAC;CACF"}

package/dist/policy/approval-manager.d.ts

@@ -0,0 +1,45 @@
+import { type ApprovalRecord, type PolicyEvaluationContext, type RiskLevel } from "../domain/policy.js";
+import { type EventStore } from "../event-state/event-store.js";
+import { type HarnessEvent } from "../domain/event.js";
+export interface ApprovalManagerOptions {
+    eventStore?: EventStore;
+    defaultTtlMs?: number;
+}
+export declare class ApprovalManager {
+    private readonly approvals;
+    private readonly eventStore?;
+    private readonly defaultTtlMs;
+    constructor(options?: ApprovalManagerOptions);
+    /**
+     * Computes a deterministic SHA-256 canonical digest of the operation and context to prevent TOCTOU tampering.
+     * PRD Part 3 Section 146.
+     */
+    private static canonicalize;
+    static computeArgumentsDigest(context: PolicyEvaluationContext, policyVersion?: string): string;
+    createApprovalRequest(context: PolicyEvaluationContext, riskLevel: RiskLevel, options?: {
+        expiresAt?: string;
+        approvalId?: string;
+        policyVersion?: string;
+    }): ApprovalRecord;
+    getApproval(approvalId: string): ApprovalRecord | undefined;
+    grantApproval(approvalId: string, approverActorId: string, options?: {
+        reason?: string;
+    }): ApprovalRecord;
+    rejectApproval(approvalId: string, approverActorId: string, options?: {
+        reason?: string;
+    }): ApprovalRecord;
+    cancelApproval(approvalId: string, cancellerActorId: string, reason?: string): ApprovalRecord;
+    /**
+     * Revalidates approval at the execution boundary against TOCTOU argument tampering, expiration, and policy shifts.
+     * PRD Part 3 Section 146.
+     */
+    validateAndConsumeApproval(approvalId: string, executionContext: PolicyEvaluationContext, currentPolicyVersion?: string): {
+        valid: boolean;
+        reason?: string;
+    };
+    /**
+     * Restores approval state deterministically from the immutable event log.
+     */
+    restoreFromEvents(events: Readonly<HarnessEvent>[]): void;
+}
+//# sourceMappingURL=approval-manager.d.ts.map

package/dist/policy/approval-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-manager.d.ts","sourceRoot":"","sources":["../../src/policy/approval-manager.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC5B,KAAK,SAAS,EAEf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEnE,MAAM,WAAW,sBAAsB;IACrC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqC;IAC/D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAa;IACzC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;gBAE1B,OAAO,GAAE,sBAA2B;IAKhD;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,YAAY;WAUb,sBAAsB,CAClC,OAAO,EAAE,uBAAuB,EAChC,aAAa,GAAE,MAAgB,GAC9B,MAAM;IAiBF,qBAAqB,CAC1B,OAAO,EAAE,uBAAuB,EAChC,SAAS,EAAE,SAAS,EACpB,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAO,GAChF,cAAc;IAkDV,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAe3D,aAAa,CAClB,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,EACvB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAChC,cAAc;IA8CV,cAAc,CACnB,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,EACvB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAChC,cAAc;IA0CV,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,cAAc;IAuBpG;;;OAGG;IACI,0BAA0B,CAC/B,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,uBAAuB,EACzC,oBAAoB,GAAE,MAAgB,GACrC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IA4CtC;;OAEG;IACI,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,GAAG,IAAI;CA2CjE"}

package/dist/policy/approval-manager.js

@@ -0,0 +1,284 @@
+import { createHash } from "node:crypto";
+import { ApprovalRecordSchema, } from "../domain/policy.js";
+import { EventTypes } from "../domain/event.js";
+export class ApprovalManager {
+    approvals = new Map();
+    eventStore;
+    defaultTtlMs;
+    constructor(options = {}) {
+        this.eventStore = options.eventStore;
+        this.defaultTtlMs = options.defaultTtlMs || 30 * 60 * 1000; // 30 mins
+    }
+    /**
+     * Computes a deterministic SHA-256 canonical digest of the operation and context to prevent TOCTOU tampering.
+     * PRD Part 3 Section 146.
+     */
+    static canonicalize(val) {
+        if (val === null || typeof val !== "object")
+            return val;
+        if (Array.isArray(val))
+            return val.map(ApprovalManager.canonicalize);
+        const sortedObj = {};
+        for (const key of Object.keys(val).sort()) {
+            sortedObj[key] = ApprovalManager.canonicalize(val[key]);
+        }
+        return sortedObj;
+    }
+    static computeArgumentsDigest(context, policyVersion = "1.0.0") {
+        const canonicalObject = {
+            actorId: context.actor.id,
+            actorType: context.actor.type,
+            projectId: context.project.id,
+            action: context.operation.toolName || context.operation.type,
+            resource: context.operation.resource || "",
+            arguments: context.operation.arguments || {},
+            targetProjectId: context.operation.targetProjectId || context.project.id,
+            dataSensitivity: context.dataSensitivity || "normal",
+            policyVersion,
+        };
+        const serialized = JSON.stringify(ApprovalManager.canonicalize(canonicalObject));
+        return createHash("sha256").update(serialized).digest("hex");
+    }
+    createApprovalRequest(context, riskLevel, options = {}) {
+        const approvalId = options.approvalId || `app_${Date.now()}_${Math.random().toString(36).slice(2, 7)}`;
+        const now = new Date();
+        const policyVersion = options.policyVersion || "1.0.0";
+        const expiresAt = options.expiresAt || new Date(now.getTime() + this.defaultTtlMs).toISOString();
+        const argumentsDigest = ApprovalManager.computeArgumentsDigest(context, policyVersion);
+        const action = context.operation.toolName || context.operation.type;
+        const record = ApprovalRecordSchema.parse({
+            approvalId,
+            projectId: context.project.id,
+            sessionId: context.session?.id,
+            taskId: context.task?.id,
+            actorId: context.actor.id,
+            action,
+            riskLevel,
+            argumentsDigest,
+            status: "pending",
+            createdAt: now.toISOString(),
+            expiresAt,
+            policyVersion,
+        });
+        this.approvals.set(approvalId, record);
+        if (this.eventStore) {
+            this.eventStore.append({
+                id: `evt_app_req_${approvalId}`,
+                schemaVersion: 1,
+                projectId: context.project.id,
+                sessionId: context.session?.id,
+                taskId: context.task?.id,
+                type: EventTypes.TOOL_REQUESTED,
+                actor: context.actor.type,
+                timestamp: now.toISOString(),
+                payload: {
+                    approvalId,
+                    action,
+                    riskLevel,
+                    argumentsDigest,
+                    expiresAt,
+                    policyVersion,
+                    toolArgs: context.operation.arguments,
+                },
+            });
+        }
+        return record;
+    }
+    getApproval(approvalId) {
+        const record = this.approvals.get(approvalId);
+        if (!record)
+            return undefined;
+        // Check expiration
+        if (record.status === "pending" && record.expiresAt) {
+            if (new Date(record.expiresAt).getTime() <= Date.now()) {
+                const expired = { ...record, status: "expired" };
+                this.approvals.set(approvalId, expired);
+                return expired;
+            }
+        }
+        return record;
+    }
+    grantApproval(approvalId, approverActorId, options = {}) {
+        const record = this.getApproval(approvalId);
+        if (!record) {
+            throw new Error(`Approval request "${approvalId}" not found.`);
+        }
+        if (record.status === "expired") {
+            throw new Error(`Approval request "${approvalId}" has expired.`);
+        }
+        if (record.status !== "pending") {
+            throw new Error(`Cannot grant approval "${approvalId}" in status "${record.status}".`);
+        }
+        const now = new Date().toISOString();
+        const updated = {
+            ...record,
+            status: "approved",
+            decidedAt: now,
+            decidedBy: approverActorId,
+            decisionReason: options.reason || "Approved by authorized human operator",
+        };
+        this.approvals.set(approvalId, updated);
+        if (this.eventStore) {
+            this.eventStore.append({
+                id: `evt_app_grant_${approvalId}_${Date.now()}`,
+                schemaVersion: 1,
+                projectId: record.projectId,
+                sessionId: record.sessionId,
+                taskId: record.taskId,
+                type: EventTypes.TOOL_APPROVED,
+                actor: "user",
+                timestamp: now,
+                payload: {
+                    approvalId,
+                    decidedBy: approverActorId,
+                    reason: updated.decisionReason,
+                },
+            });
+        }
+        return updated;
+    }
+    rejectApproval(approvalId, approverActorId, options = {}) {
+        const record = this.getApproval(approvalId);
+        if (!record) {
+            throw new Error(`Approval request "${approvalId}" not found.`);
+        }
+        if (record.status !== "pending") {
+            throw new Error(`Cannot reject approval "${approvalId}" in status "${record.status}".`);
+        }
+        const now = new Date().toISOString();
+        const updated = {
+            ...record,
+            status: "rejected",
+            decidedAt: now,
+            decidedBy: approverActorId,
+            decisionReason: options.reason || "Rejected by authorized human operator",
+        };
+        this.approvals.set(approvalId, updated);
+        if (this.eventStore) {
+            this.eventStore.append({
+                id: `evt_app_rej_${approvalId}_${Date.now()}`,
+                schemaVersion: 1,
+                projectId: record.projectId,
+                sessionId: record.sessionId,
+                taskId: record.taskId,
+                type: EventTypes.TOOL_DENIED,
+                actor: "user",
+                timestamp: now,
+                payload: {
+                    approvalId,
+                    decidedBy: approverActorId,
+                    reason: updated.decisionReason,
+                },
+            });
+        }
+        return updated;
+    }
+    cancelApproval(approvalId, cancellerActorId, reason) {
+        const record = this.getApproval(approvalId);
+        if (!record) {
+            throw new Error(`Approval request "${approvalId}" not found.`);
+        }
+        if (record.status !== "pending") {
+            throw new Error(`Cannot cancel approval "${approvalId}" in status "${record.status}".`);
+        }
+        const now = new Date().toISOString();
+        const updated = {
+            ...record,
+            status: "cancelled",
+            decidedAt: now,
+            decidedBy: cancellerActorId,
+            decisionReason: reason || "Cancelled by caller",
+        };
+        this.approvals.set(approvalId, updated);
+        return updated;
+    }
+    /**
+     * Revalidates approval at the execution boundary against TOCTOU argument tampering, expiration, and policy shifts.
+     * PRD Part 3 Section 146.
+     */
+    validateAndConsumeApproval(approvalId, executionContext, currentPolicyVersion = "1.0.0") {
+        const record = this.getApproval(approvalId);
+        if (!record) {
+            return { valid: false, reason: `Approval request "${approvalId}" does not exist.` };
+        }
+        if (record.status !== "approved") {
+            return { valid: false, reason: `Approval "${approvalId}" is not in approved state (status: "${record.status}").` };
+        }
+        // 1. Expiration check
+        if (record.expiresAt && new Date(record.expiresAt).getTime() <= Date.now()) {
+            return { valid: false, reason: `Approval "${approvalId}" expired before execution.` };
+        }
+        // 2. Policy version consistency check
+        if (currentPolicyVersion !== record.policyVersion) {
+            return {
+                valid: false,
+                reason: `Policy version drift detected: Approved under version "${record.policyVersion}", but current active policy is "${currentPolicyVersion}". Re-approval required.`,
+            };
+        }
+        // 3. TOCTOU Digest match check
+        const currentDigest = ApprovalManager.computeArgumentsDigest(executionContext, currentPolicyVersion);
+        if (currentDigest !== record.argumentsDigest) {
+            return {
+                valid: false,
+                reason: `TOCTOU violation detected: Execution arguments, target project, or context modified after approval was granted.`,
+            };
+        }
+        // 4. Atomically consume approval token (Single-use enforcement to prevent replay attacks)
+        const nowIso = new Date().toISOString();
+        const consumedRecord = {
+            ...record,
+            status: "consumed",
+            consumedAt: nowIso,
+        };
+        this.approvals.set(approvalId, consumedRecord);
+        return { valid: true };
+    }
+    /**
+     * Restores approval state deterministically from the immutable event log.
+     */
+    restoreFromEvents(events) {
+        this.approvals.clear();
+        for (const event of events) {
+            const type = event.type;
+            const payload = event.payload || {};
+            if (type === EventTypes.TOOL_REQUESTED || type === "approval.requested") {
+                const approvalId = String(payload.approvalId || `app_${event.id}`);
+                this.approvals.set(approvalId, {
+                    approvalId,
+                    projectId: event.projectId || "default",
+                    sessionId: event.sessionId,
+                    taskId: event.taskId,
+                    actorId: String(payload.actorId || event.actor || "agent"),
+                    action: String(payload.action || payload.toolName || "tool_execution"),
+                    riskLevel: payload.riskLevel || "medium",
+                    argumentsDigest: String(payload.argumentsDigest || ""),
+                    status: "pending",
+                    createdAt: event.timestamp,
+                    expiresAt: payload.expiresAt ? String(payload.expiresAt) : undefined,
+                    policyVersion: String(payload.policyVersion || "1.0.0"),
+                });
+            }
+            else if (type === EventTypes.TOOL_APPROVED || type === "approval.granted") {
+                const approvalId = String(payload.approvalId || "");
+                const existing = this.approvals.get(approvalId);
+                if (existing) {
+                    existing.status = "approved";
+                    existing.decidedAt = event.timestamp;
+                    existing.decidedBy = String(payload.decidedBy || event.actor);
+                    existing.decisionReason = payload.reason ? String(payload.reason) : undefined;
+                }
+            }
+            else if (type === EventTypes.TOOL_DENIED || type === "approval.rejected") {
+                const approvalId = String(payload.approvalId || "");
+                const existing = this.approvals.get(approvalId);
+                if (existing) {
+                    existing.status = "rejected";
+                    existing.decidedAt = event.timestamp;
+                    existing.decidedBy = String(payload.decidedBy || event.actor);
+                    existing.decisionReason = payload.reason ? String(payload.reason) : undefined;
+                }
+            }
+        }
+    }
+}
+//# sourceMappingURL=approval-manager.js.map

package/dist/policy/approval-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-manager.js","sourceRoot":"","sources":["../../src/policy/approval-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAIL,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,UAAU,EAAqB,MAAM,oBAAoB,CAAC;AAOnE,MAAM,OAAO,eAAe;IACT,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC9C,UAAU,CAAc;IACxB,YAAY,CAAS;IAEtC,YAAY,UAAkC,EAAE;QAC9C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;IACxE,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,YAAY,CAAC,GAAY;QACtC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC;QACxD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QACrE,MAAM,SAAS,GAA4B,EAAE,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1C,SAAS,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,YAAY,CAAE,GAA+B,CAAC,GAAG,CAAC,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEM,MAAM,CAAC,sBAAsB,CAClC,OAAgC,EAChC,gBAAwB,OAAO;QAE/B,MAAM,eAAe,GAAG;YACtB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;YACzB,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YAC7B,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;YAC7B,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI;YAC5D,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE;YAC1C,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE;YAC5C,eAAe,EAAE,OAAO,CAAC,SAAS,CAAC,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;YACxE,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,QAAQ;YACpD,aAAa;SACd,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC;QACjF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IAEM,qBAAqB,CAC1B,OAAgC,EAChC,SAAoB,EACpB,UAA+E,EAAE;QAEjF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACvG,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC;QACvD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACjG,MAAM,eAAe,GAAG,eAAe,CAAC,sBAAsB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC;QAEpE,MAAM,MAAM,GAAmB,oBAAoB,CAAC,KAAK,CAAC;YACxD,UAAU;YACV,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;YAC7B,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE;YAC9B,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE;YACxB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;YACzB,MAAM;YACN,SAAS;YACT,eAAe;YACf,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;YAC5B,SAAS;YACT,aAAa;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAEvC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;gBACrB,EAAE,EAAE,eAAe,UAAU,EAAE;gBAC/B,aAAa,EAAE,CAAC;gBAChB,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;gBAC7B,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE;gBAC9B,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE;gBACxB,IAAI,EAAE,UAAU,CAAC,cAAc;gBAC/B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;gBACzB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC5B,OAAO,EAAE;oBACP,UAAU;oBACV,MAAM;oBACN,SAAS;oBACT,eAAe;oBACf,SAAS;oBACT,aAAa;oBACb,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,SAAS;iBACtC;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,WAAW,CAAC,UAAkB;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAE9B,mBAAmB;QACnB,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACpD,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACvD,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC;gBAC1D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACxC,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,aAAa,CAClB,UAAkB,EAClB,eAAuB,EACvB,UAA+B,EAAE;QAEjC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,qBAAqB,UAAU,cAAc,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,qBAAqB,UAAU,gBAAgB,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,0BAA0B,UAAU,gBAAgB,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,OAAO,GAAmB;YAC9B,GAAG,MAAM;YACT,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,eAAe;YAC1B,cAAc,EAAE,OAAO,CAAC,MAAM,IAAI,uCAAuC;SAC1E,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAExC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;gBACrB,EAAE,EAAE,iBAAiB,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;gBAC/C,aAAa,EAAE,CAAC;gBAChB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,IAAI,EAAE,UAAU,CAAC,aAAa;gBAC9B,KAAK,EAAE,MAAM;gBACb,SAAS,EAAE,GAAG;gBACd,OAAO,EAAE;oBACP,UAAU;oBACV,SAAS,EAAE,eAAe;oBAC1B,MAAM,EAAE,OAAO,CAAC,cAAc;iBAC/B;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEM,cAAc,CACnB,UAAkB,EAClB,eAAuB,EACvB,UAA+B,EAAE;QAEjC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,qBAAqB,UAAU,cAAc,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,2BAA2B,UAAU,gBAAgB,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,OAAO,GAAmB;YAC9B,GAAG,MAAM;YACT,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,eAAe;YAC1B,cAAc,EAAE,OAAO,CAAC,MAAM,IAAI,uCAAuC;SAC1E,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAExC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;gBACrB,EAAE,EAAE,eAAe,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;gBAC7C,aAAa,EAAE,CAAC;gBAChB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,IAAI,EAAE,UAAU,CAAC,WAAW;gBAC5B,KAAK,EAAE,MAAM;gBACb,SAAS,EAAE,GAAG;gBACd,OAAO,EAAE;oBACP,UAAU;oBACV,SAAS,EAAE,eAAe;oBAC1B,MAAM,EAAE,OAAO,CAAC,cAAc;iBAC/B;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEM,cAAc,CAAC,UAAkB,EAAE,gBAAwB,EAAE,MAAe;QACjF,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,qBAAqB,UAAU,cAAc,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,2BAA2B,UAAU,gBAAgB,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,OAAO,GAAmB;YAC9B,GAAG,MAAM;YACT,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,gBAAgB;YAC3B,cAAc,EAAE,MAAM,IAAI,qBAAqB;SAChD,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACI,0BAA0B,CAC/B,UAAkB,EAClB,gBAAyC,EACzC,uBAA+B,OAAO;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,UAAU,mBAAmB,EAAE,CAAC;QACtF,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,UAAU,wCAAwC,MAAM,CAAC,MAAM,KAAK,EAAE,CAAC;QACrH,CAAC;QAED,sBAAsB;QACtB,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC3E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,UAAU,6BAA6B,EAAE,CAAC;QACxF,CAAC;QAED,sCAAsC;QACtC,IAAI,oBAAoB,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;YAClD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,0DAA0D,MAAM,CAAC,aAAa,oCAAoC,oBAAoB,0BAA0B;aACzK,CAAC;QACJ,CAAC;QAED,+BAA+B;QAC/B,MAAM,aAAa,GAAG,eAAe,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;QACrG,IAAI,aAAa,KAAK,MAAM,CAAC,eAAe,EAAE,CAAC;YAC7C,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,iHAAiH;aAC1H,CAAC;QACJ,CAAC;QAED,0FAA0F;QAC1F,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,cAAc,GAAmB;YACrC,GAAG,MAAM;YACT,MAAM,EAAE,UAAU;YAClB,UAAU,EAAE,MAAM;SACnB,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAE/C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;OAEG;IACI,iBAAiB,CAAC,MAAgC;QACvD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YACxB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;YAEpC,IAAI,IAAI,KAAK,UAAU,CAAC,cAAc,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBACxE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;gBACnE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE;oBAC7B,UAAU;oBACV,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,SAAS;oBACvC,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC;oBAC1D,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,IAAI,gBAAgB,CAAC;oBACtE,SAAS,EAAG,OAAO,CAAC,SAAiB,IAAI,QAAQ;oBACjD,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;oBACtD,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;oBACpE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC;iBACxD,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,IAAI,KAAK,UAAU,CAAC,aAAa,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;gBACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAChD,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC;oBAC7B,QAAQ,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;oBACrC,QAAQ,CAAC,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;oBAC9D,QAAQ,CAAC,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAChF,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,KAAK,UAAU,CAAC,WAAW,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;gBACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAChD,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC;oBAC7B,QAAQ,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;oBACrC,QAAQ,CAAC,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;oBAC9D,QAAQ,CAAC,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAChF,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/policy/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Anantham V2 — Policy, Risk Classification & Approval Plane
+ * PRD Part 1 Section 34-39, 118-120 & PRD Part 3 Section 146-150 / P4.1
+ */
+export * from "./risk-classifier.js";
+export * from "./policy-engine.js";
+export * from "./approval-manager.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC"}

package/dist/policy/index.js

@@ -0,0 +1,8 @@
+/**
+ * Anantham V2 — Policy, Risk Classification & Approval Plane
+ * PRD Part 1 Section 34-39, 118-120 & PRD Part 3 Section 146-150 / P4.1
+ */
+export * from "./risk-classifier.js";
+export * from "./policy-engine.js";
+export * from "./approval-manager.js";
+//# sourceMappingURL=index.js.map

package/dist/policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC"}

package/dist/policy/policy-engine.d.ts

@@ -0,0 +1,19 @@
+import { type PolicyDecision, type PolicyEvaluationContext, type PolicyRule } from "../domain/policy.js";
+export interface PolicyEngineOptions {
+    policyVersion?: string;
+    rules?: PolicyRule[];
+    defaultApprovalOnHighRisk?: boolean;
+}
+export declare class PolicyEngine {
+    readonly policyVersion: string;
+    private readonly rules;
+    private readonly defaultApprovalOnHighRisk;
+    constructor(options?: PolicyEngineOptions);
+    /**
+     * Evaluates an operation request deterministically against invariants, rules, and risk tiers.
+     * PRD Part 1 Section 34-39 & PRD Part 3 Section 146-150.
+     */
+    evaluate(context: PolicyEvaluationContext): PolicyDecision;
+    private matchesRule;
+}
+//# sourceMappingURL=policy-engine.d.ts.map

package/dist/policy/policy-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-engine.d.ts","sourceRoot":"","sources":["../../src/policy/policy-engine.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC5B,KAAK,UAAU,EAIhB,MAAM,qBAAqB,CAAC;AAG7B,MAAM,WAAW,mBAAmB;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED,qBAAa,YAAY;IACvB,SAAgB,aAAa,EAAE,MAAM,CAAC;IACtC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAU;gBAExC,OAAO,GAAE,mBAAwB;IAM7C;;;OAGG;IACI,QAAQ,CAAC,OAAO,EAAE,uBAAuB,GAAG,cAAc;IA8HjE,OAAO,CAAC,WAAW;CASpB"}