crewhaus 0.1.7 → 0.2.0

package/dist/justification-calibrate.d.ts

@@ -0,0 +1,150 @@
+import { type JustificationJudge } from "@crewhaus/permission-engine";
+import type { SessionEvents } from "./advise-rules";
+/**
+ * AUTOMATION-OPPORTUNITIES.md item 52 — `crewhaus justification calibrate` +
+ * `justification preflight` core: replay the intent gate over historical
+ * permission-justification records and compare the judge's verdict to the
+ * ACTUAL outcome, computing allow/deny agreement + a false-block estimate,
+ * proposing a tuned confidence threshold, and flagging high-disagreement
+ * prompts. Side-effect-free so it is unit-testable (all filesystem access in
+ * index.ts), mirroring `advise-rules.ts` / `egress-triage.ts`.
+ *
+ * DURABILITY (verified 2026-07):
+ *
+ *   - The judge's verdicts are durable: the intent gate appends one
+ *     `permission_justification_evaluated` audit record per evaluated call
+ *     `{ toolName, justification, verdict: "allow"|"deny", reason, judgeModel,
+ *     confidence? }` to `.crewhaus/audit`.
+ *
+ *   - The ACTUAL outcome proxy is durable too, but at PER-TOOL granularity:
+ *     the audit record does NOT carry a call id linking it to a specific
+ *     `tool_result`, and a DENIED call never runs (so it has no outcome at
+ *     all). What IS cleanly joinable is the session `tool_stats` stream
+ *     (`{ toolName, isError, durationMs }`) the advisor already persists —
+ *     the same signal `crewhaus advise` mines. So calibration joins the
+ *     judge's per-tool ALLOW verdicts to that tool's observed error rate: the
+ *     proxy for "the allowed call was ultimately fine" is "this tool's
+ *     tool_stats calls mostly did NOT error". This is aggregate, not per-call
+ *     — the honest granularity the durable data supports, and the report says
+ *     so. (A NEUTRAL/"never followed by an error" per-call proxy would need a
+ *     call-id the audit record does not store; adding one is a separate,
+ *     schema-touching change deliberately out of scope here.)
+ *
+ *   - `sessionGoal` (the spec's `agent.instructions`) is NOT stored in the
+ *     record, so a faithful RULE-BASED replay (used by `preflight`) needs the
+ *     goal supplied — the caller passes the cwd spec's instructions. Without
+ *     it, the rule-based judge only exercises its length check and the report
+ *     flags the degraded fidelity.
+ */
+export type JustificationRecord = {
+    readonly toolName: string;
+    readonly justification: string;
+    readonly verdict: "allow" | "deny";
+    readonly reason?: string;
+    readonly judgeModel: string;
+    readonly confidence?: number;
+};
+/** Extract `permission_justification_evaluated` records from parsed audit
+ *  objects, defensively (malformed/other kinds skipped). */
+export declare function extractJustificationRecords(auditObjects: ReadonlyArray<unknown>): JustificationRecord[];
+export type ToolOutcome = {
+    readonly calls: number;
+    readonly errors: number;
+};
+/** Fold session `tool_stats` lines into per-tool { calls, errors } — the same
+ *  aggregate `crewhaus advise` uses, reused here as the outcome proxy. */
+export declare function buildToolOutcomes(sessions: ReadonlyArray<SessionEvents>): ReadonlyMap<string, ToolOutcome>;
+export type CalibrationThresholds = {
+    /** A tool's error rate at/above which an ALLOW is judged "outcome-bad". */
+    readonly badOutcomeRate: number;
+    /** Minimum tool_stats calls before a tool's outcome is trusted. */
+    readonly minCalls: number;
+};
+export declare const DEFAULT_CALIBRATION_THRESHOLDS: CalibrationThresholds;
+export type PerToolCalibration = {
+    readonly toolName: string;
+    readonly allowed: number;
+    readonly denied: number;
+    /** Mean judge confidence over this tool's ALLOW verdicts (null if none). */
+    readonly meanAllowConfidence: number | null;
+    /** Actual outcome from tool_stats (undefined when the tool never ran —
+     *  e.g. every call was denied, so there is no observed outcome). */
+    readonly outcome?: ToolOutcome;
+    /** outcome.errors / outcome.calls, when observed. */
+    readonly errorRate: number | null;
+    /**
+     * Agreement class for this tool's ALLOW verdicts vs the outcome proxy:
+     *  - "agree"      allowed AND the tool mostly succeeded
+     *  - "over-allow" allowed BUT the tool mostly errored (judge too lenient)
+     *  - "unknown"    allowed but no/too-few observed outcomes to judge
+     *  - "n/a"        no allow verdicts for this tool
+     */
+    readonly allowAgreement: "agree" | "over-allow" | "unknown" | "n/a";
+};
+export type CalibrationResult = {
+    readonly evaluated: number;
+    readonly allowed: number;
+    readonly denied: number;
+    /** denied / evaluated. */
+    readonly denyRate: number | null;
+    readonly perTool: ReadonlyArray<PerToolCalibration>;
+    /** ALLOW verdicts whose tool mostly succeeded / total ALLOWs with a trusted
+     *  observed outcome — the allow-agreement rate. Null when none observed. */
+    readonly allowAgreementRate: number | null;
+    /**
+     * FALSE-BLOCK ESTIMATE. A denied call never runs, so its true outcome is
+     * unobservable; we estimate the false-block rate as the fraction of DENY
+     * verdicts that are LOW-confidence (< the proposed threshold) — a
+     * low-confidence deny is the judge's own signal that it was unsure, the best
+     * durable proxy for "might have been fine". Reported as an ESTIMATE.
+     */
+    readonly estimatedFalseBlockRate: number | null;
+    /** Proposed confidence threshold — see `proposeThreshold`. */
+    readonly proposedThreshold: number;
+    /** Tools whose ALLOW verdicts disagree with the outcome (over-allow). */
+    readonly highDisagreementTools: ReadonlyArray<string>;
+};
+/**
+ * Propose a confidence threshold that best separates ALLOW verdicts whose
+ * tool succeeded (should stay allow) from ALLOW verdicts whose tool errored
+ * (should have been denied / re-justified). Sweeps candidate cutpoints over
+ * the observed allow-confidences and picks the one maximizing balanced
+ * accuracy (good allows kept above, bad allows pushed below). Falls back to
+ * 0.5 when there is no confidence signal to learn from.
+ */
+export declare function proposeThreshold(samples: ReadonlyArray<{
+    confidence: number;
+    outcomeBad: boolean;
+}>): number;
+/**
+ * Calibrate the judge over historical records + per-tool outcomes. Aggregate
+ * per tool: join each tool's ALLOW confidence to its observed error rate,
+ * derive the allow-agreement, propose a threshold, and estimate the false-
+ * block rate from low-confidence denies.
+ */
+export declare function calibrateJustification(records: ReadonlyArray<JustificationRecord>, outcomes: ReadonlyMap<string, ToolOutcome>, thresholds?: CalibrationThresholds): CalibrationResult;
+export type PreflightResult = {
+    readonly sampled: number;
+    readonly wouldAllow: number;
+    readonly wouldDeny: number;
+    /** Records where the replayed verdict DIFFERS from the stored verdict. */
+    readonly flips: ReadonlyArray<{
+        readonly toolName: string;
+        readonly stored: "allow" | "deny";
+        readonly replayed: "allow" | "deny";
+    }>;
+    /** True when no sessionGoal was supplied (rule-based fidelity is degraded —
+     *  only the length check runs). */
+    readonly degraded: boolean;
+};
+/**
+ * Preflight: dry-run a judge over a sample of historical justifications BEFORE
+ * deploy. Defaults to the deterministic `ruleBasedJustificationJudge` (offline,
+ * no credentials — a clean explanation for the LLM-judge path is that it needs
+ * a live model, which preflight does not spin up). `sessionGoal` is the spec's
+ * `agent.instructions`; without it the rule-based judge runs degraded (length
+ * check only) and `degraded` is true.
+ */
+export declare function preflightJustification(records: ReadonlyArray<JustificationRecord>, sessionGoal: string, judge?: JustificationJudge): Promise<PreflightResult>;
+export declare function renderCalibrationLines(r: CalibrationResult): ReadonlyArray<string>;
+export declare function renderPreflightLines(r: PreflightResult): ReadonlyArray<string>;

package/dist/justification-calibrate.js

@@ -0,0 +1,262 @@
+import { ruleBasedJustificationJudge } from "@crewhaus/permission-engine";
+import { payloadOf } from "./advise-rules";
+function asObject(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v)
+        ? v
+        : undefined;
+}
+/** Extract `permission_justification_evaluated` records from parsed audit
+ *  objects, defensively (malformed/other kinds skipped). */
+export function extractJustificationRecords(auditObjects) {
+    const out = [];
+    for (const obj of auditObjects) {
+        const o = asObject(obj);
+        if (o === undefined || o["kind"] !== "permission_justification_evaluated")
+            continue;
+        const p = asObject(o["payload"]);
+        if (p === undefined)
+            continue;
+        const toolName = typeof p["toolName"] === "string" ? p["toolName"] : undefined;
+        const justification = typeof p["justification"] === "string" ? p["justification"] : undefined;
+        const verdict = p["verdict"];
+        const judgeModel = typeof p["judgeModel"] === "string" ? p["judgeModel"] : "(unknown)";
+        if (toolName === undefined || justification === undefined)
+            continue;
+        if (verdict !== "allow" && verdict !== "deny")
+            continue;
+        out.push({
+            toolName,
+            justification,
+            verdict,
+            ...(typeof p["reason"] === "string" ? { reason: p["reason"] } : {}),
+            judgeModel,
+            ...(typeof p["confidence"] === "number" ? { confidence: p["confidence"] } : {}),
+        });
+    }
+    return out;
+}
+/** Fold session `tool_stats` lines into per-tool { calls, errors } — the same
+ *  aggregate `crewhaus advise` uses, reused here as the outcome proxy. */
+export function buildToolOutcomes(sessions) {
+    const acc = new Map();
+    for (const session of sessions) {
+        for (const obj of session.objects) {
+            const tool = payloadOf(obj, "tool_stats");
+            if (tool === undefined || typeof tool["toolName"] !== "string")
+                continue;
+            const name = tool["toolName"];
+            const t = acc.get(name) ?? { calls: 0, errors: 0 };
+            t.calls += 1;
+            if (tool["isError"] === true)
+                t.errors += 1;
+            acc.set(name, t);
+        }
+    }
+    return acc;
+}
+export const DEFAULT_CALIBRATION_THRESHOLDS = {
+    badOutcomeRate: 0.5,
+    minCalls: 3,
+};
+/**
+ * Propose a confidence threshold that best separates ALLOW verdicts whose
+ * tool succeeded (should stay allow) from ALLOW verdicts whose tool errored
+ * (should have been denied / re-justified). Sweeps candidate cutpoints over
+ * the observed allow-confidences and picks the one maximizing balanced
+ * accuracy (good allows kept above, bad allows pushed below). Falls back to
+ * 0.5 when there is no confidence signal to learn from.
+ */
+export function proposeThreshold(samples) {
+    const withConf = samples.filter((s) => Number.isFinite(s.confidence));
+    if (withConf.length === 0)
+        return 0.5;
+    const good = withConf.filter((s) => !s.outcomeBad);
+    const bad = withConf.filter((s) => s.outcomeBad);
+    if (good.length === 0 || bad.length === 0) {
+        // No contrast to learn a boundary from — keep the neutral default.
+        return 0.5;
+    }
+    const cuts = [...new Set(withConf.map((s) => s.confidence))].sort((a, b) => a - b);
+    // Candidate thresholds sit between observed confidences (and at the extremes).
+    const candidates = new Set([0.5]);
+    for (let i = 0; i < cuts.length; i++) {
+        candidates.add(cuts[i]);
+        if (i + 1 < cuts.length)
+            candidates.add((cuts[i] + cuts[i + 1]) / 2);
+    }
+    let best = 0.5;
+    let bestScore = -1;
+    for (const thr of [...candidates].sort((a, b) => a - b)) {
+        // good allows should be ABOVE thr (kept), bad allows BELOW (re-gated).
+        const goodKept = good.filter((s) => s.confidence >= thr).length / good.length;
+        const badReGated = bad.filter((s) => s.confidence < thr).length / bad.length;
+        const balanced = (goodKept + badReGated) / 2;
+        if (balanced > bestScore) {
+            bestScore = balanced;
+            best = thr;
+        }
+    }
+    return Number(best.toFixed(3));
+}
+/**
+ * Calibrate the judge over historical records + per-tool outcomes. Aggregate
+ * per tool: join each tool's ALLOW confidence to its observed error rate,
+ * derive the allow-agreement, propose a threshold, and estimate the false-
+ * block rate from low-confidence denies.
+ */
+export function calibrateJustification(records, outcomes, thresholds = DEFAULT_CALIBRATION_THRESHOLDS) {
+    const byTool = new Map();
+    let allowed = 0;
+    let denied = 0;
+    for (const r of records) {
+        const a = byTool.get(r.toolName) ?? {
+            allowed: 0,
+            denied: 0,
+            allowConfidences: [],
+            denyConfidences: [],
+        };
+        if (r.verdict === "allow") {
+            a.allowed += 1;
+            allowed += 1;
+            if (typeof r.confidence === "number")
+                a.allowConfidences.push(r.confidence);
+        }
+        else {
+            a.denied += 1;
+            denied += 1;
+            if (typeof r.confidence === "number")
+                a.denyConfidences.push(r.confidence);
+        }
+        byTool.set(r.toolName, a);
+    }
+    const mean = (xs) => xs.length > 0 ? xs.reduce((s, x) => s + x, 0) / xs.length : null;
+    // Threshold samples: one per allow-with-confidence whose tool has a trusted
+    // observed outcome.
+    const thresholdSamples = [];
+    const perTool = [];
+    const highDisagreement = [];
+    for (const [toolName, a] of [...byTool.entries()].sort((x, y) => x[0].localeCompare(y[0]))) {
+        const outcome = outcomes.get(toolName);
+        const errorRate = outcome !== undefined && outcome.calls > 0 ? outcome.errors / outcome.calls : null;
+        const trusted = outcome !== undefined && outcome.calls >= thresholds.minCalls && errorRate !== null;
+        let allowAgreement;
+        if (a.allowed === 0) {
+            allowAgreement = "n/a";
+        }
+        else if (!trusted) {
+            allowAgreement = "unknown";
+        }
+        else if (errorRate >= thresholds.badOutcomeRate) {
+            allowAgreement = "over-allow";
+            highDisagreement.push(toolName);
+        }
+        else {
+            allowAgreement = "agree";
+        }
+        if (a.allowed > 0 && trusted) {
+            const outcomeBad = errorRate >= thresholds.badOutcomeRate;
+            for (const c of a.allowConfidences)
+                thresholdSamples.push({ confidence: c, outcomeBad });
+        }
+        perTool.push({
+            toolName,
+            allowed: a.allowed,
+            denied: a.denied,
+            meanAllowConfidence: mean(a.allowConfidences),
+            ...(outcome !== undefined ? { outcome } : {}),
+            errorRate,
+            allowAgreement,
+        });
+    }
+    const proposedThreshold = proposeThreshold(thresholdSamples);
+    // Allow-agreement rate: agree / (agree + over-allow) over trusted allows.
+    const trustedAllowTools = perTool.filter((t) => t.allowAgreement === "agree" || t.allowAgreement === "over-allow");
+    const agreeCount = trustedAllowTools.filter((t) => t.allowAgreement === "agree").length;
+    const allowAgreementRate = trustedAllowTools.length > 0 ? agreeCount / trustedAllowTools.length : null;
+    // False-block estimate: fraction of DENY verdicts whose confidence is below
+    // the proposed threshold (the judge's own low-confidence denies).
+    const denyConfidences = records
+        .filter((r) => r.verdict === "deny" && typeof r.confidence === "number")
+        .map((r) => r.confidence);
+    const estimatedFalseBlockRate = denyConfidences.length > 0
+        ? denyConfidences.filter((c) => c < proposedThreshold).length / denyConfidences.length
+        : null;
+    return {
+        evaluated: records.length,
+        allowed,
+        denied,
+        denyRate: records.length > 0 ? denied / records.length : null,
+        perTool,
+        allowAgreementRate,
+        estimatedFalseBlockRate,
+        proposedThreshold,
+        highDisagreementTools: highDisagreement.sort(),
+    };
+}
+/**
+ * Preflight: dry-run a judge over a sample of historical justifications BEFORE
+ * deploy. Defaults to the deterministic `ruleBasedJustificationJudge` (offline,
+ * no credentials — a clean explanation for the LLM-judge path is that it needs
+ * a live model, which preflight does not spin up). `sessionGoal` is the spec's
+ * `agent.instructions`; without it the rule-based judge runs degraded (length
+ * check only) and `degraded` is true.
+ */
+export async function preflightJustification(records, sessionGoal, judge = ruleBasedJustificationJudge) {
+    let wouldAllow = 0;
+    let wouldDeny = 0;
+    const flips = [];
+    const flipsMut = flips;
+    for (const r of records) {
+        const verdict = await judge({
+            toolName: r.toolName,
+            justification: r.justification,
+            sessionGoal,
+            input: null,
+        });
+        const replayed = verdict.allow ? "allow" : "deny";
+        if (verdict.allow)
+            wouldAllow += 1;
+        else
+            wouldDeny += 1;
+        if (replayed !== r.verdict) {
+            flipsMut.push({ toolName: r.toolName, stored: r.verdict, replayed });
+        }
+    }
+    return {
+        sampled: records.length,
+        wouldAllow,
+        wouldDeny,
+        flips,
+        degraded: sessionGoal.length === 0,
+    };
+}
+// -------- renderers --------
+export function renderCalibrationLines(r) {
+    const lines = [];
+    const pct = (x) => (x === null ? "n/a" : `${(x * 100).toFixed(0)}%`);
+    lines.push(`${r.evaluated} justification(s) evaluated: ${r.allowed} allow, ${r.denied} deny (deny rate ${pct(r.denyRate)})`);
+    lines.push(`allow-agreement (allowed tools that succeeded / trusted allows): ${pct(r.allowAgreementRate)}`);
+    lines.push(`estimated false-block rate (low-confidence denies): ${pct(r.estimatedFalseBlockRate)}`);
+    lines.push(`proposed confidence threshold: ${r.proposedThreshold}`);
+    for (const t of r.perTool) {
+        const conf = t.meanAllowConfidence !== null ? t.meanAllowConfidence.toFixed(2) : "n/a";
+        const err = t.errorRate !== null ? pct(t.errorRate) : "no outcome observed";
+        lines.push(`  ${t.allowAgreement === "over-allow" ? "✗" : "•"} ${t.toolName}: ${t.allowed} allow / ${t.denied} deny, mean allow-confidence ${conf}, actual error rate ${err} → ${t.allowAgreement}`);
+    }
+    if (r.highDisagreementTools.length > 0) {
+        lines.push(`high-disagreement tools (allowed but mostly errored — tighten the justification prompt or lower the threshold): ${r.highDisagreementTools.join(", ")}`);
+    }
+    lines.push("  ~ outcome is a PER-TOOL proxy from tool_stats error rate; a denied call never runs, so the false-block figure is an ESTIMATE from low-confidence denies");
+    return lines;
+}
+export function renderPreflightLines(r) {
+    const lines = [];
+    lines.push(`preflight: ${r.sampled} historical justification(s) replayed → ${r.wouldAllow} allow, ${r.wouldDeny} deny, ${r.flips.length} flip(s) vs the stored verdict`);
+    if (r.degraded) {
+        lines.push("  ~ no session goal supplied (spec agent.instructions) — rule-based replay ran DEGRADED (length check only); pass a spec for full-fidelity replay");
+    }
+    for (const f of r.flips.slice(0, 20)) {
+        lines.push(`  ↔ ${f.toolName}: stored ${f.stored} → would ${f.replayed}`);
+    }
+    return lines;
+}

package/dist/justification-gate.d.ts

@@ -1,5 +1,6 @@
+import type { AuditLog } from "@crewhaus/audit-log";
 import type { JustificationJudge } from "@crewhaus/permission-engine";
-import type { JustificationAuditSink } from "@crewhaus/runtime-core";
+import type { EgressAuditSink, JustificationAuditSink } from "@crewhaus/runtime-core";
 /**
  * FR-004 — Pillar 3 intent-gate wiring for `crewhaus run`, factored out of
  * the entry file `index.ts` (which runs a top-level argv switch and so cannot
@@ -75,10 +76,30 @@ export type OpenJustificationAuditSinkOptions = {
     readonly enabled?: boolean;
 };
 /**
- * Open the durable `JustificationAuditSink` the gate appends to. Returns
- * `undefined` when disabled (so the caller spreads nothing into
- * `runChatLoop` and the durable path is a no-op). The returned object is a
- * real `@crewhaus/audit-log` `AuditLog`, which structurally satisfies the
- * `JustificationAuditSink` seam (its `append({ kind, payload })`).
+ * Open the durable audit log the Pillar 3 gates append to, rooted at
+ * `<cwd>/.crewhaus/audit`. Returns `undefined` when disabled (so the caller
+ * spreads nothing into `runChatLoop` and the durable path is a no-op).
+ *
+ * The returned object is a real `@crewhaus/audit-log` `AuditLog`, which
+ * structurally satisfies BOTH the `JustificationAuditSink`
+ * (`permission_justification_evaluated`) and the `EgressAuditSink`
+ * (`egress_decision`) seams — its `append({ kind, payload })`. A single log
+ * instance is deliberately shared across both gates so their records land on
+ * ONE hash-chained, gapless chain (item 20): two separate logs would each own
+ * their own `_chain-tail.json` and interleave inconsistently.
+ */
+export declare function openSecurityAuditSink(opts: OpenJustificationAuditSinkOptions): Promise<AuditLog | undefined>;
+/**
+ * Back-compat alias — the justification gate's original opener. Returns the
+ * shared `AuditLog` typed down to the `JustificationAuditSink` seam. Prefer
+ * {@link openSecurityAuditSink} when a caller also needs the egress sink from
+ * the same chain.
  */
 export declare function openJustificationAuditSink(opts: OpenJustificationAuditSinkOptions): Promise<JustificationAuditSink | undefined>;
+/**
+ * Narrow a shared security audit log to the `EgressAuditSink` seam. The same
+ * `AuditLog` instance already satisfies `EgressAuditSink` structurally; this
+ * is a typed pass-through so the run path can thread one log into both
+ * `runChatLoop({ justificationAuditSink, egressAuditSink })` fields.
+ */
+export declare function asEgressAuditSink(sink: AuditLog | undefined): EgressAuditSink | undefined;

package/dist/justification-gate.js

@@ -58,15 +58,39 @@ export function justificationAuditDir(cwd) {
     return join(cwd, ".crewhaus", "audit");
 }
 /**
- * Open the durable `JustificationAuditSink` the gate appends to. Returns
- * `undefined` when disabled (so the caller spreads nothing into
- * `runChatLoop` and the durable path is a no-op). The returned object is a
- * real `@crewhaus/audit-log` `AuditLog`, which structurally satisfies the
- * `JustificationAuditSink` seam (its `append({ kind, payload })`).
+ * Open the durable audit log the Pillar 3 gates append to, rooted at
+ * `<cwd>/.crewhaus/audit`. Returns `undefined` when disabled (so the caller
+ * spreads nothing into `runChatLoop` and the durable path is a no-op).
+ *
+ * The returned object is a real `@crewhaus/audit-log` `AuditLog`, which
+ * structurally satisfies BOTH the `JustificationAuditSink`
+ * (`permission_justification_evaluated`) and the `EgressAuditSink`
+ * (`egress_decision`) seams — its `append({ kind, payload })`. A single log
+ * instance is deliberately shared across both gates so their records land on
+ * ONE hash-chained, gapless chain (item 20): two separate logs would each own
+ * their own `_chain-tail.json` and interleave inconsistently.
  */
-export async function openJustificationAuditSink(opts) {
+export async function openSecurityAuditSink(opts) {
     if (opts.enabled === false)
         return undefined;
     const { openAuditLog } = await import("@crewhaus/audit-log");
     return await openAuditLog({ rootDir: justificationAuditDir(opts.cwd) });
 }
+/**
+ * Back-compat alias — the justification gate's original opener. Returns the
+ * shared `AuditLog` typed down to the `JustificationAuditSink` seam. Prefer
+ * {@link openSecurityAuditSink} when a caller also needs the egress sink from
+ * the same chain.
+ */
+export async function openJustificationAuditSink(opts) {
+    return await openSecurityAuditSink(opts);
+}
+/**
+ * Narrow a shared security audit log to the `EgressAuditSink` seam. The same
+ * `AuditLog` instance already satisfies `EgressAuditSink` structurally; this
+ * is a typed pass-through so the run path can thread one log into both
+ * `runChatLoop({ justificationAuditSink, egressAuditSink })` fields.
+ */
+export function asEgressAuditSink(sink) {
+    return sink;
+}