governance-sdk 0.5.0

package/dist/supply-chain-sbom.js

@@ -0,0 +1,73 @@
+/**
+ * governance-sdk — Agent Software Bill of Materials (SBOM)
+ *
+ * Generates a JSON manifest of agent capabilities, dependencies,
+ * and governance posture. Compatible with CycloneDX concepts.
+ *
+ * @example
+ * ```ts
+ * import { generateAgentSBOM } from 'governance-sdk/supply-chain-sbom';
+ *
+ * const sbom = generateAgentSBOM({
+ *   agent: storedAgent,
+ *   dependencies: { tools: ['search'], mcpServers: ['mcp://files'] },
+ *   governanceScore: 87,
+ *   governanceLevel: 4,
+ *   complianceFrameworks: ['eu-ai-act', 'owasp-agentic'],
+ * });
+ * ```
+ */
+// ─── Implementation ─────────────────────────────────────────
+export function generateAgentSBOM(input) {
+    const { agent, dependencies, governanceScore, governanceLevel, complianceFrameworks, policies } = input;
+    return {
+        bomFormat: "LuaAgentSBOM",
+        specVersion: "1.0",
+        serialNumber: `urn:uuid:${generateUUID()}`,
+        generatedAt: new Date().toISOString(),
+        component: {
+            type: "agent",
+            name: agent.name,
+            version: agent.version ?? "0.0.0",
+            description: agent.description ?? "",
+            supplier: agent.owner ?? "unknown",
+            properties: {
+                "agent:id": agent.id,
+                "agent:framework": agent.framework ?? "unknown",
+            },
+        },
+        dependencies: {
+            tools: dependencies?.tools ?? [],
+            mcpServers: dependencies?.mcpServers ?? [],
+            apiEndpoints: dependencies?.apiEndpoints ?? [],
+            agents: dependencies?.agents ?? [],
+        },
+        governance: {
+            score: governanceScore ?? 0,
+            level: governanceLevel ?? 0,
+            complianceFrameworks: complianceFrameworks ?? [],
+            policyCount: policies?.length ?? 0,
+            policies: policies ?? [],
+        },
+    };
+}
+// ─── Utilities ──────────────────────────────────────────────
+function generateUUID() {
+    if (typeof globalThis.crypto !== "undefined" && globalThis.crypto.randomUUID) {
+        return globalThis.crypto.randomUUID();
+    }
+    // Fallback for environments without randomUUID
+    const bytes = new Uint8Array(16);
+    if (typeof globalThis.crypto !== "undefined" && globalThis.crypto.getRandomValues) {
+        globalThis.crypto.getRandomValues(bytes);
+    }
+    else {
+        for (let i = 0; i < 16; i++)
+            bytes[i] = Math.floor(Math.random() * 256);
+    }
+    bytes[6] = (bytes[6] & 0x0f) | 0x40; // version 4
+    bytes[8] = (bytes[8] & 0x3f) | 0x80; // variant 1
+    const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+//# sourceMappingURL=supply-chain-sbom.js.map

package/dist/supply-chain-sbom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supply-chain-sbom.js","sourceRoot":"","sources":["../src/supply-chain-sbom.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAkDH,+DAA+D;AAE/D,MAAM,UAAU,iBAAiB,CAAC,KAAqB;IACrD,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,oBAAoB,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAExG,OAAO;QACL,SAAS,EAAE,cAAc;QACzB,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,YAAY,YAAY,EAAE,EAAE;QAC1C,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,SAAS,EAAE;YACT,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO;YACjC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE;YACpC,QAAQ,EAAE,KAAK,CAAC,KAAK,IAAI,SAAS;YAClC,UAAU,EAAE;gBACV,UAAU,EAAE,KAAK,CAAC,EAAE;gBACpB,iBAAiB,EAAE,KAAK,CAAC,SAAS,IAAI,SAAS;aAChD;SACF;QACD,YAAY,EAAE;YACZ,KAAK,EAAE,YAAY,EAAE,KAAK,IAAI,EAAE;YAChC,UAAU,EAAE,YAAY,EAAE,UAAU,IAAI,EAAE;YAC1C,YAAY,EAAE,YAAY,EAAE,YAAY,IAAI,EAAE;YAC9C,MAAM,EAAE,YAAY,EAAE,MAAM,IAAI,EAAE;SACnC;QACD,UAAU,EAAE;YACV,KAAK,EAAE,eAAe,IAAI,CAAC;YAC3B,KAAK,EAAE,eAAe,IAAI,CAAC;YAC3B,oBAAoB,EAAE,oBAAoB,IAAI,EAAE;YAChD,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;YAClC,QAAQ,EAAE,QAAQ,IAAI,EAAE;SACzB;KACF,CAAC;AACJ,CAAC;AAED,+DAA+D;AAE/D,SAAS,YAAY;IACnB,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC7E,OAAO,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IACxC,CAAC;IACD,+CAA+C;IAC/C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;QAClF,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,YAAY;IACjD,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,YAAY;IACjD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/E,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AAC7G,CAAC"}

package/dist/supply-chain.d.ts

@@ -0,0 +1,61 @@
+/**
+ * governance-sdk — Agent Supply Chain Security
+ *
+ * Declare agent dependencies, validate against approved registries,
+ * and enforce supply chain policies. Addresses OWASP AA-03.
+ *
+ * @example
+ * ```ts
+ * import { createSupplyChainPolicy, declareAgentDependencies } from 'governance-sdk/supply-chain';
+ *
+ * const deps = declareAgentDependencies({
+ *   tools: ['web_search', 'email_send'],
+ *   mcpServers: ['mcp://files.company.com'],
+ *   apiEndpoints: ['https://api.internal.com'],
+ * });
+ *
+ * const policy = createSupplyChainPolicy({
+ *   approvedTools: ['web_search', 'email_send', 'calendar_read'],
+ *   approvedMcpServers: ['mcp://files.company.com'],
+ * });
+ * governance.addRule(policy);
+ * ```
+ */
+import type { PolicyRule } from "./policy.js";
+/** Declared dependencies for an agent */
+export interface AgentDependencies {
+    tools?: string[];
+    mcpServers?: string[];
+    apiEndpoints?: string[];
+    agents?: string[];
+}
+/** Approved supply chain registry */
+export interface ApprovedRegistry {
+    approvedTools?: string[];
+    approvedMcpServers?: string[];
+    approvedApiEndpoints?: string[];
+    approvedAgents?: string[];
+}
+/** Validation result for a single agent's supply chain */
+export interface SupplyChainValidation {
+    valid: boolean;
+    violations: SupplyChainViolation[];
+}
+export interface SupplyChainViolation {
+    type: "tool" | "mcp_server" | "api_endpoint" | "agent";
+    name: string;
+    reason: string;
+}
+/** Declare and normalize an agent's dependency set */
+export declare function declareAgentDependencies(deps: AgentDependencies): AgentDependencies;
+/** Validate agent dependencies against an approved registry */
+export declare function validateSupplyChain(deps: AgentDependencies, registry: ApprovedRegistry): SupplyChainValidation;
+/**
+ * Create a policy rule that blocks agents using unapproved tools.
+ * Checks the tool being called against the approved registry.
+ */
+export declare function createSupplyChainPolicy(registry: ApprovedRegistry, opts?: {
+    priority?: number;
+    id?: string;
+}): PolicyRule;
+//# sourceMappingURL=supply-chain.d.ts.map

package/dist/supply-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supply-chain.d.ts","sourceRoot":"","sources":["../src/supply-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAI9C,yCAAyC;AACzC,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,qCAAqC;AACrC,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,0DAA0D;AAC1D,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,oBAAoB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,cAAc,GAAG,OAAO,CAAC;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAID,sDAAsD;AACtD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,GAAG,iBAAiB,CAOnF;AAID,+DAA+D;AAC/D,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,iBAAiB,EACvB,QAAQ,EAAE,gBAAgB,GACzB,qBAAqB,CAoCvB;AAID;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,GACxC,UAAU,CAqBZ"}

package/dist/supply-chain.js

@@ -0,0 +1,95 @@
+/**
+ * governance-sdk — Agent Supply Chain Security
+ *
+ * Declare agent dependencies, validate against approved registries,
+ * and enforce supply chain policies. Addresses OWASP AA-03.
+ *
+ * @example
+ * ```ts
+ * import { createSupplyChainPolicy, declareAgentDependencies } from 'governance-sdk/supply-chain';
+ *
+ * const deps = declareAgentDependencies({
+ *   tools: ['web_search', 'email_send'],
+ *   mcpServers: ['mcp://files.company.com'],
+ *   apiEndpoints: ['https://api.internal.com'],
+ * });
+ *
+ * const policy = createSupplyChainPolicy({
+ *   approvedTools: ['web_search', 'email_send', 'calendar_read'],
+ *   approvedMcpServers: ['mcp://files.company.com'],
+ * });
+ * governance.addRule(policy);
+ * ```
+ */
+// ─── Dependency Declaration ─────────────────────────────────
+/** Declare and normalize an agent's dependency set */
+export function declareAgentDependencies(deps) {
+    return {
+        tools: deps.tools ? [...new Set(deps.tools)].sort() : [],
+        mcpServers: deps.mcpServers ? [...new Set(deps.mcpServers)].sort() : [],
+        apiEndpoints: deps.apiEndpoints ? [...new Set(deps.apiEndpoints)].sort() : [],
+        agents: deps.agents ? [...new Set(deps.agents)].sort() : [],
+    };
+}
+// ─── Validation ─────────────────────────────────────────────
+/** Validate agent dependencies against an approved registry */
+export function validateSupplyChain(deps, registry) {
+    const violations = [];
+    if (registry.approvedTools) {
+        for (const tool of deps.tools ?? []) {
+            if (!registry.approvedTools.includes(tool)) {
+                violations.push({ type: "tool", name: tool, reason: `Tool "${tool}" not in approved registry` });
+            }
+        }
+    }
+    if (registry.approvedMcpServers) {
+        for (const server of deps.mcpServers ?? []) {
+            if (!registry.approvedMcpServers.includes(server)) {
+                violations.push({ type: "mcp_server", name: server, reason: `MCP server "${server}" not approved` });
+            }
+        }
+    }
+    if (registry.approvedApiEndpoints) {
+        for (const ep of deps.apiEndpoints ?? []) {
+            if (!registry.approvedApiEndpoints.includes(ep)) {
+                violations.push({ type: "api_endpoint", name: ep, reason: `API endpoint "${ep}" not approved` });
+            }
+        }
+    }
+    if (registry.approvedAgents) {
+        for (const agent of deps.agents ?? []) {
+            if (!registry.approvedAgents.includes(agent)) {
+                violations.push({ type: "agent", name: agent, reason: `Agent "${agent}" not in approved list` });
+            }
+        }
+    }
+    return { valid: violations.length === 0, violations };
+}
+// ─── Policy Rule ────────────────────────────────────────────
+/**
+ * Create a policy rule that blocks agents using unapproved tools.
+ * Checks the tool being called against the approved registry.
+ */
+export function createSupplyChainPolicy(registry, opts) {
+    const approvedTools = new Set(registry.approvedTools ?? []);
+    return {
+        id: opts?.id ?? "supply-chain-tool-check",
+        name: "Supply chain: block unapproved tools",
+        condition: {
+            type: "custom",
+            params: {
+                evaluate: (ctx) => {
+                    if (!ctx.tool)
+                        return false;
+                    return approvedTools.size > 0 && !approvedTools.has(ctx.tool);
+                },
+            },
+        },
+        outcome: "block",
+        reason: "Tool not in approved supply chain registry",
+        priority: opts?.priority ?? 105,
+        enabled: true,
+        stage: "process",
+    };
+}
+//# sourceMappingURL=supply-chain.js.map

package/dist/supply-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supply-chain.js","sourceRoot":"","sources":["../src/supply-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAkCH,+DAA+D;AAE/D,sDAAsD;AACtD,MAAM,UAAU,wBAAwB,CAAC,IAAuB;IAC9D,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;QACxD,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;QACvE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;QAC7E,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED,+DAA+D;AAE/D,+DAA+D;AAC/D,MAAM,UAAU,mBAAmB,CACjC,IAAuB,EACvB,QAA0B;IAE1B,MAAM,UAAU,GAA2B,EAAE,CAAC;IAE9C,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,IAAI,4BAA4B,EAAE,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,kBAAkB,EAAE,CAAC;QAChC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YAC3C,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClD,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,MAAM,gBAAgB,EAAE,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QAClC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBAChD,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC5B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7C,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,KAAK,wBAAwB,EAAE,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;AACxD,CAAC;AAED,+DAA+D;AAE/D;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAA0B,EAC1B,IAAyC;IAEzC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAE5D,OAAO;QACL,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,yBAAyB;QACzC,IAAI,EAAE,sCAAsC;QAC5C,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE;gBACN,QAAQ,EAAE,CAAC,GAAsB,EAAE,EAAE;oBACnC,IAAI,CAAC,GAAG,CAAC,IAAI;wBAAE,OAAO,KAAK,CAAC;oBAC5B,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChE,CAAC;aACF;SACF;QACD,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,4CAA4C;QACpD,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG;QAC/B,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,SAAS;KACjB,CAAC;AACJ,CAAC"}

package/dist/token-types.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Shared token type definitions for Propolis → Honeycomb JWT exchange.
+ *
+ * Zero dependencies. These types define the JWT payload structure.
+ *
+ * DESIGN PRINCIPLE: The JWT carries identity, trust level, and scope.
+ * It does NOT carry tool permissions — those are enforced by governance
+ * policies via the policy engine. The JWT tells Honeycomb WHO the agent
+ * is and WHAT DATA it can see. Governance tells the agent WHAT ACTIONS
+ * it can take.
+ *
+ * @example
+ * ```ts
+ * import type { HoneycombAgentToken, TokenRequest } from 'governance-sdk/token-types';
+ * ```
+ */
+/** RS256 JWT payload issued by Propolis for Honeycomb authentication. */
+export interface HoneycombAgentToken {
+    /** Issuer — always "propolis" */
+    iss: "propolis";
+    /** Audience — always "honeycomb" */
+    aud: "honeycomb";
+    /** Subject — agentId */
+    sub: string;
+    /** Issued-at (unix seconds) */
+    iat: number;
+    /** Expiry (unix seconds) */
+    exp: number;
+    /** Unique token ID (UUID) — for revocation and audit correlation */
+    jti: string;
+    agentName: string;
+    orgId: string;
+    /** Governance level (0-4) from composite score */
+    governanceLevel: number;
+    /** Composite governance score (0-100) */
+    compositeScore: number;
+    /** Allowed Honeycomb namespaces */
+    namespaces: string[];
+    /** Allowed access level values */
+    accessLevels: ("public" | "namespace" | "restricted")[];
+    /** Maximum extraction tier (0=none, 1=slim, 2=full) */
+    maxExtractionTier: 0 | 1 | 2;
+    /** Maximum concurrent namespaces */
+    maxNamespaces: number;
+    /** Honeycomb tools this agent is allowed to call */
+    allowedTools: string[];
+    /** Search across all namespaces */
+    allowCrossNamespace?: boolean;
+    /** Restrict entity recall by type (undefined = all types) */
+    allowedEntityTypes?: string[];
+}
+/** Request body for POST /api/v1/token */
+export interface TokenRequest {
+    agentId: string;
+    agentName: string;
+    requestedNamespaces?: string[];
+}
+/** Response body from POST /api/v1/token */
+export interface TokenResponse {
+    token: string;
+    /** Expiry as unix seconds */
+    expiresAt: number;
+}
+/** Resource allocation limits by governance level. */
+export interface ResourceLimits {
+    maxNamespaces: number;
+    maxExtractionTier: 0 | 1 | 2;
+}
+/**
+ * Maps governance level → resource limits.
+ *
+ * These control COMPUTE COST (extraction depth, data breadth).
+ * Authorization (which tools, which actions) is handled by
+ * the governance policy engine — NOT by this table.
+ */
+export declare const RESOURCE_LIMITS_BY_LEVEL: Record<number, ResourceLimits>;
+//# sourceMappingURL=token-types.d.ts.map

package/dist/token-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-types.d.ts","sourceRoot":"","sources":["../src/token-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,yEAAyE;AACzE,MAAM,WAAW,mBAAmB;IAElC,iCAAiC;IACjC,GAAG,EAAE,UAAU,CAAC;IAChB,oCAAoC;IACpC,GAAG,EAAE,WAAW,CAAC;IACjB,wBAAwB;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,+BAA+B;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,oEAAoE;IACpE,GAAG,EAAE,MAAM,CAAC;IAGZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IAGd,kDAAkD;IAClD,eAAe,EAAE,MAAM,CAAC;IACxB,yCAAyC;IACzC,cAAc,EAAE,MAAM,CAAC;IAGvB,mCAAmC;IACnC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,kCAAkC;IAClC,YAAY,EAAE,CAAC,QAAQ,GAAG,WAAW,GAAG,YAAY,CAAC,EAAE,CAAC;IAGxD,uDAAuD;IACvD,iBAAiB,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,oCAAoC;IACpC,aAAa,EAAE,MAAM,CAAC;IAGtB,oDAAoD;IACpD,YAAY,EAAE,MAAM,EAAE,CAAC;IAGvB,mCAAmC;IACnC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,6DAA6D;IAC7D,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAID,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAED,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,sDAAsD;AACtD,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAMnE,CAAC"}

package/dist/token-types.js

@@ -0,0 +1,31 @@
+/**
+ * Shared token type definitions for Propolis → Honeycomb JWT exchange.
+ *
+ * Zero dependencies. These types define the JWT payload structure.
+ *
+ * DESIGN PRINCIPLE: The JWT carries identity, trust level, and scope.
+ * It does NOT carry tool permissions — those are enforced by governance
+ * policies via the policy engine. The JWT tells Honeycomb WHO the agent
+ * is and WHAT DATA it can see. Governance tells the agent WHAT ACTIONS
+ * it can take.
+ *
+ * @example
+ * ```ts
+ * import type { HoneycombAgentToken, TokenRequest } from 'governance-sdk/token-types';
+ * ```
+ */
+/**
+ * Maps governance level → resource limits.
+ *
+ * These control COMPUTE COST (extraction depth, data breadth).
+ * Authorization (which tools, which actions) is handled by
+ * the governance policy engine — NOT by this table.
+ */
+export const RESOURCE_LIMITS_BY_LEVEL = {
+    0: { maxNamespaces: 1, maxExtractionTier: 0 },
+    1: { maxNamespaces: 3, maxExtractionTier: 1 },
+    2: { maxNamespaces: 10, maxExtractionTier: 1 },
+    3: { maxNamespaces: 50, maxExtractionTier: 2 },
+    4: { maxNamespaces: Infinity, maxExtractionTier: 2 },
+};
+//# sourceMappingURL=token-types.js.map

package/dist/token-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-types.js","sourceRoot":"","sources":["../src/token-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA6EH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC;IACtE,CAAC,EAAE,EAAE,aAAa,EAAE,CAAC,EAAS,iBAAiB,EAAE,CAAC,EAAE;IACpD,CAAC,EAAE,EAAE,aAAa,EAAE,CAAC,EAAS,iBAAiB,EAAE,CAAC,EAAE;IACpD,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,EAAQ,iBAAiB,EAAE,CAAC,EAAE;IACpD,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,EAAQ,iBAAiB,EAAE,CAAC,EAAE;IACpD,CAAC,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,EAAE;CACrD,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,71 @@
+/**
+ * governance-sdk — Core type system for agent governance.
+ * Framework-agnostic types for agent registration, scoring, and fleet management.
+ */
+/** Supported agent frameworks */
+export type AgentFramework = "mastra" | "langchain" | "crewai" | "autogen" | "openai" | "vercel-ai" | "mcp" | "bedrock" | "genkit" | "semantic-kernel" | "anthropic" | "mistral" | "ollama" | "e2b" | "composio" | "custom" | "unknown";
+/** Agent lifecycle status */
+export type AgentStatus = "registered" | "assessed" | "approved" | "flagged" | "deprecated" | "quarantined";
+/** The seven governance dimensions */
+export type ScoreDimension = "identity" | "permissions" | "observability" | "guardrails" | "auditability" | "compliance" | "lifecycle";
+/** Governance level mapped from composite score */
+export interface GovernanceLevel {
+    level: 0 | 1 | 2 | 3 | 4;
+    label: string;
+    autonomy: string;
+    minScore: number;
+    maxScore: number;
+}
+/** Individual dimension scoring result */
+export interface DimensionResult {
+    dimension: ScoreDimension;
+    score: number;
+    weight: number;
+    evidence: Record<string, boolean | number | string>;
+}
+/** Complete governance assessment for an agent */
+export interface GovernanceAssessment {
+    agentId: string;
+    agentName: string;
+    compositeScore: number;
+    level: GovernanceLevel;
+    dimensions: DimensionResult[];
+    status: AgentStatus;
+    assessedAt: string;
+    recommendations: string[];
+}
+/** Agent registration input */
+export interface AgentRegistration {
+    name: string;
+    framework: AgentFramework;
+    description?: string;
+    owner: string;
+    version?: string;
+    channels?: string[];
+    tools?: string[];
+    hasAuth?: boolean;
+    hasGuardrails?: boolean;
+    hasObservability?: boolean;
+    hasAuditLog?: boolean;
+    permissions?: Record<string, unknown>;
+    metadata?: Record<string, unknown>;
+}
+/** Fleet-level governance summary */
+export interface FleetSummary {
+    totalAgents: number;
+    averageScore: number;
+    fleetLevel: GovernanceLevel;
+    byStatus: Record<AgentStatus, number>;
+    byFramework: Record<AgentFramework, number>;
+    byLevel: Record<number, number>;
+    highestScoring: {
+        name: string;
+        score: number;
+    } | null;
+    lowestScoring: {
+        name: string;
+        score: number;
+    } | null;
+    recommendations: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,iCAAiC;AACjC,MAAM,MAAM,cAAc,GACtB,QAAQ,GACR,WAAW,GACX,QAAQ,GACR,SAAS,GACT,QAAQ,GACR,WAAW,GACX,KAAK,GACL,SAAS,GACT,QAAQ,GACR,iBAAiB,GACjB,WAAW,GACX,SAAS,GACT,QAAQ,GACR,KAAK,GACL,UAAU,GACV,QAAQ,GACR,SAAS,CAAC;AAEd,6BAA6B;AAC7B,MAAM,MAAM,WAAW,GACnB,YAAY,GACZ,UAAU,GACV,UAAU,GACV,SAAS,GACT,YAAY,GACZ,aAAa,CAAC;AAElB,sCAAsC;AACtC,MAAM,MAAM,cAAc,GACtB,UAAU,GACV,aAAa,GACb,eAAe,GACf,YAAY,GACZ,cAAc,GACd,YAAY,GACZ,WAAW,CAAC;AAEhB,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,0CAA0C;AAC1C,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,cAAc,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC;CACrD;AAED,kDAAkD;AAClD,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,+BAA+B;AAC/B,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,cAAc,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,qCAAqC;AACrC,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,eAAe,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAC5C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,cAAc,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACvD,aAAa,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACtD,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B"}

package/dist/types.js

@@ -0,0 +1,6 @@
+/**
+ * governance-sdk — Core type system for agent governance.
+ * Framework-agnostic types for agent registration, scoring, and fleet management.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG"}