Add policy-bound credential submission and native DLP audit proofs

packages/core/policy.mjs

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { createHash, createPrivateKey, createPublicKey, sign, verify } from 'node:crypto';
 import { SecuritySchema, AgentsSchema } from './security.mjs';
+import {ControlledSubmissionSchema} from './credential-policy.mjs';
 import { SemanticPolicySchema } from './semantic.mjs';
 import { ManagedSettingsSchema } from './managed-settings.mjs';
 import { EnterpriseSchema } from './enterprise.mjs';
@@ -47,7 +48,7 @@ export const PolicySchema = z.object({
   }),
   security: SecuritySchema,
   inspection:z.object({documentAnalysisEnabled:z.boolean().default(true)}).prefault({}),
-  passwordManager:z.object({enabled:z.boolean().default(true),allowSaving:z.boolean().default(true),allowAutofill:z.boolean().default(true),idleLockSeconds:z.number().int().min(60).max(900).default(300)}).strict().prefault({}),
+  passwordManager:z.object({enabled:z.boolean().default(true),allowSaving:z.boolean().default(true),allowAutofill:z.boolean().default(true),controlledSubmission:ControlledSubmissionSchema,idleLockSeconds:z.number().int().min(60).max(900).default(300)}).strict().prefault({}),
   agents: AgentsSchema,
   enterprise: EnterpriseSchema,
   ai: z.object({ enabled: z.boolean(), model: z.string().max(100),provider:z.enum(['openai-compatible','ollama']).default('openai-compatible'),trustMode:z.enum(['external','local']).default('external'),endpointId:z.string().max(80).default('default'),allowConfidentialLocal:z.boolean().default(false) })