feat: add Rego wire models and feature flag to core

Adds HookBundle and AllPoliciesResponse Pydantic wire models for
the /all-policies/{tenant_id} endpoint alongside PolicyResponse.
Adds REGO_FEATURE_FLAG / is_rego_enabled() mirroring the existing
GOVERNANCE_FEATURE_FLAG / is_governance_enabled() pattern.
Bumps uipath-core to 0.5.31.

Generated with Claude Code

Co-Authored-By: Claude <noreply@anthropic.com>

Author: evanbijoy251

packages/uipath-core/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "uipath-core"
-version = "0.5.30"
+version = "0.5.31"
 description = "UiPath Core abstractions"
 readme = { file = "README.md", content-type = "text/markdown" }
 requires-python = ">=3.11"

packages/uipath-core/src/uipath/core/governance/__init__.py

@@ -9,7 +9,9 @@
 
 from .config import (
     GOVERNANCE_FEATURE_FLAG,
+    REGO_FEATURE_FLAG,
     is_governance_enabled,
+    is_rego_enabled,
 )
 from .exceptions import (
     GovernanceBlockException,
@@ -19,10 +21,12 @@
 )
 from .models import Action, AuditRecord, EnforcementMode, LifecycleHook, RuleEvaluation
 from .providers import (
+    AllPoliciesResponse,
     FiredRule,
     GovernanceCompensationProvider,
     GovernancePolicyProvider,
     GovernRequest,
+    HookBundle,
     PolicyContext,
     PolicyResponse,
 )
@@ -36,17 +40,21 @@
     "RuleEvaluation",
     # Config
     "GOVERNANCE_FEATURE_FLAG",
+    "REGO_FEATURE_FLAG",
     "is_governance_enabled",
+    "is_rego_enabled",
     # Exceptions
     "GovernanceBlockException",
     "GovernanceConfigError",
     "GovernanceViolation",
     "Severity",
     # Provider protocols + wire models
+    "AllPoliciesResponse",
     "FiredRule",
     "GovernanceCompensationProvider",
     "GovernancePolicyProvider",
     "GovernRequest",
+    "HookBundle",
     "PolicyContext",
     "PolicyResponse",
 ]

packages/uipath-core/src/uipath/core/governance/config.py

@@ -18,6 +18,10 @@
 # same toggle.
 GOVERNANCE_FEATURE_FLAG = "EnablePythonGovernanceChecker"
 
+# Feature flag name controlling whether the Rego/WASM evaluator runs.
+# Independent of the native evaluator flag — both can be enabled simultaneously.
+REGO_FEATURE_FLAG = "EnablePythonGovernanceRegoEvaluator"
+
 
 def is_governance_enabled() -> bool:
     """Return whether the ``EnablePythonGovernanceChecker`` flag is enabled.
@@ -35,3 +39,21 @@ def is_governance_enabled() -> bool:
     2. Default ``False`` (governance disabled).
     """
     return FeatureFlags.is_flag_enabled(GOVERNANCE_FEATURE_FLAG, default=False)
+
+
+def is_rego_enabled() -> bool:
+    """Return whether the ``EnablePythonGovernanceRegoEvaluator`` flag is enabled.
+
+    Rego evaluation is **off by default** — the flag must be explicitly
+    set to ``true`` (programmatically via the ``FeatureFlags`` registry,
+    or via the ``UIPATH_FEATURE_EnablePythonGovernanceRegoEvaluator`` env
+    var) for this function to return ``True``.
+
+    Resolution order:
+
+    1. :meth:`uipath.core.feature_flags.FeatureFlagsManager.is_flag_enabled` -
+       the in-process programmatic registry (typically populated from
+       gitops) and its own ``UIPATH_FEATURE_<name>`` env-var fallback.
+    2. Default ``False`` (Rego evaluation disabled).
+    """
+    return FeatureFlags.is_flag_enabled(REGO_FEATURE_FLAG, default=False)

packages/uipath-core/src/uipath/core/governance/providers.py

@@ -78,6 +78,54 @@ def _coerce_mode(cls, value: object) -> EnforcementMode | None:
             return None
 
 
+class HookBundle(BaseModel):
+    """Metadata for one hook's WASM policy bundle.
+
+    Returned as an element of :class:`AllPoliciesResponse` from the
+    ``/all-policies/{tenant_id}`` endpoint.
+
+    Attributes:
+        hook_type: Lifecycle hook identifier (e.g. ``"before_agent"``).
+        bundle_url: Pre-signed URL for the WASM ``.tar.gz`` bundle.
+            No platform auth required — the URL carries its own credentials.
+        etag: Server-assigned ETag for the bundle. Used by the Rego loader
+            to skip unchanged bundles on background refresh. ``None`` when
+            the server does not provide one.
+    """
+
+    model_config = ConfigDict(populate_by_name=True, extra="ignore")
+
+    hook_type: str = Field(alias="hookType")
+    bundle_url: str = Field(alias="bundleUrl")
+    etag: str | None = Field(default=None)
+
+
+class AllPoliciesResponse(BaseModel):
+    """Parsed response from the ``/all-policies/{tenant_id}`` endpoint.
+
+    Wire envelope::
+
+        {
+            "hookBundles": [
+                {
+                    "hookType": "before_agent",
+                    "bundleUrl": "https://url.example.com/...",
+                    "etag": "abc123"
+                }
+            ]
+        }
+
+    Attributes:
+        hook_bundles: One entry per lifecycle hook that has a compiled
+            WASM bundle. Empty when no policies are configured for the
+            tenant.
+    """
+
+    model_config = ConfigDict(populate_by_name=True, extra="ignore")
+
+    hook_bundles: list[HookBundle] = Field(default_factory=list, alias="hookBundles")
+
+
 class FiredRule(BaseModel):
     """Per-rule metadata carried in the ``/runtime/govern`` payload.