@atensec/pulumi-thoth 0.1.15 → 0.1.16

package/bin/types/index.js

@@ -0,0 +1,34 @@
+"use strict";
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.output = exports.input = void 0;
+// Export sub-modules:
+const input = __importStar(require("./input"));
+exports.input = input;
+const output = __importStar(require("./output"));
+exports.output = output;
+//# sourceMappingURL=index.js.map

package/bin/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../types/index.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;;;;;;;;;;;;;;;;;;;;;;;;AAIjF,sBAAsB;AACtB,+CAAiC;AAI7B,sBAAK;AAHT,iDAAmC;AAI/B,wBAAM"}

package/bin/types/input.d.ts

@@ -0,0 +1,22 @@
+import * as pulumi from "@pulumi/pulumi";
+export declare namespace governance {
+    interface GovernanceSettingsComplianceCoverage {
+        /**
+         * Action-time controls with executable predicates.
+         */
+        enforced?: pulumi.Input<number | undefined>;
+        /**
+         * Controls classified as evidence gaps.
+         */
+        evidenceGap?: pulumi.Input<number | undefined>;
+        /**
+         * Controls outside action-time enforcement.
+         */
+        notActionTime?: pulumi.Input<number | undefined>;
+        /**
+         * Total classified controls.
+         */
+        total?: pulumi.Input<number | undefined>;
+    }
+}
+//# sourceMappingURL=input.d.ts.map

package/bin/types/input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input.d.ts","sourceRoot":"","sources":["../../types/input.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAIzC,yBAAiB,UAAU,CAAC;IACxB,UAAiB,oCAAoC;QACjD;;WAEG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;QAC5C;;WAEG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;QAC/C;;WAEG;QACH,aAAa,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;QACjD;;WAEG;QACH,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;KAC5C;CACJ"}

package/bin/types/input.js

@@ -0,0 +1,5 @@
+"use strict";
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=input.js.map

package/bin/types/input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"input.js","sourceRoot":"","sources":["../../types/input.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF"}

package/bin/types/output.d.ts

@@ -0,0 +1,21 @@
+export declare namespace governance {
+    interface GovernanceSettingsComplianceCoverage {
+        /**
+         * Action-time controls with executable predicates.
+         */
+        enforced: number;
+        /**
+         * Controls classified as evidence gaps.
+         */
+        evidenceGap: number;
+        /**
+         * Controls outside action-time enforcement.
+         */
+        notActionTime: number;
+        /**
+         * Total classified controls.
+         */
+        total: number;
+    }
+}
+//# sourceMappingURL=output.d.ts.map

package/bin/types/output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../types/output.ts"],"names":[],"mappings":"AAOA,yBAAiB,UAAU,CAAC;IACxB,UAAiB,oCAAoC;QACjD;;WAEG;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB;;WAEG;QACH,WAAW,EAAE,MAAM,CAAC;QACpB;;WAEG;QACH,aAAa,EAAE,MAAM,CAAC;QACtB;;WAEG;QACH,KAAK,EAAE,MAAM,CAAC;KACjB;CAEJ"}

package/bin/types/output.js

@@ -0,0 +1,5 @@
+"use strict";
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=output.js.map

package/bin/types/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../types/output.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF"}

package/governance/getExecutiveSummary.ts

@@ -30,6 +30,8 @@ export interface GetExecutiveSummaryResult {
      * The provider-assigned unique ID for this managed resource.
      */
     readonly id: string;
+    readonly mcpCriticalDeviationAlerts: number;
+    readonly mcpDeviationAlerts: number;
     readonly rate?: number;
     readonly responseJson: string;
 }

package/governance/getReportsOverview.ts

@@ -28,6 +28,9 @@ export interface GetReportsOverviewResult {
      * The provider-assigned unique ID for this managed resource.
      */
     readonly id: string;
+    readonly mcpCriticalDeviationAlerts: number;
+    readonly mcpDeviationAlerts: number;
+    readonly mcpDeviationByTypeJson: string;
     readonly responseJson: string;
 }
 export function getReportsOverviewOutput(args?: GetReportsOverviewOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetReportsOverviewResult> {

package/governance/governanceSettings.ts

@@ -2,6 +2,8 @@
 // *** Do not edit by hand unless you're certain you know what you are doing! ***
 
 import * as pulumi from "@pulumi/pulumi";
+import * as inputs from "../types/input";
+import * as outputs from "../types/output";
 import * as utilities from "../utilities";
 
 export class GovernanceSettings extends pulumi.CustomResource {
@@ -32,10 +34,38 @@ export class GovernanceSettings extends pulumi.CustomResource {
         return obj['__pulumiType'] === GovernanceSettings.__pulumiType;
     }
 
+    /**
+     * Canonical declared regimes. Known during planning for known declarations.
+     */
+    declare public /*out*/ readonly canonicalRegimes: pulumi.Output<string[]>;
+    /**
+     * Pinned catalogue identity. Apply fails before mutation if the running catalogue differs.
+     */
+    declare public /*out*/ readonly complianceCatalogueSha256: pulumi.Output<string>;
+    /**
+     * Per-regime author classifications from the pinned executable catalogue, available before first apply. These counts are not a regulatory conformance assessment.
+     */
+    declare public /*out*/ readonly complianceCoverage: pulumi.Output<{[key: string]: outputs.governance.GovernanceSettingsComplianceCoverage}>;
+    /**
+     * Required with a nonempty declaration: observe evaluates and records advisory findings while preserving independent authorization; enforce adds non-grantable restrictions for DENY, STEP_UP and evidence-based UNRESOLVED. Changing mode affects every tenant agent within 1000 ms. Structurally unserved regimes report coverage gaps and add no action restriction.
+     */
+    declare public readonly complianceEnforcementMode: pulumi.Output<string | undefined>;
+    /**
+     * Pinned evaluator identity, checked before mutation.
+     */
+    declare public /*out*/ readonly complianceEvaluatorSha256: pulumi.Output<string>;
     /**
      * Compliance profile (soc2, healthcare, financial, public_sector, privacy, ai_governance).
      */
     declare public readonly complianceProfile: pulumi.Output<string | undefined>;
+    /**
+     * Revision used for optimistic concurrency. A stale apply or destroy fails without replacing a newer declaration.
+     */
+    declare public /*out*/ readonly complianceRevision: pulumi.Output<number>;
+    /**
+     * Explicit executable compliance declaration for all current and future tenant agents. Case and separators are ignored. Removing a managed declaration or setting [] clears it. Legacy profile defaults never activate this binding.
+     */
+    declare public readonly declaredRegulatoryRegimes: pulumi.Output<string[] | undefined>;
     /**
      * Additional JSON object merged into the outgoing settings payload for forward compatibility.
      */
@@ -65,7 +95,15 @@ export class GovernanceSettings extends pulumi.CustomResource {
      */
     declare public readonly modelRouterFailoverProviders: pulumi.Output<string[]>;
     /**
-     * Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Defaults to SOC2 when unset.
+     * Maximum positive cache lifetime for declaration changes: 1000 milliseconds.
+     */
+    declare public /*out*/ readonly propagationMaxMs: pulumi.Output<number>;
+    /**
+     * Declared regimes with no executable controls. These are coverage gaps, never a clean result or a per-action restriction.
+     */
+    declare public /*out*/ readonly regimesWithoutControls: pulumi.Output<string[]>;
+    /**
+     * Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Legacy packs only; defaults to SOC2 when unset. Does not activate executable compliance.
      */
     declare public readonly regulatoryRegimes: pulumi.Output<string[] | undefined>;
     /**
@@ -134,7 +172,14 @@ export class GovernanceSettings extends pulumi.CustomResource {
         opts = opts || {};
         if (opts.id) {
             const state = argsOrState as GovernanceSettingsState | undefined;
+            resourceInputs["canonicalRegimes"] = state?.canonicalRegimes;
+            resourceInputs["complianceCatalogueSha256"] = state?.complianceCatalogueSha256;
+            resourceInputs["complianceCoverage"] = state?.complianceCoverage;
+            resourceInputs["complianceEnforcementMode"] = state?.complianceEnforcementMode;
+            resourceInputs["complianceEvaluatorSha256"] = state?.complianceEvaluatorSha256;
             resourceInputs["complianceProfile"] = state?.complianceProfile;
+            resourceInputs["complianceRevision"] = state?.complianceRevision;
+            resourceInputs["declaredRegulatoryRegimes"] = state?.declaredRegulatoryRegimes;
             resourceInputs["extraSettingsJson"] = state?.extraSettingsJson;
             resourceInputs["modelRouterAllowedModels"] = state?.modelRouterAllowedModels;
             resourceInputs["modelRouterAllowedProviders"] = state?.modelRouterAllowedProviders;
@@ -142,6 +187,8 @@ export class GovernanceSettings extends pulumi.CustomResource {
             resourceInputs["modelRouterDefaultProvider"] = state?.modelRouterDefaultProvider;
             resourceInputs["modelRouterEnabled"] = state?.modelRouterEnabled;
             resourceInputs["modelRouterFailoverProviders"] = state?.modelRouterFailoverProviders;
+            resourceInputs["propagationMaxMs"] = state?.propagationMaxMs;
+            resourceInputs["regimesWithoutControls"] = state?.regimesWithoutControls;
             resourceInputs["regulatoryRegimes"] = state?.regulatoryRegimes;
             resourceInputs["secretBrokerAllowedHosts"] = state?.secretBrokerAllowedHosts;
             resourceInputs["secretBrokerAuthBindingsJson"] = state?.secretBrokerAuthBindingsJson;
@@ -158,7 +205,9 @@ export class GovernanceSettings extends pulumi.CustomResource {
             resourceInputs["updatedAt"] = state?.updatedAt;
         } else {
             const args = argsOrState as GovernanceSettingsArgs | undefined;
+            resourceInputs["complianceEnforcementMode"] = args?.complianceEnforcementMode;
             resourceInputs["complianceProfile"] = args?.complianceProfile;
+            resourceInputs["declaredRegulatoryRegimes"] = args?.declaredRegulatoryRegimes;
             resourceInputs["extraSettingsJson"] = args?.extraSettingsJson;
             resourceInputs["modelRouterAllowedModels"] = args?.modelRouterAllowedModels;
             resourceInputs["modelRouterAllowedProviders"] = args?.modelRouterAllowedProviders;
@@ -178,6 +227,13 @@ export class GovernanceSettings extends pulumi.CustomResource {
             resourceInputs["shadowLow"] = args?.shadowLow;
             resourceInputs["shadowMedium"] = args?.shadowMedium;
             resourceInputs["toolRiskOverrides"] = args?.toolRiskOverrides;
+            resourceInputs["canonicalRegimes"] = undefined /*out*/;
+            resourceInputs["complianceCatalogueSha256"] = undefined /*out*/;
+            resourceInputs["complianceCoverage"] = undefined /*out*/;
+            resourceInputs["complianceEvaluatorSha256"] = undefined /*out*/;
+            resourceInputs["complianceRevision"] = undefined /*out*/;
+            resourceInputs["propagationMaxMs"] = undefined /*out*/;
+            resourceInputs["regimesWithoutControls"] = undefined /*out*/;
             resourceInputs["tenantId"] = undefined /*out*/;
             resourceInputs["updatedAt"] = undefined /*out*/;
         }
@@ -190,10 +246,38 @@ export class GovernanceSettings extends pulumi.CustomResource {
  * Input properties used for looking up and filtering GovernanceSettings resources.
  */
 export interface GovernanceSettingsState {
+    /**
+     * Canonical declared regimes. Known during planning for known declarations.
+     */
+    canonicalRegimes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Pinned catalogue identity. Apply fails before mutation if the running catalogue differs.
+     */
+    complianceCatalogueSha256?: pulumi.Input<string | undefined>;
+    /**
+     * Per-regime author classifications from the pinned executable catalogue, available before first apply. These counts are not a regulatory conformance assessment.
+     */
+    complianceCoverage?: pulumi.Input<{[key: string]: pulumi.Input<inputs.governance.GovernanceSettingsComplianceCoverage>} | undefined>;
+    /**
+     * Required with a nonempty declaration: observe evaluates and records advisory findings while preserving independent authorization; enforce adds non-grantable restrictions for DENY, STEP_UP and evidence-based UNRESOLVED. Changing mode affects every tenant agent within 1000 ms. Structurally unserved regimes report coverage gaps and add no action restriction.
+     */
+    complianceEnforcementMode?: pulumi.Input<string | undefined>;
+    /**
+     * Pinned evaluator identity, checked before mutation.
+     */
+    complianceEvaluatorSha256?: pulumi.Input<string | undefined>;
     /**
      * Compliance profile (soc2, healthcare, financial, public_sector, privacy, ai_governance).
      */
     complianceProfile?: pulumi.Input<string | undefined>;
+    /**
+     * Revision used for optimistic concurrency. A stale apply or destroy fails without replacing a newer declaration.
+     */
+    complianceRevision?: pulumi.Input<number | undefined>;
+    /**
+     * Explicit executable compliance declaration for all current and future tenant agents. Case and separators are ignored. Removing a managed declaration or setting [] clears it. Legacy profile defaults never activate this binding.
+     */
+    declaredRegulatoryRegimes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
     /**
      * Additional JSON object merged into the outgoing settings payload for forward compatibility.
      */
@@ -223,7 +307,15 @@ export interface GovernanceSettingsState {
      */
     modelRouterFailoverProviders?: pulumi.Input<pulumi.Input<string>[] | undefined>;
     /**
-     * Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Defaults to SOC2 when unset.
+     * Maximum positive cache lifetime for declaration changes: 1000 milliseconds.
+     */
+    propagationMaxMs?: pulumi.Input<number | undefined>;
+    /**
+     * Declared regimes with no executable controls. These are coverage gaps, never a clean result or a per-action restriction.
+     */
+    regimesWithoutControls?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Legacy packs only; defaults to SOC2 when unset. Does not activate executable compliance.
      */
     regulatoryRegimes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
     /**
@@ -284,10 +376,18 @@ export interface GovernanceSettingsState {
  * The set of arguments for constructing a GovernanceSettings resource.
  */
 export interface GovernanceSettingsArgs {
+    /**
+     * Required with a nonempty declaration: observe evaluates and records advisory findings while preserving independent authorization; enforce adds non-grantable restrictions for DENY, STEP_UP and evidence-based UNRESOLVED. Changing mode affects every tenant agent within 1000 ms. Structurally unserved regimes report coverage gaps and add no action restriction.
+     */
+    complianceEnforcementMode?: pulumi.Input<string | undefined>;
     /**
      * Compliance profile (soc2, healthcare, financial, public_sector, privacy, ai_governance).
      */
     complianceProfile?: pulumi.Input<string | undefined>;
+    /**
+     * Explicit executable compliance declaration for all current and future tenant agents. Case and separators are ignored. Removing a managed declaration or setting [] clears it. Legacy profile defaults never activate this binding.
+     */
+    declaredRegulatoryRegimes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
     /**
      * Additional JSON object merged into the outgoing settings payload for forward compatibility.
      */
@@ -317,7 +417,7 @@ export interface GovernanceSettingsArgs {
      */
     modelRouterFailoverProviders?: pulumi.Input<pulumi.Input<string>[] | undefined>;
     /**
-     * Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Defaults to SOC2 when unset.
+     * Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Legacy packs only; defaults to SOC2 when unset. Does not activate executable compliance.
      */
     regulatoryRegimes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
     /**

package/index.ts

@@ -18,6 +18,7 @@ import * as fleet from "./fleet";
 import * as governance from "./governance";
 import * as mcp from "./mcp";
 import * as mdm from "./mdm";
+import * as types from "./types";
 
 export {
     access,
@@ -28,6 +29,7 @@ export {
     governance,
     mcp,
     mdm,
+    types,
 };
 pulumi.runtime.registerResourcePackage("thoth", {
     version: utilities.getVersion(),

package/mcp/vendor.ts

@@ -36,6 +36,10 @@ export class Vendor extends pulumi.CustomResource {
      * Whether this vendor is approved for pass-through MCP host access.
      */
     declare public readonly approved: pulumi.Output<boolean>;
+    /**
+     * Capability bindings this vendor/runtime identity is allowed to request.
+     */
+    declare public readonly capabilities: pulumi.Output<string[]>;
     /**
      * Creation timestamp.
      */
@@ -44,6 +48,14 @@ export class Vendor extends pulumi.CustomResource {
      * Human-friendly vendor display name.
      */
     declare public readonly displayName: pulumi.Output<string>;
+    /**
+     * Allowed egress host patterns enforced for this vendor/runtime identity.
+     */
+    declare public readonly egressAllowedHostPatterns: pulumi.Output<string[]>;
+    /**
+     * Egress policy mode for vendor traffic (enforce or observe).
+     */
+    declare public readonly egressPolicyMode: pulumi.Output<string>;
     /**
      * Allowed host patterns for this vendor (for example api.openai.com).
      */
@@ -52,10 +64,30 @@ export class Vendor extends pulumi.CustomResource {
      * Last observed timestamp (RFC3339) for this vendor in runtime traffic.
      */
     declare public readonly lastSeenAt: pulumi.Output<string>;
+    /**
+     * Signature bundle reference used for manifest verification.
+     */
+    declare public readonly manifestSignatureBundleRef: pulumi.Output<string>;
+    /**
+     * Signer identity for verified manifest signatures.
+     */
+    declare public readonly manifestSignatureSigner: pulumi.Output<string>;
+    /**
+     * Manifest signature verification status (verified, pending, failed).
+     */
+    declare public readonly manifestSignatureStatus: pulumi.Output<string>;
+    /**
+     * RFC3339 timestamp when manifest signature was verified.
+     */
+    declare public readonly manifestSignatureVerifiedAt: pulumi.Output<string>;
     /**
      * Optional reviewer notes for this vendor entry.
      */
     declare public readonly notes: pulumi.Output<string | undefined>;
+    /**
+     * Capability-scoped runtime identity used at action-time enforcement.
+     */
+    declare public readonly runtimeIdentity: pulumi.Output<string>;
     /**
      * Vendor entry source (for example manual, discovered).
      */
@@ -87,11 +119,19 @@ export class Vendor extends pulumi.CustomResource {
         if (opts.id) {
             const state = argsOrState as VendorState | undefined;
             resourceInputs["approved"] = state?.approved;
+            resourceInputs["capabilities"] = state?.capabilities;
             resourceInputs["createdAt"] = state?.createdAt;
             resourceInputs["displayName"] = state?.displayName;
+            resourceInputs["egressAllowedHostPatterns"] = state?.egressAllowedHostPatterns;
+            resourceInputs["egressPolicyMode"] = state?.egressPolicyMode;
             resourceInputs["hostPatterns"] = state?.hostPatterns;
             resourceInputs["lastSeenAt"] = state?.lastSeenAt;
+            resourceInputs["manifestSignatureBundleRef"] = state?.manifestSignatureBundleRef;
+            resourceInputs["manifestSignatureSigner"] = state?.manifestSignatureSigner;
+            resourceInputs["manifestSignatureStatus"] = state?.manifestSignatureStatus;
+            resourceInputs["manifestSignatureVerifiedAt"] = state?.manifestSignatureVerifiedAt;
             resourceInputs["notes"] = state?.notes;
+            resourceInputs["runtimeIdentity"] = state?.runtimeIdentity;
             resourceInputs["source"] = state?.source;
             resourceInputs["tenantId"] = state?.tenantId;
             resourceInputs["updatedAt"] = state?.updatedAt;
@@ -108,10 +148,18 @@ export class Vendor extends pulumi.CustomResource {
                 throw new Error("Missing required property 'vendorId'");
             }
             resourceInputs["approved"] = args?.approved;
+            resourceInputs["capabilities"] = args?.capabilities;
             resourceInputs["displayName"] = args?.displayName;
+            resourceInputs["egressAllowedHostPatterns"] = args?.egressAllowedHostPatterns;
+            resourceInputs["egressPolicyMode"] = args?.egressPolicyMode;
             resourceInputs["hostPatterns"] = args?.hostPatterns;
             resourceInputs["lastSeenAt"] = args?.lastSeenAt;
+            resourceInputs["manifestSignatureBundleRef"] = args?.manifestSignatureBundleRef;
+            resourceInputs["manifestSignatureSigner"] = args?.manifestSignatureSigner;
+            resourceInputs["manifestSignatureStatus"] = args?.manifestSignatureStatus;
+            resourceInputs["manifestSignatureVerifiedAt"] = args?.manifestSignatureVerifiedAt;
             resourceInputs["notes"] = args?.notes;
+            resourceInputs["runtimeIdentity"] = args?.runtimeIdentity;
             resourceInputs["source"] = args?.source;
             resourceInputs["vendorId"] = args?.vendorId;
             resourceInputs["createdAt"] = undefined /*out*/;
@@ -131,6 +179,10 @@ export interface VendorState {
      * Whether this vendor is approved for pass-through MCP host access.
      */
     approved?: pulumi.Input<boolean | undefined>;
+    /**
+     * Capability bindings this vendor/runtime identity is allowed to request.
+     */
+    capabilities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
     /**
      * Creation timestamp.
      */
@@ -139,6 +191,14 @@ export interface VendorState {
      * Human-friendly vendor display name.
      */
     displayName?: pulumi.Input<string | undefined>;
+    /**
+     * Allowed egress host patterns enforced for this vendor/runtime identity.
+     */
+    egressAllowedHostPatterns?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Egress policy mode for vendor traffic (enforce or observe).
+     */
+    egressPolicyMode?: pulumi.Input<string | undefined>;
     /**
      * Allowed host patterns for this vendor (for example api.openai.com).
      */
@@ -147,10 +207,30 @@ export interface VendorState {
      * Last observed timestamp (RFC3339) for this vendor in runtime traffic.
      */
     lastSeenAt?: pulumi.Input<string | undefined>;
+    /**
+     * Signature bundle reference used for manifest verification.
+     */
+    manifestSignatureBundleRef?: pulumi.Input<string | undefined>;
+    /**
+     * Signer identity for verified manifest signatures.
+     */
+    manifestSignatureSigner?: pulumi.Input<string | undefined>;
+    /**
+     * Manifest signature verification status (verified, pending, failed).
+     */
+    manifestSignatureStatus?: pulumi.Input<string | undefined>;
+    /**
+     * RFC3339 timestamp when manifest signature was verified.
+     */
+    manifestSignatureVerifiedAt?: pulumi.Input<string | undefined>;
     /**
      * Optional reviewer notes for this vendor entry.
      */
     notes?: pulumi.Input<string | undefined>;
+    /**
+     * Capability-scoped runtime identity used at action-time enforcement.
+     */
+    runtimeIdentity?: pulumi.Input<string | undefined>;
     /**
      * Vendor entry source (for example manual, discovered).
      */
@@ -177,10 +257,22 @@ export interface VendorArgs {
      * Whether this vendor is approved for pass-through MCP host access.
      */
     approved?: pulumi.Input<boolean | undefined>;
+    /**
+     * Capability bindings this vendor/runtime identity is allowed to request.
+     */
+    capabilities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
     /**
      * Human-friendly vendor display name.
      */
     displayName: pulumi.Input<string>;
+    /**
+     * Allowed egress host patterns enforced for this vendor/runtime identity.
+     */
+    egressAllowedHostPatterns?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Egress policy mode for vendor traffic (enforce or observe).
+     */
+    egressPolicyMode?: pulumi.Input<string | undefined>;
     /**
      * Allowed host patterns for this vendor (for example api.openai.com).
      */
@@ -189,10 +281,30 @@ export interface VendorArgs {
      * Last observed timestamp (RFC3339) for this vendor in runtime traffic.
      */
     lastSeenAt?: pulumi.Input<string | undefined>;
+    /**
+     * Signature bundle reference used for manifest verification.
+     */
+    manifestSignatureBundleRef?: pulumi.Input<string | undefined>;
+    /**
+     * Signer identity for verified manifest signatures.
+     */
+    manifestSignatureSigner?: pulumi.Input<string | undefined>;
+    /**
+     * Manifest signature verification status (verified, pending, failed).
+     */
+    manifestSignatureStatus?: pulumi.Input<string | undefined>;
+    /**
+     * RFC3339 timestamp when manifest signature was verified.
+     */
+    manifestSignatureVerifiedAt?: pulumi.Input<string | undefined>;
     /**
      * Optional reviewer notes for this vendor entry.
      */
     notes?: pulumi.Input<string | undefined>;
+    /**
+     * Capability-scoped runtime identity used at action-time enforcement.
+     */
+    runtimeIdentity?: pulumi.Input<string | undefined>;
     /**
      * Vendor entry source (for example manual, discovered).
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atensec/pulumi-thoth",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "Pulumi provider for Aten Security Thoth AI governance control plane.",
   "keywords": [
     "pulumi",

package/tsconfig.json

@@ -110,6 +110,9 @@
         "mdm/provider.ts",
         "mdm/sync.ts",
         "provider.ts",
+        "types/index.ts",
+        "types/input.ts",
+        "types/output.ts",
         "utilities.ts"
     ]
 }

package/types/index.ts

@@ -0,0 +1,13 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as utilities from "../utilities";
+
+// Export sub-modules:
+import * as input from "./input";
+import * as output from "./output";
+
+export {
+    input,
+    output,
+};

package/types/input.ts

@@ -0,0 +1,27 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as inputs from "../types/input";
+import * as outputs from "../types/output";
+
+export namespace governance {
+    export interface GovernanceSettingsComplianceCoverage {
+        /**
+         * Action-time controls with executable predicates.
+         */
+        enforced?: pulumi.Input<number | undefined>;
+        /**
+         * Controls classified as evidence gaps.
+         */
+        evidenceGap?: pulumi.Input<number | undefined>;
+        /**
+         * Controls outside action-time enforcement.
+         */
+        notActionTime?: pulumi.Input<number | undefined>;
+        /**
+         * Total classified controls.
+         */
+        total?: pulumi.Input<number | undefined>;
+    }
+}

package/types/output.ts

@@ -0,0 +1,28 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as inputs from "../types/input";
+import * as outputs from "../types/output";
+
+export namespace governance {
+    export interface GovernanceSettingsComplianceCoverage {
+        /**
+         * Action-time controls with executable predicates.
+         */
+        enforced: number;
+        /**
+         * Controls classified as evidence gaps.
+         */
+        evidenceGap: number;
+        /**
+         * Controls outside action-time enforcement.
+         */
+        notActionTime: number;
+        /**
+         * Total classified controls.
+         */
+        total: number;
+    }
+
+}