@atensec/pulumi-thoth 0.1.15 → 0.1.17

package/governance/toolClassification.ts

@@ -0,0 +1,109 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export class ToolClassification extends pulumi.CustomResource {
+    /**
+     * Get an existing ToolClassification resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: ToolClassificationState, opts?: pulumi.CustomResourceOptions): ToolClassification {
+        return new ToolClassification(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'thoth:governance/toolClassification:ToolClassification';
+
+    /**
+     * Returns true if the given object is an instance of ToolClassification.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is ToolClassification {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === ToolClassification.__pulumiType;
+    }
+
+    /**
+     * Reviewed effects: read, write, delete, execute, export, external_call, bulk_operation, credential_access, sensitive_data_access.
+     */
+    declare public readonly classes: pulumi.Output<string[]>;
+    declare public /*out*/ readonly createdAt: pulumi.Output<string>;
+    declare public /*out*/ readonly createdBy: pulumi.Output<string>;
+    /**
+     * Exact tool name; wildcards are refused.
+     */
+    declare public readonly toolName: pulumi.Output<string>;
+
+    /**
+     * Create a ToolClassification resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: ToolClassificationArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: ToolClassificationArgs | ToolClassificationState, opts?: pulumi.CustomResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as ToolClassificationState | undefined;
+            resourceInputs["classes"] = state?.classes;
+            resourceInputs["createdAt"] = state?.createdAt;
+            resourceInputs["createdBy"] = state?.createdBy;
+            resourceInputs["toolName"] = state?.toolName;
+        } else {
+            const args = argsOrState as ToolClassificationArgs | undefined;
+            if (args?.classes === undefined && !opts.urn) {
+                throw new Error("Missing required property 'classes'");
+            }
+            if (args?.toolName === undefined && !opts.urn) {
+                throw new Error("Missing required property 'toolName'");
+            }
+            resourceInputs["classes"] = args?.classes;
+            resourceInputs["toolName"] = args?.toolName;
+            resourceInputs["createdAt"] = undefined /*out*/;
+            resourceInputs["createdBy"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        super(ToolClassification.__pulumiType, name, resourceInputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering ToolClassification resources.
+ */
+export interface ToolClassificationState {
+    /**
+     * Reviewed effects: read, write, delete, execute, export, external_call, bulk_operation, credential_access, sensitive_data_access.
+     */
+    classes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    createdAt?: pulumi.Input<string | undefined>;
+    createdBy?: pulumi.Input<string | undefined>;
+    /**
+     * Exact tool name; wildcards are refused.
+     */
+    toolName?: pulumi.Input<string | undefined>;
+}
+
+/**
+ * The set of arguments for constructing a ToolClassification resource.
+ */
+export interface ToolClassificationArgs {
+    /**
+     * Reviewed effects: read, write, delete, execute, export, external_call, bulk_operation, credential_access, sensitive_data_access.
+     */
+    classes: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Exact tool name; wildcards are refused.
+     */
+    toolName: pulumi.Input<string>;
+}

package/index.ts

@@ -18,6 +18,7 @@ import * as fleet from "./fleet";
 import * as governance from "./governance";
 import * as mcp from "./mcp";
 import * as mdm from "./mdm";
+import * as types from "./types";
 
 export {
     access,
@@ -28,6 +29,7 @@ export {
     governance,
     mcp,
     mdm,
+    types,
 };
 pulumi.runtime.registerResourcePackage("thoth", {
     version: utilities.getVersion(),

package/mcp/vendor.ts

@@ -36,6 +36,10 @@ export class Vendor extends pulumi.CustomResource {
      * Whether this vendor is approved for pass-through MCP host access.
      */
     declare public readonly approved: pulumi.Output<boolean>;
+    /**
+     * Capability bindings this vendor/runtime identity is allowed to request.
+     */
+    declare public readonly capabilities: pulumi.Output<string[]>;
     /**
      * Creation timestamp.
      */
@@ -44,6 +48,14 @@ export class Vendor extends pulumi.CustomResource {
      * Human-friendly vendor display name.
      */
     declare public readonly displayName: pulumi.Output<string>;
+    /**
+     * Allowed egress host patterns enforced for this vendor/runtime identity.
+     */
+    declare public readonly egressAllowedHostPatterns: pulumi.Output<string[]>;
+    /**
+     * Egress policy mode for vendor traffic (enforce or observe).
+     */
+    declare public readonly egressPolicyMode: pulumi.Output<string>;
     /**
      * Allowed host patterns for this vendor (for example api.openai.com).
      */
@@ -52,10 +64,30 @@ export class Vendor extends pulumi.CustomResource {
      * Last observed timestamp (RFC3339) for this vendor in runtime traffic.
      */
     declare public readonly lastSeenAt: pulumi.Output<string>;
+    /**
+     * Signature bundle reference used for manifest verification.
+     */
+    declare public readonly manifestSignatureBundleRef: pulumi.Output<string>;
+    /**
+     * Signer identity for verified manifest signatures.
+     */
+    declare public readonly manifestSignatureSigner: pulumi.Output<string>;
+    /**
+     * Manifest signature verification status (verified, pending, failed).
+     */
+    declare public readonly manifestSignatureStatus: pulumi.Output<string>;
+    /**
+     * RFC3339 timestamp when manifest signature was verified.
+     */
+    declare public readonly manifestSignatureVerifiedAt: pulumi.Output<string>;
     /**
      * Optional reviewer notes for this vendor entry.
      */
     declare public readonly notes: pulumi.Output<string | undefined>;
+    /**
+     * Capability-scoped runtime identity used at action-time enforcement.
+     */
+    declare public readonly runtimeIdentity: pulumi.Output<string>;
     /**
      * Vendor entry source (for example manual, discovered).
      */
@@ -87,11 +119,19 @@ export class Vendor extends pulumi.CustomResource {
         if (opts.id) {
             const state = argsOrState as VendorState | undefined;
             resourceInputs["approved"] = state?.approved;
+            resourceInputs["capabilities"] = state?.capabilities;
             resourceInputs["createdAt"] = state?.createdAt;
             resourceInputs["displayName"] = state?.displayName;
+            resourceInputs["egressAllowedHostPatterns"] = state?.egressAllowedHostPatterns;
+            resourceInputs["egressPolicyMode"] = state?.egressPolicyMode;
             resourceInputs["hostPatterns"] = state?.hostPatterns;
             resourceInputs["lastSeenAt"] = state?.lastSeenAt;
+            resourceInputs["manifestSignatureBundleRef"] = state?.manifestSignatureBundleRef;
+            resourceInputs["manifestSignatureSigner"] = state?.manifestSignatureSigner;
+            resourceInputs["manifestSignatureStatus"] = state?.manifestSignatureStatus;
+            resourceInputs["manifestSignatureVerifiedAt"] = state?.manifestSignatureVerifiedAt;
             resourceInputs["notes"] = state?.notes;
+            resourceInputs["runtimeIdentity"] = state?.runtimeIdentity;
             resourceInputs["source"] = state?.source;
             resourceInputs["tenantId"] = state?.tenantId;
             resourceInputs["updatedAt"] = state?.updatedAt;
@@ -108,10 +148,18 @@ export class Vendor extends pulumi.CustomResource {
                 throw new Error("Missing required property 'vendorId'");
             }
             resourceInputs["approved"] = args?.approved;
+            resourceInputs["capabilities"] = args?.capabilities;
             resourceInputs["displayName"] = args?.displayName;
+            resourceInputs["egressAllowedHostPatterns"] = args?.egressAllowedHostPatterns;
+            resourceInputs["egressPolicyMode"] = args?.egressPolicyMode;
             resourceInputs["hostPatterns"] = args?.hostPatterns;
             resourceInputs["lastSeenAt"] = args?.lastSeenAt;
+            resourceInputs["manifestSignatureBundleRef"] = args?.manifestSignatureBundleRef;
+            resourceInputs["manifestSignatureSigner"] = args?.manifestSignatureSigner;
+            resourceInputs["manifestSignatureStatus"] = args?.manifestSignatureStatus;
+            resourceInputs["manifestSignatureVerifiedAt"] = args?.manifestSignatureVerifiedAt;
             resourceInputs["notes"] = args?.notes;
+            resourceInputs["runtimeIdentity"] = args?.runtimeIdentity;
             resourceInputs["source"] = args?.source;
             resourceInputs["vendorId"] = args?.vendorId;
             resourceInputs["createdAt"] = undefined /*out*/;
@@ -131,6 +179,10 @@ export interface VendorState {
      * Whether this vendor is approved for pass-through MCP host access.
      */
     approved?: pulumi.Input<boolean | undefined>;
+    /**
+     * Capability bindings this vendor/runtime identity is allowed to request.
+     */
+    capabilities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
     /**
      * Creation timestamp.
      */
@@ -139,6 +191,14 @@ export interface VendorState {
      * Human-friendly vendor display name.
      */
     displayName?: pulumi.Input<string | undefined>;
+    /**
+     * Allowed egress host patterns enforced for this vendor/runtime identity.
+     */
+    egressAllowedHostPatterns?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Egress policy mode for vendor traffic (enforce or observe).
+     */
+    egressPolicyMode?: pulumi.Input<string | undefined>;
     /**
      * Allowed host patterns for this vendor (for example api.openai.com).
      */
@@ -147,10 +207,30 @@ export interface VendorState {
      * Last observed timestamp (RFC3339) for this vendor in runtime traffic.
      */
     lastSeenAt?: pulumi.Input<string | undefined>;
+    /**
+     * Signature bundle reference used for manifest verification.
+     */
+    manifestSignatureBundleRef?: pulumi.Input<string | undefined>;
+    /**
+     * Signer identity for verified manifest signatures.
+     */
+    manifestSignatureSigner?: pulumi.Input<string | undefined>;
+    /**
+     * Manifest signature verification status (verified, pending, failed).
+     */
+    manifestSignatureStatus?: pulumi.Input<string | undefined>;
+    /**
+     * RFC3339 timestamp when manifest signature was verified.
+     */
+    manifestSignatureVerifiedAt?: pulumi.Input<string | undefined>;
     /**
      * Optional reviewer notes for this vendor entry.
      */
     notes?: pulumi.Input<string | undefined>;
+    /**
+     * Capability-scoped runtime identity used at action-time enforcement.
+     */
+    runtimeIdentity?: pulumi.Input<string | undefined>;
     /**
      * Vendor entry source (for example manual, discovered).
      */
@@ -177,10 +257,22 @@ export interface VendorArgs {
      * Whether this vendor is approved for pass-through MCP host access.
      */
     approved?: pulumi.Input<boolean | undefined>;
+    /**
+     * Capability bindings this vendor/runtime identity is allowed to request.
+     */
+    capabilities?: pulumi.Input<pulumi.Input<string>[] | undefined>;
     /**
      * Human-friendly vendor display name.
      */
     displayName: pulumi.Input<string>;
+    /**
+     * Allowed egress host patterns enforced for this vendor/runtime identity.
+     */
+    egressAllowedHostPatterns?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Egress policy mode for vendor traffic (enforce or observe).
+     */
+    egressPolicyMode?: pulumi.Input<string | undefined>;
     /**
      * Allowed host patterns for this vendor (for example api.openai.com).
      */
@@ -189,10 +281,30 @@ export interface VendorArgs {
      * Last observed timestamp (RFC3339) for this vendor in runtime traffic.
      */
     lastSeenAt?: pulumi.Input<string | undefined>;
+    /**
+     * Signature bundle reference used for manifest verification.
+     */
+    manifestSignatureBundleRef?: pulumi.Input<string | undefined>;
+    /**
+     * Signer identity for verified manifest signatures.
+     */
+    manifestSignatureSigner?: pulumi.Input<string | undefined>;
+    /**
+     * Manifest signature verification status (verified, pending, failed).
+     */
+    manifestSignatureStatus?: pulumi.Input<string | undefined>;
+    /**
+     * RFC3339 timestamp when manifest signature was verified.
+     */
+    manifestSignatureVerifiedAt?: pulumi.Input<string | undefined>;
     /**
      * Optional reviewer notes for this vendor entry.
      */
     notes?: pulumi.Input<string | undefined>;
+    /**
+     * Capability-scoped runtime identity used at action-time enforcement.
+     */
+    runtimeIdentity?: pulumi.Input<string | undefined>;
     /**
      * Vendor entry source (for example manual, discovered).
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atensec/pulumi-thoth",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "Pulumi provider for Aten Security Thoth AI governance control plane.",
   "keywords": [
     "pulumi",

package/tsconfig.json

@@ -94,6 +94,7 @@
         "governance/policyExceptionReview.ts",
         "governance/policySync.ts",
         "governance/siemSettings.ts",
+        "governance/toolClassification.ts",
         "governance/webhookSettings.ts",
         "governance/webhookTest.ts",
         "index.ts",
@@ -110,6 +111,9 @@
         "mdm/provider.ts",
         "mdm/sync.ts",
         "provider.ts",
+        "types/index.ts",
+        "types/input.ts",
+        "types/output.ts",
         "utilities.ts"
     ]
 }

package/types/index.ts

@@ -0,0 +1,13 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as utilities from "../utilities";
+
+// Export sub-modules:
+import * as input from "./input";
+import * as output from "./output";
+
+export {
+    input,
+    output,
+};

package/types/input.ts

@@ -0,0 +1,27 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as inputs from "../types/input";
+import * as outputs from "../types/output";
+
+export namespace governance {
+    export interface GovernanceSettingsComplianceCoverage {
+        /**
+         * Action-time controls with executable predicates.
+         */
+        enforced?: pulumi.Input<number | undefined>;
+        /**
+         * Controls classified as evidence gaps.
+         */
+        evidenceGap?: pulumi.Input<number | undefined>;
+        /**
+         * Controls outside action-time enforcement.
+         */
+        notActionTime?: pulumi.Input<number | undefined>;
+        /**
+         * Total classified controls.
+         */
+        total?: pulumi.Input<number | undefined>;
+    }
+}

package/types/output.ts

@@ -0,0 +1,28 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as inputs from "../types/input";
+import * as outputs from "../types/output";
+
+export namespace governance {
+    export interface GovernanceSettingsComplianceCoverage {
+        /**
+         * Action-time controls with executable predicates.
+         */
+        enforced: number;
+        /**
+         * Controls classified as evidence gaps.
+         */
+        evidenceGap: number;
+        /**
+         * Controls outside action-time enforcement.
+         */
+        notActionTime: number;
+        /**
+         * Total classified controls.
+         */
+        total: number;
+    }
+
+}