@atensec/pulumi-thoth 0.1.5 → 0.1.6

package/governance/getEffectivePolicyBundles.ts

@@ -0,0 +1,52 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export function getEffectivePolicyBundles(args?: GetEffectivePolicyBundlesArgs, opts?: pulumi.InvokeOptions): Promise<GetEffectivePolicyBundlesResult> {
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invoke("thoth:governance/getEffectivePolicyBundles:getEffectivePolicyBundles", {
+        "agentId": args.agentId,
+        "framework": args.framework,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getEffectivePolicyBundles.
+ */
+export interface GetEffectivePolicyBundlesArgs {
+    agentId?: string;
+    framework?: string;
+}
+
+/**
+ * A collection of values returned by getEffectivePolicyBundles.
+ */
+export interface GetEffectivePolicyBundlesResult {
+    readonly agentId?: string;
+    readonly dataJson: string;
+    readonly framework?: string;
+    /**
+     * The provider-assigned unique ID for this managed resource.
+     */
+    readonly id: string;
+    readonly total: number;
+}
+export function getEffectivePolicyBundlesOutput(args?: GetEffectivePolicyBundlesOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetEffectivePolicyBundlesResult> {
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("thoth:governance/getEffectivePolicyBundles:getEffectivePolicyBundles", {
+        "agentId": args.agentId,
+        "framework": args.framework,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getEffectivePolicyBundles.
+ */
+export interface GetEffectivePolicyBundlesOutputArgs {
+    agentId?: pulumi.Input<string | undefined>;
+    framework?: pulumi.Input<string | undefined>;
+}

package/governance/getPackRuleVersions.ts

@@ -0,0 +1,46 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export function getPackRuleVersions(args: GetPackRuleVersionsArgs, opts?: pulumi.InvokeOptions): Promise<GetPackRuleVersionsResult> {
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invoke("thoth:governance/getPackRuleVersions:getPackRuleVersions", {
+        "packId": args.packId,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getPackRuleVersions.
+ */
+export interface GetPackRuleVersionsArgs {
+    packId: string;
+}
+
+/**
+ * A collection of values returned by getPackRuleVersions.
+ */
+export interface GetPackRuleVersionsResult {
+    /**
+     * The provider-assigned unique ID for this managed resource.
+     */
+    readonly id: string;
+    readonly packId: string;
+    readonly responseJson: string;
+    readonly total: number;
+    readonly versionsJson: string;
+}
+export function getPackRuleVersionsOutput(args: GetPackRuleVersionsOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetPackRuleVersionsResult> {
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("thoth:governance/getPackRuleVersions:getPackRuleVersions", {
+        "packId": args.packId,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getPackRuleVersions.
+ */
+export interface GetPackRuleVersionsOutputArgs {
+    packId: pulumi.Input<string>;
+}

package/governance/getPackRules.ts

@@ -0,0 +1,49 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export function getPackRules(args: GetPackRulesArgs, opts?: pulumi.InvokeOptions): Promise<GetPackRulesResult> {
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invoke("thoth:governance/getPackRules:getPackRules", {
+        "packId": args.packId,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getPackRules.
+ */
+export interface GetPackRulesArgs {
+    packId: string;
+}
+
+/**
+ * A collection of values returned by getPackRules.
+ */
+export interface GetPackRulesResult {
+    readonly basePackVersion: string;
+    readonly currentVersionJson: string;
+    readonly displayName: string;
+    /**
+     * The provider-assigned unique ID for this managed resource.
+     */
+    readonly id: string;
+    readonly packId: string;
+    readonly regulation: string;
+    readonly responseJson: string;
+    readonly totalVersions: number;
+}
+export function getPackRulesOutput(args: GetPackRulesOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetPackRulesResult> {
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("thoth:governance/getPackRules:getPackRules", {
+        "packId": args.packId,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getPackRules.
+ */
+export interface GetPackRulesOutputArgs {
+    packId: pulumi.Input<string>;
+}

package/governance/getPolicyBundles.ts

@@ -0,0 +1,62 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export function getPolicyBundles(args?: GetPolicyBundlesArgs, opts?: pulumi.InvokeOptions): Promise<GetPolicyBundlesResult> {
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invoke("thoth:governance/getPolicyBundles:getPolicyBundles", {
+        "assignment": args.assignment,
+        "enforcementMode": args.enforcementMode,
+        "framework": args.framework,
+        "status": args.status,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getPolicyBundles.
+ */
+export interface GetPolicyBundlesArgs {
+    assignment?: string;
+    enforcementMode?: string;
+    framework?: string;
+    status?: string;
+}
+
+/**
+ * A collection of values returned by getPolicyBundles.
+ */
+export interface GetPolicyBundlesResult {
+    readonly assignment?: string;
+    readonly dataJson: string;
+    readonly enforcementMode?: string;
+    readonly framework?: string;
+    /**
+     * The provider-assigned unique ID for this managed resource.
+     */
+    readonly id: string;
+    readonly status?: string;
+    readonly total: number;
+}
+export function getPolicyBundlesOutput(args?: GetPolicyBundlesOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetPolicyBundlesResult> {
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("thoth:governance/getPolicyBundles:getPolicyBundles", {
+        "assignment": args.assignment,
+        "enforcementMode": args.enforcementMode,
+        "framework": args.framework,
+        "status": args.status,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getPolicyBundles.
+ */
+export interface GetPolicyBundlesOutputArgs {
+    assignment?: pulumi.Input<string | undefined>;
+    enforcementMode?: pulumi.Input<string | undefined>;
+    framework?: pulumi.Input<string | undefined>;
+    status?: pulumi.Input<string | undefined>;
+}

package/governance/getTenantSettings.ts

@@ -19,6 +19,7 @@ export interface GetTenantSettingsResult {
      * The provider-assigned unique ID for this managed resource.
      */
     readonly id: string;
+    readonly regulatoryRegimes: string[];
     readonly settingsJson: string;
     readonly tenantId: string;
     readonly toolRiskOverrides: {[key: string]: string};

package/governance/governanceSettings.ts

@@ -64,6 +64,10 @@ export class GovernanceSettings extends pulumi.CustomResource {
      * Failover provider order.
      */
     declare public readonly modelRouterFailoverProviders: pulumi.Output<string[] | undefined>;
+    /**
+     * Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Defaults to SOC2 when unset.
+     */
+    declare public readonly regulatoryRegimes: pulumi.Output<string[] | undefined>;
     /**
      * Allowed host patterns for secret broker.
      */
@@ -138,6 +142,7 @@ export class GovernanceSettings extends pulumi.CustomResource {
             resourceInputs["modelRouterDefaultProvider"] = state?.modelRouterDefaultProvider;
             resourceInputs["modelRouterEnabled"] = state?.modelRouterEnabled;
             resourceInputs["modelRouterFailoverProviders"] = state?.modelRouterFailoverProviders;
+            resourceInputs["regulatoryRegimes"] = state?.regulatoryRegimes;
             resourceInputs["secretBrokerAllowedHosts"] = state?.secretBrokerAllowedHosts;
             resourceInputs["secretBrokerAuthBindingsJson"] = state?.secretBrokerAuthBindingsJson;
             resourceInputs["secretBrokerEnabled"] = state?.secretBrokerEnabled;
@@ -161,6 +166,7 @@ export class GovernanceSettings extends pulumi.CustomResource {
             resourceInputs["modelRouterDefaultProvider"] = args?.modelRouterDefaultProvider;
             resourceInputs["modelRouterEnabled"] = args?.modelRouterEnabled;
             resourceInputs["modelRouterFailoverProviders"] = args?.modelRouterFailoverProviders;
+            resourceInputs["regulatoryRegimes"] = args?.regulatoryRegimes;
             resourceInputs["secretBrokerAllowedHosts"] = args?.secretBrokerAllowedHosts;
             resourceInputs["secretBrokerAuthBindingsJson"] = args?.secretBrokerAuthBindingsJson;
             resourceInputs["secretBrokerEnabled"] = args?.secretBrokerEnabled;
@@ -216,6 +222,10 @@ export interface GovernanceSettingsState {
      * Failover provider order.
      */
     modelRouterFailoverProviders?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Defaults to SOC2 when unset.
+     */
+    regulatoryRegimes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
     /**
      * Allowed host patterns for secret broker.
      */
@@ -306,6 +316,10 @@ export interface GovernanceSettingsArgs {
      * Failover provider order.
      */
     modelRouterFailoverProviders?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Defaults to SOC2 when unset.
+     */
+    regulatoryRegimes?: pulumi.Input<pulumi.Input<string>[] | undefined>;
     /**
      * Allowed host patterns for secret broker.
      */

package/governance/index.ts

@@ -35,6 +35,11 @@ export const getDay7Report: typeof import("./getDay7Report").getDay7Report = nul
 export const getDay7ReportOutput: typeof import("./getDay7Report").getDay7ReportOutput = null as any;
 utilities.lazyLoad(exports, ["getDay7Report","getDay7ReportOutput"], () => require("./getDay7Report"));
 
+export { GetEffectivePolicyBundlesArgs, GetEffectivePolicyBundlesResult, GetEffectivePolicyBundlesOutputArgs } from "./getEffectivePolicyBundles";
+export const getEffectivePolicyBundles: typeof import("./getEffectivePolicyBundles").getEffectivePolicyBundles = null as any;
+export const getEffectivePolicyBundlesOutput: typeof import("./getEffectivePolicyBundles").getEffectivePolicyBundlesOutput = null as any;
+utilities.lazyLoad(exports, ["getEffectivePolicyBundles","getEffectivePolicyBundlesOutput"], () => require("./getEffectivePolicyBundles"));
+
 export { GetEvidenceBundleArgs, GetEvidenceBundleResult, GetEvidenceBundleOutputArgs } from "./getEvidenceBundle";
 export const getEvidenceBundle: typeof import("./getEvidenceBundle").getEvidenceBundle = null as any;
 export const getEvidenceBundleOutput: typeof import("./getEvidenceBundle").getEvidenceBundleOutput = null as any;
@@ -60,11 +65,26 @@ export const getFeed: typeof import("./getFeed").getFeed = null as any;
 export const getFeedOutput: typeof import("./getFeed").getFeedOutput = null as any;
 utilities.lazyLoad(exports, ["getFeed","getFeedOutput"], () => require("./getFeed"));
 
+export { GetPackRuleVersionsArgs, GetPackRuleVersionsResult, GetPackRuleVersionsOutputArgs } from "./getPackRuleVersions";
+export const getPackRuleVersions: typeof import("./getPackRuleVersions").getPackRuleVersions = null as any;
+export const getPackRuleVersionsOutput: typeof import("./getPackRuleVersions").getPackRuleVersionsOutput = null as any;
+utilities.lazyLoad(exports, ["getPackRuleVersions","getPackRuleVersionsOutput"], () => require("./getPackRuleVersions"));
+
+export { GetPackRulesArgs, GetPackRulesResult, GetPackRulesOutputArgs } from "./getPackRules";
+export const getPackRules: typeof import("./getPackRules").getPackRules = null as any;
+export const getPackRulesOutput: typeof import("./getPackRules").getPackRulesOutput = null as any;
+utilities.lazyLoad(exports, ["getPackRules","getPackRulesOutput"], () => require("./getPackRules"));
+
 export { GetPacksResult } from "./getPacks";
 export const getPacks: typeof import("./getPacks").getPacks = null as any;
 export const getPacksOutput: typeof import("./getPacks").getPacksOutput = null as any;
 utilities.lazyLoad(exports, ["getPacks","getPacksOutput"], () => require("./getPacks"));
 
+export { GetPolicyBundlesArgs, GetPolicyBundlesResult, GetPolicyBundlesOutputArgs } from "./getPolicyBundles";
+export const getPolicyBundles: typeof import("./getPolicyBundles").getPolicyBundles = null as any;
+export const getPolicyBundlesOutput: typeof import("./getPolicyBundles").getPolicyBundlesOutput = null as any;
+utilities.lazyLoad(exports, ["getPolicyBundles","getPolicyBundlesOutput"], () => require("./getPolicyBundles"));
+
 export { GetReportsOverviewArgs, GetReportsOverviewResult, GetReportsOverviewOutputArgs } from "./getReportsOverview";
 export const getReportsOverview: typeof import("./getReportsOverview").getReportsOverview = null as any;
 export const getReportsOverviewOutput: typeof import("./getReportsOverview").getReportsOverviewOutput = null as any;
@@ -105,6 +125,11 @@ export type PamSettings = import("./pamSettings").PamSettings;
 export const PamSettings: typeof import("./pamSettings").PamSettings = null as any;
 utilities.lazyLoad(exports, ["PamSettings"], () => require("./pamSettings"));
 
+export { PolicyBundleArgs, PolicyBundleState } from "./policyBundle";
+export type PolicyBundle = import("./policyBundle").PolicyBundle;
+export const PolicyBundle: typeof import("./policyBundle").PolicyBundle = null as any;
+utilities.lazyLoad(exports, ["PolicyBundle"], () => require("./policyBundle"));
+
 export { PolicySyncArgs, PolicySyncState } from "./policySync";
 export type PolicySync = import("./policySync").PolicySync;
 export const PolicySync: typeof import("./policySync").PolicySync = null as any;
@@ -144,6 +169,8 @@ const _module = {
                 return new PackAssignmentBulk(name, <any>undefined, { urn })
             case "thoth:governance/pamSettings:PamSettings":
                 return new PamSettings(name, <any>undefined, { urn })
+            case "thoth:governance/policyBundle:PolicyBundle":
+                return new PolicyBundle(name, <any>undefined, { urn })
             case "thoth:governance/policySync:PolicySync":
                 return new PolicySync(name, <any>undefined, { urn })
             case "thoth:governance/siemSettings:SiemSettings":
@@ -164,6 +191,7 @@ pulumi.runtime.registerResourceModule("thoth", "governance/governanceSettings",
 pulumi.runtime.registerResourceModule("thoth", "governance/packAssignment", _module)
 pulumi.runtime.registerResourceModule("thoth", "governance/packAssignmentBulk", _module)
 pulumi.runtime.registerResourceModule("thoth", "governance/pamSettings", _module)
+pulumi.runtime.registerResourceModule("thoth", "governance/policyBundle", _module)
 pulumi.runtime.registerResourceModule("thoth", "governance/policySync", _module)
 pulumi.runtime.registerResourceModule("thoth", "governance/siemSettings", _module)
 pulumi.runtime.registerResourceModule("thoth", "governance/webhookSettings", _module)

package/governance/policyBundle.ts

@@ -0,0 +1,299 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export class PolicyBundle extends pulumi.CustomResource {
+    /**
+     * Get an existing PolicyBundle resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: PolicyBundleState, opts?: pulumi.CustomResourceOptions): PolicyBundle {
+        return new PolicyBundle(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'thoth:governance/policyBundle:PolicyBundle';
+
+    /**
+     * Returns true if the given object is an instance of PolicyBundle.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is PolicyBundle {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === PolicyBundle.__pulumiType;
+    }
+
+    /**
+     * Assignment targets (for example: all, agent:security-analyst-agent, coding-agent). Defaults to all.
+     */
+    declare public readonly assignments: pulumi.Output<string[] | undefined>;
+    /**
+     * Creation timestamp.
+     */
+    declare public /*out*/ readonly createdAt: pulumi.Output<string>;
+    /**
+     * Creator identity.
+     */
+    declare public /*out*/ readonly createdBy: pulumi.Output<string>;
+    /**
+     * Optional policy bundle description.
+     */
+    declare public readonly description: pulumi.Output<string | undefined>;
+    /**
+     * Customer-facing policy mode: enforce or observe. Defaults to enforce.
+     */
+    declare public readonly enforcementMode: pulumi.Output<string | undefined>;
+    /**
+     * Optional expected SHA-256 hash (hex or sha256:<hex>) to enforce policy integrity.
+     */
+    declare public readonly expectedHash: pulumi.Output<string | undefined>;
+    /**
+     * Policy framework: OPA or CEDAR.
+     */
+    declare public readonly framework: pulumi.Output<string>;
+    /**
+     * Stable bundle name. Updates create a new version for the same name.
+     */
+    declare public readonly name: pulumi.Output<string>;
+    /**
+     * SHA-256 hash of policy content.
+     */
+    declare public /*out*/ readonly policyHash: pulumi.Output<string>;
+    /**
+     * Raw Rego/Cedar policy payload. Set this or source_uri/s3_uri.
+     */
+    declare public readonly rawPolicy: pulumi.Output<string | undefined>;
+    /**
+     * Resolved immutable source version (S3 version ID or file revision hint).
+     */
+    declare public /*out*/ readonly resolvedVersion: pulumi.Output<string>;
+    /**
+     * Legacy S3 source URI (for example: s3://bucket/path/policy.rego). Set this or raw_policy. Prefer source_uri.
+     */
+    declare public readonly s3Uri: pulumi.Output<string | undefined>;
+    /**
+     * Optional S3 object version ID to pin deterministic policy enforcement.
+     */
+    declare public readonly s3VersionId: pulumi.Output<string | undefined>;
+    /**
+     * Unified policy source URI (file:// or s3://). Set this or raw_policy.
+     */
+    declare public readonly sourceUri: pulumi.Output<string | undefined>;
+    /**
+     * Bundle lifecycle status: active, staged, paused, or disabled (alias of paused).
+     */
+    declare public readonly status: pulumi.Output<string | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    declare public /*out*/ readonly tenantId: pulumi.Output<string>;
+    /**
+     * Last update timestamp.
+     */
+    declare public /*out*/ readonly updatedAt: pulumi.Output<string>;
+    /**
+     * Monotonic policy bundle version.
+     */
+    declare public /*out*/ readonly version: pulumi.Output<number>;
+
+    /**
+     * Create a PolicyBundle resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: PolicyBundleArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: PolicyBundleArgs | PolicyBundleState, opts?: pulumi.CustomResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as PolicyBundleState | undefined;
+            resourceInputs["assignments"] = state?.assignments;
+            resourceInputs["createdAt"] = state?.createdAt;
+            resourceInputs["createdBy"] = state?.createdBy;
+            resourceInputs["description"] = state?.description;
+            resourceInputs["enforcementMode"] = state?.enforcementMode;
+            resourceInputs["expectedHash"] = state?.expectedHash;
+            resourceInputs["framework"] = state?.framework;
+            resourceInputs["name"] = state?.name;
+            resourceInputs["policyHash"] = state?.policyHash;
+            resourceInputs["rawPolicy"] = state?.rawPolicy;
+            resourceInputs["resolvedVersion"] = state?.resolvedVersion;
+            resourceInputs["s3Uri"] = state?.s3Uri;
+            resourceInputs["s3VersionId"] = state?.s3VersionId;
+            resourceInputs["sourceUri"] = state?.sourceUri;
+            resourceInputs["status"] = state?.status;
+            resourceInputs["tenantId"] = state?.tenantId;
+            resourceInputs["updatedAt"] = state?.updatedAt;
+            resourceInputs["version"] = state?.version;
+        } else {
+            const args = argsOrState as PolicyBundleArgs | undefined;
+            if (args?.framework === undefined && !opts.urn) {
+                throw new Error("Missing required property 'framework'");
+            }
+            if (args?.name === undefined && !opts.urn) {
+                throw new Error("Missing required property 'name'");
+            }
+            resourceInputs["assignments"] = args?.assignments;
+            resourceInputs["description"] = args?.description;
+            resourceInputs["enforcementMode"] = args?.enforcementMode;
+            resourceInputs["expectedHash"] = args?.expectedHash;
+            resourceInputs["framework"] = args?.framework;
+            resourceInputs["name"] = args?.name;
+            resourceInputs["rawPolicy"] = args?.rawPolicy ? pulumi.secret(args.rawPolicy) : undefined;
+            resourceInputs["s3Uri"] = args?.s3Uri;
+            resourceInputs["s3VersionId"] = args?.s3VersionId;
+            resourceInputs["sourceUri"] = args?.sourceUri;
+            resourceInputs["status"] = args?.status;
+            resourceInputs["createdAt"] = undefined /*out*/;
+            resourceInputs["createdBy"] = undefined /*out*/;
+            resourceInputs["policyHash"] = undefined /*out*/;
+            resourceInputs["resolvedVersion"] = undefined /*out*/;
+            resourceInputs["tenantId"] = undefined /*out*/;
+            resourceInputs["updatedAt"] = undefined /*out*/;
+            resourceInputs["version"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        const secretOpts = { additionalSecretOutputs: ["rawPolicy"] };
+        opts = pulumi.mergeOptions(opts, secretOpts);
+        super(PolicyBundle.__pulumiType, name, resourceInputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering PolicyBundle resources.
+ */
+export interface PolicyBundleState {
+    /**
+     * Assignment targets (for example: all, agent:security-analyst-agent, coding-agent). Defaults to all.
+     */
+    assignments?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Creation timestamp.
+     */
+    createdAt?: pulumi.Input<string | undefined>;
+    /**
+     * Creator identity.
+     */
+    createdBy?: pulumi.Input<string | undefined>;
+    /**
+     * Optional policy bundle description.
+     */
+    description?: pulumi.Input<string | undefined>;
+    /**
+     * Customer-facing policy mode: enforce or observe. Defaults to enforce.
+     */
+    enforcementMode?: pulumi.Input<string | undefined>;
+    /**
+     * Optional expected SHA-256 hash (hex or sha256:<hex>) to enforce policy integrity.
+     */
+    expectedHash?: pulumi.Input<string | undefined>;
+    /**
+     * Policy framework: OPA or CEDAR.
+     */
+    framework?: pulumi.Input<string | undefined>;
+    /**
+     * Stable bundle name. Updates create a new version for the same name.
+     */
+    name?: pulumi.Input<string | undefined>;
+    /**
+     * SHA-256 hash of policy content.
+     */
+    policyHash?: pulumi.Input<string | undefined>;
+    /**
+     * Raw Rego/Cedar policy payload. Set this or source_uri/s3_uri.
+     */
+    rawPolicy?: pulumi.Input<string | undefined>;
+    /**
+     * Resolved immutable source version (S3 version ID or file revision hint).
+     */
+    resolvedVersion?: pulumi.Input<string | undefined>;
+    /**
+     * Legacy S3 source URI (for example: s3://bucket/path/policy.rego). Set this or raw_policy. Prefer source_uri.
+     */
+    s3Uri?: pulumi.Input<string | undefined>;
+    /**
+     * Optional S3 object version ID to pin deterministic policy enforcement.
+     */
+    s3VersionId?: pulumi.Input<string | undefined>;
+    /**
+     * Unified policy source URI (file:// or s3://). Set this or raw_policy.
+     */
+    sourceUri?: pulumi.Input<string | undefined>;
+    /**
+     * Bundle lifecycle status: active, staged, paused, or disabled (alias of paused).
+     */
+    status?: pulumi.Input<string | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    tenantId?: pulumi.Input<string | undefined>;
+    /**
+     * Last update timestamp.
+     */
+    updatedAt?: pulumi.Input<string | undefined>;
+    /**
+     * Monotonic policy bundle version.
+     */
+    version?: pulumi.Input<number | undefined>;
+}
+
+/**
+ * The set of arguments for constructing a PolicyBundle resource.
+ */
+export interface PolicyBundleArgs {
+    /**
+     * Assignment targets (for example: all, agent:security-analyst-agent, coding-agent). Defaults to all.
+     */
+    assignments?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Optional policy bundle description.
+     */
+    description?: pulumi.Input<string | undefined>;
+    /**
+     * Customer-facing policy mode: enforce or observe. Defaults to enforce.
+     */
+    enforcementMode?: pulumi.Input<string | undefined>;
+    /**
+     * Optional expected SHA-256 hash (hex or sha256:<hex>) to enforce policy integrity.
+     */
+    expectedHash?: pulumi.Input<string | undefined>;
+    /**
+     * Policy framework: OPA or CEDAR.
+     */
+    framework: pulumi.Input<string>;
+    /**
+     * Stable bundle name. Updates create a new version for the same name.
+     */
+    name: pulumi.Input<string>;
+    /**
+     * Raw Rego/Cedar policy payload. Set this or source_uri/s3_uri.
+     */
+    rawPolicy?: pulumi.Input<string | undefined>;
+    /**
+     * Legacy S3 source URI (for example: s3://bucket/path/policy.rego). Set this or raw_policy. Prefer source_uri.
+     */
+    s3Uri?: pulumi.Input<string | undefined>;
+    /**
+     * Optional S3 object version ID to pin deterministic policy enforcement.
+     */
+    s3VersionId?: pulumi.Input<string | undefined>;
+    /**
+     * Unified policy source URI (file:// or s3://). Set this or raw_policy.
+     */
+    sourceUri?: pulumi.Input<string | undefined>;
+    /**
+     * Bundle lifecycle status: active, staged, paused, or disabled (alias of paused).
+     */
+    status?: pulumi.Input<string | undefined>;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atensec/pulumi-thoth",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Pulumi provider for Aten Security Thoth AI governance control plane.",
   "keywords": [
     "pulumi",

package/tsconfig.json

@@ -56,12 +56,16 @@
         "governance/getApprovals.ts",
         "governance/getCostReport.ts",
         "governance/getDay7Report.ts",
+        "governance/getEffectivePolicyBundles.ts",
         "governance/getEvidenceBundle.ts",
         "governance/getEvidenceChain.ts",
         "governance/getEvidenceSlos.ts",
         "governance/getEvidenceVerify.ts",
         "governance/getFeed.ts",
+        "governance/getPackRuleVersions.ts",
+        "governance/getPackRules.ts",
         "governance/getPacks.ts",
+        "governance/getPolicyBundles.ts",
         "governance/getReportsOverview.ts",
         "governance/getRuntimeStatus.ts",
         "governance/getTenantSettings.ts",
@@ -71,6 +75,7 @@
         "governance/packAssignment.ts",
         "governance/packAssignmentBulk.ts",
         "governance/pamSettings.ts",
+        "governance/policyBundle.ts",
         "governance/policySync.ts",
         "governance/siemSettings.ts",
         "governance/webhookSettings.ts",