@atlasauth/pca-policy-bridge 0.1.0 → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Atlas Authorization
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,55 @@
+# @atlasauth/pca-policy-bridge
+
+Import existing authorization policy into Proof-Carrying Authority (PCA). Each translator compiles a policy source into PCA predicates (the shapes `@atlasauth/pca` evaluates, droppable into an envelope's `predicates`) plus a report of what was and was not translated. Anything unmodeled fails closed: it never widens an allow.
+
+Supported sources:
+
+- **Cedar**: `permit` and `forbid` policies (`cedarToPca`)
+- **OPA / Rego**: a subset covering `allow` rules written as conjunctions of `input` comparisons (`regoToPca`)
+- **OpenFGA / Zanzibar**: ReBAC model plus relationship tuples (`openfgaToPca`)
+
+## Install
+
+```sh
+npm i @atlasauth/pca-policy-bridge
+```
+
+## Usage
+
+```ts
+import { cedarToPca, decide } from '@atlasauth/pca-policy-bridge';
+
+const result = cedarToPca(`
+  permit (principal == User::"alice", action == Action::"view", resource == Photo::"p1");
+  forbid (principal, action == Action::"delete", resource);
+`);
+
+result.report.errors;   // non-empty => incomplete translation, treat as deny
+result.report.skipped;  // constructs that were not modeled (each fails closed)
+result.predicates;      // permits: plug into Envelope.predicates
+result.denies;          // forbids: applied with deny-overrides-permit via decide()
+
+// Evaluate one action under the translation (deny overrides permit).
+decide(result, {
+  subject: { id: 'User::alice' },
+  action: { verb: 'view', resource: 'Photo::p1' },
+});
+```
+
+`regoToPca(moduleText)` and `openfgaToPca(model, tuples)` return the same `BridgeResult` shape. For Cedar group membership (`principal in Group::"g"`), supply the entity parent map to the evaluator at `env.entity_parents`.
+
+## Boundaries
+
+Each translator documents the subset it models. Not modeled (reported in `report.skipped` / `report.errors`, and failing closed): Cedar arithmetic, set operations and extension functions; Rego iteration, comprehensions, `:=` assignment and general builtins (the whole containing rule is dropped); OpenFGA userset-valued tuples such as `group:eng#member`.
+
+## API
+
+`cedarToPca`, `regoToPca`, `openfgaToPca`, `decide`, and types `BridgeResult`, `TranslationReport`, `PolicySource`.
+
+## Status
+
+Part of [Proof-Carrying Authority](https://github.com/Atlas-Authorization/pca). Policy translation is a static compile step; review the report before granting on its output. PCA's cryptography has not been independently audited.
+
+## License
+
+MIT - see LICENSE

package/package.json

@@ -1,7 +1,29 @@
 {
   "name": "@atlasauth/pca-policy-bridge",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Import external authz policy into PCA: compile Cedar and OPA/Rego policies and OpenFGA/Zanzibar ReBAC models+tuples into PCA predicates/caveats, so existing enterprise policy engines drive proof-carrying authority.",
+  "keywords": [
+    "cedar",
+    "opa",
+    "rego",
+    "openfga",
+    "zanzibar",
+    "policy import",
+    "agent authorization",
+    "proof-carrying authority",
+    "pca",
+    "ai agents"
+  ],
+  "license": "MIT",
+  "homepage": "https://github.com/Atlas-Authorization/pca#readme",
+  "bugs": {
+    "url": "https://github.com/Atlas-Authorization/pca/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Atlas-Authorization/pca.git",
+    "directory": "packages/pca-policy-bridge"
+  },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -12,7 +34,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@atlasauth/pca": "0.1.0"
+    "@atlasauth/pca": "0.2.0"
   },
   "devDependencies": {
     "typescript": "^5.6.3",
@@ -20,8 +42,12 @@
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
+  "engines": {
+    "node": ">=20"
+  },
   "publishConfig": {
     "access": "public"
   },