@axtary/policy 0.0.1

package/dist/index.js

@@ -0,0 +1,1218 @@
+import { DEFAULT_EXPIRES_IN_SECONDS, NormalizedActionSchema, } from "@axtary/actionpass";
+import { z } from "zod";
+export const POLICY_SCHEMA_VERSION = "axtary.policy.v0";
+const DEFAULT_GITHUB_PULL_REQUEST_POLICY = {
+    enabled: true,
+    requiredBaseBranch: "main",
+    maxFilesChanged: 12,
+    denyPathPrefixes: [".env", "secrets/"],
+    stepUpPathPrefixes: ["infra/prod/", "billing/", "auth/"],
+    requiresTests: true,
+};
+const DEFAULT_GITHUB_CONTENTS_POLICY = {
+    enabled: true,
+    denyReadPathPrefixes: [".env", "secrets/", "infra/prod/"],
+};
+const DEFAULT_SLACK_MESSAGES_POLICY = {
+    enabled: true,
+    allowedChannels: ["#axtary-dev"],
+    stepUpExternalRecipients: true,
+};
+const DEFAULT_ISSUE_TRACKER_POLICY = {
+    enabled: true,
+    allowedProjectKeys: ["AXT"],
+    stepUpStatuses: ["Done", "Closed"],
+};
+const DEFAULT_AWS_READ_POLICY = {
+    enabled: true,
+    allowedAccountIds: [],
+    allowedRegions: ["us-east-1"],
+    allowedS3Buckets: [],
+    denyObjectKeyPrefixes: ["secrets/", ".env"],
+};
+const DEFAULT_GCP_READ_POLICY = {
+    enabled: true,
+    allowedProjectIds: [],
+    allowedStorageBuckets: [],
+    denyObjectNamePrefixes: ["secrets/", ".env"],
+};
+const DEFAULT_MCP_POLICY = {
+    enabled: true,
+    allowedTools: [],
+};
+const DEFAULT_DOCS_POLICY = {
+    enabled: true,
+    allowedWorkspaces: ["local"],
+    allowedPathPrefixes: ["README.md", "docs/", "product/"],
+    denyPathPrefixes: [".env", "secrets/", "private/"],
+    maxSearchResults: 10,
+    maxReadBytes: 20_000,
+};
+export const PolicyConfigSchema = z.object({
+    version: z.string().min(1).default("2026-05-30"),
+    github: z
+        .object({
+        pullRequests: z
+            .object({
+            enabled: z.boolean().default(true),
+            requiredBaseBranch: z.string().min(1).default("main"),
+            maxFilesChanged: z.number().int().nonnegative().default(12),
+            denyPathPrefixes: z.array(z.string().min(1)).default([".env", "secrets/"]),
+            stepUpPathPrefixes: z
+                .array(z.string().min(1))
+                .default(DEFAULT_GITHUB_PULL_REQUEST_POLICY.stepUpPathPrefixes),
+            requiresTests: z.boolean().default(true),
+        })
+            .default(DEFAULT_GITHUB_PULL_REQUEST_POLICY),
+        contents: z
+            .object({
+            enabled: z.boolean().default(true),
+            denyReadPathPrefixes: z
+                .array(z.string().min(1))
+                .default(DEFAULT_GITHUB_CONTENTS_POLICY.denyReadPathPrefixes),
+        })
+            .default(DEFAULT_GITHUB_CONTENTS_POLICY),
+    })
+        .default({
+        pullRequests: DEFAULT_GITHUB_PULL_REQUEST_POLICY,
+        contents: DEFAULT_GITHUB_CONTENTS_POLICY,
+    }),
+    slack: z
+        .object({
+        messages: z
+            .object({
+            enabled: z.boolean().default(true),
+            allowedChannels: z.array(z.string().min(1)).default(["#axtary-dev"]),
+            stepUpExternalRecipients: z.boolean().default(true),
+        })
+            .default(DEFAULT_SLACK_MESSAGES_POLICY),
+    })
+        .default({
+        messages: DEFAULT_SLACK_MESSAGES_POLICY,
+    }),
+    issueTrackers: z
+        .object({
+        linear: z
+            .object({
+            enabled: z.boolean().default(true),
+            allowedProjectKeys: z
+                .array(z.string().min(1))
+                .default(DEFAULT_ISSUE_TRACKER_POLICY.allowedProjectKeys),
+            stepUpStatuses: z
+                .array(z.string().min(1))
+                .default(DEFAULT_ISSUE_TRACKER_POLICY.stepUpStatuses),
+        })
+            .default(DEFAULT_ISSUE_TRACKER_POLICY),
+        jira: z
+            .object({
+            enabled: z.boolean().default(true),
+            allowedProjectKeys: z
+                .array(z.string().min(1))
+                .default(DEFAULT_ISSUE_TRACKER_POLICY.allowedProjectKeys),
+            stepUpStatuses: z
+                .array(z.string().min(1))
+                .default(DEFAULT_ISSUE_TRACKER_POLICY.stepUpStatuses),
+        })
+            .default(DEFAULT_ISSUE_TRACKER_POLICY),
+    })
+        .default({
+        linear: DEFAULT_ISSUE_TRACKER_POLICY,
+        jira: DEFAULT_ISSUE_TRACKER_POLICY,
+    }),
+    cloud: z
+        .object({
+        aws: z
+            .object({
+            enabled: z.boolean().default(true),
+            allowedAccountIds: z.array(z.string().min(1)).default([]),
+            allowedRegions: z.array(z.string().min(1)).default(["us-east-1"]),
+            allowedS3Buckets: z.array(z.string().min(1)).default([]),
+            denyObjectKeyPrefixes: z.array(z.string().min(1)).default(["secrets/", ".env"]),
+        })
+            .default(DEFAULT_AWS_READ_POLICY),
+        gcp: z
+            .object({
+            enabled: z.boolean().default(true),
+            allowedProjectIds: z.array(z.string().min(1)).default([]),
+            allowedStorageBuckets: z.array(z.string().min(1)).default([]),
+            denyObjectNamePrefixes: z
+                .array(z.string().min(1))
+                .default(["secrets/", ".env"]),
+        })
+            .default(DEFAULT_GCP_READ_POLICY),
+    })
+        .default({
+        aws: DEFAULT_AWS_READ_POLICY,
+        gcp: DEFAULT_GCP_READ_POLICY,
+    }),
+    mcp: z
+        .object({
+        enabled: z.boolean().default(true),
+        allowedTools: z
+            .array(z.object({
+            serverIdentity: z.string().min(1),
+            toolName: z.string().min(1),
+            definitionHash: z
+                .string()
+                .regex(/^sha256:[a-f0-9]{64}$/),
+        }))
+            .default([]),
+    })
+        .default(DEFAULT_MCP_POLICY),
+    docs: z
+        .object({
+        documents: z
+            .object({
+            enabled: z.boolean().default(true),
+            allowedWorkspaces: z
+                .array(z.string().min(1))
+                .default(DEFAULT_DOCS_POLICY.allowedWorkspaces),
+            allowedPathPrefixes: z
+                .array(z.string().min(1))
+                .default(DEFAULT_DOCS_POLICY.allowedPathPrefixes),
+            denyPathPrefixes: z
+                .array(z.string().min(1))
+                .default(DEFAULT_DOCS_POLICY.denyPathPrefixes),
+            maxSearchResults: z.number().int().positive().default(10),
+            maxReadBytes: z.number().int().positive().default(20_000),
+        })
+            .default(DEFAULT_DOCS_POLICY),
+    })
+        .default({
+        documents: DEFAULT_DOCS_POLICY,
+    }),
+});
+export const PolicyFixtureInputSchema = z.object({
+    id: z.string().min(1).optional(),
+    name: z.string().min(1).optional(),
+    expectedDecision: z.enum(["allow", "deny", "step_up"]),
+    expectedReasons: z.array(z.string().min(1)).optional(),
+    action: NormalizedActionSchema,
+    sourcePath: z.string().min(1).optional(),
+});
+export const DEFAULT_POLICY_CONFIG = PolicyConfigSchema.parse({});
+export const DEFAULT_POLICY_FIXTURE_SOURCE = {
+    kind: "package_defaults",
+    label: "package defaults from @axtary/policy",
+    path: null,
+};
+export const POLICY_TEMPLATES = [
+    {
+        id: "coding-agent-repo-guardrails",
+        name: "Coding agent repo guardrails",
+        category: "coding_agent",
+        summary: "Allow routine PR work while denying secret reads and stepping up auth, billing, and production paths.",
+        tools: [
+            "github.pull_requests.create",
+            "github.branches.create",
+            "github.contents.read",
+            "github.contents.write",
+        ],
+        decisionModel: "step_up",
+        config: {
+            github: {
+                pullRequests: {
+                    requiredBaseBranch: "main",
+                    maxFilesChanged: 12,
+                    denyPathPrefixes: [".env", "secrets/"],
+                    stepUpPathPrefixes: ["infra/prod/", "billing/", "auth/"],
+                    requiresTests: true,
+                },
+                contents: {
+                    denyReadPathPrefixes: [".env", "secrets/", "infra/prod/"],
+                },
+            },
+        },
+        evidence: ["filesChanged", "baseBranch", "testsPassed", "payloadHash"],
+        notes: [
+            "Matches the current coding-agent wedge.",
+            "Protected path changes require exact approval evidence before execution.",
+        ],
+    },
+    {
+        id: "staging-cloud-read-only",
+        name: "Staging cloud read-only",
+        category: "cloud_read",
+        summary: "Permit bounded AWS/GCP inventory and object listing only after account, project, region, and bucket scopes are pinned.",
+        tools: [
+            "aws.identity.get",
+            "aws.s3.objects.list",
+            "gcp.projects.get",
+            "gcp.storage.objects.list",
+        ],
+        decisionModel: "deny_until_scoped",
+        config: {
+            cloud: {
+                aws: {
+                    enabled: true,
+                    allowedAccountIds: [],
+                    allowedRegions: ["us-east-1"],
+                    allowedS3Buckets: [],
+                    denyObjectKeyPrefixes: ["secrets/", ".env"],
+                },
+                gcp: {
+                    enabled: true,
+                    allowedProjectIds: [],
+                    allowedStorageBuckets: [],
+                    denyObjectNamePrefixes: ["secrets/", ".env"],
+                },
+            },
+        },
+        evidence: ["accountId", "region", "projectId", "bucket", "prefix"],
+        notes: [
+            "Empty allowlists intentionally fail closed until customer scopes are configured.",
+            "Smoke checks stay read/auth-only.",
+        ],
+    },
+    {
+        id: "production-impact-step-up",
+        name: "Production impact step-up",
+        category: "production_change",
+        summary: "Route production-impact declarations and protected infrastructure paths through approval.",
+        tools: ["github.pull_requests.create", "github.contents.write"],
+        decisionModel: "step_up",
+        config: {
+            github: {
+                pullRequests: {
+                    stepUpPathPrefixes: ["infra/prod/", "deploy/", "auth/", "billing/"],
+                    requiresTests: true,
+                },
+            },
+        },
+        evidence: ["touchesProduction", "filesChanged", "diff", "payloadHash"],
+        notes: [
+            "The native evaluator already steps up PR payloads with touchesProduction=true.",
+            "Future cloud write tools should attach the same production-impact evidence before execution.",
+        ],
+    },
+    {
+        id: "iam-mutation-deny",
+        name: "IAM mutation deny",
+        category: "identity_mutation",
+        summary: "Keep identity and credential mutations denied until a scoped connector and reviewer workflow exist.",
+        tools: [
+            "aws.iam.roles.update",
+            "aws.iam.policies.attach",
+            "gcp.iam.bindings.set",
+            "gcp.serviceAccounts.keys.create",
+        ],
+        decisionModel: "deny",
+        config: {},
+        evidence: ["resource", "role", "principal", "payloadHash"],
+        notes: [
+            "These tools are not registered executable handlers yet; unsupported tools fail closed.",
+            "When added, they should require reviewer permissions and short-lived/federated credentials.",
+        ],
+    },
+    {
+        id: "external-slack-step-up",
+        name: "External Slack step-up",
+        category: "external_communication",
+        summary: "Allow approved internal channels and require approval when a message reaches external recipients.",
+        tools: ["slack.chat.postMessage"],
+        decisionModel: "step_up",
+        config: {
+            slack: {
+                messages: {
+                    allowedChannels: ["#axtary-dev"],
+                    stepUpExternalRecipients: true,
+                },
+            },
+        },
+        evidence: ["channel", "message", "externalRecipients", "payloadHash"],
+        notes: [
+            "Exact message payload is approval evidence.",
+            "Unapproved channels are denied rather than stepped up.",
+        ],
+    },
+    {
+        id: "local-docs-read-scoped",
+        name: "Local docs read scoped",
+        category: "docs_read",
+        summary: "Permit local docs search and read actions only inside configured workspaces, paths, result caps, and byte limits.",
+        tools: ["docs.documents.search", "docs.documents.read"],
+        decisionModel: "deny_until_scoped",
+        config: {
+            docs: {
+                documents: {
+                    enabled: true,
+                    allowedWorkspaces: ["local"],
+                    allowedPathPrefixes: ["README.md", "docs/", "product/"],
+                    denyPathPrefixes: [".env", "secrets/", "private/"],
+                    maxSearchResults: 10,
+                    maxReadBytes: 20_000,
+                },
+            },
+        },
+        evidence: ["workspace", "path", "query", "maxResults", "maxBytes"],
+        notes: [
+            "Local document roots are configured adapter-side, while policy controls normalized action scope.",
+            "Returned content should be bounded and redacted by the connector before the agent sees it.",
+        ],
+    },
+];
+export const DEFAULT_POLICY_REVIEW_FIXTURES = [
+    PolicyFixtureInputSchema.parse({
+        id: "allow-github-pr",
+        name: "allow GitHub PR inside configured branch, paths, and test policy",
+        expectedDecision: "allow",
+        expectedReasons: ["github_pr_inside_policy"],
+        action: {
+            schemaVersion: "axtary.action.v0",
+            actor: {
+                agentId: "agent:codex-prod",
+                humanOwner: "user:asrar@company.com",
+                runtime: "codex-cli",
+                tenant: "org:company",
+            },
+            intent: {
+                taskId: "AXT-418",
+                declaredGoal: "Open a PR that fixes the auth redirect bug",
+            },
+            capability: {
+                tool: "github.pull_requests.create",
+                resource: "repo:company/web-app",
+                payload: {
+                    baseBranch: "main",
+                    filesChanged: ["src/app/login/page.tsx", "src/lib/auth/session.ts"],
+                    testsPassed: true,
+                    touchesProduction: false,
+                },
+            },
+        },
+    }),
+    PolicyFixtureInputSchema.parse({
+        id: "deny-secret-read",
+        name: "deny GitHub content read of secret path",
+        expectedDecision: "deny",
+        expectedReasons: ["content_read_denied_path"],
+        action: {
+            schemaVersion: "axtary.action.v0",
+            actor: {
+                agentId: "agent:codex-prod",
+                humanOwner: "user:asrar@company.com",
+                runtime: "codex-cli",
+                tenant: "org:company",
+            },
+            intent: {
+                taskId: "AXT-418",
+                declaredGoal: "Read files required for the auth redirect bug",
+            },
+            capability: {
+                tool: "github.contents.read",
+                resource: "repo:company/web-app",
+                payload: {
+                    path: ".env.production",
+                },
+            },
+        },
+    }),
+    PolicyFixtureInputSchema.parse({
+        id: "step-up-linear-done",
+        name: "step up Linear issue completion",
+        expectedDecision: "step_up",
+        expectedReasons: ["linear_status_requires_step_up"],
+        action: {
+            schemaVersion: "axtary.action.v0",
+            actor: {
+                agentId: "agent:codex-prod",
+                humanOwner: "user:asrar@company.com",
+                runtime: "codex-cli",
+                tenant: "org:company",
+            },
+            intent: {
+                taskId: "AXT-418",
+                declaredGoal: "Mark the source Linear issue as done after the PR",
+            },
+            capability: {
+                tool: "linear.issues.update",
+                resource: "linear:workspace/company",
+                payload: {
+                    issueKey: "AXT-418",
+                    projectKey: "AXT",
+                    status: "Done",
+                },
+            },
+        },
+    }),
+];
+export function getPolicyTemplates() {
+    return POLICY_TEMPLATES;
+}
+export function getPolicyTemplate(id) {
+    return POLICY_TEMPLATES.find((template) => template.id === id) ?? null;
+}
+export function mergePolicyConfig(baseInput = {}, patchInput = {}) {
+    const base = PolicyConfigSchema.parse(baseInput);
+    const patch = deepMerge(base, patchInput);
+    return PolicyConfigSchema.parse(patch);
+}
+export function applyPolicyTemplate(baseInput, templateId) {
+    const template = getPolicyTemplate(templateId);
+    if (!template) {
+        throw new Error(`policy_template_not_found:${templateId}`);
+    }
+    return mergePolicyConfig(baseInput, template.config);
+}
+export function explainPolicyDecision(decisionInput) {
+    const reviewerAction = decisionInput.decision === "allow"
+        ? "none"
+        : decisionInput.decision === "step_up"
+            ? "approval_required"
+            : "block";
+    const label = decisionInput.decision === "allow"
+        ? "Allowed"
+        : decisionInput.decision === "step_up"
+            ? "Step-up required"
+            : "Denied";
+    return {
+        label,
+        reviewerAction,
+        summary: decisionSummary(decisionInput),
+        reasonDetails: decisionInput.reasons.map((reason) => ({
+            reason,
+            detail: reasonDetail(reason),
+        })),
+    };
+}
+export function runPolicyFixtures(configInput = {}, fixtureInputs = DEFAULT_POLICY_REVIEW_FIXTURES) {
+    const config = PolicyConfigSchema.parse(configInput);
+    return fixtureInputs.map((fixtureInput, index) => {
+        const fixture = PolicyFixtureInputSchema.parse(fixtureInput);
+        const action = NormalizedActionSchema.parse(fixture.action);
+        const decisionResult = evaluatePolicy(action, config);
+        const expectedReasons = fixture.expectedReasons ?? null;
+        const reasonsPassed = !expectedReasons || arraysEqual(expectedReasons, decisionResult.reasons);
+        return {
+            id: fixture.id ?? `fixture-${index + 1}`,
+            name: fixture.name ?? `Policy fixture ${index + 1}`,
+            tool: action.capability.tool,
+            resource: action.capability.resource,
+            expectedDecision: fixture.expectedDecision,
+            actualDecision: decisionResult.decision,
+            expectedReasons,
+            actualReasons: decisionResult.reasons,
+            sourcePath: fixture.sourcePath ?? null,
+            passed: decisionResult.decision === fixture.expectedDecision && reasonsPassed,
+            decision: decisionResult,
+            explanation: explainPolicyDecision(decisionResult),
+            cedar: toCedarRequest(action),
+            opa: toOpaInput(action),
+        };
+    });
+}
+export function buildPolicyReview(configInput = {}, fixtureInputs = DEFAULT_POLICY_REVIEW_FIXTURES, source = DEFAULT_POLICY_FIXTURE_SOURCE) {
+    const config = PolicyConfigSchema.parse(configInput);
+    const fixtures = runPolicyFixtures(config, fixtureInputs);
+    return {
+        schemaVersion: POLICY_SCHEMA_VERSION,
+        policyVersion: config.version,
+        nativeRule: "axtary_policy_v0",
+        source,
+        summary: {
+            totalFixtures: fixtures.length,
+            passedFixtures: fixtures.filter((fixture) => fixture.passed).length,
+            failedFixtures: fixtures.filter((fixture) => !fixture.passed).length,
+            allow: fixtures.filter((fixture) => fixture.actualDecision === "allow").length,
+            deny: fixtures.filter((fixture) => fixture.actualDecision === "deny").length,
+            stepUp: fixtures.filter((fixture) => fixture.actualDecision === "step_up").length,
+        },
+        fixtures,
+    };
+}
+export function previewPolicyTemplates(configInput = {}, templates = getPolicyTemplates(), fixtureInputs = DEFAULT_POLICY_REVIEW_FIXTURES) {
+    const config = PolicyConfigSchema.parse(configInput);
+    const beforeFixtures = runPolicyFixtures(config, fixtureInputs);
+    return templates.map((template) => {
+        const resultingConfig = mergePolicyConfig(config, template.config);
+        const afterFixtures = runPolicyFixtures(resultingConfig, fixtureInputs);
+        const fixtureOutcomeChanges = afterFixtures.flatMap((afterFixture) => {
+            const beforeFixture = beforeFixtures.find((fixture) => fixture.id === afterFixture.id);
+            if (!beforeFixture || !fixtureOutcomeChanged(beforeFixture, afterFixture)) {
+                return [];
+            }
+            return [
+                {
+                    fixtureId: afterFixture.id,
+                    name: afterFixture.name,
+                    tool: afterFixture.tool,
+                    beforeDecision: beforeFixture.actualDecision,
+                    afterDecision: afterFixture.actualDecision,
+                    beforePassed: beforeFixture.passed,
+                    afterPassed: afterFixture.passed,
+                    beforeReasons: beforeFixture.actualReasons,
+                    afterReasons: afterFixture.actualReasons,
+                },
+            ];
+        });
+        return {
+            templateId: template.id,
+            name: template.name,
+            category: template.category,
+            decisionModel: template.decisionModel,
+            changedSections: collectPatchPaths(template.config),
+            evidence: template.evidence,
+            fixtureOutcomeSummary: {
+                totalFixtures: beforeFixtures.length,
+                changedFixtures: fixtureOutcomeChanges.length,
+                newlyFailingFixtures: fixtureOutcomeChanges.filter((change) => change.beforePassed && !change.afterPassed).length,
+                newlyPassingFixtures: fixtureOutcomeChanges.filter((change) => !change.beforePassed && change.afterPassed).length,
+            },
+            fixtureOutcomeChanges,
+            resultingConfig,
+        };
+    });
+}
+export function evaluatePolicy(actionInput, configInput = {}) {
+    const action = NormalizedActionSchema.parse(actionInput);
+    const config = PolicyConfigSchema.parse(configInput);
+    switch (action.capability.tool) {
+        case "github.pull_requests.create":
+            return evaluateGitHubPullRequest(action, config);
+        case "github.contents.read":
+            return evaluateGitHubContentRead(action, config);
+        case "github.contents.write":
+            return evaluateGitHubContentWrite(action, config);
+        case "github.branches.create":
+            return evaluateGitHubBranchCreate(action, config);
+        case "slack.chat.postMessage":
+            return evaluateSlackMessage(action, config);
+        case "linear.issues.read":
+        case "linear.comments.create":
+        case "linear.issues.update":
+            return evaluateIssueTrackerAction(action, config, "linear");
+        case "jira.issues.read":
+        case "jira.comments.create":
+        case "jira.issues.update":
+            return evaluateIssueTrackerAction(action, config, "jira");
+        case "aws.identity.get":
+        case "aws.s3.objects.list":
+            return evaluateAwsRead(action, config);
+        case "gcp.projects.get":
+        case "gcp.storage.objects.list":
+            return evaluateGcpRead(action, config);
+        case "docs.documents.search":
+        case "docs.documents.read":
+            return evaluateDocsDocument(action, config);
+        case "mcp.tool.call":
+            return evaluateMcpToolCall(action, config);
+        default:
+            return decision("deny", [`unsupported_tool:${action.capability.tool}`], config, {
+                maxFilesChanged: 0,
+                blockedPaths: [],
+            });
+    }
+}
+function evaluateGitHubContentWrite(action, config) {
+    const policy = config.github.pullRequests;
+    const path = getString(action.capability.payload.path);
+    const branch = getString(action.capability.payload.branch);
+    if (!path) {
+        return decision("deny", ["github_content_write_missing_path"], config, {
+            maxFilesChanged: policy.maxFilesChanged,
+            blockedPaths: policy.denyPathPrefixes,
+        });
+    }
+    if (!branch) {
+        return decision("deny", ["github_content_write_missing_branch"], config, {
+            maxFilesChanged: policy.maxFilesChanged,
+            blockedPaths: policy.denyPathPrefixes,
+        });
+    }
+    if (pathsMatch([path], policy.denyPathPrefixes)) {
+        return decision("deny", ["payload_touches_denied_path"], config, {
+            maxFilesChanged: policy.maxFilesChanged,
+            blockedPaths: policy.denyPathPrefixes,
+        });
+    }
+    if (pathsMatch([path], policy.stepUpPathPrefixes)) {
+        return decision("step_up", ["payload_touches_step_up_path"], config, {
+            maxFilesChanged: policy.maxFilesChanged,
+            blockedPaths: [...policy.denyPathPrefixes, ...policy.stepUpPathPrefixes],
+        });
+    }
+    return decision("allow", ["github_content_write_inside_policy"], config, {
+        maxFilesChanged: policy.maxFilesChanged,
+        blockedPaths: [...policy.denyPathPrefixes, ...policy.stepUpPathPrefixes],
+    });
+}
+function evaluateGitHubBranchCreate(action, config) {
+    const policy = config.github.pullRequests;
+    const branch = getString(action.capability.payload.branch);
+    const baseBranch = getString(action.capability.payload.baseBranch);
+    if (!branch) {
+        return decision("deny", ["github_branch_missing_name"], config, {
+            maxFilesChanged: policy.maxFilesChanged,
+            blockedPaths: [],
+        });
+    }
+    if (baseBranch && baseBranch !== policy.requiredBaseBranch) {
+        return decision("step_up", [`base_branch_mismatch:${policy.requiredBaseBranch}`], config, {
+            maxFilesChanged: policy.maxFilesChanged,
+            blockedPaths: [],
+        });
+    }
+    return decision("allow", ["github_branch_inside_policy"], config, {
+        maxFilesChanged: policy.maxFilesChanged,
+        blockedPaths: [],
+    });
+}
+export function toCedarRequest(actionInput) {
+    const action = NormalizedActionSchema.parse(actionInput);
+    return {
+        principal: {
+            type: "Agent",
+            id: action.actor.agentId,
+        },
+        action: {
+            type: "Action",
+            id: action.capability.tool,
+        },
+        resource: resourceToCedar(action.capability.resource),
+        context: {
+            human_owner: action.actor.humanOwner,
+            runtime: action.actor.runtime,
+            tenant: action.actor.tenant ?? null,
+            task_id: action.intent.taskId,
+            declared_goal: action.intent.declaredGoal,
+            payload: action.capability.payload,
+            constraints: action.capability.constraints ?? null,
+            tool_definition: action.toolDefinition ?? null,
+            budget: action.budget ?? null,
+        },
+    };
+}
+export function toOpaInput(actionInput) {
+    const action = NormalizedActionSchema.parse(actionInput);
+    return {
+        input: {
+            schemaVersion: POLICY_SCHEMA_VERSION,
+            action,
+        },
+    };
+}
+function evaluateGitHubPullRequest(action, config) {
+    const policy = config.github.pullRequests;
+    if (!policy.enabled) {
+        return decision("deny", ["github_pr_policy_disabled"], config, {
+            maxFilesChanged: policy.maxFilesChanged,
+            blockedPaths: [...policy.denyPathPrefixes, ...policy.stepUpPathPrefixes],
+        });
+    }
+    const payload = action.capability.payload;
+    const filesChanged = getStringArray(payload.filesChanged);
+    const denyReasons = [];
+    const stepUpReasons = [];
+    if (payload.baseBranch !== policy.requiredBaseBranch) {
+        stepUpReasons.push(`base_branch_mismatch:${policy.requiredBaseBranch}`);
+    }
+    if (filesChanged.length > policy.maxFilesChanged) {
+        stepUpReasons.push("file_count_exceeds_policy_limit");
+    }
+    if (pathsMatch(filesChanged, policy.denyPathPrefixes)) {
+        denyReasons.push("payload_touches_denied_path");
+    }
+    if (pathsMatch(filesChanged, policy.stepUpPathPrefixes)) {
+        stepUpReasons.push("payload_touches_step_up_path");
+    }
+    if (policy.requiresTests && payload.testsPassed !== true) {
+        stepUpReasons.push("tests_required_before_pr");
+    }
+    if (payload.touchesProduction === true) {
+        stepUpReasons.push("payload_declares_production_impact");
+    }
+    if (denyReasons.length > 0) {
+        return decision("deny", denyReasons, config, {
+            maxFilesChanged: policy.maxFilesChanged,
+            blockedPaths: policy.denyPathPrefixes,
+        });
+    }
+    if (stepUpReasons.length > 0) {
+        return decision("step_up", stepUpReasons, config, {
+            maxFilesChanged: policy.maxFilesChanged,
+            blockedPaths: [...policy.denyPathPrefixes, ...policy.stepUpPathPrefixes],
+        });
+    }
+    return decision("allow", ["github_pr_inside_policy"], config, {
+        maxFilesChanged: policy.maxFilesChanged,
+        blockedPaths: [...policy.denyPathPrefixes, ...policy.stepUpPathPrefixes],
+    });
+}
+function evaluateGitHubContentRead(action, config) {
+    const policy = config.github.contents;
+    const path = getString(action.capability.payload.path);
+    if (!policy.enabled) {
+        return decision("deny", ["github_contents_policy_disabled"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyReadPathPrefixes,
+        });
+    }
+    if (!path) {
+        return decision("deny", ["missing_content_path"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyReadPathPrefixes,
+        });
+    }
+    if (pathsMatch([path], policy.denyReadPathPrefixes)) {
+        return decision("deny", ["content_read_denied_path"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyReadPathPrefixes,
+        });
+    }
+    return decision("allow", ["content_read_inside_policy"], config, {
+        maxFilesChanged: 0,
+        blockedPaths: policy.denyReadPathPrefixes,
+    });
+}
+function evaluateSlackMessage(action, config) {
+    const policy = config.slack.messages;
+    const channel = getString(action.capability.payload.channel);
+    const externalRecipients = getStringArray(action.capability.payload.externalRecipients);
+    if (!policy.enabled) {
+        return decision("deny", ["slack_message_policy_disabled"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    if (!channel || !policy.allowedChannels.includes(channel)) {
+        return decision("deny", ["slack_channel_not_allowed"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    if (policy.stepUpExternalRecipients && externalRecipients.length > 0) {
+        return decision("step_up", ["slack_external_recipient_step_up"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    return decision("allow", ["slack_message_inside_policy"], config, {
+        maxFilesChanged: 0,
+        blockedPaths: [],
+    });
+}
+function evaluateIssueTrackerAction(action, config, provider) {
+    const policy = config.issueTrackers[provider];
+    const payload = action.capability.payload;
+    const issueKey = getString(payload.issueKey);
+    const projectKey = getString(payload.projectKey) ?? issueKey?.split("-", 1)[0] ?? null;
+    if (!policy.enabled) {
+        return decision("deny", [`${provider}_issue_tracker_policy_disabled`], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    if (!issueKey || !projectKey) {
+        return decision("deny", [`${provider}_issue_missing_key`], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    if (!policy.allowedProjectKeys.includes(projectKey)) {
+        return decision("deny", [`${provider}_project_not_allowed`], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    if (action.capability.tool.endsWith(".comments.create")) {
+        const body = getString(payload.body);
+        if (!body) {
+            return decision("deny", [`${provider}_comment_missing_body`], config, {
+                maxFilesChanged: 0,
+                blockedPaths: [],
+            });
+        }
+    }
+    if (action.capability.tool.endsWith(".issues.update")) {
+        const status = getString(payload.status);
+        if (status && policy.stepUpStatuses.includes(status)) {
+            return decision("step_up", [`${provider}_status_requires_step_up`], config, {
+                maxFilesChanged: 0,
+                blockedPaths: [],
+            });
+        }
+    }
+    return decision("allow", [`${provider}_issue_inside_policy`], config, {
+        maxFilesChanged: 0,
+        blockedPaths: [],
+    });
+}
+function evaluateAwsRead(action, config) {
+    const policy = config.cloud.aws;
+    if (!policy.enabled) {
+        return decision("deny", ["aws_read_policy_disabled"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyObjectKeyPrefixes,
+        });
+    }
+    if (action.capability.tool === "aws.identity.get") {
+        return decision("allow", ["aws_identity_read_inside_policy"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    const bucket = getString(action.capability.payload.bucket);
+    const prefix = getString(action.capability.payload.prefix) ?? "";
+    const region = getString(action.capability.payload.region) ?? "us-east-1";
+    const accountId = getString(action.capability.payload.accountId);
+    if (!bucket) {
+        return decision("deny", ["aws_s3_missing_bucket"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyObjectKeyPrefixes,
+        });
+    }
+    if (policy.allowedAccountIds.length > 0 &&
+        (!accountId || !policy.allowedAccountIds.includes(accountId))) {
+        return decision("deny", ["aws_account_not_allowed"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyObjectKeyPrefixes,
+        });
+    }
+    if (!policy.allowedRegions.includes(region)) {
+        return decision("deny", ["aws_region_not_allowed"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyObjectKeyPrefixes,
+        });
+    }
+    if (!policy.allowedS3Buckets.includes(bucket)) {
+        return decision("deny", ["aws_s3_bucket_not_allowed"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyObjectKeyPrefixes,
+        });
+    }
+    if (pathsMatch([prefix], policy.denyObjectKeyPrefixes)) {
+        return decision("deny", ["aws_s3_prefix_denied"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyObjectKeyPrefixes,
+        });
+    }
+    return decision("allow", ["aws_s3_read_inside_policy"], config, {
+        maxFilesChanged: 0,
+        blockedPaths: policy.denyObjectKeyPrefixes,
+    });
+}
+function evaluateGcpRead(action, config) {
+    const policy = config.cloud.gcp;
+    if (!policy.enabled) {
+        return decision("deny", ["gcp_read_policy_disabled"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyObjectNamePrefixes,
+        });
+    }
+    if (action.capability.tool === "gcp.projects.get") {
+        const projectId = getString(action.capability.payload.projectId);
+        if (!projectId) {
+            return decision("deny", ["gcp_missing_project_id"], config, {
+                maxFilesChanged: 0,
+                blockedPaths: [],
+            });
+        }
+        if (!policy.allowedProjectIds.includes(projectId)) {
+            return decision("deny", ["gcp_project_not_allowed"], config, {
+                maxFilesChanged: 0,
+                blockedPaths: [],
+            });
+        }
+        return decision("allow", ["gcp_project_read_inside_policy"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    const bucket = getString(action.capability.payload.bucket);
+    const prefix = getString(action.capability.payload.prefix) ?? "";
+    if (!bucket) {
+        return decision("deny", ["gcp_storage_missing_bucket"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyObjectNamePrefixes,
+        });
+    }
+    if (!policy.allowedStorageBuckets.includes(bucket)) {
+        return decision("deny", ["gcp_storage_bucket_not_allowed"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyObjectNamePrefixes,
+        });
+    }
+    if (pathsMatch([prefix], policy.denyObjectNamePrefixes)) {
+        return decision("deny", ["gcp_storage_prefix_denied"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyObjectNamePrefixes,
+        });
+    }
+    return decision("allow", ["gcp_storage_read_inside_policy"], config, {
+        maxFilesChanged: 0,
+        blockedPaths: policy.denyObjectNamePrefixes,
+    });
+}
+function evaluateDocsDocument(action, config) {
+    const policy = config.docs.documents;
+    const workspace = getString(action.capability.payload.workspace) ?? "local";
+    const path = getString(action.capability.payload.path);
+    const query = getString(action.capability.payload.query);
+    const maxResults = getNumber(action.capability.payload.maxResults) ?? 5;
+    const maxBytes = getNumber(action.capability.payload.maxBytes) ?? policy.maxReadBytes;
+    if (!policy.enabled) {
+        return decision("deny", ["docs_policy_disabled"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyPathPrefixes,
+        });
+    }
+    if (!policy.allowedWorkspaces.includes(workspace)) {
+        return decision("deny", ["docs_workspace_not_allowed"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyPathPrefixes,
+        });
+    }
+    if (action.capability.tool === "docs.documents.search") {
+        if (!query) {
+            return decision("deny", ["docs_search_query_required"], config, {
+                maxFilesChanged: 0,
+                blockedPaths: policy.denyPathPrefixes,
+            });
+        }
+        if (maxResults > policy.maxSearchResults) {
+            return decision("deny", ["docs_result_limit_exceeds_policy"], config, {
+                maxFilesChanged: 0,
+                blockedPaths: policy.denyPathPrefixes,
+            });
+        }
+        return decision("allow", ["docs_search_inside_policy"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyPathPrefixes,
+        });
+    }
+    if (!path) {
+        return decision("deny", ["docs_path_required"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyPathPrefixes,
+        });
+    }
+    if (isUnsafeRelativePath(path) || pathsMatch([path], policy.denyPathPrefixes)) {
+        return decision("deny", ["docs_path_denied"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyPathPrefixes,
+        });
+    }
+    if (!pathsMatch([path], policy.allowedPathPrefixes)) {
+        return decision("deny", ["docs_path_not_allowed"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyPathPrefixes,
+        });
+    }
+    if (maxBytes > policy.maxReadBytes) {
+        return decision("deny", ["docs_read_bytes_exceeds_policy"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyPathPrefixes,
+        });
+    }
+    return decision("allow", ["docs_read_inside_policy"], config, {
+        maxFilesChanged: 0,
+        blockedPaths: policy.denyPathPrefixes,
+    });
+}
+function evaluateMcpToolCall(action, config) {
+    const policy = config.mcp;
+    if (!policy.enabled) {
+        return decision("deny", ["mcp_policy_disabled"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    const toolName = getString(action.capability.payload.toolName);
+    const toolDefinition = action.toolDefinition;
+    if (!toolName) {
+        return decision("deny", ["mcp_tool_name_required"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    if (!toolDefinition) {
+        return decision("deny", ["mcp_tool_definition_required"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    const allowedTool = policy.allowedTools.find((entry) => entry.serverIdentity === toolDefinition.serverIdentity &&
+        entry.toolName === toolName);
+    if (!allowedTool) {
+        return decision("deny", ["mcp_tool_not_allowed"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    if (allowedTool.definitionHash !== toolDefinition.definitionHash) {
+        return decision("deny", ["mcp_definition_hash_not_allowed"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    return decision("allow", ["mcp_tool_inside_policy"], config, {
+        maxFilesChanged: 0,
+        blockedPaths: [],
+    });
+}
+function decision(value, reasons, config, constraints) {
+    return {
+        decision: value,
+        reasons,
+        policy: {
+            nativeRule: "axtary_policy_v0",
+            version: config.version,
+            cedarCompatible: true,
+            opaCompatible: true,
+        },
+        constraints: {
+            expiresInSeconds: DEFAULT_EXPIRES_IN_SECONDS,
+            maxFilesChanged: constraints.maxFilesChanged,
+            blockedPaths: constraints.blockedPaths,
+        },
+    };
+}
+function resourceToCedar(resource) {
+    const [kind, id] = resource.split(":", 2);
+    return {
+        type: kind ? titleCase(kind) : "Resource",
+        id: id ?? resource,
+    };
+}
+function pathsMatch(paths, prefixes) {
+    return paths.some((path) => prefixes.some((prefix) => path.startsWith(prefix)));
+}
+function isUnsafeRelativePath(path) {
+    if (path.startsWith("/") || path.startsWith("\\") || path.includes("\0")) {
+        return true;
+    }
+    return path.split(/[\\/]+/).some((segment) => segment === ".." || segment === "");
+}
+function decisionSummary(decisionInput) {
+    if (decisionInput.decision === "allow") {
+        return "The normalized action is inside the active policy and can proceed through ActionPass issuance.";
+    }
+    if (decisionInput.decision === "step_up") {
+        return "The normalized action is in scope only after exact payload-bound reviewer approval.";
+    }
+    return "The normalized action is outside the active policy and must not execute.";
+}
+function reasonDetail(reason) {
+    if (reason === "github_pr_inside_policy") {
+        return "Base branch, changed paths, file count, and test evidence satisfy the GitHub PR rule.";
+    }
+    if (reason === "github_content_write_inside_policy") {
+        return "The write path and branch are inside the configured repository guardrails.";
+    }
+    if (reason === "github_branch_inside_policy") {
+        return "The branch creation request is tied to the configured base branch.";
+    }
+    if (reason === "content_read_denied_path") {
+        return "The requested file path matches a protected content-read prefix.";
+    }
+    if (reason === "payload_touches_denied_path") {
+        return "The payload touches a path prefix that policy blocks outright.";
+    }
+    if (reason === "payload_touches_step_up_path") {
+        return "The payload touches a protected path prefix that requires exact review.";
+    }
+    if (reason === "file_count_exceeds_policy_limit") {
+        return "The PR changes more files than the active policy allows without review.";
+    }
+    if (reason === "tests_required_before_pr") {
+        return "The PR payload does not include passing test evidence required by policy.";
+    }
+    if (reason === "payload_declares_production_impact") {
+        return "The action declares production impact, so reviewer approval is required.";
+    }
+    if (reason === "slack_channel_not_allowed") {
+        return "The Slack channel is not in the configured allowlist.";
+    }
+    if (reason === "slack_external_recipient_step_up") {
+        return "The message reaches external recipients and must be reviewed exactly.";
+    }
+    if (reason === "linear_status_requires_step_up") {
+        return "The Linear status transition targets a configured protected status.";
+    }
+    if (reason === "jira_status_requires_step_up") {
+        return "The Jira status transition targets a configured protected status.";
+    }
+    if (reason.endsWith("_project_not_allowed")) {
+        return "The issue project key is outside the configured tracker allowlist.";
+    }
+    if (reason === "docs_search_inside_policy") {
+        return "The document search request stays inside the configured workspace and result limit.";
+    }
+    if (reason === "docs_read_inside_policy") {
+        return "The document path and requested byte limit are inside the configured documentation scope.";
+    }
+    if (reason === "docs_workspace_not_allowed") {
+        return "The document workspace is outside the configured allowlist.";
+    }
+    if (reason === "docs_path_denied") {
+        return "The requested document path matches a protected documentation prefix.";
+    }
+    if (reason === "docs_path_not_allowed") {
+        return "The requested document path is outside the configured documentation prefixes.";
+    }
+    if (reason === "docs_result_limit_exceeds_policy") {
+        return "The search request asks for more document results than policy allows.";
+    }
+    if (reason === "docs_read_bytes_exceeds_policy") {
+        return "The read request asks for more document bytes than policy allows.";
+    }
+    if (reason.startsWith("unsupported_tool:")) {
+        return "The tool is not supported by the native policy evaluator and fails closed.";
+    }
+    if (reason.startsWith("base_branch_mismatch:")) {
+        return "The requested base branch differs from the configured branch and needs review.";
+    }
+    return "The active native policy emitted this reason for the normalized action.";
+}
+function collectPatchPaths(input, prefix = "") {
+    if (!isPlainObject(input)) {
+        return prefix ? [prefix] : [];
+    }
+    return Object.entries(input).flatMap(([key, value]) => {
+        const path = prefix ? `${prefix}.${key}` : key;
+        if (isPlainObject(value)) {
+            return collectPatchPaths(value, path);
+        }
+        return [path];
+    });
+}
+function arraysEqual(left, right) {
+    return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function fixtureOutcomeChanged(beforeFixture, afterFixture) {
+    return (beforeFixture.actualDecision !== afterFixture.actualDecision ||
+        beforeFixture.passed !== afterFixture.passed ||
+        !arraysEqual(beforeFixture.actualReasons, afterFixture.actualReasons));
+}
+function getStringArray(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value.filter((item) => typeof item === "string");
+}
+function getString(value) {
+    return typeof value === "string" ? value : null;
+}
+function getNumber(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function deepMerge(base, patch) {
+    if (Array.isArray(base) || Array.isArray(patch)) {
+        return (patch ?? base);
+    }
+    if (!isPlainObject(base) || !isPlainObject(patch)) {
+        return (patch ?? base);
+    }
+    const merged = { ...base };
+    for (const [key, value] of Object.entries(patch)) {
+        merged[key] = key in merged ? deepMerge(merged[key], value) : value;
+    }
+    return merged;
+}
+function isPlainObject(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function titleCase(value) {
+    return `${value.slice(0, 1).toUpperCase()}${value.slice(1)}`;
+}
+//# sourceMappingURL=index.js.map