@axtary/policy 0.1.0 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +52 -2
- package/dist/index.d.ts +208 -19
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1033 -162
- package/dist/index.js.map +1 -1
- package/dist/parity.d.ts +100 -0
- package/dist/parity.d.ts.map +1 -0
- package/dist/parity.js +289 -0
- package/dist/parity.js.map +1 -0
- package/package.json +6 -2
package/README.md
CHANGED
|
@@ -12,9 +12,18 @@ npm install @axtary/policy
|
|
|
12
12
|
|
|
13
13
|
- Evaluates normalized Axtary actions against a local policy config.
|
|
14
14
|
- Returns `allow`, `deny`, or `step_up` decisions.
|
|
15
|
-
-
|
|
15
|
+
- Supports named multi-rule policies with wildcard tool/resource/actor matchers,
|
|
16
|
+
deny-overrides precedence, and default-deny.
|
|
17
|
+
- Attaches enforceable obligations: narrowed TTL, approver roles, blocked paths,
|
|
18
|
+
UTC time windows, and per-process rate windows.
|
|
19
|
+
- Ships guardrails for GitHub PRs/reviews/checks and content reads/writes,
|
|
20
|
+
Slack posts (channel allowlists + external-recipient step-up), Linear/Jira
|
|
21
|
+
issue actions, Postgres scoped SELECT analysis (write statements denied
|
|
22
|
+
before execution), Google Drive file reads, and MCP tool calls pinned by
|
|
23
|
+
definition hash (same-name definition drift denies).
|
|
16
24
|
- Maps the same normalized action into Cedar-style principal/action/resource/context.
|
|
17
|
-
- Exposes OPA/Rego-compatible input JSON
|
|
25
|
+
- Exposes OPA/Rego-compatible input JSON, with an executable `--parity` harness
|
|
26
|
+
that fails on any cross-engine disagreement.
|
|
18
27
|
|
|
19
28
|
## Quickstart
|
|
20
29
|
|
|
@@ -32,8 +41,49 @@ console.log(decision.decision, decision.reasons);
|
|
|
32
41
|
console.log(explainPolicyDecision(decision).summary);
|
|
33
42
|
```
|
|
34
43
|
|
|
44
|
+
## Multi-rule policies
|
|
45
|
+
|
|
46
|
+
`axtary.yml` may define a top-level `policies:` block. When `rules` is empty,
|
|
47
|
+
the existing provider guardrail preset remains active for compatibility.
|
|
48
|
+
When one or more rules are present, only the explicit rules apply and unmatched
|
|
49
|
+
actions deny.
|
|
50
|
+
|
|
51
|
+
```yaml
|
|
52
|
+
policies:
|
|
53
|
+
defaultDecision: deny
|
|
54
|
+
rules:
|
|
55
|
+
- id: review-repo-writes
|
|
56
|
+
match:
|
|
57
|
+
tools: github.contents.write
|
|
58
|
+
resources: repo:company/*
|
|
59
|
+
actors:
|
|
60
|
+
runtimes: [codex-*, claude-*]
|
|
61
|
+
effect: step_up
|
|
62
|
+
reason: repository_write_requires_review
|
|
63
|
+
obligations:
|
|
64
|
+
expiresInSeconds: 60
|
|
65
|
+
requiredApproverRoles: [security-reviewer]
|
|
66
|
+
blockedPathPrefixes: [.env, secrets/]
|
|
67
|
+
```
|
|
68
|
+
|
|
69
|
+
All matching rules are evaluated. `deny` outranks `step_up`, which outranks
|
|
70
|
+
`allow`; obligations are merged toward the narrower result. Use
|
|
71
|
+
`simulatePolicy` for the complete match/mismatch trace.
|
|
72
|
+
|
|
35
73
|
## Design Notes
|
|
36
74
|
|
|
37
75
|
The normalized action schema from `@axtary/actionpass` remains the source of truth. Policy evaluation is deterministic and fail-closed for unknown protected tools.
|
|
38
76
|
|
|
77
|
+
## Deterministic provenance guard
|
|
78
|
+
|
|
79
|
+
Set `policy.provenance.enabled: true` to require authority-stamped lineage for
|
|
80
|
+
covered outbound/content fields. Missing or unknown lineage denies with
|
|
81
|
+
`provenance_unknown_egress`. Untrusted document/tool-output lineage steps up
|
|
82
|
+
with `provenance_untrusted_egress` by default, or can be configured to deny.
|
|
83
|
+
The guard runs after the underlying native, Cedar, or Rego decision and can
|
|
84
|
+
only preserve or restrict it—never turn a deny into an allow.
|
|
85
|
+
|
|
86
|
+
Coverage is intentionally explicit (`PROVENANCE_COVERAGE`) rather than generic
|
|
87
|
+
DLP or semantic prompt-injection detection.
|
|
88
|
+
|
|
39
89
|
This package stays format-agnostic. `@axtary/config` loads YAML and passes the parsed policy object into this evaluator so the same deterministic decision path can be used by tests, the local proxy, and future MCP wrappers.
|
package/dist/index.d.ts
CHANGED
|
@@ -1,8 +1,107 @@
|
|
|
1
|
-
import { type JsonValue, type NormalizedAction, type PolicyDecision } from "@axtary/actionpass";
|
|
1
|
+
import { type JsonValue, type NormalizedAction, type PolicyDecision, type PolicyDecisionExplanation } from "@axtary/actionpass";
|
|
2
2
|
import { z } from "zod";
|
|
3
|
+
export { explainDecision as explainPolicyDecision } from "@axtary/actionpass";
|
|
4
|
+
export type { PolicyDecisionExplanation } from "@axtary/actionpass";
|
|
3
5
|
export declare const POLICY_SCHEMA_VERSION = "axtary.policy.v0";
|
|
6
|
+
export declare const PROVENANCE_COVERAGE: {
|
|
7
|
+
readonly "github.pull_requests.create": readonly ["title", "body"];
|
|
8
|
+
readonly "github.contents.write": readonly ["content", "message"];
|
|
9
|
+
readonly "github.pull_request_review_comments.create": readonly ["body"];
|
|
10
|
+
readonly "github.check_runs.create": readonly ["output"];
|
|
11
|
+
readonly "github.issue_comments.create": readonly ["body"];
|
|
12
|
+
readonly "slack.chat.postMessage": readonly ["message", "text"];
|
|
13
|
+
readonly "linear.comments.create": readonly ["body"];
|
|
14
|
+
readonly "linear.issues.update": readonly ["title", "description", "status"];
|
|
15
|
+
readonly "jira.comments.create": readonly ["body"];
|
|
16
|
+
readonly "jira.issues.update": readonly ["title", "description", "status"];
|
|
17
|
+
readonly "mcp.tool.call": readonly ["arguments"];
|
|
18
|
+
};
|
|
19
|
+
export declare const PolicyRuleSchema: z.ZodObject<{
|
|
20
|
+
id: z.ZodString;
|
|
21
|
+
description: z.ZodOptional<z.ZodString>;
|
|
22
|
+
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
23
|
+
match: z.ZodDefault<z.ZodObject<{
|
|
24
|
+
tools: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
|
|
25
|
+
resources: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
|
|
26
|
+
actors: z.ZodOptional<z.ZodObject<{
|
|
27
|
+
agentIds: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
|
|
28
|
+
humanOwners: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
|
|
29
|
+
runtimes: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
|
|
30
|
+
tenants: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
|
|
31
|
+
}, z.core.$strip>>;
|
|
32
|
+
}, z.core.$strip>>;
|
|
33
|
+
effect: z.ZodEnum<{
|
|
34
|
+
deny: "deny";
|
|
35
|
+
step_up: "step_up";
|
|
36
|
+
allow: "allow";
|
|
37
|
+
}>;
|
|
38
|
+
reason: z.ZodOptional<z.ZodString>;
|
|
39
|
+
obligations: z.ZodDefault<z.ZodObject<{
|
|
40
|
+
expiresInSeconds: z.ZodOptional<z.ZodNumber>;
|
|
41
|
+
requiredApproverRoles: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
42
|
+
blockedPathPrefixes: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
43
|
+
timeWindow: z.ZodOptional<z.ZodObject<{
|
|
44
|
+
startHourUtc: z.ZodNumber;
|
|
45
|
+
endHourUtc: z.ZodNumber;
|
|
46
|
+
daysOfWeek: z.ZodDefault<z.ZodArray<z.ZodNumber>>;
|
|
47
|
+
}, z.core.$strip>>;
|
|
48
|
+
rateLimit: z.ZodOptional<z.ZodObject<{
|
|
49
|
+
maxActions: z.ZodNumber;
|
|
50
|
+
windowSeconds: z.ZodNumber;
|
|
51
|
+
scope: z.ZodDefault<z.ZodEnum<{
|
|
52
|
+
actor: "actor";
|
|
53
|
+
tool: "tool";
|
|
54
|
+
resource: "resource";
|
|
55
|
+
tenant: "tenant";
|
|
56
|
+
}>>;
|
|
57
|
+
}, z.core.$strip>>;
|
|
58
|
+
}, z.core.$strip>>;
|
|
59
|
+
}, z.core.$strip>;
|
|
60
|
+
export type PolicyRule = z.infer<typeof PolicyRuleSchema>;
|
|
4
61
|
export declare const PolicyConfigSchema: z.ZodObject<{
|
|
5
62
|
version: z.ZodDefault<z.ZodString>;
|
|
63
|
+
defaultDecision: z.ZodDefault<z.ZodLiteral<"deny">>;
|
|
64
|
+
rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
|
|
65
|
+
id: z.ZodString;
|
|
66
|
+
description: z.ZodOptional<z.ZodString>;
|
|
67
|
+
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
68
|
+
match: z.ZodDefault<z.ZodObject<{
|
|
69
|
+
tools: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
|
|
70
|
+
resources: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
|
|
71
|
+
actors: z.ZodOptional<z.ZodObject<{
|
|
72
|
+
agentIds: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
|
|
73
|
+
humanOwners: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
|
|
74
|
+
runtimes: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
|
|
75
|
+
tenants: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
|
|
76
|
+
}, z.core.$strip>>;
|
|
77
|
+
}, z.core.$strip>>;
|
|
78
|
+
effect: z.ZodEnum<{
|
|
79
|
+
deny: "deny";
|
|
80
|
+
step_up: "step_up";
|
|
81
|
+
allow: "allow";
|
|
82
|
+
}>;
|
|
83
|
+
reason: z.ZodOptional<z.ZodString>;
|
|
84
|
+
obligations: z.ZodDefault<z.ZodObject<{
|
|
85
|
+
expiresInSeconds: z.ZodOptional<z.ZodNumber>;
|
|
86
|
+
requiredApproverRoles: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
87
|
+
blockedPathPrefixes: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
88
|
+
timeWindow: z.ZodOptional<z.ZodObject<{
|
|
89
|
+
startHourUtc: z.ZodNumber;
|
|
90
|
+
endHourUtc: z.ZodNumber;
|
|
91
|
+
daysOfWeek: z.ZodDefault<z.ZodArray<z.ZodNumber>>;
|
|
92
|
+
}, z.core.$strip>>;
|
|
93
|
+
rateLimit: z.ZodOptional<z.ZodObject<{
|
|
94
|
+
maxActions: z.ZodNumber;
|
|
95
|
+
windowSeconds: z.ZodNumber;
|
|
96
|
+
scope: z.ZodDefault<z.ZodEnum<{
|
|
97
|
+
actor: "actor";
|
|
98
|
+
tool: "tool";
|
|
99
|
+
resource: "resource";
|
|
100
|
+
tenant: "tenant";
|
|
101
|
+
}>>;
|
|
102
|
+
}, z.core.$strip>>;
|
|
103
|
+
}, z.core.$strip>>;
|
|
104
|
+
}, z.core.$strip>>>;
|
|
6
105
|
github: z.ZodDefault<z.ZodObject<{
|
|
7
106
|
pullRequests: z.ZodDefault<z.ZodObject<{
|
|
8
107
|
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
@@ -69,8 +168,67 @@ export declare const PolicyConfigSchema: z.ZodObject<{
|
|
|
69
168
|
maxReadBytes: z.ZodDefault<z.ZodNumber>;
|
|
70
169
|
}, z.core.$strip>>;
|
|
71
170
|
}, z.core.$strip>>;
|
|
171
|
+
postgres: z.ZodDefault<z.ZodObject<{
|
|
172
|
+
reads: z.ZodDefault<z.ZodObject<{
|
|
173
|
+
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
174
|
+
allowedDatabases: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
175
|
+
allowedTables: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
176
|
+
allowedFunctions: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
177
|
+
maxRows: z.ZodDefault<z.ZodNumber>;
|
|
178
|
+
requirePredicate: z.ZodDefault<z.ZodBoolean>;
|
|
179
|
+
}, z.core.$strip>>;
|
|
180
|
+
}, z.core.$strip>>;
|
|
181
|
+
drive: z.ZodDefault<z.ZodObject<{
|
|
182
|
+
reads: z.ZodDefault<z.ZodObject<{
|
|
183
|
+
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
184
|
+
allowedFileIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
185
|
+
maxReadBytes: z.ZodDefault<z.ZodNumber>;
|
|
186
|
+
}, z.core.$strip>>;
|
|
187
|
+
}, z.core.$strip>>;
|
|
188
|
+
provenance: z.ZodDefault<z.ZodObject<{
|
|
189
|
+
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
190
|
+
unknownDecision: z.ZodDefault<z.ZodLiteral<"deny">>;
|
|
191
|
+
untrustedDecision: z.ZodDefault<z.ZodEnum<{
|
|
192
|
+
deny: "deny";
|
|
193
|
+
step_up: "step_up";
|
|
194
|
+
}>>;
|
|
195
|
+
}, z.core.$strip>>;
|
|
196
|
+
behavior: z.ZodDefault<z.ZodObject<{
|
|
197
|
+
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
198
|
+
firstSeen: z.ZodDefault<z.ZodBoolean>;
|
|
199
|
+
abnormalSequence: z.ZodDefault<z.ZodBoolean>;
|
|
200
|
+
}, z.core.$strip>>;
|
|
72
201
|
}, z.core.$strip>;
|
|
73
202
|
export type PolicyConfig = z.infer<typeof PolicyConfigSchema>;
|
|
203
|
+
/**
|
|
204
|
+
* Behavioral signals derived by the proxy from the durable observation store
|
|
205
|
+
* (`@axtary/ledger`). The policy itself stays pure: it only maps these booleans
|
|
206
|
+
* to an escalation. Absent signals mean the guard is inert.
|
|
207
|
+
*/
|
|
208
|
+
export type BehaviorSignalContext = {
|
|
209
|
+
firstSeenCombo?: boolean;
|
|
210
|
+
abnormalSequence?: boolean;
|
|
211
|
+
};
|
|
212
|
+
export type PolicyEvaluationContext = {
|
|
213
|
+
now?: Date;
|
|
214
|
+
rateLimitCounts?: Readonly<Record<string, number>>;
|
|
215
|
+
behaviorSignals?: BehaviorSignalContext;
|
|
216
|
+
};
|
|
217
|
+
export type PolicyRuleTrace = {
|
|
218
|
+
ruleId: string;
|
|
219
|
+
matched: boolean;
|
|
220
|
+
effect: PolicyRule["effect"];
|
|
221
|
+
mismatches: string[];
|
|
222
|
+
obligations: PolicyRule["obligations"];
|
|
223
|
+
};
|
|
224
|
+
export type PolicySimulation = {
|
|
225
|
+
schemaVersion: typeof POLICY_SCHEMA_VERSION;
|
|
226
|
+
action: NormalizedAction;
|
|
227
|
+
mode: "rules" | "builtin_preset";
|
|
228
|
+
defaultDecision: "deny";
|
|
229
|
+
decision: PolicyDecision;
|
|
230
|
+
rules: PolicyRuleTrace[];
|
|
231
|
+
};
|
|
74
232
|
export type CedarEntityRef = {
|
|
75
233
|
type: string;
|
|
76
234
|
id: string;
|
|
@@ -88,7 +246,7 @@ export type OpaInput = {
|
|
|
88
246
|
};
|
|
89
247
|
};
|
|
90
248
|
type DeepPartial<T> = {
|
|
91
|
-
[K in keyof T]?: T[K] extends Array<infer U> ? Array<U
|
|
249
|
+
[K in keyof T]?: T[K] extends Array<infer U> ? Array<DeepPartial<U>> : T[K] extends object ? DeepPartial<T[K]> : T[K];
|
|
92
250
|
};
|
|
93
251
|
export type PolicyConfigPatch = DeepPartial<PolicyConfig>;
|
|
94
252
|
export type PolicyTemplateCategory = "coding_agent" | "cloud_read" | "production_change" | "identity_mutation" | "external_communication" | "docs_read";
|
|
@@ -102,14 +260,15 @@ export type PolicyTemplate = {
|
|
|
102
260
|
config: PolicyConfigPatch;
|
|
103
261
|
evidence: string[];
|
|
104
262
|
notes: string[];
|
|
263
|
+
fixtures: PolicyFixtureInput[];
|
|
105
264
|
};
|
|
106
265
|
export declare const PolicyFixtureInputSchema: z.ZodObject<{
|
|
107
266
|
id: z.ZodOptional<z.ZodString>;
|
|
108
267
|
name: z.ZodOptional<z.ZodString>;
|
|
109
268
|
expectedDecision: z.ZodEnum<{
|
|
110
|
-
allow: "allow";
|
|
111
269
|
deny: "deny";
|
|
112
270
|
step_up: "step_up";
|
|
271
|
+
allow: "allow";
|
|
113
272
|
}>;
|
|
114
273
|
expectedReasons: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
115
274
|
action: z.ZodObject<{
|
|
@@ -135,15 +294,45 @@ export declare const PolicyFixtureInputSchema: z.ZodObject<{
|
|
|
135
294
|
serverIdentity: z.ZodString;
|
|
136
295
|
schemaVersion: z.ZodString;
|
|
137
296
|
definitionHash: z.ZodString;
|
|
297
|
+
publisher: z.ZodOptional<z.ZodString>;
|
|
298
|
+
publisherKeyId: z.ZodOptional<z.ZodString>;
|
|
299
|
+
semver: z.ZodOptional<z.ZodString>;
|
|
300
|
+
priorDefinitionHash: z.ZodOptional<z.ZodString>;
|
|
301
|
+
}, z.core.$strip>>;
|
|
302
|
+
provenance: z.ZodOptional<z.ZodObject<{
|
|
303
|
+
schemaVersion: z.ZodDefault<z.ZodLiteral<"axtary.provenance.v0">>;
|
|
304
|
+
sources: z.ZodArray<z.ZodObject<{
|
|
305
|
+
id: z.ZodString;
|
|
306
|
+
kind: z.ZodEnum<{
|
|
307
|
+
unknown: "unknown";
|
|
308
|
+
task: "task";
|
|
309
|
+
operator: "operator";
|
|
310
|
+
document: "document";
|
|
311
|
+
tool_output: "tool_output";
|
|
312
|
+
connector: "connector";
|
|
313
|
+
}>;
|
|
314
|
+
integrity: z.ZodEnum<{
|
|
315
|
+
unknown: "unknown";
|
|
316
|
+
trusted: "trusted";
|
|
317
|
+
untrusted: "untrusted";
|
|
318
|
+
}>;
|
|
319
|
+
resource: z.ZodOptional<z.ZodString>;
|
|
320
|
+
observedAt: z.ZodOptional<z.ZodString>;
|
|
321
|
+
}, z.core.$strip>>;
|
|
322
|
+
bindings: z.ZodArray<z.ZodObject<{
|
|
323
|
+
path: z.ZodString;
|
|
324
|
+
sourceIds: z.ZodArray<z.ZodString>;
|
|
325
|
+
}, z.core.$strip>>;
|
|
138
326
|
}, z.core.$strip>>;
|
|
139
327
|
budget: z.ZodOptional<z.ZodObject<{
|
|
140
|
-
reservationId: z.
|
|
141
|
-
|
|
142
|
-
|
|
328
|
+
reservationId: z.ZodString;
|
|
329
|
+
cost: z.ZodRecord<z.ZodString, z.ZodNumber>;
|
|
330
|
+
limit: z.ZodRecord<z.ZodString, z.ZodNumber>;
|
|
331
|
+
commitStatus: z.ZodEnum<{
|
|
143
332
|
pending: "pending";
|
|
144
333
|
committed: "committed";
|
|
145
334
|
rolled_back: "rolled_back";
|
|
146
|
-
}
|
|
335
|
+
}>;
|
|
147
336
|
}, z.core.$strip>>;
|
|
148
337
|
}, z.core.$strip>;
|
|
149
338
|
sourcePath: z.ZodOptional<z.ZodString>;
|
|
@@ -155,15 +344,6 @@ export type PolicyFixtureSource = {
|
|
|
155
344
|
label: string;
|
|
156
345
|
path: string | null;
|
|
157
346
|
};
|
|
158
|
-
export type PolicyDecisionExplanation = {
|
|
159
|
-
label: string;
|
|
160
|
-
summary: string;
|
|
161
|
-
reviewerAction: "none" | "block" | "approval_required";
|
|
162
|
-
reasonDetails: Array<{
|
|
163
|
-
reason: string;
|
|
164
|
-
detail: string;
|
|
165
|
-
}>;
|
|
166
|
-
};
|
|
167
347
|
export type PolicyFixtureResult = {
|
|
168
348
|
id: string;
|
|
169
349
|
name: string;
|
|
@@ -230,12 +410,21 @@ export declare function getPolicyTemplates(): PolicyTemplate[];
|
|
|
230
410
|
export declare function getPolicyTemplate(id: string): PolicyTemplate | null;
|
|
231
411
|
export declare function mergePolicyConfig(baseInput?: PolicyConfigPatch, patchInput?: PolicyConfigPatch): PolicyConfig;
|
|
232
412
|
export declare function applyPolicyTemplate(baseInput: PolicyConfigPatch, templateId: string): PolicyConfig;
|
|
233
|
-
export declare function explainPolicyDecision(decisionInput: PolicyDecision): PolicyDecisionExplanation;
|
|
234
413
|
export declare function runPolicyFixtures(configInput?: PolicyConfigPatch, fixtureInputs?: PolicyFixtureInput[]): PolicyFixtureResult[];
|
|
235
414
|
export declare function buildPolicyReview(configInput?: PolicyConfigPatch, fixtureInputs?: PolicyFixtureInput[], source?: PolicyFixtureSource): PolicyReview;
|
|
236
415
|
export declare function previewPolicyTemplates(configInput?: PolicyConfigPatch, templates?: PolicyTemplate[], fixtureInputs?: PolicyFixtureInput[]): PolicyTemplatePreview[];
|
|
237
|
-
export declare function evaluatePolicy(actionInput: unknown, configInput?: PolicyConfigPatch): PolicyDecision;
|
|
416
|
+
export declare function evaluatePolicy(actionInput: unknown, configInput?: PolicyConfigPatch, context?: PolicyEvaluationContext): PolicyDecision;
|
|
417
|
+
export declare function simulatePolicy(actionInput: unknown, configInput?: PolicyConfigPatch, context?: PolicyEvaluationContext): PolicySimulation;
|
|
418
|
+
/**
|
|
419
|
+
* The step-up reason codes the behavior guard would emit for the given signals
|
|
420
|
+
* and config. Read-only; used by the proxy/tests to inspect the guard without
|
|
421
|
+
* a full policy evaluation.
|
|
422
|
+
*/
|
|
423
|
+
export declare function evaluateBehaviorGuard(configInput?: PolicyConfigPatch, signals?: BehaviorSignalContext | undefined): string[];
|
|
424
|
+
export declare function evaluateProvenanceGuard(actionInput: unknown, configInput?: PolicyConfigPatch): {
|
|
425
|
+
decision: "deny" | "step_up";
|
|
426
|
+
reason: string;
|
|
427
|
+
} | null;
|
|
238
428
|
export declare function toCedarRequest(actionInput: unknown): CedarAuthorizationRequest;
|
|
239
429
|
export declare function toOpaInput(actionInput: unknown): OpaInput;
|
|
240
|
-
export {};
|
|
241
430
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,SAAS,EAEd,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,yBAAyB,EAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,eAAe,IAAI,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,YAAY,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAEpE,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AA4ExD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;CAYgC,CAAC;AAsBjE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4C3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyL7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,aAAa,EAAE,OAAO,qBAAqB,CAAC;IAC5C,MAAM,EAAE,gBAAgB,CAAC;IACzB,IAAI,EAAE,OAAO,GAAG,gBAAgB,CAAC;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,EAAE,eAAe,EAAE,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,cAAc,CAAC;IAC1B,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,cAAc,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACrB,KAAK,EAAE;QACL,aAAa,EAAE,OAAO,qBAAqB,CAAC;QAC5C,MAAM,EAAE,gBAAgB,CAAC;KAC1B,CAAC;CACH,CAAC;AAEF,KAAK,WAAW,CAAC,CAAC,IAAI;KACnB,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,MAAM,CAAC,CAAC,GACxC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GACrB,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM,GACjB,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GACjB,CAAC,CAAC,CAAC,CAAC;CACX,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;AAE1D,MAAM,MAAM,sBAAsB,GAC9B,cAAc,GACd,YAAY,GACZ,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GACxB,WAAW,CAAC;AAEhB,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,sBAAsB,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,aAAa,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAAC;IAClE,MAAM,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,kBAAkB,EAAE,CAAC;CAChC,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAOnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,MAAM,MAAM,uBAAuB,GAC/B,kBAAkB,GAClB,YAAY,GACZ,iBAAiB,GACjB,cAAc,CAAC;AAEnB,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAC7C,cAAc,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAC3C,eAAe,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,cAAc,CAAC;IACzB,WAAW,EAAE,yBAAyB,CAAC;IACvC,KAAK,EAAE,yBAAyB,CAAC;IACjC,GAAG,EAAE,QAAQ,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,aAAa,EAAE,OAAO,qBAAqB,CAAC;IAC5C,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,OAAO,EAAE;QACP,aAAa,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,QAAQ,EAAE,mBAAmB,EAAE,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAC3C,aAAa,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAC1C,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,sBAAsB,CAAC;IACjC,aAAa,EAAE,cAAc,CAAC,eAAe,CAAC,CAAC;IAC/C,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,qBAAqB,EAAE;QACrB,aAAa,EAAE,MAAM,CAAC;QACtB,eAAe,EAAE,MAAM,CAAC;QACxB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,oBAAoB,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,qBAAqB,EAAE,kCAAkC,EAAE,CAAC;IAC5D,eAAe,EAAE,YAAY,CAAC;CAC/B,CAAC;AAEF,eAAO,MAAM,qBAAqB,EAAE,YAA2C,CAAC;AAEhF,eAAO,MAAM,6BAA6B,EAAE,mBAI3C,CAAC;AA2FF,eAAO,MAAM,gBAAgB,EAAE,cAAc,EAge5C,CAAC;AAWF,eAAO,MAAM,8BAA8B,EAAE,kBAAkB,EAoF9D,CAAC;AAEF,wBAAgB,kBAAkB,IAAI,cAAc,EAAE,CAErD;AAED,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAGnE;AAED,wBAAgB,iBAAiB,CAC/B,SAAS,GAAE,iBAAsB,EACjC,UAAU,GAAE,iBAAsB,GACjC,YAAY,CAKd;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,iBAAiB,EAC5B,UAAU,EAAE,MAAM,GACjB,YAAY,CAQd;AAED,wBAAgB,iBAAiB,CAC/B,WAAW,GAAE,iBAAsB,EACnC,aAAa,GAAE,kBAAkB,EAAmC,GACnE,mBAAmB,EAAE,CA6BvB;AAED,wBAAgB,iBAAiB,CAC/B,WAAW,GAAE,iBAAsB,EACnC,aAAa,GAAE,kBAAkB,EAAmC,EACpE,MAAM,GAAE,mBAAmD,GAC1D,YAAY,CAmBd;AAED,wBAAgB,sBAAsB,CACpC,WAAW,GAAE,iBAAsB,EACnC,SAAS,GAAE,cAAc,EAAyB,EAClD,aAAa,GAAE,kBAAkB,EAAmC,GACnE,qBAAqB,EAAE,CAoDzB;AAED,wBAAgB,cAAc,CAC5B,WAAW,EAAE,OAAO,EACpB,WAAW,GAAE,iBAAsB,EACnC,OAAO,GAAE,uBAA4B,GACpC,cAAc,CAchB;AAED,wBAAgB,cAAc,CAC5B,WAAW,EAAE,OAAO,EACpB,WAAW,GAAE,iBAAsB,EACnC,OAAO,GAAE,uBAA4B,GACpC,gBAAgB,CAgClB;AAqPD;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,GAAE,iBAAsB,EACnC,OAAO,GAAE,qBAAqB,GAAG,SAAqB,GACrD,MAAM,EAAE,CAGV;AAED,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,OAAO,EACpB,WAAW,GAAE,iBAAsB,GAClC;IAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA4CzD;AAqRD,wBAAgB,cAAc,CAAC,WAAW,EAAE,OAAO,GAAG,yBAAyB,CAyB9E;AAED,wBAAgB,UAAU,CAAC,WAAW,EAAE,OAAO,GAAG,QAAQ,CASzD"}
|