@axtary/policy 0.1.0 → 0.3.0

package/dist/parity.js

@@ -0,0 +1,348 @@
+import { analyzePostgresSelect, hashAction, hashPayload, NormalizedActionSchema, } from "@axtary/actionpass";
+import { DEFAULT_POLICY_CONFIG, evaluateProvenanceGuard, mergePolicyConfig, toCedarRequest, toOpaInput, } from "./index.js";
+export const PARITY_DECISIONS = ["allow", "deny", "step_up"];
+export const AGENTCORE_CEDAR_EXPORT_SCHEMA_VERSION = "axtary.agentcore_cedar_export.v0";
+/**
+ * Cedar cannot quantify over sets ("any file starts with prefix"), count
+ * elements, or split strings, so — per Cedar's own guidance — those become
+ * precomputed context attributes. Everything else (branch equality, channel
+ * allowlists, status step-up, missing-field checks) stays in the Cedar
+ * policies themselves, driven by `context.config`.
+ */
+export function buildCedarParityRequest(actionInput, configInput) {
+    const action = NormalizedActionSchema.parse(actionInput);
+    const config = mergePolicyConfig(DEFAULT_POLICY_CONFIG, configInput);
+    const base = toCedarRequest(action);
+    const payload = stripNulls(action.capability.payload);
+    return {
+        principal: base.principal,
+        action: base.action,
+        resource: base.resource,
+        context: {
+            task_id: action.intent.taskId,
+            declared_goal: action.intent.declaredGoal,
+            runtime: action.actor.runtime,
+            human_owner: action.actor.humanOwner,
+            payload,
+            config: cedarConfigContext(config),
+            derived: cedarDerivedContext(action, config),
+        },
+    };
+}
+export function buildAgentCoreCedarAuthorizationRequest(actionInput, input = {}) {
+    const action = NormalizedActionSchema.parse(actionInput);
+    const payload = stripNulls(action.capability.payload);
+    const tags = {
+        agent_id: action.actor.agentId,
+        human_owner: action.actor.humanOwner,
+        runtime: action.actor.runtime,
+    };
+    if (action.actor.tenant) {
+        tags.tenant = action.actor.tenant;
+    }
+    return {
+        schemaVersion: AGENTCORE_CEDAR_EXPORT_SCHEMA_VERSION,
+        principal: {
+            type: "AgentCore::OAuthUser",
+            tags,
+        },
+        action: {
+            type: "AgentCore::Action",
+            id: agentCoreActionId(action.capability.tool),
+        },
+        resource: {
+            type: "AgentCore::Gateway",
+            id: input.gatewayResource ??
+                "arn:aws:bedrock-agentcore:local:000000000000:gateway/axtary-local",
+        },
+        context: {
+            input: payload,
+            axtary: {
+                actionHash: hashAction(action),
+                payloadHash: hashPayload(action.capability.payload),
+                tool: action.capability.tool,
+                resource: action.capability.resource,
+                taskId: action.intent.taskId,
+                policyVersion: input.policyVersion ?? DEFAULT_POLICY_CONFIG.version,
+            },
+        },
+    };
+}
+export function buildAgentCoreCedarExport(input) {
+    return {
+        schemaVersion: AGENTCORE_CEDAR_EXPORT_SCHEMA_VERSION,
+        status: "offline_mapping",
+        gatewayResource: input.gatewayResource ??
+            "arn:aws:bedrock-agentcore:local:000000000000:gateway/axtary-local",
+        note: "Offline Cedar-shaped AgentCore Gateway request mapping. This is not a deployed AWS AgentCore policy engine.",
+        fixtures: input.fixtures.map((fixture) => ({
+            fixtureId: fixture.id,
+            request: buildAgentCoreCedarAuthorizationRequest(fixture.action, {
+                gatewayResource: input.gatewayResource,
+                policyVersion: input.policyVersion,
+            }),
+        })),
+    };
+}
+function agentCoreActionId(tool) {
+    return tool.replace(/[^A-Za-z0-9]+/g, "___");
+}
+function cedarConfigContext(config) {
+    return {
+        required_base_branch: config.github.pullRequests.requiredBaseBranch,
+        max_files_changed: config.github.pullRequests.maxFilesChanged,
+        requires_tests: config.github.pullRequests.requiresTests,
+        allowed_channels: config.slack.messages.allowedChannels,
+        step_up_external_recipients: config.slack.messages.stepUpExternalRecipients,
+        allowed_project_keys: config.issueTrackers.linear.allowedProjectKeys,
+        step_up_statuses: config.issueTrackers.linear.stepUpStatuses,
+        postgres_allowed_databases: config.postgres.reads.allowedDatabases,
+        postgres_allowed_tables: config.postgres.reads.allowedTables,
+        postgres_allowed_functions: config.postgres.reads.allowedFunctions,
+        postgres_max_rows: config.postgres.reads.maxRows,
+        postgres_require_predicate: config.postgres.reads.requirePredicate,
+        drive_allowed_file_ids: config.drive.reads.allowedFileIds,
+        drive_max_read_bytes: config.drive.reads.maxReadBytes,
+    };
+}
+function cedarDerivedContext(action, config) {
+    const payload = action.capability.payload;
+    const prPolicy = config.github.pullRequests;
+    const filesChanged = stringArray(payload.filesChanged);
+    const path = typeof payload.path === "string" ? payload.path : undefined;
+    const issueKey = typeof payload.issueKey === "string" ? payload.issueKey : undefined;
+    const projectKey = typeof payload.projectKey === "string"
+        ? payload.projectKey
+        : issueKey?.split("-", 1)[0];
+    const postgres = postgresDerivedContext(action, config);
+    const drive = driveDerivedContext(action, config);
+    return {
+        files_changed_count: filesChanged.length,
+        any_file_in_deny_paths: anyPrefix(filesChanged, prPolicy.denyPathPrefixes),
+        any_file_in_step_up_paths: anyPrefix(filesChanged, prPolicy.stepUpPathPrefixes),
+        path_in_deny_read_paths: path
+            ? anyPrefix([path], config.github.contents.denyReadPathPrefixes)
+            : false,
+        path_in_deny_paths: path ? anyPrefix([path], prPolicy.denyPathPrefixes) : false,
+        path_in_step_up_paths: path ? anyPrefix([path], prPolicy.stepUpPathPrefixes) : false,
+        external_recipients_count: stringArray(payload.externalRecipients).length,
+        ...postgres,
+        ...drive,
+        ...(projectKey ? { project_key: projectKey } : {}),
+    };
+}
+function driveDerivedContext(action, config) {
+    if (action.capability.tool !== "drive.files.read")
+        return {};
+    const fileId = typeof action.capability.payload.fileId === "string"
+        ? action.capability.payload.fileId
+        : "";
+    const maxBytes = typeof action.capability.payload.maxBytes === "number"
+        ? action.capability.payload.maxBytes
+        : 0;
+    return {
+        drive_payload_valid: fileId.length > 0 && Number.isInteger(maxBytes) && maxBytes > 0,
+        drive_resource_matches: action.capability.resource === `drive:file:${fileId}`,
+        drive_file_allowed: config.drive.reads.allowedFileIds.includes(fileId),
+        drive_byte_limit_ok: Number.isInteger(maxBytes) &&
+            maxBytes > 0 &&
+            maxBytes <= config.drive.reads.maxReadBytes,
+    };
+}
+function postgresDerivedContext(action, config) {
+    if (action.capability.tool !== "postgres.query.select")
+        return {};
+    const statement = typeof action.capability.payload.statement === "string"
+        ? action.capability.payload.statement
+        : "";
+    const parameters = Array.isArray(action.capability.payload.parameters)
+        ? action.capability.payload.parameters
+        : [];
+    const maxRows = typeof action.capability.payload.maxRows === "number"
+        ? action.capability.payload.maxRows
+        : 0;
+    const analyzed = analyzePostgresSelect(statement);
+    if (!analyzed.ok) {
+        return {
+            postgres_parse_ok: false,
+            postgres_has_predicate: false,
+            postgres_parameter_count_match: false,
+            postgres_database_allowed: false,
+            postgres_tables_allowed: false,
+            postgres_tables_qualified: false,
+            postgres_functions_allowed: false,
+            postgres_row_limit_ok: false,
+        };
+    }
+    const { analysis } = analyzed;
+    return {
+        postgres_parse_ok: true,
+        postgres_has_predicate: analysis.hasPredicate,
+        postgres_parameter_count_match: analysis.parameterCount === parameters.length,
+        postgres_database_allowed: config.postgres.reads.allowedDatabases.includes(action.capability.resource),
+        postgres_tables_allowed: analysis.tables.every((table) => config.postgres.reads.allowedTables.includes(table)),
+        postgres_tables_qualified: analysis.tables.every((table) => table.includes(".")),
+        postgres_functions_allowed: analysis.functions.every((functionName) => config.postgres.reads.allowedFunctions.includes(functionName)),
+        postgres_row_limit_ok: Number.isInteger(maxRows) &&
+            maxRows > 0 &&
+            maxRows <= config.postgres.reads.maxRows,
+    };
+}
+/**
+ * Parses @id/@decision/@reason annotations from a Cedar policy file, in
+ * statement order, so Cedar's index-based determining-policy ids ("policy0")
+ * can be mapped back to native decisions and reason strings.
+ */
+export function parseCedarPolicyMeta(policiesText) {
+    const statements = policiesText
+        .split(";")
+        .map((statement) => statement.trim())
+        .filter((statement) => /(^|\n)\s*(@\w+\("[^"]*"\)\s*)*\b(permit|forbid)\s*\(/.test(statement));
+    return statements.map((statement, index) => {
+        const id = statement.match(/@id\("([^"]+)"\)/)?.[1] ?? `policy${index}`;
+        const effect = /\bforbid\s*\(/.test(statement) ? "forbid" : "permit";
+        const annotatedDecision = statement.match(/@decision\("([^"]+)"\)/)?.[1];
+        const reason = statement.match(/@reason\("([^"]+)"\)/)?.[1];
+        return {
+            id,
+            effect,
+            decision: effect === "forbid"
+                ? "deny"
+                : annotatedDecision === "step_up"
+                    ? "step_up"
+                    : "allow",
+            reason,
+        };
+    });
+}
+/**
+ * Maps a Cedar authorization response onto the native decision model:
+ * any determining forbid => deny; otherwise an allow whose determining
+ * policies include a @decision("step_up") permit => step_up; plain allow
+ * => allow; no matching policy at all => fail-closed deny.
+ */
+export function mapCedarResponse(response, meta) {
+    const metaById = new Map(meta.map((entry, index) => [`policy${index}`, entry]));
+    const determining = response.determiningPolicies
+        .map((policyId) => metaById.get(policyId))
+        .filter((entry) => entry !== undefined);
+    if (response.decision === "deny") {
+        const reasons = determining
+            .filter((entry) => entry.effect === "forbid")
+            .map((entry) => entry.reason ?? entry.id);
+        return {
+            decision: "deny",
+            reasons: reasons.length > 0 ? reasons.sort() : ["no_matching_policy"],
+        };
+    }
+    const stepUps = determining.filter((entry) => entry.decision === "step_up");
+    if (stepUps.length > 0) {
+        return {
+            decision: "step_up",
+            reasons: stepUps.map((entry) => entry.reason ?? entry.id).sort(),
+        };
+    }
+    return {
+        decision: "allow",
+        reasons: determining.map((entry) => entry.reason ?? entry.id).sort(),
+    };
+}
+/**
+ * Evaluates an action against a Cedar policy set using @cedar-policy/cedar-wasm.
+ * The engine is an optional dependency: install it (devDependency in this
+ * repo) before calling, or this throws `cedar_engine_unavailable`.
+ */
+export async function evaluateCedarParity(input) {
+    let cedar;
+    try {
+        cedar = await import("@cedar-policy/cedar-wasm/nodejs");
+    }
+    catch {
+        throw new Error("cedar_engine_unavailable:install @cedar-policy/cedar-wasm");
+    }
+    const request = buildCedarParityRequest(input.action, input.config);
+    const result = cedar.isAuthorized({
+        ...request,
+        policies: { staticPolicies: input.policiesText },
+        entities: [],
+    });
+    if (result.type !== "success") {
+        throw new Error(`cedar_evaluation_failed:${JSON.stringify(result)}`);
+    }
+    const meta = parseCedarPolicyMeta(input.policiesText);
+    return applyParityProvenance(input.action, input.config, mapCedarResponse({
+        decision: result.response.decision === "allow" ? "allow" : "deny",
+        determiningPolicies: result.response.diagnostics.reason,
+        errors: result.response.diagnostics.errors.map((error) => typeof error === "string" ? error : JSON.stringify(error)),
+    }, meta));
+}
+/**
+ * Loads a compiled Rego wasm bundle (built with `opa build -t wasm
+ * -e axtary/policy/result`) using @open-policy-agent/opa-wasm and binds the
+ * policy config as `data.axtary.config`.
+ */
+export async function loadRegoParityEvaluator(input) {
+    let opa;
+    try {
+        opa = await import("@open-policy-agent/opa-wasm");
+    }
+    catch {
+        throw new Error("rego_engine_unavailable:install @open-policy-agent/opa-wasm");
+    }
+    const policy = await opa.loadPolicy(input.wasm);
+    const config = mergePolicyConfig(DEFAULT_POLICY_CONFIG, input.config);
+    policy.setData({ axtary: { config } });
+    return {
+        evaluate(action) {
+            const normalizedAction = NormalizedActionSchema.parse(action);
+            const output = policy.evaluate({
+                ...toOpaInput(normalizedAction).input,
+                derived: cedarDerivedContext(normalizedAction, config),
+            });
+            const result = output[0]?.result;
+            if (!result ||
+                !PARITY_DECISIONS.includes(result.decision) ||
+                !Array.isArray(result.reasons)) {
+                throw new Error(`rego_evaluation_malformed:${JSON.stringify(output)}`);
+            }
+            return applyParityProvenance(action, config, {
+                decision: result.decision,
+                reasons: [...result.reasons].sort(),
+            });
+        },
+    };
+}
+function applyParityProvenance(action, config, base) {
+    if (base.decision === "deny")
+        return base;
+    const guard = evaluateProvenanceGuard(action, config ?? {});
+    if (!guard)
+        return base;
+    if (guard.decision === "deny") {
+        return { decision: "deny", reasons: [guard.reason] };
+    }
+    return {
+        decision: "step_up",
+        reasons: [...new Set([...base.reasons, guard.reason])].sort(),
+    };
+}
+function anyPrefix(paths, prefixes) {
+    return paths.some((path) => prefixes.some((prefix) => path.startsWith(prefix)));
+}
+function stringArray(value) {
+    return Array.isArray(value)
+        ? value.filter((entry) => typeof entry === "string")
+        : [];
+}
+function stripNulls(value) {
+    if (Array.isArray(value)) {
+        return value.map((entry) => stripNulls(entry));
+    }
+    if (value !== null && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value)
+            .filter(([, entry]) => entry !== null)
+            .map(([key, entry]) => [key, stripNulls(entry)]));
+    }
+    return value;
+}
+//# sourceMappingURL=parity.js.map

package/dist/parity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parity.js","sourceRoot":"","sources":["../src/parity.ts"],"names":[],"mappings":"AACA,OAAO,EACL,qBAAqB,EACrB,UAAU,EACV,WAAW,EACX,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,cAAc,EACd,UAAU,GAGX,MAAM,YAAY,CAAC;AAEpB,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AAetE,MAAM,CAAC,MAAM,qCAAqC,GAChD,kCAAkC,CAAC;AA0CrC;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAoB,EACpB,WAA+B;IAE/B,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,iBAAiB,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAA8B,CAAC;IAEnF,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE;YACP,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;YAC7B,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY;YACzC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;YAC7B,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;YACpC,OAAO;YACP,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC;YAClC,OAAO,EAAE,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC;SAC7C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,WAAoB,EACpB,QAGI,EAAE;IAEN,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAA8B,CAAC;IACnF,MAAM,IAAI,GAA2B;QACnC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;QAC9B,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;QACpC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;KAC9B,CAAC;IAEF,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;IACpC,CAAC;IAED,OAAO;QACL,aAAa,EAAE,qCAAqC;QACpD,SAAS,EAAE;YACT,IAAI,EAAE,sBAAsB;YAC5B,IAAI;SACL;QACD,MAAM,EAAE;YACN,IAAI,EAAE,mBAAmB;YACzB,EAAE,EAAE,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;SAC9C;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,oBAAoB;YAC1B,EAAE,EACA,KAAK,CAAC,eAAe;gBACrB,mEAAmE;SACtE;QACD,OAAO,EAAE;YACP,KAAK,EAAE,OAAO;YACd,MAAM,EAAE;gBACN,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC;gBAC9B,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;gBACnD,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI;gBAC5B,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ;gBACpC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;gBAC5B,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,qBAAqB,CAAC,OAAO;aACpE;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAIzC;IACC,OAAO;QACL,aAAa,EAAE,qCAAqC;QACpD,MAAM,EAAE,iBAAiB;QACzB,eAAe,EACb,KAAK,CAAC,eAAe;YACrB,mEAAmE;QACrE,IAAI,EACF,6GAA6G;QAC/G,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACzC,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,OAAO,EAAE,uCAAuC,CAAC,OAAO,CAAC,MAAM,EAAE;gBAC/D,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC,CAAC;SACH,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAoB;IAC9C,OAAO;QACL,oBAAoB,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,kBAAkB;QACnE,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,eAAe;QAC7D,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa;QACxD,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe;QACvD,2BAA2B,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,wBAAwB;QAC3E,oBAAoB,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB;QACpE,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,cAAc;QAC5D,0BAA0B,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB;QAClE,uBAAuB,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa;QAC5D,0BAA0B,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB;QAClE,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;QAChD,0BAA0B,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB;QAClE,sBAAsB,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc;QACzD,oBAAoB,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAwB,EAAE,MAAoB;IACzE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;IAC5C,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,MAAM,UAAU,GACd,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ;QACpC,CAAC,CAAC,OAAO,CAAC,UAAU;QACpB,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElD,OAAO;QACL,mBAAmB,EAAE,YAAY,CAAC,MAAM;QACxC,sBAAsB,EAAE,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QAC1E,yBAAyB,EAAE,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,kBAAkB,CAAC;QAC/E,uBAAuB,EAAE,IAAI;YAC3B,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YAChE,CAAC,CAAC,KAAK;QACT,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK;QAC/E,qBAAqB,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,KAAK;QACpF,yBAAyB,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,MAAM;QACzE,GAAG,QAAQ;QACX,GAAG,KAAK;QACR,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAwB,EACxB,MAAoB;IAEpB,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,kBAAkB;QAAE,OAAO,EAAE,CAAC;IAC7D,MAAM,MAAM,GACV,OAAO,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ;QAClD,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM;QAClC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,QAAQ,GACZ,OAAO,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ;QACpD,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ;QACpC,CAAC,CAAC,CAAC,CAAC;IACR,OAAO;QACL,mBAAmB,EACjB,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;QACjE,sBAAsB,EACpB,MAAM,CAAC,UAAU,CAAC,QAAQ,KAAK,cAAc,MAAM,EAAE;QACvD,kBAAkB,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;QACtE,mBAAmB,EACjB,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC1B,QAAQ,GAAG,CAAC;YACZ,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,MAAwB,EACxB,MAAoB;IAEpB,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,uBAAuB;QAAE,OAAO,EAAE,CAAC;IAClE,MAAM,SAAS,GACb,OAAO,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,KAAK,QAAQ;QACrD,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS;QACrC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC;QACpE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU;QACtC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,OAAO,GACX,OAAO,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ;QACnD,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO;QACnC,CAAC,CAAC,CAAC,CAAC;IACR,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,iBAAiB,EAAE,KAAK;YACxB,sBAAsB,EAAE,KAAK;YAC7B,8BAA8B,EAAE,KAAK;YACrC,yBAAyB,EAAE,KAAK;YAChC,uBAAuB,EAAE,KAAK;YAC9B,yBAAyB,EAAE,KAAK;YAChC,0BAA0B,EAAE,KAAK;YACjC,qBAAqB,EAAE,KAAK;SAC7B,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IAC9B,OAAO;QACL,iBAAiB,EAAE,IAAI;QACvB,sBAAsB,EAAE,QAAQ,CAAC,YAAY;QAC7C,8BAA8B,EAC5B,QAAQ,CAAC,cAAc,KAAK,UAAU,CAAC,MAAM;QAC/C,yBAAyB,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CACxE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAC3B;QACD,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACvD,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CACpD;QACD,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACzD,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CACpB;QACD,0BAA0B,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,EAAE,CACpE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAC9D;QACD,qBAAqB,EACnB,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;YACzB,OAAO,GAAG,CAAC;YACX,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;KAC3C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,MAAM,UAAU,GAAG,YAAY;SAC5B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;SACpC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACpB,sDAAsD,CAAC,IAAI,CAAC,SAAS,CAAC,CACvE,CAAC;IAEJ,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;QACzC,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,KAAK,EAAE,CAAC;QACxE,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAE,QAAkB,CAAC,CAAC,CAAE,QAAkB,CAAC;QAC3F,MAAM,iBAAiB,GAAG,SAAS,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAE5D,OAAO;YACL,EAAE;YACF,MAAM;YACN,QAAQ,EACN,MAAM,KAAK,QAAQ;gBACjB,CAAC,CAAE,MAAgB;gBACnB,CAAC,CAAC,iBAAiB,KAAK,SAAS;oBAC/B,CAAC,CAAE,SAAmB;oBACtB,CAAC,CAAE,OAAiB;YAC1B,MAAM;SACP,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA6B,EAC7B,IAAuB;IAEvB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,WAAW,GAAG,QAAQ,CAAC,mBAAmB;SAC7C,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;SACzC,MAAM,CAAC,CAAC,KAAK,EAA4B,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAEpE,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,WAAW;aACxB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC;aAC5C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC;QAE5C,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;SACtE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAE5E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE;SACjE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE;KACrE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAIzC;IACC,IAAI,KAAuD,CAAC;IAE5D,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC;QAChC,GAAG,OAAO;QACV,QAAQ,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,YAAY,EAAE;QAChD,QAAQ,EAAE,EAAE;KACb,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAEtD,OAAO,qBAAqB,CAC1B,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,MAAM,EACZ,gBAAgB,CACd;QACE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;QACjE,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM;QACvD,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACvD,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAC1D;KACF,EACD,IAAI,CACL,CACF,CAAC;AACJ,CAAC;AAMD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAG7C;IACC,IAAI,GAAiD,CAAC;IAEtD,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAEvC,OAAO;QACL,QAAQ,CAAC,MAAe;YACtB,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC;gBAC7B,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC,KAAK;gBACrC,OAAO,EAAE,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,CAAC;aACvD,CAEC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;YAEjC,IACE,CAAC,MAAM;gBACP,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAA0B,CAAC;gBAC7D,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAC9B,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,OAAO,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE;gBAC3C,QAAQ,EAAE,MAAM,CAAC,QAA0B;gBAC3C,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAe,EACf,MAAqC,EACrC,IAAwB;IAExB,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,uBAAuB,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;KAC9D,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAe,EAAE,QAAkB;IACpD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,WAAW,CAAC,KAA4B;IAC/C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,UAAU,CAAC,KAAgB;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aAClB,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CACnD,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axtary/policy",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "private": false,
   "description": "Deterministic policy evaluation and Cedar/OPA mappings for Axtary agent actions.",
   "type": "module",
@@ -37,11 +37,19 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./parity": {
+      "types": "./dist/parity.d.ts",
+      "import": "./dist/parity.js"
+    },
+    "./acs": {
+      "types": "./dist/acs.d.ts",
+      "import": "./dist/acs.js"
     }
   },
   "types": "./dist/index.d.ts",
   "dependencies": {
-    "@axtary/actionpass": "^0.1.0",
+    "@axtary/actionpass": "^0.3.0",
     "zod": "^4.4.3"
   }
 }