@contractspec/bundle.library 3.8.10 → 3.8.11

package/dist/components/docs/specs/SpecsPolicyPage.js

@@ -1,123 +1,5 @@
 // @bun
-// src/components/docs/specs/SpecsPolicyPage.tsx
-import Link from "@contractspec/lib.ui-link";
-import { ChevronRight } from "lucide-react";
-import { jsx, jsxs } from "react/jsx-runtime";
-function SpecsPolicyPage() {
-  return /* @__PURE__ */ jsxs("div", {
-    className: "space-y-8",
-    children: [
-      /* @__PURE__ */ jsxs("div", {
-        className: "space-y-4",
-        children: [
-          /* @__PURE__ */ jsx("h1", {
-            className: "font-bold text-4xl",
-            children: "Policy"
-          }),
-          /* @__PURE__ */ jsxs("p", {
-            className: "text-muted-foreground",
-            children: [
-              "A ",
-              /* @__PURE__ */ jsx("strong", {
-                children: "PolicySpec"
-              }),
-              " defines who can do what, when, and under what conditions. ContractSpec uses attribute-based access control (ABAC) to enforce policies across your entire application\u2014from API endpoints to UI components."
-            ]
-          })
-        ]
-      }),
-      /* @__PURE__ */ jsxs("div", {
-        className: "space-y-4",
-        children: [
-          /* @__PURE__ */ jsx("h2", {
-            className: "font-bold text-2xl",
-            children: "Why policies matter"
-          }),
-          /* @__PURE__ */ jsx("p", {
-            className: "text-muted-foreground",
-            children: "Traditional access control relies on roles (RBAC), which can become unwieldy as applications grow. ABAC is more flexible\u2014it evaluates policies based on attributes of the user, resource, action, and context."
-          }),
-          /* @__PURE__ */ jsxs("p", {
-            className: "text-muted-foreground",
-            children: [
-              "ContractSpec's policy engine ensures that access control is consistent across all surfaces. You don't have to remember to add authorization checks in every API endpoint or UI component\u2014the",
-              " ",
-              /* @__PURE__ */ jsx(Link, {
-                href: "/docs/safety/pdp",
-                className: "text-violet-400 hover:text-violet-300",
-                children: "Policy Decision Point"
-              }),
-              " ",
-              "enforces policies automatically."
-            ]
-          })
-        ]
-      }),
-      /* @__PURE__ */ jsxs("div", {
-        className: "space-y-4",
-        children: [
-          /* @__PURE__ */ jsx("h2", {
-            className: "font-bold text-2xl",
-            children: "Policy structure"
-          }),
-          /* @__PURE__ */ jsx("p", {
-            className: "text-muted-foreground",
-            children: "A PolicySpec contains one or more rules. Each rule has:"
-          }),
-          /* @__PURE__ */ jsxs("ul", {
-            className: "list-inside list-disc space-y-2 text-muted-foreground",
-            children: [
-              /* @__PURE__ */ jsxs("li", {
-                children: [
-                  /* @__PURE__ */ jsx("strong", {
-                    children: "Effect"
-                  }),
-                  " \u2013 PERMIT, DENY, or REDACT"
-                ]
-              }),
-              /* @__PURE__ */ jsxs("li", {
-                children: [
-                  /* @__PURE__ */ jsx("strong", {
-                    children: "Condition"
-                  }),
-                  " \u2013 A boolean expression that determines when the rule applies"
-                ]
-              }),
-              /* @__PURE__ */ jsxs("li", {
-                children: [
-                  /* @__PURE__ */ jsx("strong", {
-                    children: "Scope"
-                  }),
-                  " \u2013 Which resources, actions, or fields the rule applies to"
-                ]
-              }),
-              /* @__PURE__ */ jsxs("li", {
-                children: [
-                  /* @__PURE__ */ jsx("strong", {
-                    children: "Priority"
-                  }),
-                  " \u2013 Rules are evaluated in priority order; the first matching rule wins"
-                ]
-              })
-            ]
-          })
-        ]
-      }),
-      /* @__PURE__ */ jsxs("div", {
-        className: "space-y-4",
-        children: [
-          /* @__PURE__ */ jsx("h2", {
-            className: "font-bold text-2xl",
-            children: "Example PolicySpec"
-          }),
-          /* @__PURE__ */ jsx("p", {
-            className: "text-muted-foreground",
-            children: "Here's a policy that controls access to customer data in TypeScript:"
-          }),
-          /* @__PURE__ */ jsx("div", {
-            className: "overflow-x-auto rounded-lg border border-border bg-background/50 p-4 font-mono text-muted-foreground text-sm",
-            children: /* @__PURE__ */ jsx("pre", {
-              children: `import { definePolicy } from '@contractspec/lib.contracts-spec';
+import z from"@contractspec/lib.ui-link";import{ChevronRight as A}from"lucide-react";import{jsx as q,jsxs as y}from"react/jsx-runtime";function E(){return y("div",{className:"space-y-8",children:[y("div",{className:"space-y-4",children:[q("h1",{className:"font-bold text-4xl",children:"Policy"}),y("p",{className:"text-muted-foreground",children:["A ",q("strong",{children:"PolicySpec"})," defines who can do what, when, and under what conditions. ContractSpec uses attribute-based access control (ABAC) to enforce policies across your entire application\u2014from API endpoints to UI components."]})]}),y("div",{className:"space-y-4",children:[q("h2",{className:"font-bold text-2xl",children:"Why policies matter"}),q("p",{className:"text-muted-foreground",children:"Traditional access control relies on roles (RBAC), which can become unwieldy as applications grow. ABAC is more flexible\u2014it evaluates policies based on attributes of the user, resource, action, and context."}),y("p",{className:"text-muted-foreground",children:["ContractSpec's policy engine ensures that access control is consistent across all surfaces. You don't have to remember to add authorization checks in every API endpoint or UI component\u2014the"," ",q(z,{href:"/docs/safety/pdp",className:"text-violet-400 hover:text-violet-300",children:"Policy Decision Point"})," ","enforces policies automatically."]})]}),y("div",{className:"space-y-4",children:[q("h2",{className:"font-bold text-2xl",children:"Policy structure"}),q("p",{className:"text-muted-foreground",children:"A PolicySpec contains one or more rules. Each rule has:"}),y("ul",{className:"list-inside list-disc space-y-2 text-muted-foreground",children:[y("li",{children:[q("strong",{children:"Effect"})," \u2013 PERMIT, DENY, or REDACT"]}),y("li",{children:[q("strong",{children:"Condition"})," \u2013 A boolean expression that determines when the rule applies"]}),y("li",{children:[q("strong",{children:"Scope"})," \u2013 Which resources, actions, or fields the rule applies to"]}),y("li",{children:[q("strong",{children:"Priority"})," \u2013 Rules are evaluated in priority order; the first matching rule wins"]})]})]}),y("div",{className:"space-y-4",children:[q("h2",{className:"font-bold text-2xl",children:"Example PolicySpec"}),q("p",{className:"text-muted-foreground",children:"Here's a policy that controls access to customer data in TypeScript:"}),q("div",{className:"overflow-x-auto rounded-lg border border-border bg-background/50 p-4 font-mono text-muted-foreground text-sm",children:q("pre",{children:`import { definePolicy } from '@contractspec/lib.contracts-spec';
 
 export const CustomerDataAccess = definePolicy({
   meta: {
@@ -159,181 +41,7 @@ export const CustomerDataAccess = definePolicy({
       redactFields: ['creditCard', 'ssn', 'bankAccount'],
     },
   ],
-});`
-            })
-          })
-        ]
-      }),
-      /* @__PURE__ */ jsxs("div", {
-        className: "space-y-4",
-        children: [
-          /* @__PURE__ */ jsx("h2", {
-            className: "font-bold text-2xl",
-            children: "Attributes"
-          }),
-          /* @__PURE__ */ jsx("p", {
-            className: "text-muted-foreground",
-            children: "Policy conditions can reference attributes from four categories:"
-          }),
-          /* @__PURE__ */ jsxs("div", {
-            className: "space-y-3",
-            children: [
-              /* @__PURE__ */ jsxs("div", {
-                children: [
-                  /* @__PURE__ */ jsx("h3", {
-                    className: "font-semibold text-lg",
-                    children: "User attributes"
-                  }),
-                  /* @__PURE__ */ jsxs("p", {
-                    className: "text-muted-foreground",
-                    children: [
-                      /* @__PURE__ */ jsx("code", {
-                        className: "rounded bg-background/50 px-2 py-1",
-                        children: "user.id"
-                      }),
-                      ",",
-                      " ",
-                      /* @__PURE__ */ jsx("code", {
-                        className: "rounded bg-background/50 px-2 py-1",
-                        children: "user.role"
-                      }),
-                      ",",
-                      " ",
-                      /* @__PURE__ */ jsx("code", {
-                        className: "rounded bg-background/50 px-2 py-1",
-                        children: "user.groups"
-                      }),
-                      ",",
-                      " ",
-                      /* @__PURE__ */ jsx("code", {
-                        className: "rounded bg-background/50 px-2 py-1",
-                        children: "user.department"
-                      }),
-                      ", custom attributes"
-                    ]
-                  })
-                ]
-              }),
-              /* @__PURE__ */ jsxs("div", {
-                children: [
-                  /* @__PURE__ */ jsx("h3", {
-                    className: "font-semibold text-lg",
-                    children: "Resource attributes"
-                  }),
-                  /* @__PURE__ */ jsxs("p", {
-                    className: "text-muted-foreground",
-                    children: [
-                      /* @__PURE__ */ jsx("code", {
-                        className: "rounded bg-background/50 px-2 py-1",
-                        children: "resource.type"
-                      }),
-                      ",",
-                      " ",
-                      /* @__PURE__ */ jsx("code", {
-                        className: "rounded bg-background/50 px-2 py-1",
-                        children: "resource.owner"
-                      }),
-                      ",",
-                      " ",
-                      /* @__PURE__ */ jsx("code", {
-                        className: "rounded bg-background/50 px-2 py-1",
-                        children: "resource.sensitivity"
-                      }),
-                      ", custom attributes"
-                    ]
-                  })
-                ]
-              }),
-              /* @__PURE__ */ jsxs("div", {
-                children: [
-                  /* @__PURE__ */ jsx("h3", {
-                    className: "font-semibold text-lg",
-                    children: "Action attributes"
-                  }),
-                  /* @__PURE__ */ jsxs("p", {
-                    className: "text-muted-foreground",
-                    children: [
-                      /* @__PURE__ */ jsx("code", {
-                        className: "rounded bg-background/50 px-2 py-1",
-                        children: "action"
-                      }),
-                      " ",
-                      "(read, write, delete, execute, export, etc.)"
-                    ]
-                  })
-                ]
-              }),
-              /* @__PURE__ */ jsxs("div", {
-                children: [
-                  /* @__PURE__ */ jsx("h3", {
-                    className: "font-semibold text-lg",
-                    children: "Context attributes"
-                  }),
-                  /* @__PURE__ */ jsxs("p", {
-                    className: "text-muted-foreground",
-                    children: [
-                      /* @__PURE__ */ jsx("code", {
-                        className: "rounded bg-background/50 px-2 py-1",
-                        children: "time.hour"
-                      }),
-                      ",",
-                      " ",
-                      /* @__PURE__ */ jsx("code", {
-                        className: "rounded bg-background/50 px-2 py-1",
-                        children: "time.dayOfWeek"
-                      }),
-                      ",",
-                      " ",
-                      /* @__PURE__ */ jsx("code", {
-                        className: "rounded bg-background/50 px-2 py-1",
-                        children: "request.ipAddress"
-                      }),
-                      ",",
-                      " ",
-                      /* @__PURE__ */ jsx("code", {
-                        className: "rounded bg-background/50 px-2 py-1",
-                        children: "request.userAgent"
-                      })
-                    ]
-                  })
-                ]
-              })
-            ]
-          })
-        ]
-      }),
-      /* @__PURE__ */ jsxs("div", {
-        className: "space-y-4",
-        children: [
-          /* @__PURE__ */ jsx("h2", {
-            className: "font-bold text-2xl",
-            children: "Data classification"
-          }),
-          /* @__PURE__ */ jsxs("p", {
-            className: "text-muted-foreground",
-            children: [
-              "You can tag fields with sensitivity levels in your",
-              " ",
-              /* @__PURE__ */ jsx(Link, {
-                href: "/docs/specs/capabilities",
-                className: "text-violet-400 hover:text-violet-300",
-                children: "CapabilitySpecs"
-              }),
-              " ",
-              "and",
-              " ",
-              /* @__PURE__ */ jsx(Link, {
-                href: "/docs/specs/dataviews",
-                className: "text-violet-400 hover:text-violet-300",
-                children: "DataViewSpecs"
-              }),
-              ":"
-            ]
-          }),
-          /* @__PURE__ */ jsx("div", {
-            className: "overflow-x-auto rounded-lg border border-border bg-background/50 p-4 font-mono text-muted-foreground text-sm",
-            children: /* @__PURE__ */ jsx("pre", {
-              children: `fields:
+});`})})]}),y("div",{className:"space-y-4",children:[q("h2",{className:"font-bold text-2xl",children:"Attributes"}),q("p",{className:"text-muted-foreground",children:"Policy conditions can reference attributes from four categories:"}),y("div",{className:"space-y-3",children:[y("div",{children:[q("h3",{className:"font-semibold text-lg",children:"User attributes"}),y("p",{className:"text-muted-foreground",children:[q("code",{className:"rounded bg-background/50 px-2 py-1",children:"user.id"}),","," ",q("code",{className:"rounded bg-background/50 px-2 py-1",children:"user.role"}),","," ",q("code",{className:"rounded bg-background/50 px-2 py-1",children:"user.groups"}),","," ",q("code",{className:"rounded bg-background/50 px-2 py-1",children:"user.department"}),", custom attributes"]})]}),y("div",{children:[q("h3",{className:"font-semibold text-lg",children:"Resource attributes"}),y("p",{className:"text-muted-foreground",children:[q("code",{className:"rounded bg-background/50 px-2 py-1",children:"resource.type"}),","," ",q("code",{className:"rounded bg-background/50 px-2 py-1",children:"resource.owner"}),","," ",q("code",{className:"rounded bg-background/50 px-2 py-1",children:"resource.sensitivity"}),", custom attributes"]})]}),y("div",{children:[q("h3",{className:"font-semibold text-lg",children:"Action attributes"}),y("p",{className:"text-muted-foreground",children:[q("code",{className:"rounded bg-background/50 px-2 py-1",children:"action"})," ","(read, write, delete, execute, export, etc.)"]})]}),y("div",{children:[q("h3",{className:"font-semibold text-lg",children:"Context attributes"}),y("p",{className:"text-muted-foreground",children:[q("code",{className:"rounded bg-background/50 px-2 py-1",children:"time.hour"}),","," ",q("code",{className:"rounded bg-background/50 px-2 py-1",children:"time.dayOfWeek"}),","," ",q("code",{className:"rounded bg-background/50 px-2 py-1",children:"request.ipAddress"}),","," ",q("code",{className:"rounded bg-background/50 px-2 py-1",children:"request.userAgent"})]})]})]})]}),y("div",{className:"space-y-4",children:[q("h2",{className:"font-bold text-2xl",children:"Data classification"}),y("p",{className:"text-muted-foreground",children:["You can tag fields with sensitivity levels in your"," ",q(z,{href:"/docs/specs/capabilities",className:"text-violet-400 hover:text-violet-300",children:"CapabilitySpecs"})," ","and"," ",q(z,{href:"/docs/specs/dataviews",className:"text-violet-400 hover:text-violet-300",children:"DataViewSpecs"}),":"]}),q("div",{className:"overflow-x-auto rounded-lg border border-border bg-background/50 p-4 font-mono text-muted-foreground text-sm",children:q("pre",{children:`fields:
   - name: email
     type: string
     sensitivity: PII
@@ -346,129 +54,4 @@ export const CustomerDataAccess = definePolicy({
     sensitivity: PHI
   - name: salary
     type: number
-    sensitivity: confidential`
-            })
-          }),
-          /* @__PURE__ */ jsx("p", {
-            className: "text-muted-foreground",
-            children: 'Policies can then reference these tags to enforce blanket rules like "support staff cannot see PII" or "PHI can only be accessed from approved IP addresses."'
-          })
-        ]
-      }),
-      /* @__PURE__ */ jsxs("div", {
-        className: "space-y-4",
-        children: [
-          /* @__PURE__ */ jsx("h2", {
-            className: "font-bold text-2xl",
-            children: "Testing policies"
-          }),
-          /* @__PURE__ */ jsx("p", {
-            className: "text-muted-foreground",
-            children: "ContractSpec provides tools for testing policies before deployment:"
-          }),
-          /* @__PURE__ */ jsxs("ul", {
-            className: "list-inside list-disc space-y-2 text-muted-foreground",
-            children: [
-              /* @__PURE__ */ jsxs("li", {
-                children: [
-                  /* @__PURE__ */ jsx("strong", {
-                    children: "Policy simulator"
-                  }),
-                  " \u2013 Test how policies evaluate for different users and scenarios"
-                ]
-              }),
-              /* @__PURE__ */ jsxs("li", {
-                children: [
-                  /* @__PURE__ */ jsx("strong", {
-                    children: "Coverage analysis"
-                  }),
-                  " \u2013 Identify resources or actions that aren't covered by any policy"
-                ]
-              }),
-              /* @__PURE__ */ jsxs("li", {
-                children: [
-                  /* @__PURE__ */ jsx("strong", {
-                    children: "Conflict detection"
-                  }),
-                  " \u2013 Find rules that might conflict or produce unexpected results"
-                ]
-              }),
-              /* @__PURE__ */ jsxs("li", {
-                children: [
-                  /* @__PURE__ */ jsx("strong", {
-                    children: "Audit mode"
-                  }),
-                  " \u2013 Run policies in audit-only mode to see what would be blocked without actually blocking it"
-                ]
-              })
-            ]
-          })
-        ]
-      }),
-      /* @__PURE__ */ jsxs("div", {
-        className: "space-y-4",
-        children: [
-          /* @__PURE__ */ jsx("h2", {
-            className: "font-bold text-2xl",
-            children: "Best practices"
-          }),
-          /* @__PURE__ */ jsxs("ul", {
-            className: "list-inside list-disc space-y-2 text-muted-foreground",
-            children: [
-              /* @__PURE__ */ jsx("li", {
-                children: "Start with a deny-by-default policy\u2014explicitly permit what should be allowed."
-              }),
-              /* @__PURE__ */ jsx("li", {
-                children: "Use clear, descriptive rule IDs that explain what the rule does."
-              }),
-              /* @__PURE__ */ jsx("li", {
-                children: "Set priorities carefully to ensure rules are evaluated in the right order."
-              }),
-              /* @__PURE__ */ jsx("li", {
-                children: "Test policies thoroughly with realistic user scenarios before deploying."
-              }),
-              /* @__PURE__ */ jsxs("li", {
-                children: [
-                  "Monitor policy decisions in production using",
-                  " ",
-                  /* @__PURE__ */ jsx(Link, {
-                    href: "/docs/safety/auditing",
-                    className: "text-violet-400 hover:text-violet-300",
-                    children: "audit logs"
-                  }),
-                  "."
-                ]
-              }),
-              /* @__PURE__ */ jsx("li", {
-                children: "Review and update policies regularly as your application and requirements evolve."
-              })
-            ]
-          })
-        ]
-      }),
-      /* @__PURE__ */ jsxs("div", {
-        className: "flex items-center gap-4 pt-4",
-        children: [
-          /* @__PURE__ */ jsx(Link, {
-            href: "/docs/specs/workflows",
-            className: "btn-ghost",
-            children: "Previous: Workflows"
-          }),
-          /* @__PURE__ */ jsxs(Link, {
-            href: "/docs/specs/overlays",
-            className: "btn-primary",
-            children: [
-              "Next: Overlays ",
-              /* @__PURE__ */ jsx(ChevronRight, {
-                size: 16
-              })
-            ]
-          })
-        ]
-      })
-    ]
-  });
-}
-export {
-  SpecsPolicyPage
-};
+    sensitivity: confidential`})}),q("p",{className:"text-muted-foreground",children:'Policies can then reference these tags to enforce blanket rules like "support staff cannot see PII" or "PHI can only be accessed from approved IP addresses."'})]}),y("div",{className:"space-y-4",children:[q("h2",{className:"font-bold text-2xl",children:"Testing policies"}),q("p",{className:"text-muted-foreground",children:"ContractSpec provides tools for testing policies before deployment:"}),y("ul",{className:"list-inside list-disc space-y-2 text-muted-foreground",children:[y("li",{children:[q("strong",{children:"Policy simulator"})," \u2013 Test how policies evaluate for different users and scenarios"]}),y("li",{children:[q("strong",{children:"Coverage analysis"})," \u2013 Identify resources or actions that aren't covered by any policy"]}),y("li",{children:[q("strong",{children:"Conflict detection"})," \u2013 Find rules that might conflict or produce unexpected results"]}),y("li",{children:[q("strong",{children:"Audit mode"})," \u2013 Run policies in audit-only mode to see what would be blocked without actually blocking it"]})]})]}),y("div",{className:"space-y-4",children:[q("h2",{className:"font-bold text-2xl",children:"Best practices"}),y("ul",{className:"list-inside list-disc space-y-2 text-muted-foreground",children:[q("li",{children:"Start with a deny-by-default policy\u2014explicitly permit what should be allowed."}),q("li",{children:"Use clear, descriptive rule IDs that explain what the rule does."}),q("li",{children:"Set priorities carefully to ensure rules are evaluated in the right order."}),q("li",{children:"Test policies thoroughly with realistic user scenarios before deploying."}),y("li",{children:["Monitor policy decisions in production using"," ",q(z,{href:"/docs/safety/auditing",className:"text-violet-400 hover:text-violet-300",children:"audit logs"}),"."]}),q("li",{children:"Review and update policies regularly as your application and requirements evolve."})]})]}),y("div",{className:"flex items-center gap-4 pt-4",children:[q(z,{href:"/docs/specs/workflows",className:"btn-ghost",children:"Previous: Workflows"}),y(z,{href:"/docs/specs/overlays",className:"btn-primary",children:["Next: Overlays ",q(A,{size:16})]})]})]})}export{E as SpecsPolicyPage};