@defai.digital/contracts 13.0.3

package/dist/file-system/v1/schema.js

@@ -0,0 +1,278 @@
+/**
+ * File System Contracts v1
+ *
+ * Defines schemas for file and directory operations with security invariants.
+ * Used by scaffold tools to write generated code to disk.
+ *
+ * @module @defai.digital/contracts/file-system/v1
+ */
+import { z } from 'zod';
+// ============================================================================
+// Path Validation
+// ============================================================================
+/**
+ * File path schema with security validation
+ *
+ * Invariants:
+ * - INV-FS-001: No path traversal allowed
+ */
+export const FilePathSchema = z
+    .string()
+    .min(1, 'Path cannot be empty')
+    .max(1000, 'Path too long')
+    .refine((path) => !path.includes('..'), 'Path traversal (..) not allowed')
+    .refine((path) => !path.includes('\0'), 'Null bytes not allowed in path');
+// ============================================================================
+// File Write Operations
+// ============================================================================
+/**
+ * File encoding options
+ */
+export const FileEncodingSchema = z.enum(['utf-8', 'ascii', 'base64', 'binary']);
+/**
+ * Request to write a file
+ *
+ * Invariants:
+ * - INV-FS-002: No silent overwrites (requires explicit flag)
+ * - INV-FS-004: UTF-8 default encoding
+ */
+export const FileWriteRequestSchema = z.object({
+    /** Relative path from workspace root */
+    path: FilePathSchema,
+    /** File content to write */
+    content: z.string(),
+    /** Create parent directories if they don't exist */
+    createDirectories: z.boolean().default(true),
+    /** Allow overwriting existing files */
+    overwrite: z.boolean().default(false),
+    /** File encoding */
+    encoding: FileEncodingSchema.default('utf-8'),
+    /** Optional backup before overwrite */
+    backup: z.boolean().default(false),
+});
+/**
+ * Result of file write operation
+ */
+export const FileWriteResultSchema = z.object({
+    /** Whether the operation succeeded */
+    success: z.boolean(),
+    /** Path that was written */
+    path: z.string(),
+    /** Number of bytes written */
+    bytesWritten: z.number().int().min(0),
+    /** Whether a new file was created */
+    created: z.boolean(),
+    /** Whether an existing file was overwritten */
+    overwritten: z.boolean(),
+    /** Backup path if backup was created */
+    backupPath: z.string().optional(),
+    /** Error details if operation failed */
+    error: z
+        .object({
+        code: z.string(),
+        message: z.string(),
+    })
+        .optional(),
+});
+// ============================================================================
+// Directory Operations
+// ============================================================================
+/**
+ * Request to create a directory
+ */
+export const DirectoryCreateRequestSchema = z.object({
+    /** Relative path from workspace root */
+    path: FilePathSchema,
+    /** Create parent directories if they don't exist */
+    recursive: z.boolean().default(true),
+});
+/**
+ * Result of directory creation
+ */
+export const DirectoryCreateResultSchema = z.object({
+    /** Whether the operation succeeded */
+    success: z.boolean(),
+    /** Path that was created */
+    path: z.string(),
+    /** Whether a new directory was created */
+    created: z.boolean(),
+    /** Whether the directory already existed */
+    existed: z.boolean(),
+    /** Error details if operation failed */
+    error: z
+        .object({
+        code: z.string(),
+        message: z.string(),
+    })
+        .optional(),
+});
+// ============================================================================
+// File Read Operations (for validation/preview)
+// ============================================================================
+/**
+ * Request to check if a file exists
+ */
+export const FileExistsRequestSchema = z.object({
+    /** Relative path from workspace root */
+    path: FilePathSchema,
+});
+/**
+ * Result of file existence check
+ */
+export const FileExistsResultSchema = z.object({
+    /** Path that was checked */
+    path: z.string(),
+    /** Whether the file exists */
+    exists: z.boolean(),
+    /** Whether it's a file (vs directory) */
+    isFile: z.boolean().optional(),
+    /** Whether it's a directory */
+    isDirectory: z.boolean().optional(),
+    /** File size in bytes (if exists and is file) */
+    size: z.number().int().min(0).optional(),
+});
+// ============================================================================
+// Batch Operations
+// ============================================================================
+/**
+ * Single file operation in a batch
+ */
+export const BatchFileOperationSchema = z.discriminatedUnion('operation', [
+    z.object({
+        operation: z.literal('write'),
+        path: FilePathSchema,
+        content: z.string(),
+        overwrite: z.boolean().default(false),
+    }),
+    z.object({
+        operation: z.literal('mkdir'),
+        path: FilePathSchema,
+        recursive: z.boolean().default(true),
+    }),
+]);
+/**
+ * Request for batch file operations
+ */
+export const BatchOperationRequestSchema = z.object({
+    /** List of operations to perform */
+    operations: z.array(BatchFileOperationSchema).min(1).max(100),
+    /** Stop on first error */
+    stopOnError: z.boolean().default(true),
+    /** Dry run - validate without executing */
+    dryRun: z.boolean().default(false),
+});
+/**
+ * Result of a single operation in a batch
+ */
+export const BatchOperationResultItemSchema = z.object({
+    /** Operation index in the batch */
+    index: z.number().int().min(0),
+    /** Path affected */
+    path: z.string(),
+    /** Whether operation succeeded */
+    success: z.boolean(),
+    /** Operation type */
+    operation: z.enum(['write', 'mkdir']),
+    /** Error if failed */
+    error: z
+        .object({
+        code: z.string(),
+        message: z.string(),
+    })
+        .optional(),
+});
+/**
+ * Result of batch operations
+ */
+export const BatchOperationResultSchema = z.object({
+    /** Overall success */
+    success: z.boolean(),
+    /** Total operations attempted */
+    total: z.number().int().min(0),
+    /** Successful operations */
+    succeeded: z.number().int().min(0),
+    /** Failed operations */
+    failed: z.number().int().min(0),
+    /** Individual results */
+    results: z.array(BatchOperationResultItemSchema),
+    /** Whether this was a dry run */
+    dryRun: z.boolean(),
+});
+// ============================================================================
+// Error Codes
+// ============================================================================
+/**
+ * File system error codes
+ */
+export const FileSystemErrorCode = {
+    /** Path contains traversal attempt */
+    PATH_TRAVERSAL: 'PATH_TRAVERSAL',
+    /** File already exists (and overwrite=false) */
+    FILE_EXISTS: 'FILE_EXISTS',
+    /** Permission denied */
+    PERMISSION_DENIED: 'PERMISSION_DENIED',
+    /** Invalid path format */
+    INVALID_PATH: 'INVALID_PATH',
+    /** Write operation failed */
+    WRITE_FAILED: 'WRITE_FAILED',
+    /** Directory creation failed */
+    MKDIR_FAILED: 'MKDIR_FAILED',
+    /** Path is outside workspace */
+    OUTSIDE_WORKSPACE: 'OUTSIDE_WORKSPACE',
+    /** Path is a symlink (not allowed) */
+    SYMLINK_NOT_ALLOWED: 'SYMLINK_NOT_ALLOWED',
+    /** Operation would affect too many files */
+    BATCH_LIMIT_EXCEEDED: 'BATCH_LIMIT_EXCEEDED',
+};
+// ============================================================================
+// Validation Functions
+// ============================================================================
+export function validateFileWriteRequest(data) {
+    return FileWriteRequestSchema.parse(data);
+}
+export function validateDirectoryCreateRequest(data) {
+    return DirectoryCreateRequestSchema.parse(data);
+}
+export function validateBatchOperationRequest(data) {
+    return BatchOperationRequestSchema.parse(data);
+}
+/**
+ * Check if a path is safe (no traversal, within workspace)
+ */
+export function isPathSafe(filePath) {
+    try {
+        FilePathSchema.parse(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// ============================================================================
+// MCP Tool Input/Output Schemas
+// ============================================================================
+/**
+ * file_write tool input schema
+ */
+export const FileWriteInputSchema = FileWriteRequestSchema;
+/**
+ * file_write tool output schema
+ */
+export const FileWriteOutputSchema = FileWriteResultSchema;
+/**
+ * directory_create tool input schema
+ */
+export const DirectoryCreateInputSchema = DirectoryCreateRequestSchema;
+/**
+ * directory_create tool output schema
+ */
+export const DirectoryCreateOutputSchema = DirectoryCreateResultSchema;
+/**
+ * file_exists tool input schema
+ */
+export const FileExistsInputSchema = FileExistsRequestSchema;
+/**
+ * file_exists tool output schema
+ */
+export const FileExistsOutputSchema = FileExistsResultSchema;
+//# sourceMappingURL=schema.js.map

package/dist/file-system/v1/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/file-system/v1/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC;KAC9B,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC;KAC1B,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAC9B,iCAAiC,CAClC;KACA,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAC9B,gCAAgC,CACjC,CAAC;AAIJ,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAIjF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,wCAAwC;IACxC,IAAI,EAAE,cAAc;IAEpB,4BAA4B;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IAEnB,oDAAoD;IACpD,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE5C,uCAAuC;IACvC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAErC,oBAAoB;IACpB,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC;IAE7C,uCAAuC;IACvC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACnC,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,sCAAsC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IAEpB,4BAA4B;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAEhB,8BAA8B;IAC9B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAErC,qCAAqC;IACrC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IAEpB,+CAA+C;IAC/C,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IAExB,wCAAwC;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjC,wCAAwC;IACxC,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;KACpB,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,wCAAwC;IACxC,IAAI,EAAE,cAAc;IAEpB,oDAAoD;IACpD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACrC,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,sCAAsC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IAEpB,4BAA4B;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAEhB,0CAA0C;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IAEpB,4CAA4C;IAC5C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IAEpB,wCAAwC;IACxC,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;KACpB,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH,+EAA+E;AAC/E,gDAAgD;AAChD,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,wCAAwC;IACxC,IAAI,EAAE,cAAc;CACrB,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,4BAA4B;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAEhB,8BAA8B;IAC9B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IAEnB,yCAAyC;IACzC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE9B,+BAA+B;IAC/B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEnC,iDAAiD;IACjD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAIH,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,kBAAkB,CAAC,WAAW,EAAE;IACxE,CAAC,CAAC,MAAM,CAAC;QACP,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC7B,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACtC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC7B,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACrC,CAAC;CACH,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,oCAAoC;IACpC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAE7D,0BAA0B;IAC1B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAEtC,2CAA2C;IAC3C,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACnC,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,mCAAmC;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9B,oBAAoB;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAEhB,kCAAkC;IAClC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IAEpB,qBAAqB;IACrB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAErC,sBAAsB;IACtB,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;KACpB,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,sBAAsB;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IAEpB,iCAAiC;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9B,4BAA4B;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAElC,wBAAwB;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/B,yBAAyB;IACzB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC;IAEhD,iCAAiC;IACjC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAIH,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,sCAAsC;IACtC,cAAc,EAAE,gBAAgB;IAEhC,gDAAgD;IAChD,WAAW,EAAE,aAAa;IAE1B,wBAAwB;IACxB,iBAAiB,EAAE,mBAAmB;IAEtC,0BAA0B;IAC1B,YAAY,EAAE,cAAc;IAE5B,6BAA6B;IAC7B,YAAY,EAAE,cAAc;IAE5B,gCAAgC;IAChC,YAAY,EAAE,cAAc;IAE5B,gCAAgC;IAChC,iBAAiB,EAAE,mBAAmB;IAEtC,sCAAsC;IACtC,mBAAmB,EAAE,qBAAqB;IAE1C,4CAA4C;IAC5C,oBAAoB,EAAE,sBAAsB;CACpC,CAAC;AAIX,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E,MAAM,UAAU,wBAAwB,CAAC,IAAa;IACpD,OAAO,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,IAAa;IAC1D,OAAO,4BAA4B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,IAAa;IACzD,OAAO,2BAA2B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,IAAI,CAAC;QACH,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,gCAAgC;AAChC,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE3D;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAE3D;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,4BAA4B,CAAC;AAEvE;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;AAEvE;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAE7D;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAC"}

package/dist/guard/v1/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * AX Guard Policy Contract V1
+ *
+ * Governance policy schemas for AI coding checks and agent behavior.
+ */
+export { PolicySchema, GateTypeSchema, ContractTypeSchema, validatePolicy, safeValidatePolicy, } from './schema.js';
+export type { Policy, GateType, ContractType } from './schema.js';
+export { AgentPolicySchema, PolicyActionSchema, PolicyCheckResultSchema, ResourceUsageSchema, LimitCheckResultSchema, AgentPolicyErrorCodes, validateAgentPolicy, createDefaultAgentPolicy, createRestrictiveAgentPolicy, type AgentPolicy, type PolicyAction, type PolicyCheckResult, type ResourceUsage, type LimitCheckResult, type AgentPolicyErrorCode, } from './schema.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/guard/v1/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/guard/v1/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGlE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,4BAA4B,EAC5B,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,GAC1B,MAAM,aAAa,CAAC"}

package/dist/guard/v1/index.js

@@ -0,0 +1,10 @@
+/**
+ * AX Guard Policy Contract V1
+ *
+ * Governance policy schemas for AI coding checks and agent behavior.
+ */
+// Code Change Policy
+export { PolicySchema, GateTypeSchema, ContractTypeSchema, validatePolicy, safeValidatePolicy, } from './schema.js';
+// Agent Behavior Policy
+export { AgentPolicySchema, PolicyActionSchema, PolicyCheckResultSchema, ResourceUsageSchema, LimitCheckResultSchema, AgentPolicyErrorCodes, validateAgentPolicy, createDefaultAgentPolicy, createRestrictiveAgentPolicy, } from './schema.js';
+//# sourceMappingURL=index.js.map

package/dist/guard/v1/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/guard/v1/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,qBAAqB;AACrB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAIrB,wBAAwB;AACxB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,4BAA4B,GAO7B,MAAM,aAAa,CAAC"}

package/dist/guard/v1/schema.d.ts

@@ -0,0 +1,308 @@
+/**
+ * AX Guard Policy Schema
+ *
+ * Zod schema for runtime validation of governance policies.
+ */
+import { z } from 'zod';
+/**
+ * Available gate types
+ */
+export declare const GateTypeSchema: z.ZodEnum<["path_violation", "dependency", "change_radius", "contract_tests", "config_validation", "sensitive_change", "secrets_detection", "agent_selection"]>;
+export type GateType = z.infer<typeof GateTypeSchema>;
+/**
+ * Available contract types for testing
+ */
+export declare const ContractTypeSchema: z.ZodEnum<["workflow", "workflow-templates", "ml-lifecycle", "routing", "memory", "trace", "mcp", "agent", "session", "config", "guard", "ability"]>;
+export type ContractType = z.infer<typeof ContractTypeSchema>;
+/**
+ * Policy schema for AI coding governance
+ */
+export declare const PolicySchema: z.ZodObject<{
+    /**
+     * Unique identifier for this policy
+     */
+    policyId: z.ZodString;
+    /**
+     * Glob patterns for paths that may be modified
+     * Supports {{variable}} placeholders
+     */
+    allowedPaths: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Glob patterns for paths that must not be modified
+     */
+    forbiddenPaths: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Contract test suites that must pass
+     */
+    requiredContracts: z.ZodDefault<z.ZodArray<z.ZodEnum<["workflow", "workflow-templates", "ml-lifecycle", "routing", "memory", "trace", "mcp", "agent", "session", "config", "guard", "ability"]>, "many">>;
+    /**
+     * Gates to execute for this policy
+     */
+    gates: z.ZodDefault<z.ZodArray<z.ZodEnum<["path_violation", "dependency", "change_radius", "contract_tests", "config_validation", "sensitive_change", "secrets_detection", "agent_selection"]>, "many">>;
+    /**
+     * Maximum number of packages that can be modified
+     */
+    changeRadiusLimit: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    gates: ("path_violation" | "dependency" | "change_radius" | "contract_tests" | "config_validation" | "sensitive_change" | "secrets_detection" | "agent_selection")[];
+    policyId: string;
+    allowedPaths: string[];
+    forbiddenPaths: string[];
+    changeRadiusLimit: number;
+    requiredContracts: ("memory" | "config" | "workflow" | "agent" | "session" | "trace" | "workflow-templates" | "ml-lifecycle" | "routing" | "mcp" | "guard" | "ability")[];
+}, {
+    policyId: string;
+    gates?: ("path_violation" | "dependency" | "change_radius" | "contract_tests" | "config_validation" | "sensitive_change" | "secrets_detection" | "agent_selection")[] | undefined;
+    allowedPaths?: string[] | undefined;
+    forbiddenPaths?: string[] | undefined;
+    changeRadiusLimit?: number | undefined;
+    requiredContracts?: ("memory" | "config" | "workflow" | "agent" | "session" | "trace" | "workflow-templates" | "ml-lifecycle" | "routing" | "mcp" | "guard" | "ability")[] | undefined;
+}>;
+export type Policy = z.infer<typeof PolicySchema>;
+/**
+ * Validates a policy object
+ */
+export declare function validatePolicy(data: unknown): Policy;
+/**
+ * Safely validates a policy object
+ */
+export declare function safeValidatePolicy(data: unknown): {
+    success: true;
+    data: Policy;
+} | {
+    success: false;
+    error: z.ZodError;
+};
+/**
+ * Agent behavior policy for controlling agent capabilities
+ *
+ * Invariants:
+ * - INV-AP-001: Policies merged by priority (higher wins)
+ * - INV-AP-002: Forbidden lists take precedence over allowed
+ * - INV-AP-003: Resource limits strictly enforced
+ */
+export declare const AgentPolicySchema: z.ZodObject<{
+    /** Policy identifier */
+    policyId: z.ZodString;
+    /** Agent this applies to (* for all) */
+    agentId: z.ZodDefault<z.ZodString>;
+    /** Team this applies to */
+    team: z.ZodOptional<z.ZodString>;
+    /** Can access memory domain */
+    canAccessMemory: z.ZodDefault<z.ZodBoolean>;
+    /** Can access session domain */
+    canAccessSessions: z.ZodDefault<z.ZodBoolean>;
+    /** Allowed memory namespaces (glob patterns) */
+    allowedMemoryNamespaces: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Forbidden memory namespaces */
+    forbiddenMemoryNamespaces: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Can delegate to other agents */
+    canDelegate: z.ZodDefault<z.ZodBoolean>;
+    /** Agents this can delegate to (patterns supported) */
+    allowedDelegates: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Agents this cannot delegate to */
+    forbiddenDelegates: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Maximum delegation depth */
+    maxDelegationDepth: z.ZodDefault<z.ZodNumber>;
+    /** Max tokens per request */
+    maxTokensPerRequest: z.ZodDefault<z.ZodNumber>;
+    /** Max requests per minute */
+    maxRequestsPerMinute: z.ZodDefault<z.ZodNumber>;
+    /** Max concurrent executions */
+    maxConcurrentExecutions: z.ZodDefault<z.ZodNumber>;
+    /** Max session duration in ms */
+    maxSessionDurationMs: z.ZodDefault<z.ZodNumber>;
+    /** Allowed capabilities (patterns) */
+    allowedCapabilities: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Forbidden capabilities */
+    forbiddenCapabilities: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Allowed MCP tools (patterns) */
+    allowedTools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Forbidden MCP tools */
+    forbiddenTools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Allowed paths (glob patterns) */
+    allowedPaths: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Forbidden paths (glob patterns) */
+    forbiddenPaths: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Policy enabled flag */
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    /** Priority for policy merging (INV-AP-001) */
+    priority: z.ZodDefault<z.ZodNumber>;
+    /** Policy description */
+    description: z.ZodOptional<z.ZodString>;
+    /** Policy tags */
+    tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+    policyId: string;
+    priority: number;
+    agentId: string;
+    allowedPaths: string[];
+    forbiddenPaths: string[];
+    maxDelegationDepth: number;
+    canAccessMemory: boolean;
+    canAccessSessions: boolean;
+    allowedMemoryNamespaces: string[];
+    forbiddenMemoryNamespaces: string[];
+    canDelegate: boolean;
+    allowedDelegates: string[];
+    forbiddenDelegates: string[];
+    maxTokensPerRequest: number;
+    maxRequestsPerMinute: number;
+    maxConcurrentExecutions: number;
+    maxSessionDurationMs: number;
+    allowedCapabilities: string[];
+    forbiddenCapabilities: string[];
+    allowedTools: string[];
+    forbiddenTools: string[];
+    description?: string | undefined;
+    team?: string | undefined;
+    tags?: string[] | undefined;
+}, {
+    policyId: string;
+    description?: string | undefined;
+    enabled?: boolean | undefined;
+    priority?: number | undefined;
+    agentId?: string | undefined;
+    allowedPaths?: string[] | undefined;
+    forbiddenPaths?: string[] | undefined;
+    team?: string | undefined;
+    maxDelegationDepth?: number | undefined;
+    tags?: string[] | undefined;
+    canAccessMemory?: boolean | undefined;
+    canAccessSessions?: boolean | undefined;
+    allowedMemoryNamespaces?: string[] | undefined;
+    forbiddenMemoryNamespaces?: string[] | undefined;
+    canDelegate?: boolean | undefined;
+    allowedDelegates?: string[] | undefined;
+    forbiddenDelegates?: string[] | undefined;
+    maxTokensPerRequest?: number | undefined;
+    maxRequestsPerMinute?: number | undefined;
+    maxConcurrentExecutions?: number | undefined;
+    maxSessionDurationMs?: number | undefined;
+    allowedCapabilities?: string[] | undefined;
+    forbiddenCapabilities?: string[] | undefined;
+    allowedTools?: string[] | undefined;
+    forbiddenTools?: string[] | undefined;
+}>;
+export type AgentPolicy = z.infer<typeof AgentPolicySchema>;
+/**
+ * Policy check action types
+ */
+export declare const PolicyActionSchema: z.ZodEnum<["accessMemory", "accessSession", "delegate", "useTool", "accessPath", "useCapability"]>;
+export type PolicyAction = z.infer<typeof PolicyActionSchema>;
+/**
+ * Policy check result
+ */
+export declare const PolicyCheckResultSchema: z.ZodObject<{
+    /** Whether action is allowed */
+    allowed: z.ZodBoolean;
+    /** Reason if not allowed */
+    reason: z.ZodOptional<z.ZodString>;
+    /** Policy that made the decision */
+    policyId: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    allowed: boolean;
+    policyId?: string | undefined;
+    reason?: string | undefined;
+}, {
+    allowed: boolean;
+    policyId?: string | undefined;
+    reason?: string | undefined;
+}>;
+export type PolicyCheckResult = z.infer<typeof PolicyCheckResultSchema>;
+/**
+ * Resource usage for limit checking
+ */
+export declare const ResourceUsageSchema: z.ZodObject<{
+    /** Tokens used in current request */
+    tokensThisRequest: z.ZodNumber;
+    /** Requests in current minute */
+    requestsThisMinute: z.ZodNumber;
+    /** Current concurrent executions */
+    concurrentExecutions: z.ZodNumber;
+    /** Session duration in ms */
+    sessionDurationMs: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    tokensThisRequest: number;
+    requestsThisMinute: number;
+    concurrentExecutions: number;
+    sessionDurationMs?: number | undefined;
+}, {
+    tokensThisRequest: number;
+    requestsThisMinute: number;
+    concurrentExecutions: number;
+    sessionDurationMs?: number | undefined;
+}>;
+export type ResourceUsage = z.infer<typeof ResourceUsageSchema>;
+/**
+ * Limit check result
+ */
+export declare const LimitCheckResultSchema: z.ZodObject<{
+    /** Whether within all limits */
+    withinLimits: z.ZodBoolean;
+    /** List of violated limits */
+    violations: z.ZodArray<z.ZodString, "many">;
+    /** Current limits */
+    limits: z.ZodObject<{
+        maxTokensPerRequest: z.ZodNumber;
+        maxRequestsPerMinute: z.ZodNumber;
+        maxConcurrentExecutions: z.ZodNumber;
+        maxSessionDurationMs: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        maxTokensPerRequest: number;
+        maxRequestsPerMinute: number;
+        maxConcurrentExecutions: number;
+        maxSessionDurationMs?: number | undefined;
+    }, {
+        maxTokensPerRequest: number;
+        maxRequestsPerMinute: number;
+        maxConcurrentExecutions: number;
+        maxSessionDurationMs?: number | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    withinLimits: boolean;
+    violations: string[];
+    limits: {
+        maxTokensPerRequest: number;
+        maxRequestsPerMinute: number;
+        maxConcurrentExecutions: number;
+        maxSessionDurationMs?: number | undefined;
+    };
+}, {
+    withinLimits: boolean;
+    violations: string[];
+    limits: {
+        maxTokensPerRequest: number;
+        maxRequestsPerMinute: number;
+        maxConcurrentExecutions: number;
+        maxSessionDurationMs?: number | undefined;
+    };
+}>;
+export type LimitCheckResult = z.infer<typeof LimitCheckResultSchema>;
+/**
+ * Agent policy error codes
+ */
+export declare const AgentPolicyErrorCodes: {
+    readonly POLICY_NOT_FOUND: "AGENT_POLICY_NOT_FOUND";
+    readonly ACCESS_DENIED: "AGENT_POLICY_ACCESS_DENIED";
+    readonly LIMIT_EXCEEDED: "AGENT_POLICY_LIMIT_EXCEEDED";
+    readonly DELEGATION_DENIED: "AGENT_POLICY_DELEGATION_DENIED";
+    readonly TOOL_DENIED: "AGENT_POLICY_TOOL_DENIED";
+    readonly PATH_DENIED: "AGENT_POLICY_PATH_DENIED";
+    readonly CAPABILITY_DENIED: "AGENT_POLICY_CAPABILITY_DENIED";
+};
+export type AgentPolicyErrorCode = (typeof AgentPolicyErrorCodes)[keyof typeof AgentPolicyErrorCodes];
+/**
+ * Validates agent policy
+ */
+export declare function validateAgentPolicy(data: unknown): AgentPolicy;
+/**
+ * Creates default agent policy (permissive)
+ */
+export declare function createDefaultAgentPolicy(agentId?: string): AgentPolicy;
+/**
+ * Creates restrictive agent policy
+ */
+export declare function createRestrictiveAgentPolicy(policyId: string, agentId?: string): AgentPolicy;
+//# sourceMappingURL=schema.d.ts.map

package/dist/guard/v1/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/guard/v1/schema.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB;;GAEG;AACH,eAAO,MAAM,cAAc,iKASzB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;GAEG;AACH,eAAO,MAAM,kBAAkB,sJAa7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,YAAY;IACvB;;OAEG;;IAKH;;;OAGG;;IAGH;;OAEG;;IAGH;;OAEG;;IAGH;;OAEG;;IAKH;;OAEG;;;;;;;;;;;;;;;;EAEH,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAElD;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,OAAO,GACZ;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAA;CAAE,CAMzE;AAMD;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB;IAC5B,wBAAwB;;IAGxB,wCAAwC;;IAGxC,2BAA2B;;IAK3B,+BAA+B;;IAG/B,gCAAgC;;IAGhC,gDAAgD;;IAGhD,kCAAkC;;IAKlC,mCAAmC;;IAGnC,uDAAuD;;IAGvD,qCAAqC;;IAGrC,+BAA+B;;IAK/B,6BAA6B;;IAG7B,8BAA8B;;IAG9B,gCAAgC;;IAGhC,iCAAiC;;IAUjC,sCAAsC;;IAGtC,6BAA6B;;IAK7B,mCAAmC;;IAGnC,0BAA0B;;IAK1B,oCAAoC;;IAGpC,sCAAsC;;IAKtC,0BAA0B;;IAG1B,+CAA+C;;IAG/C,yBAAyB;;IAGzB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAElB,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D;;GAEG;AACH,eAAO,MAAM,kBAAkB,oGAO7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,uBAAuB;IAClC,gCAAgC;;IAGhC,4BAA4B;;IAG5B,oCAAoC;;;;;;;;;;EAEpC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,mBAAmB;IAC9B,qCAAqC;;IAGrC,iCAAiC;;IAGjC,oCAAoC;;IAGpC,6BAA6B;;;;;;;;;;;;EAE7B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;GAEG;AACH,eAAO,MAAM,sBAAsB;IACjC,gCAAgC;;IAGhC,8BAA8B;;IAG9B,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOrB,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;CAQxB,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAC9B,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAC;AAErE;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,WAAW,CAE9D;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,SAAM,GAAG,WAAW,CAEnE;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,EAChB,OAAO,SAAM,GACZ,WAAW,CAyBb"}