npm - @guardbee/guard-core - Versions diffs - 0.2.1 → 0.4.0 - Mend

@guardbee/guard-core 0.2.1 → 0.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (20) hide show

package/README.md CHANGED Viewed

@@ -15,6 +15,7 @@ It exists so the same rule runs everywhere: a static scanner flagging a pattern
 | `isValidTcKimlik`, `isValidVkn`, `isValidIban`, `isValidLuhn`, `isValidTrPhone` | security-proxy, prompt-leak-scanner | Validation after a regex match |
 | `INJECTION_RULES`, `findInjections` | prompt-injection-scanner, security-proxy | 27 injection rules in English and Turkish, with base64-decoding; the scanner uses the 17 precise ones |
 | `scanForPromptInjection`, `scanToolResult` | security-proxy | Block on a precise high/critical rule, warn on anything else |
+| `gatewayPolicySchema`, `validatePolicy`, `policyShape` | security-proxy, app.guardbee.ai | The gateway policy document (labels, rules, taint, approval, defaults, interceptors). The dashboard validates an edit with it before saving, so a policy that saves is one the proxy accepts |
 | `classifyTool`, `CAPABILITY_RULES` | toxic-flow-auditor, security-proxy | Label a tool as untrusted-content / sensitive-data / exfiltration / destructive (lethal trifecta) |
 ## Checksum-validated masking

package/TR.md CHANGED Viewed

@@ -15,6 +15,7 @@ Amacı, aynı kuralın her yerde çalışması: bir kalıbı raporlayan statik t
 | `isValidTcKimlik`, `isValidVkn`, `isValidIban`, `isValidLuhn`, `isValidTrPhone` | security-proxy, prompt-leak-scanner | Regex eşleşmesinden sonra doğrulama |
 | `INJECTION_RULES`, `findInjections` | prompt-injection-scanner, security-proxy | İngilizce ve Türkçe 27 injection kuralı, base64 çözme dahil; tarayıcı 17 kesin kuralı kullanır |
 | `scanForPromptInjection`, `scanToolResult` | security-proxy | Kesin bir high/critical kuralda engeller, geri kalan her şeyde uyarır |
+| `gatewayPolicySchema`, `validatePolicy`, `policyShape` | security-proxy, app.guardbee.ai | Gateway politika belgesi (etiketler, kurallar, taint, onay, varsayılanlar, interceptor'lar). Dashboard bir düzenlemeyi kaydetmeden önce bununla doğrular; kaydedilen politika proxy'nin kabul ettiği politikadır |
 | `classifyTool`, `CAPABILITY_RULES` | toxic-flow-auditor, security-proxy | Bir tool'u untrusted-content / sensitive-data / exfiltration / destructive olarak etiketler (lethal trifecta) |
 ## Checksum doğrulamalı maskeleme

package/ZH.md CHANGED Viewed

@@ -15,6 +15,7 @@
 | `isValidTcKimlik`、`isValidVkn`、`isValidIban`、`isValidLuhn`、`isValidTrPhone` | security-proxy、prompt-leak-scanner | 正则匹配之后的校验 |
 | `INJECTION_RULES`、`findInjections` | prompt-injection-scanner、security-proxy | 27 条英文和土耳其语注入规则，包含 base64 解码；扫描器使用其中 17 条精确规则 |
 | `scanForPromptInjection`、`scanToolResult` | security-proxy | 命中精确的 high/critical 规则时拦截，其余情况只警告 |
+| `gatewayPolicySchema`、`validatePolicy`、`policyShape` | security-proxy、app.guardbee.ai | 网关策略文档（标签、规则、污点、审批、默认值、拦截器）。仪表盘在保存编辑前用它校验，因此能保存的策略就是代理会接受的策略 |
 | `classifyTool`、`CAPABILITY_RULES` | toxic-flow-auditor、security-proxy | 把工具标记为 untrusted-content / sensitive-data / exfiltration / destructive（lethal trifecta） |
 ## 经校验和验证的脱敏

package/dist/cjs/index.d.ts CHANGED Viewed

@@ -7,4 +7,6 @@ export { INJECTION_RULES, INJECTION_PATTERNS, findInjections, scanForPromptInjec
 export type { ScanResult, InjectionRule, InjectionCategory, InjectionFinding } from "./injection.js";
 export { CAPABILITY_RULES, classifyTool, textOf } from "./classify.js";
 export type { Capability, FlowCategory, ToolRecord } from "./classify.js";
+export { POLICY_LABELS, POLICY_ACTIONS, policyRuleSchema, policyShape, gatewayPolicySchema, validatePolicy } from "./policy.js";
+export type { GatewayPolicy, PolicyValidation } from "./policy.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAChI,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC"}

package/dist/cjs/index.js CHANGED Viewed

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.textOf = exports.classifyTool = exports.CAPABILITY_RULES = exports.scanToolResult = exports.scanForPromptInjection = exports.findInjections = exports.INJECTION_PATTERNS = exports.INJECTION_RULES = exports.SECRET_RULES = exports.maskPiiInValue = exports.maskPiiInText = exports.PII_PATTERNS = exports.isValidTrPhone = exports.isValidVkn = exports.isValidIban = exports.isValidLuhn = exports.isValidTcKimlik = void 0;
+exports.validatePolicy = exports.gatewayPolicySchema = exports.policyShape = exports.policyRuleSchema = exports.POLICY_ACTIONS = exports.POLICY_LABELS = exports.textOf = exports.classifyTool = exports.CAPABILITY_RULES = exports.scanToolResult = exports.scanForPromptInjection = exports.findInjections = exports.INJECTION_PATTERNS = exports.INJECTION_RULES = exports.SECRET_RULES = exports.maskPiiInValue = exports.maskPiiInText = exports.PII_PATTERNS = exports.isValidTrPhone = exports.isValidVkn = exports.isValidIban = exports.isValidLuhn = exports.isValidTcKimlik = void 0;
 var validators_js_1 = require("./validators.js");
 Object.defineProperty(exports, "isValidTcKimlik", { enumerable: true, get: function () { return validators_js_1.isValidTcKimlik; } });
 Object.defineProperty(exports, "isValidLuhn", { enumerable: true, get: function () { return validators_js_1.isValidLuhn; } });
@@ -23,4 +23,11 @@ var classify_js_1 = require("./classify.js");
 Object.defineProperty(exports, "CAPABILITY_RULES", { enumerable: true, get: function () { return classify_js_1.CAPABILITY_RULES; } });
 Object.defineProperty(exports, "classifyTool", { enumerable: true, get: function () { return classify_js_1.classifyTool; } });
 Object.defineProperty(exports, "textOf", { enumerable: true, get: function () { return classify_js_1.textOf; } });
+var policy_js_1 = require("./policy.js");
+Object.defineProperty(exports, "POLICY_LABELS", { enumerable: true, get: function () { return policy_js_1.POLICY_LABELS; } });
+Object.defineProperty(exports, "POLICY_ACTIONS", { enumerable: true, get: function () { return policy_js_1.POLICY_ACTIONS; } });
+Object.defineProperty(exports, "policyRuleSchema", { enumerable: true, get: function () { return policy_js_1.policyRuleSchema; } });
+Object.defineProperty(exports, "policyShape", { enumerable: true, get: function () { return policy_js_1.policyShape; } });
+Object.defineProperty(exports, "gatewayPolicySchema", { enumerable: true, get: function () { return policy_js_1.gatewayPolicySchema; } });
+Object.defineProperty(exports, "validatePolicy", { enumerable: true, get: function () { return policy_js_1.validatePolicy; } });
 //# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,iDAAwG;AAA/F,gHAAA,eAAe,OAAA;AAAE,4GAAA,WAAW,OAAA;AAAE,4GAAA,WAAW,OAAA;AAAE,2GAAA,UAAU,OAAA;AAAE,+GAAA,cAAc,OAAA;AAC9E,mCAAuE;AAA9D,sGAAA,YAAY,OAAA;AAAE,uGAAA,aAAa,OAAA;AAAE,wGAAA,cAAc,OAAA;AAEpD,2CAA4C;AAAnC,0GAAA,YAAY,OAAA;AAErB,+CAMwB;AALtB,+GAAA,eAAe,OAAA;AACf,kHAAA,kBAAkB,OAAA;AAClB,8GAAA,cAAc,OAAA;AACd,sHAAA,sBAAsB,OAAA;AACtB,8GAAA,cAAc,OAAA;AAGhB,6CAAuE;AAA9D,+GAAA,gBAAgB,OAAA;AAAE,2GAAA,YAAY,OAAA;AAAE,qGAAA,MAAM,OAAA"}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,iDAAwG;AAA/F,gHAAA,eAAe,OAAA;AAAE,4GAAA,WAAW,OAAA;AAAE,4GAAA,WAAW,OAAA;AAAE,2GAAA,UAAU,OAAA;AAAE,+GAAA,cAAc,OAAA;AAC9E,mCAAuE;AAA9D,sGAAA,YAAY,OAAA;AAAE,uGAAA,aAAa,OAAA;AAAE,wGAAA,cAAc,OAAA;AAEpD,2CAA4C;AAAnC,0GAAA,YAAY,OAAA;AAErB,+CAMwB;AALtB,+GAAA,eAAe,OAAA;AACf,kHAAA,kBAAkB,OAAA;AAClB,8GAAA,cAAc,OAAA;AACd,sHAAA,sBAAsB,OAAA;AACtB,8GAAA,cAAc,OAAA;AAGhB,6CAAuE;AAA9D,+GAAA,gBAAgB,OAAA;AAAE,2GAAA,YAAY,OAAA;AAAE,qGAAA,MAAM,OAAA;AAE/C,yCAAgI;AAAvH,0GAAA,aAAa,OAAA;AAAE,2GAAA,cAAc,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAAE,wGAAA,WAAW,OAAA;AAAE,gHAAA,mBAAmB,OAAA;AAAE,2GAAA,cAAc,OAAA"}

package/dist/cjs/policy.d.ts ADDED Viewed

@@ -0,0 +1,250 @@
+import { z } from "zod";
+/**
+ * The policy part of a GuardBee MCP gateway config: what may run and how.
+ * security-proxy reads it from guardbee-proxy.yaml or from the dashboard; the
+ * dashboard validates an edit with the same schema before it saves it, so a
+ * policy that saves is a policy the proxy accepts. Deployment settings
+ * (upstreams, listen, audit) stay out: they hold commands and secrets.
+ */
+export declare const POLICY_LABELS: readonly ["untrusted", "sensitive", "egress", "destructive"];
+export declare const POLICY_ACTIONS: readonly ["allow", "deny", "mask", "warn", "approve"];
+export declare const policyRuleSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    match: z.ZodObject<{
+        tool: z.ZodOptional<z.ZodString>;
+        upstream: z.ZodOptional<z.ZodString>;
+        label: z.ZodOptional<z.ZodEnum<{
+            destructive: "destructive";
+            untrusted: "untrusted";
+            sensitive: "sensitive";
+            egress: "egress";
+        }>>;
+        session: z.ZodOptional<z.ZodEnum<{
+            clean: "clean";
+            tainted: "tainted";
+        }>>;
+        args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    }, z.core.$strict>;
+    action: z.ZodEnum<{
+        allow: "allow";
+        warn: "warn";
+        deny: "deny";
+        mask: "mask";
+        approve: "approve";
+    }>;
+    mask: z.ZodOptional<z.ZodObject<{
+        fields: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** Every field has a default, so `{}` is a valid (allow-all, strict-taint) policy. */
+export declare const policyShape: {
+    labels: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodEnum<{
+        destructive: "destructive";
+        untrusted: "untrusted";
+        sensitive: "sensitive";
+        egress: "egress";
+    }>>>>;
+    rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        match: z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            upstream: z.ZodOptional<z.ZodString>;
+            label: z.ZodOptional<z.ZodEnum<{
+                destructive: "destructive";
+                untrusted: "untrusted";
+                sensitive: "sensitive";
+                egress: "egress";
+            }>>;
+            session: z.ZodOptional<z.ZodEnum<{
+                clean: "clean";
+                tainted: "tainted";
+            }>>;
+            args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        }, z.core.$strict>;
+        action: z.ZodEnum<{
+            allow: "allow";
+            warn: "warn";
+            deny: "deny";
+            mask: "mask";
+            approve: "approve";
+        }>;
+        mask: z.ZodOptional<z.ZodObject<{
+            fields: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
+    taint: z.ZodDefault<z.ZodObject<{
+        mode: z.ZodDefault<z.ZodEnum<{
+            warn: "warn";
+            approve: "approve";
+            strict: "strict";
+            off: "off";
+        }>>;
+        basis: z.ZodDefault<z.ZodEnum<{
+            capability: "capability";
+            data: "data";
+        }>>;
+    }, z.core.$strict>>;
+    approval: z.ZodDefault<z.ZodObject<{
+        timeoutSeconds: z.ZodDefault<z.ZodNumber>;
+        channels: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            elicitation: "elicitation";
+            dashboard: "dashboard";
+        }>>>;
+    }, z.core.$strict>>;
+    defaults: z.ZodDefault<z.ZodObject<{
+        action: z.ZodDefault<z.ZodEnum<{
+            allow: "allow";
+            warn: "warn";
+            deny: "deny";
+            mask: "mask";
+            approve: "approve";
+        }>>;
+    }, z.core.$strict>>;
+    interceptors: z.ZodDefault<z.ZodObject<{
+        promptInjection: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            action: z.ZodEnum<{
+                block: "block";
+                warn: "warn";
+            }>;
+        }, z.core.$strict>>;
+        toolResultInjection: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            action: z.ZodEnum<{
+                block: "block";
+                warn: "warn";
+            }>;
+        }, z.core.$strict>>;
+        definitionDrift: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            action: z.ZodEnum<{
+                block: "block";
+                warn: "warn";
+            }>;
+            recheck: z.ZodOptional<z.ZodEnum<{
+                "every-call": "every-call";
+                "on-change": "on-change";
+            }>>;
+        }, z.core.$strict>>;
+        piiMasking: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            mode: z.ZodOptional<z.ZodEnum<{
+                redact: "redact";
+                tokenize: "tokenize";
+            }>>;
+            detokenizeForEgress: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+};
+export declare const gatewayPolicySchema: z.ZodObject<{
+    labels: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodEnum<{
+        destructive: "destructive";
+        untrusted: "untrusted";
+        sensitive: "sensitive";
+        egress: "egress";
+    }>>>>;
+    rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        match: z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            upstream: z.ZodOptional<z.ZodString>;
+            label: z.ZodOptional<z.ZodEnum<{
+                destructive: "destructive";
+                untrusted: "untrusted";
+                sensitive: "sensitive";
+                egress: "egress";
+            }>>;
+            session: z.ZodOptional<z.ZodEnum<{
+                clean: "clean";
+                tainted: "tainted";
+            }>>;
+            args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        }, z.core.$strict>;
+        action: z.ZodEnum<{
+            allow: "allow";
+            warn: "warn";
+            deny: "deny";
+            mask: "mask";
+            approve: "approve";
+        }>;
+        mask: z.ZodOptional<z.ZodObject<{
+            fields: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
+    taint: z.ZodDefault<z.ZodObject<{
+        mode: z.ZodDefault<z.ZodEnum<{
+            warn: "warn";
+            approve: "approve";
+            strict: "strict";
+            off: "off";
+        }>>;
+        basis: z.ZodDefault<z.ZodEnum<{
+            capability: "capability";
+            data: "data";
+        }>>;
+    }, z.core.$strict>>;
+    approval: z.ZodDefault<z.ZodObject<{
+        timeoutSeconds: z.ZodDefault<z.ZodNumber>;
+        channels: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            elicitation: "elicitation";
+            dashboard: "dashboard";
+        }>>>;
+    }, z.core.$strict>>;
+    defaults: z.ZodDefault<z.ZodObject<{
+        action: z.ZodDefault<z.ZodEnum<{
+            allow: "allow";
+            warn: "warn";
+            deny: "deny";
+            mask: "mask";
+            approve: "approve";
+        }>>;
+    }, z.core.$strict>>;
+    interceptors: z.ZodDefault<z.ZodObject<{
+        promptInjection: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            action: z.ZodEnum<{
+                block: "block";
+                warn: "warn";
+            }>;
+        }, z.core.$strict>>;
+        toolResultInjection: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            action: z.ZodEnum<{
+                block: "block";
+                warn: "warn";
+            }>;
+        }, z.core.$strict>>;
+        definitionDrift: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            action: z.ZodEnum<{
+                block: "block";
+                warn: "warn";
+            }>;
+            recheck: z.ZodOptional<z.ZodEnum<{
+                "every-call": "every-call";
+                "on-change": "on-change";
+            }>>;
+        }, z.core.$strict>>;
+        piiMasking: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            mode: z.ZodOptional<z.ZodEnum<{
+                redact: "redact";
+                tokenize: "tokenize";
+            }>>;
+            detokenizeForEgress: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type GatewayPolicy = z.infer<typeof gatewayPolicySchema>;
+export type PolicyValidation = {
+    ok: true;
+    policy: GatewayPolicy;
+} | {
+    ok: false;
+    issues: string[];
+};
+/** Validate an already-parsed policy document; issues read `path: message`. */
+export declare function validatePolicy(value: unknown): PolicyValidation;
+//# sourceMappingURL=policy.d.ts.map

package/dist/cjs/policy.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,eAAO,MAAM,aAAa,8DAA+D,CAAC;AAC1F,eAAO,MAAM,cAAc,uDAAwD,CAAC;AAMpF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmBzB,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuCvB,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAAiC,CAAC;AAElE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErG,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAO/D"}

package/dist/cjs/policy.js ADDED Viewed

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gatewayPolicySchema = exports.policyShape = exports.policyRuleSchema = exports.POLICY_ACTIONS = exports.POLICY_LABELS = void 0;
+exports.validatePolicy = validatePolicy;
+const zod_1 = require("zod");
+/**
+ * The policy part of a GuardBee MCP gateway config: what may run and how.
+ * security-proxy reads it from guardbee-proxy.yaml or from the dashboard; the
+ * dashboard validates an edit with the same schema before it saves it, so a
+ * policy that saves is a policy the proxy accepts. Deployment settings
+ * (upstreams, listen, audit) stay out: they hold commands and secrets.
+ */
+exports.POLICY_LABELS = ["untrusted", "sensitive", "egress", "destructive"];
+exports.POLICY_ACTIONS = ["allow", "deny", "mask", "warn", "approve"];
+const labelSchema = zod_1.z.enum(exports.POLICY_LABELS);
+const actionSchema = zod_1.z.enum(exports.POLICY_ACTIONS);
+const interceptorSchema = zod_1.z.object({ enabled: zod_1.z.boolean(), action: zod_1.z.enum(["block", "warn"]) }).strict();
+exports.policyRuleSchema = zod_1.z
+    .object({
+    id: zod_1.z.string().optional(),
+    match: zod_1.z
+        .object({
+        tool: zod_1.z.string().optional(),
+        upstream: zod_1.z.string().optional(),
+        label: labelSchema.optional(),
+        session: zod_1.z.enum(["clean", "tainted"]).optional(),
+        args: zod_1.z.record(zod_1.z.string(), zod_1.z.union([zod_1.z.string(), zod_1.z.number(), zod_1.z.boolean()])).optional(),
+    })
+        .strict(),
+    action: actionSchema,
+    mask: zod_1.z.object({ fields: zod_1.z.array(zod_1.z.string()).min(1) }).strict().optional(),
+})
+    .strict()
+    .refine((rule) => rule.mask === undefined || rule.action === "mask", {
+    message: "mask.fields only applies to action: mask",
+    path: ["mask"],
+});
+/** Every field has a default, so `{}` is a valid (allow-all, strict-taint) policy. */
+exports.policyShape = {
+    labels: zod_1.z.record(zod_1.z.string(), zod_1.z.array(labelSchema)).default({}),
+    rules: zod_1.z.array(exports.policyRuleSchema).default([]),
+    taint: zod_1.z
+        .object({
+        mode: zod_1.z.enum(["strict", "approve", "warn", "off"]).default("strict"),
+        /**
+         * capability: any egress call after untrusted + sensitive content is a toxic flow.
+         * data: only an egress call whose arguments carry sensitive data the session saw.
+         */
+        basis: zod_1.z.enum(["capability", "data"]).default("capability"),
+    })
+        .strict()
+        .default({ mode: "strict", basis: "capability" }),
+    approval: zod_1.z
+        .object({
+        timeoutSeconds: zod_1.z.number().int().positive().default(120),
+        channels: zod_1.z.array(zod_1.z.enum(["elicitation", "dashboard"])).min(1).default(["elicitation"]),
+    })
+        .strict()
+        .default({ timeoutSeconds: 120, channels: ["elicitation"] }),
+    defaults: zod_1.z.object({ action: actionSchema.default("allow") }).strict().default({ action: "allow" }),
+    interceptors: zod_1.z
+        .object({
+        promptInjection: interceptorSchema.optional(),
+        toolResultInjection: interceptorSchema.optional(),
+        definitionDrift: interceptorSchema.extend({ recheck: zod_1.z.enum(["every-call", "on-change"]).optional() }).optional(),
+        piiMasking: zod_1.z
+            .object({
+            enabled: zod_1.z.boolean(),
+            patterns: zod_1.z.array(zod_1.z.string()).optional(),
+            mode: zod_1.z.enum(["redact", "tokenize"]).optional(),
+            detokenizeForEgress: zod_1.z.boolean().optional(),
+        })
+            .strict()
+            .optional(),
+    })
+        .strict()
+        .default({}),
+};
+exports.gatewayPolicySchema = zod_1.z.object(exports.policyShape).strict();
+/** Validate an already-parsed policy document; issues read `path: message`. */
+function validatePolicy(value) {
+    const parsed = exports.gatewayPolicySchema.safeParse(value ?? {});
+    if (parsed.success)
+        return { ok: true, policy: parsed.data };
+    return {
+        ok: false,
+        issues: parsed.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`),
+    };
+}
+//# sourceMappingURL=policy.js.map

package/dist/cjs/policy.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/policy.ts"],"names":[],"mappings":";;;AAuFA,wCAOC;AA9FD,6BAAwB;AAExB;;;;;;GAMG;AAEU,QAAA,aAAa,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAU,CAAC;AAC7E,QAAA,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AAEpF,MAAM,WAAW,GAAG,OAAC,CAAC,IAAI,CAAC,qBAAa,CAAC,CAAC;AAC1C,MAAM,YAAY,GAAG,OAAC,CAAC,IAAI,CAAC,sBAAc,CAAC,CAAC;AAC5C,MAAM,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAE5F,QAAA,gBAAgB,GAAG,OAAC;KAC9B,MAAM,CAAC;IACN,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,OAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC7B,OAAO,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,IAAI,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACtF,CAAC;SACD,MAAM,EAAE;IACX,MAAM,EAAE,YAAY;IACpB,IAAI,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3E,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE;IACnE,OAAO,EAAE,0CAA0C;IACnD,IAAI,EAAE,CAAC,MAAM,CAAC;CACf,CAAC,CAAC;AAEL,sFAAsF;AACzE,QAAA,WAAW,GAAG;IACzB,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,wBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,KAAK,EAAE,OAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpE;;;WAGG;QACH,KAAK,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC5D,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACnD,QAAQ,EAAE,OAAC;SACR,MAAM,CAAC;QACN,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QACxD,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC;KACxF,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9D,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnG,YAAY,EAAE,OAAC;SACZ,MAAM,CAAC;QACN,eAAe,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QAC7C,mBAAmB,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QACjD,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QACjH,UAAU,EAAE,OAAC;aACV,MAAM,CAAC;YACN,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;YACpB,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;YACxC,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC/C,mBAAmB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAC5C,CAAC;aACD,MAAM,EAAE;aACR,QAAQ,EAAE;KACd,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,CAAC;CACf,CAAC;AAEW,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC,mBAAW,CAAC,CAAC,MAAM,EAAE,CAAC;AAMlE,+EAA+E;AAC/E,SAAgB,cAAc,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,2BAAmB,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;KACpG,CAAC;AACJ,CAAC"}

package/dist/index.d.ts CHANGED Viewed

@@ -7,4 +7,6 @@ export { INJECTION_RULES, INJECTION_PATTERNS, findInjections, scanForPromptInjec
 export type { ScanResult, InjectionRule, InjectionCategory, InjectionFinding } from "./injection.js";
 export { CAPABILITY_RULES, classifyTool, textOf } from "./classify.js";
 export type { Capability, FlowCategory, ToolRecord } from "./classify.js";
+export { POLICY_LABELS, POLICY_ACTIONS, policyRuleSchema, policyShape, gatewayPolicySchema, validatePolicy } from "./policy.js";
+export type { GatewayPolicy, PolicyValidation } from "./policy.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAChI,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js CHANGED Viewed

@@ -3,4 +3,5 @@ export { PII_PATTERNS, maskPiiInText, maskPiiInValue } from "./pii.js";
 export { SECRET_RULES } from "./secrets.js";
 export { INJECTION_RULES, INJECTION_PATTERNS, findInjections, scanForPromptInjection, scanToolResult, } from "./injection.js";
 export { CAPABILITY_RULES, classifyTool, textOf } from "./classify.js";
+export { POLICY_LABELS, POLICY_ACTIONS, policyRuleSchema, policyShape, gatewayPolicySchema, validatePolicy } from "./policy.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAEvE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC"}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAEvE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC"}

package/dist/policy.d.ts ADDED Viewed

@@ -0,0 +1,250 @@
+import { z } from "zod";
+/**
+ * The policy part of a GuardBee MCP gateway config: what may run and how.
+ * security-proxy reads it from guardbee-proxy.yaml or from the dashboard; the
+ * dashboard validates an edit with the same schema before it saves it, so a
+ * policy that saves is a policy the proxy accepts. Deployment settings
+ * (upstreams, listen, audit) stay out: they hold commands and secrets.
+ */
+export declare const POLICY_LABELS: readonly ["untrusted", "sensitive", "egress", "destructive"];
+export declare const POLICY_ACTIONS: readonly ["allow", "deny", "mask", "warn", "approve"];
+export declare const policyRuleSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    match: z.ZodObject<{
+        tool: z.ZodOptional<z.ZodString>;
+        upstream: z.ZodOptional<z.ZodString>;
+        label: z.ZodOptional<z.ZodEnum<{
+            destructive: "destructive";
+            untrusted: "untrusted";
+            sensitive: "sensitive";
+            egress: "egress";
+        }>>;
+        session: z.ZodOptional<z.ZodEnum<{
+            clean: "clean";
+            tainted: "tainted";
+        }>>;
+        args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    }, z.core.$strict>;
+    action: z.ZodEnum<{
+        allow: "allow";
+        warn: "warn";
+        deny: "deny";
+        mask: "mask";
+        approve: "approve";
+    }>;
+    mask: z.ZodOptional<z.ZodObject<{
+        fields: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** Every field has a default, so `{}` is a valid (allow-all, strict-taint) policy. */
+export declare const policyShape: {
+    labels: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodEnum<{
+        destructive: "destructive";
+        untrusted: "untrusted";
+        sensitive: "sensitive";
+        egress: "egress";
+    }>>>>;
+    rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        match: z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            upstream: z.ZodOptional<z.ZodString>;
+            label: z.ZodOptional<z.ZodEnum<{
+                destructive: "destructive";
+                untrusted: "untrusted";
+                sensitive: "sensitive";
+                egress: "egress";
+            }>>;
+            session: z.ZodOptional<z.ZodEnum<{
+                clean: "clean";
+                tainted: "tainted";
+            }>>;
+            args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        }, z.core.$strict>;
+        action: z.ZodEnum<{
+            allow: "allow";
+            warn: "warn";
+            deny: "deny";
+            mask: "mask";
+            approve: "approve";
+        }>;
+        mask: z.ZodOptional<z.ZodObject<{
+            fields: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
+    taint: z.ZodDefault<z.ZodObject<{
+        mode: z.ZodDefault<z.ZodEnum<{
+            warn: "warn";
+            approve: "approve";
+            strict: "strict";
+            off: "off";
+        }>>;
+        basis: z.ZodDefault<z.ZodEnum<{
+            capability: "capability";
+            data: "data";
+        }>>;
+    }, z.core.$strict>>;
+    approval: z.ZodDefault<z.ZodObject<{
+        timeoutSeconds: z.ZodDefault<z.ZodNumber>;
+        channels: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            elicitation: "elicitation";
+            dashboard: "dashboard";
+        }>>>;
+    }, z.core.$strict>>;
+    defaults: z.ZodDefault<z.ZodObject<{
+        action: z.ZodDefault<z.ZodEnum<{
+            allow: "allow";
+            warn: "warn";
+            deny: "deny";
+            mask: "mask";
+            approve: "approve";
+        }>>;
+    }, z.core.$strict>>;
+    interceptors: z.ZodDefault<z.ZodObject<{
+        promptInjection: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            action: z.ZodEnum<{
+                block: "block";
+                warn: "warn";
+            }>;
+        }, z.core.$strict>>;
+        toolResultInjection: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            action: z.ZodEnum<{
+                block: "block";
+                warn: "warn";
+            }>;
+        }, z.core.$strict>>;
+        definitionDrift: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            action: z.ZodEnum<{
+                block: "block";
+                warn: "warn";
+            }>;
+            recheck: z.ZodOptional<z.ZodEnum<{
+                "every-call": "every-call";
+                "on-change": "on-change";
+            }>>;
+        }, z.core.$strict>>;
+        piiMasking: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            mode: z.ZodOptional<z.ZodEnum<{
+                redact: "redact";
+                tokenize: "tokenize";
+            }>>;
+            detokenizeForEgress: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+};
+export declare const gatewayPolicySchema: z.ZodObject<{
+    labels: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodEnum<{
+        destructive: "destructive";
+        untrusted: "untrusted";
+        sensitive: "sensitive";
+        egress: "egress";
+    }>>>>;
+    rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        match: z.ZodObject<{
+            tool: z.ZodOptional<z.ZodString>;
+            upstream: z.ZodOptional<z.ZodString>;
+            label: z.ZodOptional<z.ZodEnum<{
+                destructive: "destructive";
+                untrusted: "untrusted";
+                sensitive: "sensitive";
+                egress: "egress";
+            }>>;
+            session: z.ZodOptional<z.ZodEnum<{
+                clean: "clean";
+                tainted: "tainted";
+            }>>;
+            args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        }, z.core.$strict>;
+        action: z.ZodEnum<{
+            allow: "allow";
+            warn: "warn";
+            deny: "deny";
+            mask: "mask";
+            approve: "approve";
+        }>;
+        mask: z.ZodOptional<z.ZodObject<{
+            fields: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
+    taint: z.ZodDefault<z.ZodObject<{
+        mode: z.ZodDefault<z.ZodEnum<{
+            warn: "warn";
+            approve: "approve";
+            strict: "strict";
+            off: "off";
+        }>>;
+        basis: z.ZodDefault<z.ZodEnum<{
+            capability: "capability";
+            data: "data";
+        }>>;
+    }, z.core.$strict>>;
+    approval: z.ZodDefault<z.ZodObject<{
+        timeoutSeconds: z.ZodDefault<z.ZodNumber>;
+        channels: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            elicitation: "elicitation";
+            dashboard: "dashboard";
+        }>>>;
+    }, z.core.$strict>>;
+    defaults: z.ZodDefault<z.ZodObject<{
+        action: z.ZodDefault<z.ZodEnum<{
+            allow: "allow";
+            warn: "warn";
+            deny: "deny";
+            mask: "mask";
+            approve: "approve";
+        }>>;
+    }, z.core.$strict>>;
+    interceptors: z.ZodDefault<z.ZodObject<{
+        promptInjection: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            action: z.ZodEnum<{
+                block: "block";
+                warn: "warn";
+            }>;
+        }, z.core.$strict>>;
+        toolResultInjection: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            action: z.ZodEnum<{
+                block: "block";
+                warn: "warn";
+            }>;
+        }, z.core.$strict>>;
+        definitionDrift: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            action: z.ZodEnum<{
+                block: "block";
+                warn: "warn";
+            }>;
+            recheck: z.ZodOptional<z.ZodEnum<{
+                "every-call": "every-call";
+                "on-change": "on-change";
+            }>>;
+        }, z.core.$strict>>;
+        piiMasking: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            mode: z.ZodOptional<z.ZodEnum<{
+                redact: "redact";
+                tokenize: "tokenize";
+            }>>;
+            detokenizeForEgress: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type GatewayPolicy = z.infer<typeof gatewayPolicySchema>;
+export type PolicyValidation = {
+    ok: true;
+    policy: GatewayPolicy;
+} | {
+    ok: false;
+    issues: string[];
+};
+/** Validate an already-parsed policy document; issues read `path: message`. */
+export declare function validatePolicy(value: unknown): PolicyValidation;
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,eAAO,MAAM,aAAa,8DAA+D,CAAC;AAC1F,eAAO,MAAM,cAAc,uDAAwD,CAAC;AAMpF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmBzB,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuCvB,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAAiC,CAAC;AAElE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErG,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAO/D"}

package/dist/policy.js ADDED Viewed

@@ -0,0 +1,86 @@
+import { z } from "zod";
+/**
+ * The policy part of a GuardBee MCP gateway config: what may run and how.
+ * security-proxy reads it from guardbee-proxy.yaml or from the dashboard; the
+ * dashboard validates an edit with the same schema before it saves it, so a
+ * policy that saves is a policy the proxy accepts. Deployment settings
+ * (upstreams, listen, audit) stay out: they hold commands and secrets.
+ */
+export const POLICY_LABELS = ["untrusted", "sensitive", "egress", "destructive"];
+export const POLICY_ACTIONS = ["allow", "deny", "mask", "warn", "approve"];
+const labelSchema = z.enum(POLICY_LABELS);
+const actionSchema = z.enum(POLICY_ACTIONS);
+const interceptorSchema = z.object({ enabled: z.boolean(), action: z.enum(["block", "warn"]) }).strict();
+export const policyRuleSchema = z
+    .object({
+    id: z.string().optional(),
+    match: z
+        .object({
+        tool: z.string().optional(),
+        upstream: z.string().optional(),
+        label: labelSchema.optional(),
+        session: z.enum(["clean", "tainted"]).optional(),
+        args: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
+    })
+        .strict(),
+    action: actionSchema,
+    mask: z.object({ fields: z.array(z.string()).min(1) }).strict().optional(),
+})
+    .strict()
+    .refine((rule) => rule.mask === undefined || rule.action === "mask", {
+    message: "mask.fields only applies to action: mask",
+    path: ["mask"],
+});
+/** Every field has a default, so `{}` is a valid (allow-all, strict-taint) policy. */
+export const policyShape = {
+    labels: z.record(z.string(), z.array(labelSchema)).default({}),
+    rules: z.array(policyRuleSchema).default([]),
+    taint: z
+        .object({
+        mode: z.enum(["strict", "approve", "warn", "off"]).default("strict"),
+        /**
+         * capability: any egress call after untrusted + sensitive content is a toxic flow.
+         * data: only an egress call whose arguments carry sensitive data the session saw.
+         */
+        basis: z.enum(["capability", "data"]).default("capability"),
+    })
+        .strict()
+        .default({ mode: "strict", basis: "capability" }),
+    approval: z
+        .object({
+        timeoutSeconds: z.number().int().positive().default(120),
+        channels: z.array(z.enum(["elicitation", "dashboard"])).min(1).default(["elicitation"]),
+    })
+        .strict()
+        .default({ timeoutSeconds: 120, channels: ["elicitation"] }),
+    defaults: z.object({ action: actionSchema.default("allow") }).strict().default({ action: "allow" }),
+    interceptors: z
+        .object({
+        promptInjection: interceptorSchema.optional(),
+        toolResultInjection: interceptorSchema.optional(),
+        definitionDrift: interceptorSchema.extend({ recheck: z.enum(["every-call", "on-change"]).optional() }).optional(),
+        piiMasking: z
+            .object({
+            enabled: z.boolean(),
+            patterns: z.array(z.string()).optional(),
+            mode: z.enum(["redact", "tokenize"]).optional(),
+            detokenizeForEgress: z.boolean().optional(),
+        })
+            .strict()
+            .optional(),
+    })
+        .strict()
+        .default({}),
+};
+export const gatewayPolicySchema = z.object(policyShape).strict();
+/** Validate an already-parsed policy document; issues read `path: message`. */
+export function validatePolicy(value) {
+    const parsed = gatewayPolicySchema.safeParse(value ?? {});
+    if (parsed.success)
+        return { ok: true, policy: parsed.data };
+    return {
+        ok: false,
+        issues: parsed.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`),
+    };
+}
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAU,CAAC;AAC1F,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AAEpF,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAC1C,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAC5C,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAEzG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC7B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACtF,CAAC;SACD,MAAM,EAAE;IACX,MAAM,EAAE,YAAY;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3E,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE;IACnE,OAAO,EAAE,0CAA0C;IACnD,IAAI,EAAE,CAAC,MAAM,CAAC;CACf,CAAC,CAAC;AAEL,sFAAsF;AACtF,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpE;;;WAGG;QACH,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC5D,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACnD,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QACxD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC;KACxF,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnG,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,eAAe,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QAC7C,mBAAmB,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QACjD,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QACjH,UAAU,EAAE,CAAC;aACV,MAAM,CAAC;YACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;YACpB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;YACxC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC/C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAC5C,CAAC;aACD,MAAM,EAAE;aACR,QAAQ,EAAE;KACd,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,CAAC;CACf,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;AAMlE,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;KACpG,CAAC;AACJ,CAAC"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@guardbee/guard-core",
-  "version": "0.2.1",
+  "version": "0.4.0",
   "description": "Shared detectors for GuardBee MCP packages — checksum-validated PII masking, prompt injection patterns, and lethal-trifecta tool classification",
   "type": "module",
   "main": "./dist/index.js",
@@ -45,6 +45,9 @@
   "bugs": {
     "url": "https://github.com/GuardBee/guardbee-mcp/issues"
   },
+  "dependencies": {
+    "zod": "^4.5.4"
+  },
   "scripts": {
     "build": "tsc && tsc -p tsconfig.cjs.json && node -e \"require('fs').mkdirSync('dist/cjs',{recursive:true});require('fs').writeFileSync('dist/cjs/package.json','{\\\"type\\\":\\\"commonjs\\\"}\\n')\"",
     "dev": "tsc --watch",