@guardbee/guard-core 0.3.0 → 0.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cjs/policy.d.ts +54 -0
- package/dist/cjs/policy.d.ts.map +1 -1
- package/dist/cjs/policy.js +24 -1
- package/dist/cjs/policy.js.map +1 -1
- package/dist/policy.d.ts +54 -0
- package/dist/policy.d.ts.map +1 -1
- package/dist/policy.js +24 -1
- package/dist/policy.js.map +1 -1
- package/package.json +1 -1
package/dist/cjs/policy.d.ts
CHANGED
|
@@ -79,6 +79,10 @@ export declare const policyShape: {
|
|
|
79
79
|
strict: "strict";
|
|
80
80
|
off: "off";
|
|
81
81
|
}>>;
|
|
82
|
+
basis: z.ZodDefault<z.ZodEnum<{
|
|
83
|
+
capability: "capability";
|
|
84
|
+
data: "data";
|
|
85
|
+
}>>;
|
|
82
86
|
}, z.core.$strict>>;
|
|
83
87
|
approval: z.ZodDefault<z.ZodObject<{
|
|
84
88
|
timeoutSeconds: z.ZodDefault<z.ZodNumber>;
|
|
@@ -131,6 +135,29 @@ export declare const policyShape: {
|
|
|
131
135
|
}>>;
|
|
132
136
|
detokenizeForEgress: z.ZodOptional<z.ZodBoolean>;
|
|
133
137
|
}, z.core.$strict>>;
|
|
138
|
+
anomaly: z.ZodOptional<z.ZodObject<{
|
|
139
|
+
enabled: z.ZodBoolean;
|
|
140
|
+
action: z.ZodEnum<{
|
|
141
|
+
block: "block";
|
|
142
|
+
warn: "warn";
|
|
143
|
+
}>;
|
|
144
|
+
callBurst: z.ZodOptional<z.ZodObject<{
|
|
145
|
+
count: z.ZodNumber;
|
|
146
|
+
windowSeconds: z.ZodNumber;
|
|
147
|
+
}, z.core.$strict>>;
|
|
148
|
+
sensitiveSweep: z.ZodOptional<z.ZodObject<{
|
|
149
|
+
count: z.ZodNumber;
|
|
150
|
+
windowSeconds: z.ZodNumber;
|
|
151
|
+
}, z.core.$strict>>;
|
|
152
|
+
destructiveBurst: z.ZodOptional<z.ZodObject<{
|
|
153
|
+
count: z.ZodNumber;
|
|
154
|
+
windowSeconds: z.ZodNumber;
|
|
155
|
+
}, z.core.$strict>>;
|
|
156
|
+
repeatedBlocks: z.ZodOptional<z.ZodObject<{
|
|
157
|
+
count: z.ZodNumber;
|
|
158
|
+
windowSeconds: z.ZodNumber;
|
|
159
|
+
}, z.core.$strict>>;
|
|
160
|
+
}, z.core.$strict>>;
|
|
134
161
|
}, z.core.$strict>>;
|
|
135
162
|
};
|
|
136
163
|
export declare const gatewayPolicySchema: z.ZodObject<{
|
|
@@ -175,6 +202,10 @@ export declare const gatewayPolicySchema: z.ZodObject<{
|
|
|
175
202
|
strict: "strict";
|
|
176
203
|
off: "off";
|
|
177
204
|
}>>;
|
|
205
|
+
basis: z.ZodDefault<z.ZodEnum<{
|
|
206
|
+
capability: "capability";
|
|
207
|
+
data: "data";
|
|
208
|
+
}>>;
|
|
178
209
|
}, z.core.$strict>>;
|
|
179
210
|
approval: z.ZodDefault<z.ZodObject<{
|
|
180
211
|
timeoutSeconds: z.ZodDefault<z.ZodNumber>;
|
|
@@ -227,6 +258,29 @@ export declare const gatewayPolicySchema: z.ZodObject<{
|
|
|
227
258
|
}>>;
|
|
228
259
|
detokenizeForEgress: z.ZodOptional<z.ZodBoolean>;
|
|
229
260
|
}, z.core.$strict>>;
|
|
261
|
+
anomaly: z.ZodOptional<z.ZodObject<{
|
|
262
|
+
enabled: z.ZodBoolean;
|
|
263
|
+
action: z.ZodEnum<{
|
|
264
|
+
block: "block";
|
|
265
|
+
warn: "warn";
|
|
266
|
+
}>;
|
|
267
|
+
callBurst: z.ZodOptional<z.ZodObject<{
|
|
268
|
+
count: z.ZodNumber;
|
|
269
|
+
windowSeconds: z.ZodNumber;
|
|
270
|
+
}, z.core.$strict>>;
|
|
271
|
+
sensitiveSweep: z.ZodOptional<z.ZodObject<{
|
|
272
|
+
count: z.ZodNumber;
|
|
273
|
+
windowSeconds: z.ZodNumber;
|
|
274
|
+
}, z.core.$strict>>;
|
|
275
|
+
destructiveBurst: z.ZodOptional<z.ZodObject<{
|
|
276
|
+
count: z.ZodNumber;
|
|
277
|
+
windowSeconds: z.ZodNumber;
|
|
278
|
+
}, z.core.$strict>>;
|
|
279
|
+
repeatedBlocks: z.ZodOptional<z.ZodObject<{
|
|
280
|
+
count: z.ZodNumber;
|
|
281
|
+
windowSeconds: z.ZodNumber;
|
|
282
|
+
}, z.core.$strict>>;
|
|
283
|
+
}, z.core.$strict>>;
|
|
230
284
|
}, z.core.$strict>>;
|
|
231
285
|
}, z.core.$strict>;
|
|
232
286
|
export type GatewayPolicy = z.infer<typeof gatewayPolicySchema>;
|
package/dist/cjs/policy.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,eAAO,MAAM,aAAa,8DAA+D,CAAC;AAC1F,eAAO,MAAM,cAAc,uDAAwD,CAAC;
|
|
1
|
+
{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,eAAO,MAAM,aAAa,8DAA+D,CAAC;AAC1F,eAAO,MAAM,cAAc,uDAAwD,CAAC;AAUpF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmBzB,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDvB,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAAiC,CAAC;AAElE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErG,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAO/D"}
|
package/dist/cjs/policy.js
CHANGED
|
@@ -15,6 +15,10 @@ exports.POLICY_ACTIONS = ["allow", "deny", "mask", "warn", "approve"];
|
|
|
15
15
|
const labelSchema = zod_1.z.enum(exports.POLICY_LABELS);
|
|
16
16
|
const actionSchema = zod_1.z.enum(exports.POLICY_ACTIONS);
|
|
17
17
|
const interceptorSchema = zod_1.z.object({ enabled: zod_1.z.boolean(), action: zod_1.z.enum(["block", "warn"]) }).strict();
|
|
18
|
+
/** At most `count` events within `windowSeconds`; one more trips the anomaly check. */
|
|
19
|
+
const anomalyWindowSchema = zod_1.z
|
|
20
|
+
.object({ count: zod_1.z.number().int().positive(), windowSeconds: zod_1.z.number().int().positive().max(86_400) })
|
|
21
|
+
.strict();
|
|
18
22
|
exports.policyRuleSchema = zod_1.z
|
|
19
23
|
.object({
|
|
20
24
|
id: zod_1.z.string().optional(),
|
|
@@ -39,7 +43,17 @@ exports.policyRuleSchema = zod_1.z
|
|
|
39
43
|
exports.policyShape = {
|
|
40
44
|
labels: zod_1.z.record(zod_1.z.string(), zod_1.z.array(labelSchema)).default({}),
|
|
41
45
|
rules: zod_1.z.array(exports.policyRuleSchema).default([]),
|
|
42
|
-
taint: zod_1.z
|
|
46
|
+
taint: zod_1.z
|
|
47
|
+
.object({
|
|
48
|
+
mode: zod_1.z.enum(["strict", "approve", "warn", "off"]).default("strict"),
|
|
49
|
+
/**
|
|
50
|
+
* capability: any egress call after untrusted + sensitive content is a toxic flow.
|
|
51
|
+
* data: only an egress call whose arguments carry sensitive data the session saw.
|
|
52
|
+
*/
|
|
53
|
+
basis: zod_1.z.enum(["capability", "data"]).default("capability"),
|
|
54
|
+
})
|
|
55
|
+
.strict()
|
|
56
|
+
.default({ mode: "strict", basis: "capability" }),
|
|
43
57
|
approval: zod_1.z
|
|
44
58
|
.object({
|
|
45
59
|
timeoutSeconds: zod_1.z.number().int().positive().default(120),
|
|
@@ -62,6 +76,15 @@ exports.policyShape = {
|
|
|
62
76
|
})
|
|
63
77
|
.strict()
|
|
64
78
|
.optional(),
|
|
79
|
+
/** Behaviour over a session: call bursts, sweeps of sensitive reads, bulk destructive calls, repeated blocks. */
|
|
80
|
+
anomaly: interceptorSchema
|
|
81
|
+
.extend({
|
|
82
|
+
callBurst: anomalyWindowSchema.optional(),
|
|
83
|
+
sensitiveSweep: anomalyWindowSchema.optional(),
|
|
84
|
+
destructiveBurst: anomalyWindowSchema.optional(),
|
|
85
|
+
repeatedBlocks: anomalyWindowSchema.optional(),
|
|
86
|
+
})
|
|
87
|
+
.optional(),
|
|
65
88
|
})
|
|
66
89
|
.strict()
|
|
67
90
|
.default({}),
|
package/dist/cjs/policy.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/policy.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/policy.ts"],"names":[],"mappings":";;;AAoGA,wCAOC;AA3GD,6BAAwB;AAExB;;;;;;GAMG;AAEU,QAAA,aAAa,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAU,CAAC;AAC7E,QAAA,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AAEpF,MAAM,WAAW,GAAG,OAAC,CAAC,IAAI,CAAC,qBAAa,CAAC,CAAC;AAC1C,MAAM,YAAY,GAAG,OAAC,CAAC,IAAI,CAAC,sBAAc,CAAC,CAAC;AAC5C,MAAM,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACzG,uFAAuF;AACvF,MAAM,mBAAmB,GAAG,OAAC;KAC1B,MAAM,CAAC,EAAE,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KACtG,MAAM,EAAE,CAAC;AAEC,QAAA,gBAAgB,GAAG,OAAC;KAC9B,MAAM,CAAC;IACN,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,OAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC7B,OAAO,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,IAAI,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACtF,CAAC;SACD,MAAM,EAAE;IACX,MAAM,EAAE,YAAY;IACpB,IAAI,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3E,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE;IACnE,OAAO,EAAE,0CAA0C;IACnD,IAAI,EAAE,CAAC,MAAM,CAAC;CACf,CAAC,CAAC;AAEL,sFAAsF;AACzE,QAAA,WAAW,GAAG;IACzB,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,wBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,KAAK,EAAE,OAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpE;;;WAGG;QACH,KAAK,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC5D,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACnD,QAAQ,EAAE,OAAC;SACR,MAAM,CAAC;QACN,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QACxD,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC;KACxF,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9D,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnG,YAAY,EAAE,OAAC;SACZ,MAAM,CAAC;QACN,eAAe,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QAC7C,mBAAmB,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QACjD,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QACjH,UAAU,EAAE,OAAC;aACV,MAAM,CAAC;YACN,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;YACpB,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;YACxC,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC/C,mBAAmB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAC5C,CAAC;aACD,MAAM,EAAE;aACR,QAAQ,EAAE;QACb,iHAAiH;QACjH,OAAO,EAAE,iBAAiB;aACvB,MAAM,CAAC;YACN,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YACzC,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YAC9C,gBAAgB,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YAChD,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;SAC/C,CAAC;aACD,QAAQ,EAAE;KACd,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,CAAC;CACf,CAAC;AAEW,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC,mBAAW,CAAC,CAAC,MAAM,EAAE,CAAC;AAMlE,+EAA+E;AAC/E,SAAgB,cAAc,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,2BAAmB,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;KACpG,CAAC;AACJ,CAAC"}
|
package/dist/policy.d.ts
CHANGED
|
@@ -79,6 +79,10 @@ export declare const policyShape: {
|
|
|
79
79
|
strict: "strict";
|
|
80
80
|
off: "off";
|
|
81
81
|
}>>;
|
|
82
|
+
basis: z.ZodDefault<z.ZodEnum<{
|
|
83
|
+
capability: "capability";
|
|
84
|
+
data: "data";
|
|
85
|
+
}>>;
|
|
82
86
|
}, z.core.$strict>>;
|
|
83
87
|
approval: z.ZodDefault<z.ZodObject<{
|
|
84
88
|
timeoutSeconds: z.ZodDefault<z.ZodNumber>;
|
|
@@ -131,6 +135,29 @@ export declare const policyShape: {
|
|
|
131
135
|
}>>;
|
|
132
136
|
detokenizeForEgress: z.ZodOptional<z.ZodBoolean>;
|
|
133
137
|
}, z.core.$strict>>;
|
|
138
|
+
anomaly: z.ZodOptional<z.ZodObject<{
|
|
139
|
+
enabled: z.ZodBoolean;
|
|
140
|
+
action: z.ZodEnum<{
|
|
141
|
+
block: "block";
|
|
142
|
+
warn: "warn";
|
|
143
|
+
}>;
|
|
144
|
+
callBurst: z.ZodOptional<z.ZodObject<{
|
|
145
|
+
count: z.ZodNumber;
|
|
146
|
+
windowSeconds: z.ZodNumber;
|
|
147
|
+
}, z.core.$strict>>;
|
|
148
|
+
sensitiveSweep: z.ZodOptional<z.ZodObject<{
|
|
149
|
+
count: z.ZodNumber;
|
|
150
|
+
windowSeconds: z.ZodNumber;
|
|
151
|
+
}, z.core.$strict>>;
|
|
152
|
+
destructiveBurst: z.ZodOptional<z.ZodObject<{
|
|
153
|
+
count: z.ZodNumber;
|
|
154
|
+
windowSeconds: z.ZodNumber;
|
|
155
|
+
}, z.core.$strict>>;
|
|
156
|
+
repeatedBlocks: z.ZodOptional<z.ZodObject<{
|
|
157
|
+
count: z.ZodNumber;
|
|
158
|
+
windowSeconds: z.ZodNumber;
|
|
159
|
+
}, z.core.$strict>>;
|
|
160
|
+
}, z.core.$strict>>;
|
|
134
161
|
}, z.core.$strict>>;
|
|
135
162
|
};
|
|
136
163
|
export declare const gatewayPolicySchema: z.ZodObject<{
|
|
@@ -175,6 +202,10 @@ export declare const gatewayPolicySchema: z.ZodObject<{
|
|
|
175
202
|
strict: "strict";
|
|
176
203
|
off: "off";
|
|
177
204
|
}>>;
|
|
205
|
+
basis: z.ZodDefault<z.ZodEnum<{
|
|
206
|
+
capability: "capability";
|
|
207
|
+
data: "data";
|
|
208
|
+
}>>;
|
|
178
209
|
}, z.core.$strict>>;
|
|
179
210
|
approval: z.ZodDefault<z.ZodObject<{
|
|
180
211
|
timeoutSeconds: z.ZodDefault<z.ZodNumber>;
|
|
@@ -227,6 +258,29 @@ export declare const gatewayPolicySchema: z.ZodObject<{
|
|
|
227
258
|
}>>;
|
|
228
259
|
detokenizeForEgress: z.ZodOptional<z.ZodBoolean>;
|
|
229
260
|
}, z.core.$strict>>;
|
|
261
|
+
anomaly: z.ZodOptional<z.ZodObject<{
|
|
262
|
+
enabled: z.ZodBoolean;
|
|
263
|
+
action: z.ZodEnum<{
|
|
264
|
+
block: "block";
|
|
265
|
+
warn: "warn";
|
|
266
|
+
}>;
|
|
267
|
+
callBurst: z.ZodOptional<z.ZodObject<{
|
|
268
|
+
count: z.ZodNumber;
|
|
269
|
+
windowSeconds: z.ZodNumber;
|
|
270
|
+
}, z.core.$strict>>;
|
|
271
|
+
sensitiveSweep: z.ZodOptional<z.ZodObject<{
|
|
272
|
+
count: z.ZodNumber;
|
|
273
|
+
windowSeconds: z.ZodNumber;
|
|
274
|
+
}, z.core.$strict>>;
|
|
275
|
+
destructiveBurst: z.ZodOptional<z.ZodObject<{
|
|
276
|
+
count: z.ZodNumber;
|
|
277
|
+
windowSeconds: z.ZodNumber;
|
|
278
|
+
}, z.core.$strict>>;
|
|
279
|
+
repeatedBlocks: z.ZodOptional<z.ZodObject<{
|
|
280
|
+
count: z.ZodNumber;
|
|
281
|
+
windowSeconds: z.ZodNumber;
|
|
282
|
+
}, z.core.$strict>>;
|
|
283
|
+
}, z.core.$strict>>;
|
|
230
284
|
}, z.core.$strict>>;
|
|
231
285
|
}, z.core.$strict>;
|
|
232
286
|
export type GatewayPolicy = z.infer<typeof gatewayPolicySchema>;
|
package/dist/policy.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,eAAO,MAAM,aAAa,8DAA+D,CAAC;AAC1F,eAAO,MAAM,cAAc,uDAAwD,CAAC;
|
|
1
|
+
{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,eAAO,MAAM,aAAa,8DAA+D,CAAC;AAC1F,eAAO,MAAM,cAAc,uDAAwD,CAAC;AAUpF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmBzB,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDvB,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAAiC,CAAC;AAElE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErG,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAO/D"}
|
package/dist/policy.js
CHANGED
|
@@ -11,6 +11,10 @@ export const POLICY_ACTIONS = ["allow", "deny", "mask", "warn", "approve"];
|
|
|
11
11
|
const labelSchema = z.enum(POLICY_LABELS);
|
|
12
12
|
const actionSchema = z.enum(POLICY_ACTIONS);
|
|
13
13
|
const interceptorSchema = z.object({ enabled: z.boolean(), action: z.enum(["block", "warn"]) }).strict();
|
|
14
|
+
/** At most `count` events within `windowSeconds`; one more trips the anomaly check. */
|
|
15
|
+
const anomalyWindowSchema = z
|
|
16
|
+
.object({ count: z.number().int().positive(), windowSeconds: z.number().int().positive().max(86_400) })
|
|
17
|
+
.strict();
|
|
14
18
|
export const policyRuleSchema = z
|
|
15
19
|
.object({
|
|
16
20
|
id: z.string().optional(),
|
|
@@ -35,7 +39,17 @@ export const policyRuleSchema = z
|
|
|
35
39
|
export const policyShape = {
|
|
36
40
|
labels: z.record(z.string(), z.array(labelSchema)).default({}),
|
|
37
41
|
rules: z.array(policyRuleSchema).default([]),
|
|
38
|
-
taint: z
|
|
42
|
+
taint: z
|
|
43
|
+
.object({
|
|
44
|
+
mode: z.enum(["strict", "approve", "warn", "off"]).default("strict"),
|
|
45
|
+
/**
|
|
46
|
+
* capability: any egress call after untrusted + sensitive content is a toxic flow.
|
|
47
|
+
* data: only an egress call whose arguments carry sensitive data the session saw.
|
|
48
|
+
*/
|
|
49
|
+
basis: z.enum(["capability", "data"]).default("capability"),
|
|
50
|
+
})
|
|
51
|
+
.strict()
|
|
52
|
+
.default({ mode: "strict", basis: "capability" }),
|
|
39
53
|
approval: z
|
|
40
54
|
.object({
|
|
41
55
|
timeoutSeconds: z.number().int().positive().default(120),
|
|
@@ -58,6 +72,15 @@ export const policyShape = {
|
|
|
58
72
|
})
|
|
59
73
|
.strict()
|
|
60
74
|
.optional(),
|
|
75
|
+
/** Behaviour over a session: call bursts, sweeps of sensitive reads, bulk destructive calls, repeated blocks. */
|
|
76
|
+
anomaly: interceptorSchema
|
|
77
|
+
.extend({
|
|
78
|
+
callBurst: anomalyWindowSchema.optional(),
|
|
79
|
+
sensitiveSweep: anomalyWindowSchema.optional(),
|
|
80
|
+
destructiveBurst: anomalyWindowSchema.optional(),
|
|
81
|
+
repeatedBlocks: anomalyWindowSchema.optional(),
|
|
82
|
+
})
|
|
83
|
+
.optional(),
|
|
61
84
|
})
|
|
62
85
|
.strict()
|
|
63
86
|
.default({}),
|
package/dist/policy.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAU,CAAC;AAC1F,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AAEpF,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAC1C,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAC5C,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAU,CAAC;AAC1F,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AAEpF,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAC1C,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAC5C,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACzG,uFAAuF;AACvF,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KACtG,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC7B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACtF,CAAC;SACD,MAAM,EAAE;IACX,MAAM,EAAE,YAAY;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3E,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE;IACnE,OAAO,EAAE,0CAA0C;IACnD,IAAI,EAAE,CAAC,MAAM,CAAC;CACf,CAAC,CAAC;AAEL,sFAAsF;AACtF,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpE;;;WAGG;QACH,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC5D,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACnD,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QACxD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC;KACxF,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnG,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,eAAe,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QAC7C,mBAAmB,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QACjD,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QACjH,UAAU,EAAE,CAAC;aACV,MAAM,CAAC;YACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;YACpB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;YACxC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC/C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAC5C,CAAC;aACD,MAAM,EAAE;aACR,QAAQ,EAAE;QACb,iHAAiH;QACjH,OAAO,EAAE,iBAAiB;aACvB,MAAM,CAAC;YACN,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YACzC,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YAC9C,gBAAgB,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YAChD,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;SAC/C,CAAC;aACD,QAAQ,EAAE;KACd,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,CAAC;CACf,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;AAMlE,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;KACpG,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@guardbee/guard-core",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.5.0",
|
|
4
4
|
"description": "Shared detectors for GuardBee MCP packages — checksum-validated PII masking, prompt injection patterns, and lethal-trifecta tool classification",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/index.js",
|