@guilz-dev/belay 0.4.0 → 0.7.0

package/dist/core/capability/policy-engine.js

@@ -0,0 +1,663 @@
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+import { matchesSensitivePath } from '../glob.js';
+import { parseNetworkEndpoint } from '../network-endpoint.js';
+import { canonicalPath, pathWithinRoot, resolveWorkspaceRootMatch } from '../path-utils.js';
+import { tokenizeShell } from '../shell-tokenizer.js';
+import { BOUNDARY_GRANT_ISSUER_CONTAINER, isPathWithinBoundaryMount, materializeContainerBoundaryGrant, } from './boundary-grant-materialize.js';
+import { boundaryVerifiedAllowEnabled } from './boundary-profile.js';
+import { isGrantScopeTooBroad } from './grant.js';
+import { broadGrantTargetsRequest, grantMatchesRequest } from './grant-match.js';
+import { CAPABILITY_REQUEST_VERSION, } from './request.js';
+function enrichAuthWithMaterializedGrants(request, config, auth) {
+    if (!auth?.attestation || !boundaryVerifiedAllowEnabled(auth.attestation)) {
+        return auth;
+    }
+    const materialized = materializeContainerBoundaryGrant(request, {
+        attestation: auth.attestation,
+        mountRoot: request.context.cwd,
+        egressProxyActive: auth.egressProxyActive === true,
+        existingGrants: auth.grants,
+        sensitivePaths: auth.sensitivePaths ?? config.classifier.sensitivePaths,
+    });
+    if (!materialized) {
+        return auth;
+    }
+    return { ...auth, grants: [...(auth.grants ?? []), materialized] };
+}
+function buildAuthorizationContext(config, trustedWorkspaceRoots, auth) {
+    return {
+        config,
+        grants: auth?.grants,
+        attestation: auth?.attestation ?? null,
+        trustedWorkspaceRoots,
+    };
+}
+export function buildSubagentCapabilityRequest(analysis) {
+    return {
+        version: CAPABILITY_REQUEST_VERSION,
+        principal: {
+            adapter: analysis.adapter,
+            repoRoot: analysis.repoRoot,
+            sessionHash: hashSession(`${analysis.repoRoot}:${analysis.cwd}`),
+        },
+        action: 'process.exec',
+        resource: { kind: 'executable', command: analysis.subagentType },
+        context: {
+            cwd: analysis.cwd,
+            inputFingerprint: analysis.inputFingerprint,
+            hookKind: 'subagent',
+            analysisBasis: [`subagent:${analysis.subagentType}`],
+        },
+        evidence: {
+            level: 'possible',
+            signals: [...analysis.signals],
+        },
+    };
+}
+export function evaluateSubagentPolicy(analysis, config, auth) {
+    const request = buildSubagentCapabilityRequest(analysis);
+    const enriched = enrichAuthWithMaterializedGrants(request, config, auth);
+    const decision = getDefaultPolicyEngine().evaluate(request, buildAuthorizationContext(config, undefined, enriched));
+    return { request, decision };
+}
+function hashSession(value) {
+    return createHash('sha256').update(value).digest('hex').slice(0, 16);
+}
+function resolveCapabilityPath(targetPath, cwd) {
+    const joined = path.isAbsolute(targetPath) ? targetPath : path.join(cwd, targetPath);
+    return canonicalPath(joined);
+}
+function evidenceLevelForOpacity(opacity) {
+    if (opacity === 'transparent' || opacity === 'recursive') {
+        return 'certain';
+    }
+    if (opacity === 'opaque') {
+        return 'possible';
+    }
+    return 'indeterminate';
+}
+function isGitRefWrite(analysis) {
+    if (analysis.segmentHead !== 'git') {
+        return false;
+    }
+    return analysis.signals.includes('git.push');
+}
+function actionForShellAnalysis(analysis) {
+    if (isGitRefWrite(analysis)) {
+        return 'git.ref.write';
+    }
+    if (analysis.effect === 'remote_mutation' ||
+        analysis.egressClass === 'ambiguous' ||
+        analysis.egressClass === 'read' ||
+        analysis.egressClass === 'destructive') {
+        return 'network.connect';
+    }
+    if (analysis.opacity === 'unparseable' || analysis.effect === 'unknown') {
+        return 'indeterminate';
+    }
+    if (analysis.effect === 'read_only') {
+        return 'fs.read';
+    }
+    if (analysis.location === 'external') {
+        return 'network.connect';
+    }
+    if (analysis.effect === 'local_mutation') {
+        return 'fs.write';
+    }
+    return 'indeterminate';
+}
+function resourcePathForShellAnalysis(analysis) {
+    const targets = analysis.resolvedPathTargets && analysis.resolvedPathTargets.length > 0
+        ? analysis.resolvedPathTargets
+        : analysis.pathArgs;
+    if (targets.length === 0) {
+        return null;
+    }
+    const repoRoot = canonicalPath(analysis.repoRoot);
+    const resolved = targets.map((target) => analysis.resolvedPathTargets?.length
+        ? canonicalPath(target)
+        : resolveCapabilityPath(target, analysis.cwd));
+    const [first] = resolved;
+    if (!first) {
+        return null;
+    }
+    if (analysis.effect === 'local_mutation') {
+        const outside = resolved.find((candidate) => !pathWithinRoot(repoRoot, candidate));
+        return outside ?? resolved.at(-1) ?? first;
+    }
+    return first;
+}
+function resourceForShellAnalysis(analysis) {
+    if (isGitRefWrite(analysis)) {
+        return { kind: 'git-ref', ref: 'push' };
+    }
+    if (isNetworkShellAnalysis(analysis)) {
+        const exact = exactNetworkResources(analysis);
+        return ((exact.length === 1 ? exact[0] : undefined) ?? {
+            kind: 'network',
+            host: '*',
+            protocol: 'unknown',
+        });
+    }
+    const resourcePath = resourcePathForShellAnalysis(analysis);
+    if (resourcePath) {
+        return { kind: 'path', path: resourcePath };
+    }
+    return { kind: 'executable', command: analysis.segmentHead };
+}
+function isNetworkShellAnalysis(analysis) {
+    return (analysis.egressClass === 'ambiguous' ||
+        analysis.egressClass === 'read' ||
+        analysis.egressClass === 'destructive' ||
+        analysis.location === 'external');
+}
+const SCP_STYLE_COMMANDS = new Set(['git', 'rsync', 'scp']);
+const PACKAGE_SPEC_COMMANDS = new Set(['bun', 'npm', 'npx', 'pnpm', 'yarn']);
+const NETWORK_VALUE_OPTIONS = new Set(['--registry', '--url']);
+const GIT_OPTIONS_WITH_VALUE = new Set([
+    '-C',
+    '-b',
+    '-c',
+    '-o',
+    '--branch',
+    '--config',
+    '--depth',
+    '--filter',
+    '--git-dir',
+    '--namespace',
+    '--origin',
+    '--reference',
+    '--separate-git-dir',
+    '--upload-pack',
+    '--work-tree',
+]);
+function gitRemoteOperand(tokens) {
+    let cursor = 1;
+    while (cursor < tokens.length) {
+        const token = tokens[cursor];
+        if (!token) {
+            return null;
+        }
+        if (GIT_OPTIONS_WITH_VALUE.has(token)) {
+            cursor += 2;
+            continue;
+        }
+        if (token.startsWith('-')) {
+            cursor += 1;
+            continue;
+        }
+        break;
+    }
+    const subcommand = tokens[cursor];
+    if (!subcommand) {
+        return null;
+    }
+    const positionals = [];
+    let skipOptionValue = false;
+    for (const token of tokens.slice(cursor + 1)) {
+        if (skipOptionValue) {
+            skipOptionValue = false;
+            continue;
+        }
+        if (GIT_OPTIONS_WITH_VALUE.has(token)) {
+            skipOptionValue = true;
+            continue;
+        }
+        if (token.startsWith('-')) {
+            continue;
+        }
+        positionals.push(token);
+    }
+    if (['clone', 'fetch', 'ls-remote', 'pull', 'push'].includes(subcommand)) {
+        return positionals[0] ?? null;
+    }
+    if (subcommand === 'remote' && positionals[0] === 'add') {
+        return positionals[2] ?? null;
+    }
+    if (subcommand === 'submodule' && positionals[0] === 'add') {
+        return positionals[1] ?? null;
+    }
+    return null;
+}
+function exactNetworkResources(analysis) {
+    const resources = new Map();
+    const shellTokens = tokenizeShell(analysis.command);
+    const gitRemote = analysis.segmentHead === 'git' ? gitRemoteOperand(shellTokens) : null;
+    for (const rawToken of shellTokens) {
+        const optionSeparator = rawToken.startsWith('-') ? rawToken.indexOf('=') : -1;
+        const optionName = optionSeparator === -1 ? null : rawToken.slice(0, optionSeparator);
+        const token = optionSeparator !== -1 && optionName && NETWORK_VALUE_OPTIONS.has(optionName)
+            ? rawToken.slice(optionSeparator + 1)
+            : rawToken;
+        const endpoint = parseNetworkEndpoint(token, {
+            allowHostedGitShorthand: PACKAGE_SPEC_COMMANDS.has(analysis.segmentHead),
+            allowScpStyle: SCP_STYLE_COMMANDS.has(analysis.segmentHead) &&
+                (analysis.segmentHead !== 'git' || rawToken === gitRemote),
+        });
+        if (!endpoint) {
+            continue;
+        }
+        const resource = { kind: 'network', ...endpoint };
+        resources.set(`${resource.host}:${resource.port ?? ''}:${resource.protocol}`, resource);
+    }
+    return [...resources.values()];
+}
+export function buildShellCapabilityRequest(analysis) {
+    const [request] = buildShellCapabilityRequests(analysis);
+    if (!request) {
+        throw new Error('shell analysis produced no capability request');
+    }
+    return request;
+}
+export function buildShellCapabilityRequests(analysis) {
+    const resources = isNetworkShellAnalysis(analysis) ? exactNetworkResources(analysis) : [];
+    const selectedResources = resources.length > 0 ? resources : [resourceForShellAnalysis(analysis)];
+    return selectedResources.map((resource) => ({
+        version: CAPABILITY_REQUEST_VERSION,
+        principal: {
+            adapter: analysis.adapter,
+            repoRoot: analysis.repoRoot,
+            sessionHash: hashSession(`${analysis.repoRoot}:${analysis.cwd}`),
+        },
+        action: actionForShellAnalysis(analysis),
+        resource,
+        context: {
+            cwd: analysis.cwd,
+            inputFingerprint: analysis.inputFingerprint,
+            hookKind: analysis.hookKind,
+            analysisBasis: [
+                `segment:${analysis.segmentHead}`,
+                `effect:${analysis.effect}`,
+                `location:${analysis.location}`,
+                `opacity:${analysis.opacity}`,
+            ],
+        },
+        evidence: {
+            level: evidenceLevelForOpacity(analysis.opacity),
+            signals: [...analysis.signals],
+        },
+    }));
+}
+function actionForFileMutation(analysis) {
+    if (analysis.locationLabel === 'control_plane') {
+        return 'control_plane.write';
+    }
+    if (analysis.locationLabel === 'sensitive_path') {
+        return 'fs.write';
+    }
+    if (analysis.isDelete) {
+        return 'fs.write';
+    }
+    return 'fs.write';
+}
+export function buildFileMutationCapabilityRequest(analysis) {
+    return {
+        version: CAPABILITY_REQUEST_VERSION,
+        principal: {
+            adapter: analysis.adapter,
+            repoRoot: analysis.repoRoot,
+            sessionHash: hashSession(`${analysis.repoRoot}:${analysis.cwd}`),
+        },
+        action: actionForFileMutation(analysis),
+        resource: { kind: 'path', path: analysis.resolvedPath },
+        context: {
+            cwd: analysis.cwd,
+            inputFingerprint: analysis.inputFingerprint,
+            hookKind: analysis.hookKind,
+            analysisBasis: [
+                `tool:${analysis.toolKind}`,
+                `location:${analysis.locationLabel}`,
+                analysis.isDelete ? 'delete' : 'write',
+            ],
+        },
+        evidence: {
+            level: analysis.locationLabel === 'repo_local' ? 'certain' : 'possible',
+            signals: [...analysis.signals],
+        },
+    };
+}
+function findFreshGrant(request, grants) {
+    if (!grants?.length) {
+        return null;
+    }
+    const now = Date.now();
+    for (const grant of grants) {
+        const expires = Date.parse(grant.expiresAt);
+        if (Number.isFinite(expires) && expires > now && grantMatchesRequest(grant, request)) {
+            return grant;
+        }
+    }
+    return null;
+}
+function hasFreshGrant(request, grants) {
+    return findFreshGrant(request, grants) !== null;
+}
+function grantDecisionSignals(request, grant) {
+    const signals = [...request.evidence.signals, 'capability_grant'];
+    if (grant.issuer === BOUNDARY_GRANT_ISSUER_CONTAINER) {
+        signals.push('boundary_materialized_grant');
+    }
+    return signals;
+}
+function shellLocationFromRequest(request) {
+    const entry = request.context.analysisBasis.find((basis) => basis.startsWith('location:'));
+    return entry?.slice('location:'.length) ?? null;
+}
+function isRepoLocalShellLocation(request) {
+    return shellLocationFromRequest(request) === 'repo_local';
+}
+function isRepoLocalPackageExec(request) {
+    if (request.action !== 'process.exec' || request.resource.kind !== 'executable') {
+        return false;
+    }
+    if (!request.evidence.signals.includes('package_exec.local_bin_resolved')) {
+        return false;
+    }
+    const commandPath = canonicalPath(request.resource.command);
+    return path.isAbsolute(commandPath) && pathWithinRoot(request.principal.repoRoot, commandPath);
+}
+function isRepoLocalRoutineWrite(request, sensitivePaths) {
+    if (!isRepoLocalShellLocation(request)) {
+        return false;
+    }
+    if (request.action !== 'fs.write' && request.action !== 'fs.read') {
+        return false;
+    }
+    if (request.resource.kind !== 'path') {
+        return false;
+    }
+    const resolved = resolveCapabilityPath(request.resource.path, request.context.cwd);
+    const repoRoot = canonicalPath(request.principal.repoRoot);
+    if (!pathWithinRoot(repoRoot, resolved)) {
+        return false;
+    }
+    const relative = resolved.slice(repoRoot.length).replace(/^[/\\]/, '');
+    return !matchesSensitivePath(relative, sensitivePaths);
+}
+function isTrustedWorkspaceWrite(request, trustedWorkspaceRoots) {
+    if (!trustedWorkspaceRoots?.length || request.resource.kind !== 'path') {
+        return false;
+    }
+    const match = resolveWorkspaceRootMatch(request.principal.repoRoot, trustedWorkspaceRoots, request.resource.path);
+    return match?.kind === 'trusted';
+}
+/**
+ * boundary.verified widens only when builtin already allows, or a boundary-materialized
+ * grant is present for an approved high-risk action (network via egress chokepoint).
+ */
+function verifiedBoundaryAllows(request, context) {
+    if (!boundaryVerifiedAllowEnabled(context.attestation)) {
+        return false;
+    }
+    if (request.evidence.level !== 'certain') {
+        return false;
+    }
+    const builtin = builtInRule(request, context);
+    if (builtin?.outcome === 'allow') {
+        return isPathWithinBoundaryMount(request);
+    }
+    if (builtin?.outcome === 'deny') {
+        return false;
+    }
+    return hasFreshGrant(request, context.grants?.filter((grant) => grant.issuer === BOUNDARY_GRANT_ISSUER_CONTAINER));
+}
+function builtInRule(request, context) {
+    const trustedWorkspaceRoots = context.trustedWorkspaceRoots;
+    const sensitivePaths = context.config.classifier.sensitivePaths;
+    if (request.action === 'control_plane.write') {
+        return {
+            outcome: 'require_approval',
+            reason: 'control_plane_mutation',
+            signals: [...request.evidence.signals, 'control_plane_path'],
+            matchedRule: 'builtin.control_plane',
+        };
+    }
+    if (request.action === 'process.exec' && request.context.hookKind === 'subagent') {
+        return {
+            outcome: 'allow',
+            reason: 'subagent_review',
+            signals: [...request.evidence.signals],
+            matchedRule: 'builtin.subagent',
+        };
+    }
+    if (isRepoLocalPackageExec(request)) {
+        return {
+            outcome: 'allow',
+            reason: 'read_only',
+            signals: [...request.evidence.signals, 'repo_local_exec'],
+            matchedRule: 'builtin.repo_local_exec',
+        };
+    }
+    if (request.action === 'secret.read' || request.action === 'git.ref.write') {
+        return {
+            outcome: 'require_approval',
+            reason: 'high_stakes_path',
+            signals: [...request.evidence.signals, 'secret_path'],
+            matchedRule: 'builtin.secret',
+        };
+    }
+    if (request.action === 'network.connect') {
+        return {
+            outcome: 'require_approval',
+            reason: 'external_effect',
+            signals: [...request.evidence.signals, 'network_connect'],
+            matchedRule: 'builtin.network',
+        };
+    }
+    if (request.action === 'indeterminate' || request.evidence.level === 'indeterminate') {
+        return {
+            outcome: 'require_approval',
+            reason: 'indeterminate_effect',
+            signals: [...request.evidence.signals, 'indeterminate'],
+            matchedRule: 'builtin.indeterminate',
+        };
+    }
+    if (request.resource.kind === 'path' && sensitivePaths?.length) {
+        const repoRoot = canonicalPath(request.principal.repoRoot);
+        const resolved = resolveCapabilityPath(request.resource.path, request.context.cwd);
+        if (pathWithinRoot(repoRoot, resolved)) {
+            const relative = resolved.slice(repoRoot.length).replace(/^[/\\]/, '');
+            if (matchesSensitivePath(relative, sensitivePaths)) {
+                return {
+                    outcome: 'require_approval',
+                    reason: 'high_stakes_path',
+                    signals: [...request.evidence.signals, 'sensitive_path'],
+                    matchedRule: 'builtin.sensitive_path',
+                };
+            }
+        }
+    }
+    if (request.resource.kind === 'path') {
+        const repoRoot = canonicalPath(request.principal.repoRoot);
+        const resolved = resolveCapabilityPath(request.resource.path, request.context.cwd);
+        const insideRepo = pathWithinRoot(repoRoot, resolved);
+        if (!insideRepo && !isTrustedWorkspaceWrite(request, trustedWorkspaceRoots)) {
+            return {
+                outcome: 'require_approval',
+                reason: 'outside_repo_mutation',
+                signals: [...request.evidence.signals, 'outside_repo_path'],
+                matchedRule: 'builtin.outside_repo',
+            };
+        }
+    }
+    if (request.action === 'fs.read' || request.action === 'fs.write') {
+        if (request.action === 'fs.read' &&
+            request.resource.kind === 'executable' &&
+            isRepoLocalShellLocation(request)) {
+            return {
+                outcome: 'allow',
+                reason: 'read_only',
+                signals: [...request.evidence.signals],
+                matchedRule: 'builtin.repo_local',
+            };
+        }
+        if (isRepoLocalRoutineWrite(request, sensitivePaths)) {
+            return {
+                outcome: 'allow',
+                reason: request.action === 'fs.read' ? 'read_only' : 'repo_local_mutation',
+                signals: [...request.evidence.signals],
+                matchedRule: 'builtin.repo_local',
+            };
+        }
+        if (isTrustedWorkspaceWrite(request, trustedWorkspaceRoots)) {
+            return {
+                outcome: 'allow',
+                reason: 'trusted_workspace_root',
+                signals: [...request.evidence.signals, 'trusted_workspace_root'],
+                matchedRule: 'builtin.trusted_workspace',
+            };
+        }
+    }
+    if (request.evidence.signals.includes('unparseable_shell')) {
+        const deny = context.config.policy.unparseableShell === 'deny';
+        return {
+            outcome: deny ? 'require_approval' : 'allow',
+            reason: 'unparseable_shell',
+            signals: [...request.evidence.signals],
+            matchedRule: deny ? 'builtin.unparseable' : 'builtin.unparseable_allow_flagged',
+        };
+    }
+    if (request.evidence.signals.includes('opaque_execution')) {
+        return {
+            outcome: 'require_approval',
+            reason: 'opaque_execution',
+            signals: [...request.evidence.signals],
+            matchedRule: 'builtin.opaque',
+        };
+    }
+    return null;
+}
+export function createTypeScriptPolicyEngine() {
+    return {
+        evaluate(request, context) {
+            if (request.evidence.signals.includes('forged_grant')) {
+                return {
+                    outcome: 'deny',
+                    reason: 'grant_forgery',
+                    signals: [...request.evidence.signals, 'grant_forgery'],
+                    matchedRule: 'forbid.grant_forgery',
+                };
+            }
+            const grants = context.grants;
+            if (grants?.some((grant) => isGrantScopeTooBroad(grant) && broadGrantTargetsRequest(grant, request))) {
+                return {
+                    outcome: 'deny',
+                    reason: 'grant_scope_too_broad',
+                    signals: [...request.evidence.signals, 'grant_scope_too_broad'],
+                    matchedRule: 'forbid.broad_grant',
+                };
+            }
+            const matchedGrant = findFreshGrant(request, grants);
+            if (matchedGrant) {
+                return {
+                    outcome: 'allow',
+                    reason: 'capability_grant',
+                    signals: grantDecisionSignals(request, matchedGrant),
+                    matchedRule: 'grant.exact',
+                };
+            }
+            if (verifiedBoundaryAllows(request, context)) {
+                return {
+                    outcome: 'allow',
+                    reason: 'verified_boundary',
+                    signals: [...request.evidence.signals, 'verified_boundary'],
+                    matchedRule: 'boundary.verified',
+                };
+            }
+            const builtin = builtInRule(request, context);
+            if (builtin) {
+                return builtin;
+            }
+            return {
+                outcome: 'require_approval',
+                reason: 'policy_default',
+                signals: [...request.evidence.signals, 'default_deny'],
+                matchedRule: 'default.require_approval',
+            };
+        },
+    };
+}
+let defaultPolicyEngine = null;
+export function getDefaultPolicyEngine() {
+    if (!defaultPolicyEngine) {
+        defaultPolicyEngine = createTypeScriptPolicyEngine();
+    }
+    return defaultPolicyEngine;
+}
+export function policyDecisionRequiresAsk(decision) {
+    return decision.outcome === 'require_approval' || decision.outcome === 'deny';
+}
+function policyOutcomeRank(outcome) {
+    switch (outcome) {
+        case 'deny':
+            return 3;
+        case 'require_approval':
+            return 2;
+        case 'allow':
+            return 1;
+        default:
+            return 0;
+    }
+}
+export function combinePolicyDecisions(decisions) {
+    if (!decisions.length) {
+        return {
+            outcome: 'allow',
+            reason: 'read_only',
+            signals: [],
+            matchedRule: 'plan.conjunction',
+        };
+    }
+    const sorted = [...decisions].sort((left, right) => policyOutcomeRank(right.outcome) - policyOutcomeRank(left.outcome));
+    const worst = sorted[0];
+    if (!worst) {
+        return {
+            outcome: 'allow',
+            reason: 'read_only',
+            signals: [],
+            matchedRule: 'plan.conjunction',
+        };
+    }
+    return worst;
+}
+export function evaluateCapabilityRequestsPolicy(requests, config, auth, trustedWorkspaceRoots) {
+    let workingAuth = auth;
+    const decisions = [];
+    for (const request of requests) {
+        const enriched = enrichAuthWithMaterializedGrants(request, config, workingAuth);
+        const decision = getDefaultPolicyEngine().evaluate(request, buildAuthorizationContext(config, trustedWorkspaceRoots, enriched));
+        decisions.push(decision);
+        const previousCount = workingAuth?.grants?.length ?? 0;
+        const nextCount = enriched?.grants?.length ?? 0;
+        if (nextCount > previousCount) {
+            workingAuth = enriched;
+        }
+    }
+    return {
+        decisions,
+        decision: combinePolicyDecisions(decisions),
+    };
+}
+export function evaluateShellPolicy(analysis, config, auth) {
+    const requests = buildShellCapabilityRequests(analysis);
+    const enrichedAuth = {
+        ...auth,
+        sensitivePaths: auth?.sensitivePaths ?? analysis.sensitivePaths,
+    };
+    const { decision } = evaluateCapabilityRequestsPolicy(requests, config, enrichedAuth, analysis.trustedWorkspaceRoots);
+    const [request] = requests;
+    if (!request) {
+        throw new Error('shell analysis produced no capability request');
+    }
+    return { request, requests, decision };
+}
+export function evaluateFileMutationPolicy(analysis, config, auth) {
+    const request = buildFileMutationCapabilityRequest(analysis);
+    const enriched = enrichAuthWithMaterializedGrants(request, config, {
+        ...auth,
+        sensitivePaths: auth?.sensitivePaths ?? analysis.sensitivePaths,
+    });
+    const decision = getDefaultPolicyEngine().evaluate(request, buildAuthorizationContext(config, analysis.trustedWorkspaceRoots, enriched));
+    return { request, decision };
+}

package/dist/core/capability/policy-types.d.ts

@@ -0,0 +1,20 @@
+import type { BelayConfigV4 } from '../config.js';
+import type { BoundaryAttestation } from './attestation.js';
+import type { CapabilityGrantV1 } from './grant.js';
+import type { CapabilityRequestV1 } from './request.js';
+export type PolicyOutcome = 'allow' | 'require_approval' | 'deny';
+export interface PolicyDecision {
+    outcome: PolicyOutcome;
+    reason: string;
+    signals: string[];
+    matchedRule?: string;
+}
+export interface AuthorizationContext {
+    config: BelayConfigV4;
+    grants?: CapabilityGrantV1[];
+    attestation?: BoundaryAttestation | null;
+    trustedWorkspaceRoots?: string[];
+}
+export interface PolicyEngine {
+    evaluate(request: CapabilityRequestV1, context: AuthorizationContext): PolicyDecision;
+}

package/dist/core/capability/policy-types.js

@@ -0,0 +1 @@
+export {};