@handlebar/governance-schema 0.2.0 → 0.3.0

package/dist/index.js

@@ -13881,10 +13881,10 @@ var MetricRefSchema = exports_external.discriminatedUnion("kind", [
 ]);
 var MetricWindowConditionSchema = exports_external.object({
   kind: exports_external.literal("metricWindow"),
-  scope: exports_external.enum(["agent", "agent_user"]),
+  scope: exports_external.enum(["run", "agent", "agent_user"]),
   metric: MetricRefSchema,
   aggregate: exports_external.enum(["sum", "avg", "max", "min", "count"]),
-  windowSeconds: exports_external.number().int().positive(),
+  windowSeconds: exports_external.number().int().positive().optional(),
   filter: exports_external.object({
     toolName: exports_external.union([GlobSchema, exports_external.array(GlobSchema).min(1)]).optional(),
     toolTag: exports_external.union([exports_external.string().min(1), exports_external.array(exports_external.string().min(1)).min(1)]).optional()
@@ -13894,6 +13894,53 @@ var MetricWindowConditionSchema = exports_external.object({
   onMissing: RuleEffectKindSchema.optional()
 }).strict();
 
+// src/rules/sensitive.ts
+var SensitiveDataDetectorSchema = exports_external.enum([
+  "email",
+  "email_domain",
+  "phone",
+  "credit_card",
+  "iban",
+  "uk_nino",
+  "ip_address",
+  "url",
+  "jwt",
+  "private_key",
+  "secret_key"
+]);
+var SubConditionValueSchema = exports_external.union([
+  exports_external.string().min(1),
+  exports_external.array(exports_external.string().min(1)).min(1)
+]);
+var SensitiveDataSubConditionSchema = exports_external.discriminatedUnion("check", [
+  exports_external.object({
+    check: exports_external.literal("domain"),
+    op: exports_external.enum(["eq", "neq", "endsWith", "in"]),
+    value: SubConditionValueSchema
+  }).strict(),
+  exports_external.object({
+    check: exports_external.literal("tld"),
+    op: exports_external.enum(["eq", "neq", "in"]),
+    value: SubConditionValueSchema
+  }).strict(),
+  exports_external.object({
+    check: exports_external.literal("scheme"),
+    op: exports_external.enum(["eq", "neq", "in"]),
+    value: SubConditionValueSchema
+  }).strict()
+]);
+var SensitiveDataDetectorEntrySchema = exports_external.object({
+  detector: SensitiveDataDetectorSchema,
+  subCondition: SensitiveDataSubConditionSchema.optional()
+}).strict();
+var SensitiveDataConditionSchema = exports_external.object({
+  kind: exports_external.literal("sensitiveData"),
+  target: exports_external.literal("toolArg"),
+  path: exports_external.string().min(1).max(200).optional(),
+  op: exports_external.enum(["anyOf", "allOf"]).default("anyOf"),
+  detectors: exports_external.array(SensitiveDataDetectorEntrySchema).min(1)
+}).strict();
+
 // src/rules/signals.ts
 var RequireSubjectConditionSchema = exports_external.object({
   kind: exports_external.literal("requireSubject"),
@@ -13926,13 +13973,20 @@ var SignalConditionSchema = exports_external.object({
 // src/rules/time.ts
 var DaySchema = exports_external.enum(["mon", "tue", "wed", "thu", "fri", "sat", "sun"]);
 var TimeHHMMSchema = exports_external.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/, 'Expected time in "HH:MM" 24-hour format');
-var TimeGateConditionSchema = exports_external.object({
-  kind: exports_external.literal("timeGate"),
-  timezone: exports_external.object({
+var TimezoneSchema = exports_external.discriminatedUnion("source", [
+  exports_external.object({
     source: exports_external.literal("enduserTag"),
     tag: exports_external.string().min(1),
     fallback: exports_external.literal("org").optional()
   }).strict(),
+  exports_external.object({
+    source: exports_external.literal("static"),
+    tz: exports_external.string().min(1)
+  }).strict()
+]);
+var TimeGateConditionSchema = exports_external.object({
+  kind: exports_external.literal("timeGate"),
+  timezone: TimezoneSchema,
   windows: exports_external.array(exports_external.object({
     days: exports_external.array(DaySchema).min(1),
     start: TimeHHMMSchema,
@@ -13960,28 +14014,43 @@ var ToolNameConditionSchema = exports_external.discriminatedUnion("op", [
     value: exports_external.array(exports_external.string().min(1)).min(1)
   }).strict()
 ]);
-var ToolArgConditionSchema = exports_external.discriminatedUnion("type", [
-  exports_external.object({
-    kind: exports_external.literal("toolArg"),
-    type: exports_external.literal("string"),
-    op: exports_external.enum(["eq", "neq", "contains", "startsWith", "endsWith", "in"]),
-    path: exports_external.string().min(1).max(100),
-    value: exports_external.string().min(1).max(1000)
-  }),
-  exports_external.object({
-    kind: exports_external.literal("toolArg"),
-    type: exports_external.literal("number"),
-    op: exports_external.enum(["eq", "neq", "lt", "lte", "gt", "gte"]),
-    path: exports_external.string().min(1).max(100),
-    value: exports_external.number()
-  }),
+var ToolArgConditionSchema = exports_external.union([
+  exports_external.discriminatedUnion("type", [
+    exports_external.object({
+      kind: exports_external.literal("toolArg"),
+      type: exports_external.literal("string"),
+      op: exports_external.enum([
+        "eq",
+        "neq",
+        "contains",
+        "startsWith",
+        "endsWith",
+        "in",
+        "regex"
+      ]),
+      path: exports_external.string().min(1).max(100).optional(),
+      value: exports_external.string().min(1).max(1000)
+    }),
+    exports_external.object({
+      kind: exports_external.literal("toolArg"),
+      type: exports_external.literal("number"),
+      op: exports_external.enum(["eq", "neq", "lt", "lte", "gt", "gte"]),
+      path: exports_external.string().min(1).max(100).optional(),
+      value: exports_external.number()
+    }),
+    exports_external.object({
+      kind: exports_external.literal("toolArg"),
+      type: exports_external.literal("boolean"),
+      op: exports_external.literal("eq"),
+      path: exports_external.string().min(1).max(100).optional(),
+      value: exports_external.boolean()
+    })
+  ]),
   exports_external.object({
     kind: exports_external.literal("toolArg"),
-    type: exports_external.literal("boolean"),
-    op: exports_external.literal("eq"),
-    path: exports_external.string().min(1).max(100),
-    value: exports_external.boolean()
-  })
+    op: exports_external.enum(["exists", "notExists"]),
+    path: exports_external.string().min(1).max(100)
+  }).strict()
 ]);
 var ToolTagConditionSchema = exports_external.discriminatedUnion("op", [
   exports_external.object({
@@ -14000,10 +14069,22 @@ var ToolTagConditionSchema = exports_external.discriminatedUnion("op", [
     tags: exports_external.array(exports_external.string().min(1)).min(1)
   }).strict()
 ]);
+var SequenceEntrySchema = exports_external.union([
+  GlobSchema,
+  exports_external.object({
+    by: exports_external.literal("toolName"),
+    patterns: exports_external.array(GlobSchema).min(1)
+  }).strict(),
+  exports_external.object({
+    by: exports_external.literal("toolTag"),
+    tags: exports_external.array(exports_external.string().min(1)).min(1),
+    op: exports_external.enum(["anyOf", "allOf"]).optional()
+  }).strict()
+]);
 var SequenceConditionSchema = exports_external.object({
   kind: exports_external.literal("sequence"),
-  mustHaveCalled: exports_external.array(GlobSchema).min(1).optional(),
-  mustNotHaveCalled: exports_external.array(GlobSchema).min(1).optional()
+  mustHaveCalled: exports_external.array(SequenceEntrySchema).min(1).optional(),
+  mustNotHaveCalled: exports_external.array(SequenceEntrySchema).min(1).optional()
 }).strict().refine((v) => v.mustHaveCalled?.length || v.mustNotHaveCalled?.length, "sequence requires mustHaveCalled and/or mustNotHaveCalled");
 var MaxCallsSelectorSchema = exports_external.discriminatedUnion("by", [
   exports_external.object({ by: exports_external.literal("toolName"), patterns: exports_external.array(GlobSchema).min(1) }).strict(),
@@ -14015,7 +14096,10 @@ var MaxCallsSelectorSchema = exports_external.discriminatedUnion("by", [
 var MaxCallsConditionSchema = exports_external.object({
   kind: exports_external.literal("maxCalls"),
   selector: MaxCallsSelectorSchema,
-  max: exports_external.number().int().nonnegative()
+  max: exports_external.number().int().nonnegative(),
+  windowSeconds: exports_external.number().int().positive().optional(),
+  per: exports_external.enum(["agent", "agent_user"]).optional(),
+  tagFilter: exports_external.array(exports_external.string().min(1)).min(1).optional()
 }).strict();
 
 // src/rules/condition.ts
@@ -14031,17 +14115,19 @@ var BaseRuleConditionSchema = exports_external.union([
   MetricWindowConditionSchema,
   TimeGateConditionSchema,
   RequireSubjectConditionSchema,
-  SignalConditionSchema
+  SignalConditionSchema,
+  SensitiveDataConditionSchema
 ]);
+var LazyRuleConditionSchema = exports_external.lazy(() => RuleConditionSchema);
 var AndConditionSchema = exports_external.object({
   kind: exports_external.literal("and"),
-  all: exports_external.array(BaseRuleConditionSchema).min(1)
+  all: exports_external.array(LazyRuleConditionSchema).min(1)
 }).strict();
 var OrConditionSchema = exports_external.object({
   kind: exports_external.literal("or"),
-  any: exports_external.array(BaseRuleConditionSchema).min(1)
+  any: exports_external.array(LazyRuleConditionSchema).min(1)
 }).strict();
-var NotConditionSchema = exports_external.object({ kind: exports_external.literal("not"), not: BaseRuleConditionSchema }).strict();
+var NotConditionSchema = exports_external.object({ kind: exports_external.literal("not"), not: LazyRuleConditionSchema }).strict();
 var RuleConditionSchema = exports_external.union([
   BaseRuleConditionSchema,
   AndConditionSchema,