@highflame/policy 2.0.0 → 2.0.2

package/dist/studio-ui.test.js

@@ -0,0 +1,254 @@
+/**
+ * Studio UI Integration Tests
+ *
+ * These tests simulate exactly how the Studio UI (Overwatch admin dashboard)
+ * will use the @highflame/policy npm package.
+ */
+import { describe, it, expect } from 'vitest';
+// Browser-safe imports (simulating '@highflame/policy/types')
+import { PolicyBuilder, OVERWATCH_SCHEMA, PALISADE_SCHEMA, OVERWATCH_CONTEXT, OverwatchContextKey, PalisadeContextKey, 
+// Entity metadata for UI dropdowns
+OVERWATCH_ENTITIES, OVERWATCH_ACTION_ENTITIES, PALISADE_ENTITIES, PALISADE_ACTION_ENTITIES, } from './types.js';
+// Node.js only imports (for API routes)
+import { PolicyEngine, PolicyValidator, newEntityUID, newEntity, } from './index.js';
+describe('Studio UI Integration Tests', () => {
+    /**
+     * Test: PolicyBuilder action formatting
+     *
+     * Tests that simple action names are properly formatted to Cedar syntax.
+     * This is the "normal approach" for non-namespaced schemas.
+     */
+    it('should format simple action names to Cedar syntax', () => {
+        // Using simple action name (normal approach)
+        const policy = PolicyBuilder.permit()
+            .principalType('User')
+            .action('call_tool')
+            .resourceType('Tool')
+            .build();
+        const cedarText = policy.toCedar();
+        // Simple actions should be wrapped as Action::"..."
+        expect(cedarText).toContain('action == Action::"call_tool"');
+        expect(cedarText).not.toContain('Action::"Action::'); // No double-wrapping
+    });
+    /**
+     * Test 1: Schema and Context Loading
+     *
+     * Studio UI needs to load schemas for validation and context metadata
+     * for populating form dropdowns.
+     */
+    it('should load schemas and context metadata for form builders', () => {
+        // Schemas should be strings
+        expect(typeof OVERWATCH_SCHEMA).toBe('string');
+        expect(OVERWATCH_SCHEMA).toContain('namespace Overwatch');
+        expect(typeof PALISADE_SCHEMA).toBe('string');
+        expect(PALISADE_SCHEMA).toContain('namespace Palisade');
+        // Context metadata should have action definitions
+        expect(OVERWATCH_CONTEXT.service).toBe('overwatch');
+        expect(OVERWATCH_CONTEXT.actions.length).toBeGreaterThan(0);
+        // Find call_tool action and verify context attributes
+        const callToolAction = OVERWATCH_CONTEXT.actions.find((a) => a.name === 'call_tool');
+        expect(callToolAction).toBeDefined();
+        expect(callToolAction.context_attributes.length).toBeGreaterThan(0);
+        // Context keys should be available for type-safe form building
+        expect(OverwatchContextKey.ToolName).toBe('tool_name');
+        expect(OverwatchContextKey.ThreatCount).toBe('threat_count');
+        expect(PalisadeContextKey.Severity).toBe('severity');
+        expect(PalisadeContextKey.Environment).toBe('environment');
+    });
+    /**
+     * Test 2: Full Round-Trip - Create Policy → Validate → Evaluate
+     *
+     * This simulates the complete flow:
+     * 1. User creates a policy using PolicyBuilder in the UI
+     * 2. API validates the policy against the schema
+     * 3. Runtime evaluates the policy
+     */
+    it('should complete full policy lifecycle for Overwatch', () => {
+        // Step 1: User creates policy in form UI
+        const policy = PolicyBuilder.permit()
+            .principalType('Overwatch::User')
+            .action('Overwatch::Action::"call_tool"')
+            .resourceType('Overwatch::Tool')
+            .whenRaw('context.threat_count < 5')
+            .build();
+        const cedarText = policy.toCedar();
+        expect(cedarText).toContain('permit');
+        expect(cedarText).toContain('Overwatch::User');
+        // Step 2: API validates policy against schema
+        const validator = new PolicyValidator(OVERWATCH_SCHEMA);
+        const validationResult = validator.validate(cedarText);
+        expect(validationResult.valid).toBe(true);
+        // Step 3: Runtime loads and evaluates policy
+        const engine = new PolicyEngine({ schema: OVERWATCH_SCHEMA });
+        engine.loadPolicies(cedarText);
+        const entities = [
+            newEntity('Overwatch::User', 'mcp_client', { user_type: 'external', email: 'test@example.com' }),
+            newEntity('Overwatch::Tool', 'shell', { tool_name: 'shell', risk_level: 'high' }),
+        ];
+        // Full context as Guardian will provide at runtime
+        const baseContext = {
+            content: 'ls -la',
+            source: 'claudecode',
+            event: 'PreToolUse',
+            user_email: 'test@example.com',
+            tool_name: 'shell',
+            mcp_server: 'filesystem',
+            mcp_tool: 'shell',
+            path: '/workspace',
+            cwd: '/workspace',
+            workspace_root: '/workspace',
+            highest_severity: 'low',
+            threat_categories: [],
+            threat_types: [],
+            yara_threats: [],
+            max_threat_severity: 1,
+            contains_secrets: false,
+            response_content: '',
+        };
+        // Should allow when threat_count < 5
+        const allowDecision = engine.evaluate({
+            principal: newEntityUID('Overwatch::User', 'mcp_client'),
+            action: 'Overwatch::Action::"call_tool"',
+            resource: newEntityUID('Overwatch::Tool', 'shell'),
+            context: { ...baseContext, threat_count: 3 },
+            entities,
+        });
+        expect(allowDecision.effect).toBe('Allow');
+        // Should deny when threat_count >= 5 (no matching permit)
+        const denyDecision = engine.evaluate({
+            principal: newEntityUID('Overwatch::User', 'mcp_client'),
+            action: 'Overwatch::Action::"call_tool"',
+            resource: newEntityUID('Overwatch::Tool', 'shell'),
+            context: { ...baseContext, threat_count: 10 },
+            entities,
+        });
+        expect(denyDecision.effect).toBe('Deny');
+    });
+    /**
+     * Test 3: Full Round-Trip for Palisade
+     *
+     * Same flow but for Palisade ML security policies.
+     */
+    it('should complete full policy lifecycle for Palisade', () => {
+        // Step 1: Create a forbid policy for CRITICAL findings
+        const policy = PolicyBuilder.forbid()
+            .principalType('Palisade::Scanner')
+            .action('Palisade::Action::"load_model"')
+            .resourceType('Palisade::Artifact')
+            .whenRaw('context.severity == "CRITICAL"')
+            .build();
+        const cedarText = policy.toCedar();
+        // Step 2: Validate
+        const validator = new PolicyValidator(PALISADE_SCHEMA);
+        expect(validator.validate(cedarText).valid).toBe(true);
+        // Step 3: Evaluate
+        const engine = new PolicyEngine({ schema: PALISADE_SCHEMA });
+        engine.loadPolicies(cedarText);
+        const entities = [
+            newEntity('Palisade::Scanner', 'palisade', { scanner_type: 'ml' }),
+            newEntity('Palisade::Artifact', 'model.pkl', {
+                artifact_format: 'pickle',
+                path: '/model.pkl',
+                signed: false,
+                signer: 'unsigned',
+            }),
+        ];
+        // Should deny CRITICAL findings
+        const decision = engine.evaluate({
+            principal: newEntityUID('Palisade::Scanner', 'palisade'),
+            action: 'Palisade::Action::"load_model"',
+            resource: newEntityUID('Palisade::Artifact', 'model.pkl'),
+            context: { severity: 'CRITICAL' },
+            entities,
+        });
+        expect(decision.effect).toBe('Deny');
+    });
+    /**
+     * Test 4: Entity Metadata for UI Dropdowns - Overwatch
+     *
+     * Studio UI needs to know which entity types can be principals,
+     * which can be resources, and what actions are available.
+     * This data is extracted from Cedar schema appliesTo blocks.
+     */
+    it('should provide correct entity metadata for Overwatch UI dropdowns', () => {
+        // Verify ServiceEntityMetadata structure
+        expect(OVERWATCH_ENTITIES.principals).toBeDefined();
+        expect(OVERWATCH_ENTITIES.resources).toBeDefined();
+        expect(OVERWATCH_ENTITIES.actions).toBeDefined();
+        // Overwatch principals should include User and Agent
+        expect(OVERWATCH_ENTITIES.principals).toContain('Agent');
+        expect(OVERWATCH_ENTITIES.principals).toContain('User');
+        expect(OVERWATCH_ENTITIES.principals).toHaveLength(2);
+        // Overwatch resources should include all resource types
+        expect(OVERWATCH_ENTITIES.resources).toContain('FilePath');
+        expect(OVERWATCH_ENTITIES.resources).toContain('LlmPrompt');
+        expect(OVERWATCH_ENTITIES.resources).toContain('Server');
+        expect(OVERWATCH_ENTITIES.resources).toContain('Tool');
+        expect(OVERWATCH_ENTITIES.resources).toHaveLength(4);
+        // Overwatch actions should match schema
+        expect(OVERWATCH_ENTITIES.actions).toContain('call_tool');
+        expect(OVERWATCH_ENTITIES.actions).toContain('connect_server');
+        expect(OVERWATCH_ENTITIES.actions).toContain('process_prompt');
+        expect(OVERWATCH_ENTITIES.actions).toContain('read_file');
+        expect(OVERWATCH_ENTITIES.actions).toContain('write_file');
+        expect(OVERWATCH_ENTITIES.actions).toHaveLength(5);
+    });
+    /**
+     * Test 5: Per-Action Entity Mapping - Overwatch
+     *
+     * Studio UI needs to filter dropdowns based on selected action.
+     * Each action has specific valid principals and resources.
+     */
+    it('should provide per-action entity mapping for Overwatch', () => {
+        // call_tool action should have correct principals and resources
+        const callTool = OVERWATCH_ACTION_ENTITIES['call_tool'];
+        expect(callTool).toBeDefined();
+        expect(callTool.principals).toContain('User');
+        expect(callTool.principals).toContain('Agent');
+        expect(callTool.resources).toContain('Tool');
+        expect(callTool.resources).toContain('FilePath');
+        // connect_server action should only apply to Server resource
+        const connectServer = OVERWATCH_ACTION_ENTITIES['connect_server'];
+        expect(connectServer).toBeDefined();
+        expect(connectServer.principals).toContain('User');
+        expect(connectServer.principals).toContain('Agent');
+        expect(connectServer.resources).toContain('Server');
+        expect(connectServer.resources).not.toContain('Tool');
+        // process_prompt action should only apply to LlmPrompt resource
+        const processPrompt = OVERWATCH_ACTION_ENTITIES['process_prompt'];
+        expect(processPrompt).toBeDefined();
+        expect(processPrompt.resources).toContain('LlmPrompt');
+        expect(processPrompt.resources).not.toContain('Tool');
+        // read_file and write_file should apply to FilePath resource
+        const readFile = OVERWATCH_ACTION_ENTITIES['read_file'];
+        const writeFile = OVERWATCH_ACTION_ENTITIES['write_file'];
+        expect(readFile.resources).toContain('FilePath');
+        expect(writeFile.resources).toContain('FilePath');
+    });
+    /**
+     * Test 6: Entity Metadata for Palisade
+     *
+     * Verify Palisade service also has correct entity metadata.
+     */
+    it('should provide correct entity metadata for Palisade UI dropdowns', () => {
+        // Palisade has Scanner as principal
+        expect(PALISADE_ENTITIES.principals).toContain('Scanner');
+        // Palisade resources include Artifact and Package
+        expect(PALISADE_ENTITIES.resources).toContain('Artifact');
+        expect(PALISADE_ENTITIES.resources).toContain('Package');
+        // Palisade actions
+        expect(PALISADE_ENTITIES.actions).toContain('load_model');
+        expect(PALISADE_ENTITIES.actions).toContain('scan_artifact');
+        expect(PALISADE_ENTITIES.actions).toContain('quarantine_artifact');
+        // Per-action mapping - load_model applies to Artifact
+        const loadModel = PALISADE_ACTION_ENTITIES['load_model'];
+        expect(loadModel).toBeDefined();
+        expect(loadModel.principals).toContain('Scanner');
+        expect(loadModel.resources).toContain('Artifact');
+        // scan_package applies to Package resource
+        const scanPackage = PALISADE_ACTION_ENTITIES['scan_package'];
+        expect(scanPackage).toBeDefined();
+        expect(scanPackage.resources).toContain('Package');
+    });
+});
+//# sourceMappingURL=studio-ui.test.js.map

package/dist/studio-ui.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"studio-ui.test.js","sourceRoot":"","sources":["../src/studio-ui.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE9C,8DAA8D;AAC9D,OAAO,EAGL,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EAEjB,mBAAmB,EACnB,kBAAkB;AAClB,mCAAmC;AACnC,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,wBAAwB,GAKzB,MAAM,YAAY,CAAC;AAEpB,wCAAwC;AACxC,OAAO,EACL,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,SAAS,GACV,MAAM,YAAY,CAAC;AAEpB,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C;;;;;OAKG;IACH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,6CAA6C;QAC7C,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE;aAClC,aAAa,CAAC,MAAM,CAAC;aACrB,MAAM,CAAC,WAAW,CAAC;aACnB,YAAY,CAAC,MAAM,CAAC;aACpB,KAAK,EAAE,CAAC;QAEX,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QAEnC,oDAAoD;QACpD,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;QAC7D,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAE,qBAAqB;IAC9E,CAAC,CAAC,CAAC;IAEH;;;;;OAKG;IACH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,4BAA4B;QAC5B,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,CAAC,gBAAgB,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QAC1D,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAExD,kDAAkD;QAClD,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAE5D,sDAAsD;QACtD,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,IAAI,CACnD,CAAC,CAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAC7C,CAAC;QACF,MAAM,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,CAAC,cAAe,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAErE,+DAA+D;QAC/D,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC7D,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,yCAAyC;QACzC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE;aAClC,aAAa,CAAC,iBAAiB,CAAC;aAChC,MAAM,CAAC,gCAAgC,CAAC;aACxC,YAAY,CAAC,iBAAiB,CAAC;aAC/B,OAAO,CAAC,0BAA0B,CAAC;aACnC,KAAK,EAAE,CAAC;QAEX,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAE/C,8CAA8C;QAC9C,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,gBAAgB,CAAC,CAAC;QACxD,MAAM,gBAAgB,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE1C,6CAA6C;QAC7C,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC9D,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAE/B,MAAM,QAAQ,GAAG;YACf,SAAS,CAAC,iBAAiB,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;YAChG,SAAS,CAAC,iBAAiB,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;SAClF,CAAC;QAEF,mDAAmD;QACnD,MAAM,WAAW,GAAG;YAClB,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,YAAY;YACpB,KAAK,EAAE,YAAY;YACnB,UAAU,EAAE,kBAAkB;YAC9B,SAAS,EAAE,OAAO;YAClB,UAAU,EAAE,YAAY;YACxB,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,YAAY;YAClB,GAAG,EAAE,YAAY;YACjB,cAAc,EAAE,YAAY;YAC5B,gBAAgB,EAAE,KAAK;YACvB,iBAAiB,EAAE,EAAE;YACrB,YAAY,EAAE,EAAE;YAChB,YAAY,EAAE,EAAE;YAChB,mBAAmB,EAAE,CAAC;YACtB,gBAAgB,EAAE,KAAK;YACvB,gBAAgB,EAAE,EAAE;SACrB,CAAC;QAEF,qCAAqC;QACrC,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC;YACpC,SAAS,EAAE,YAAY,CAAC,iBAAiB,EAAE,YAAY,CAAC;YACxD,MAAM,EAAE,gCAAgC;YACxC,QAAQ,EAAE,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC;YAClD,OAAO,EAAE,EAAE,GAAG,WAAW,EAAE,YAAY,EAAE,CAAC,EAAE;YAC5C,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE3C,0DAA0D;QAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC;YACnC,SAAS,EAAE,YAAY,CAAC,iBAAiB,EAAE,YAAY,CAAC;YACxD,MAAM,EAAE,gCAAgC;YACxC,QAAQ,EAAE,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC;YAClD,OAAO,EAAE,EAAE,GAAG,WAAW,EAAE,YAAY,EAAE,EAAE,EAAE;YAC7C,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH;;;;OAIG;IACH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,uDAAuD;QACvD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE;aAClC,aAAa,CAAC,mBAAmB,CAAC;aAClC,MAAM,CAAC,gCAAgC,CAAC;aACxC,YAAY,CAAC,oBAAoB,CAAC;aAClC,OAAO,CAAC,gCAAgC,CAAC;aACzC,KAAK,EAAE,CAAC;QAEX,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QAEnC,mBAAmB;QACnB,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;QACvD,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEvD,mBAAmB;QACnB,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAC7D,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAE/B,MAAM,QAAQ,GAAG;YACf,SAAS,CAAC,mBAAmB,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YAClE,SAAS,CAAC,oBAAoB,EAAE,WAAW,EAAE;gBAC3C,eAAe,EAAE,QAAQ;gBACzB,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,UAAU;aACnB,CAAC;SACH,CAAC;QAEF,gCAAgC;QAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC/B,SAAS,EAAE,YAAY,CAAC,mBAAmB,EAAE,UAAU,CAAC;YACxD,MAAM,EAAE,gCAAgC;YACxC,QAAQ,EAAE,YAAY,CAAC,oBAAoB,EAAE,WAAW,CAAC;YACzD,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE;YACjC,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,yCAAyC;QACzC,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAEjD,qDAAqD;QACrD,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAEtD,wDAAwD;QACxD,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3D,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAErD,wCAAwC;QACxC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC1D,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC/D,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC/D,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC1D,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC3D,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH;;;;;OAKG;IACH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,gEAAgE;QAChE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;QACxD,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAEjD,6DAA6D;QAC7D,MAAM,aAAa,GAAG,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;QAClE,MAAM,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAEtD,gEAAgE;QAChE,MAAM,aAAa,GAAG,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;QAClE,MAAM,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAEtD,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,yBAAyB,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH;;;;OAIG;IACH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,oCAAoC;QACpC,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAE1D,kDAAkD;QAClD,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC1D,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAEzD,mBAAmB;QACnB,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC7D,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QAEnE,sDAAsD;QACtD,MAAM,SAAS,GAAG,wBAAwB,CAAC,YAAY,CAAC,CAAC;QACzD,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAElD,2CAA2C;QAC3C,MAAM,WAAW,GAAG,wBAAwB,CAAC,cAAc,CAAC,CAAC;QAC7D,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/types.d.ts

@@ -4,4 +4,11 @@ export * from './context.gen.js';
 export * from './schema.gen.js';
 export * from './builder.js';
 export * from './errors.js';
+export { OVERWATCH_SCHEMA, OVERWATCH_CONTEXT, PALISADE_SCHEMA, PALISADE_CONTEXT, } from './service-schemas.gen.js';
+export type { ContextAttribute, ActionContext, ServiceContext, } from './service-schemas.gen.js';
+export { OverwatchContextKey } from './overwatch-context.gen.js';
+export { PalisadeContextKey } from './palisade-context.gen.js';
+export { OVERWATCH_ENTITIES, OVERWATCH_ACTION_ENTITIES, } from './overwatch-entities.gen.js';
+export { PALISADE_ENTITIES, PALISADE_ACTION_ENTITIES, } from './palisade-entities.gen.js';
+export type { ServiceEntityMetadata, ActionEntityMetadata } from './entity-metadata-types.gen.js';
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAQA,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAGhC,cAAc,cAAc,CAAC;AAG7B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAQA,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAGhC,cAAc,cAAc,CAAC;AAG7B,cAAc,aAAa,CAAC;AAG5B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,gBAAgB,EAChB,aAAa,EACb,cAAc,GACf,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAG/D,OAAO,EACL,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/types.js

@@ -13,4 +13,12 @@ export * from './schema.gen.js';
 export * from './builder.js';
 // Error types - works in browser (no WASM dependency)
 export * from './errors.js';
+// Service-specific schemas and context (inlined, browser-safe)
+export { OVERWATCH_SCHEMA, OVERWATCH_CONTEXT, PALISADE_SCHEMA, PALISADE_CONTEXT, } from './service-schemas.gen.js';
+// Service-specific context key enums
+export { OverwatchContextKey } from './overwatch-context.gen.js';
+export { PalisadeContextKey } from './palisade-context.gen.js';
+// Service-specific entity metadata (for UI - principals, resources, actions)
+export { OVERWATCH_ENTITIES, OVERWATCH_ACTION_ENTITIES, } from './overwatch-entities.gen.js';
+export { PALISADE_ENTITIES, PALISADE_ACTION_ENTITIES, } from './palisade-entities.gen.js';
 //# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,uCAAuC;AACvC,EAAE;AACF,6CAA6C;AAC7C,gDAAgD;AAChD,yEAAyE;AAEzE,gDAAgD;AAChD,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAEhC,wDAAwD;AACxD,cAAc,cAAc,CAAC;AAE7B,sDAAsD;AACtD,cAAc,aAAa,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,uCAAuC;AACvC,EAAE;AACF,6CAA6C;AAC7C,gDAAgD;AAChD,yEAAyE;AAEzE,gDAAgD;AAChD,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAEhC,wDAAwD;AACxD,cAAc,cAAc,CAAC;AAE7B,sDAAsD;AACtD,cAAc,aAAa,CAAC;AAE5B,+DAA+D;AAC/D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAOlC,qCAAqC;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,6EAA6E;AAC7E,OAAO,EACL,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,4BAA4B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highflame/policy",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "description": "Highflame Cedar policy types and engine wrapper",
   "readme": "README.md",
   "main": "dist/index.js",

package/src/builder.ts

@@ -25,6 +25,20 @@
 import { EntityType, EntityUID } from './entities.gen.js';
 import { ActionType } from './actions.gen.js';
 
+/**
+ * Format an action string for Cedar policy text.
+ * Detects if action is already namespaced (contains 'Action::"') and preserves it,
+ * otherwise wraps with Action::"...".
+ */
+function formatAction(action: string): string {
+    if (action.includes('Action::"')) {
+        // Already namespaced (e.g., 'Overwatch::Action::"call_tool"')
+        return action;
+    }
+    // Non-namespaced, wrap with Action::"..."
+    return `Action::"${action}"`;
+}
+
 /**
  * Policy effect - permit or forbid
  */
@@ -163,13 +177,13 @@ export class Policy {
         // Action
         if (Array.isArray(this.data.action)) {
             if (this.data.action.length === 1) {
-                policyLine += `,\n    action == Action::\"${this.data.action[0]}\"`;
+                policyLine += `,\n    action == ${formatAction(this.data.action[0])}`;
             } else {
-                const actions = this.data.action.map(a => `Action::\"${a}\"`).join(', ');
+                const actions = this.data.action.map(a => formatAction(a)).join(', ');
                 policyLine += `,\n    action in [${actions}]`;
             }
         } else {
-            policyLine += `,\n    action == Action::\"${this.data.action}\"`;
+            policyLine += `,\n    action == ${formatAction(this.data.action)}`;
         }
 
         // Resource

package/src/entity-metadata-types.gen.ts

@@ -0,0 +1,19 @@
+// Code generated by highflame-policy-codegen. DO NOT EDIT.
+
+/**
+ * Entity metadata for a service, extracted from Cedar schema appliesTo blocks.
+ * Used by Studio UI to populate dropdowns in policy editor.
+ */
+export interface ServiceEntityMetadata {
+  readonly principals: readonly string[];
+  readonly resources: readonly string[];
+  readonly actions: readonly string[];
+}
+
+/**
+ * Entity metadata for a specific action.
+ */
+export interface ActionEntityMetadata {
+  readonly principals: readonly string[];
+  readonly resources: readonly string[];
+}

package/src/index.ts

@@ -14,3 +14,31 @@ export * from './engine.js';
 export * from './builder.js';
 export * from './parser.js';
 export * from './errors.js';
+
+// Service-specific schemas and context (inlined)
+export {
+  OVERWATCH_SCHEMA,
+  OVERWATCH_CONTEXT,
+  PALISADE_SCHEMA,
+  PALISADE_CONTEXT,
+} from './service-schemas.gen.js';
+export type {
+  ContextAttribute,
+  ActionContext,
+  ServiceContext,
+} from './service-schemas.gen.js';
+
+// Service-specific context key enums
+export { OverwatchContextKey } from './overwatch-context.gen.js';
+export { PalisadeContextKey } from './palisade-context.gen.js';
+
+// Service-specific entity metadata (for UI - principals, resources, actions)
+export {
+  OVERWATCH_ENTITIES,
+  OVERWATCH_ACTION_ENTITIES,
+} from './overwatch-entities.gen.js';
+export {
+  PALISADE_ENTITIES,
+  PALISADE_ACTION_ENTITIES,
+} from './palisade-entities.gen.js';
+export type { ServiceEntityMetadata, ActionEntityMetadata } from './entity-metadata-types.gen.js';

package/src/overwatch-context.gen.ts

@@ -12,7 +12,6 @@ export const OverwatchContextKey = {
   Content: 'content',
   Cwd: 'cwd',
   Event: 'event',
-  FilePath: 'file_path',
   HighestSeverity: 'highest_severity',
   MaxThreatSeverity: 'max_threat_severity',
   McpServer: 'mcp_server',
@@ -20,7 +19,6 @@ export const OverwatchContextKey = {
   Path: 'path',
   PromptText: 'prompt_text',
   ResponseContent: 'response_content',
-  ServerName: 'server_name',
   Source: 'source',
   ThreatCategories: 'threat_categories',
   ThreatCount: 'threat_count',

package/src/overwatch-entities.gen.ts

@@ -0,0 +1,41 @@
+// Code generated by highflame-policy-codegen. DO NOT EDIT.
+// Source: schemas/overwatch/schema.cedarschema
+
+import type { ServiceEntityMetadata, ActionEntityMetadata } from './entity-metadata-types.gen.js';
+
+/**
+ * Overwatch entity metadata for UI components.
+ * Extracted from Cedar schema appliesTo blocks.
+ */
+export const OVERWATCH_ENTITIES: ServiceEntityMetadata = {
+  principals: ['Agent', 'User'],
+  resources: ['FilePath', 'LlmPrompt', 'Server', 'Tool'],
+  actions: ['call_tool', 'connect_server', 'process_prompt', 'read_file', 'write_file'],
+} as const;
+
+/**
+ * Per-action entity mapping for Overwatch.
+ * Maps action names to their valid principals and resources.
+ */
+export const OVERWATCH_ACTION_ENTITIES: Record<string, ActionEntityMetadata> = {
+  'call_tool': {
+    principals: ['User', 'Agent'],
+    resources: ['Tool', 'FilePath'],
+  },
+  'connect_server': {
+    principals: ['User', 'Agent'],
+    resources: ['Server'],
+  },
+  'process_prompt': {
+    principals: ['User', 'Agent'],
+    resources: ['LlmPrompt'],
+  },
+  'read_file': {
+    principals: ['User', 'Agent'],
+    resources: ['FilePath'],
+  },
+  'write_file': {
+    principals: ['User', 'Agent'],
+    resources: ['FilePath'],
+  },
+} as const;

package/src/palisade-entities.gen.ts

@@ -0,0 +1,49 @@
+// Code generated by highflame-policy-codegen. DO NOT EDIT.
+// Source: schemas/palisade/schema.cedarschema
+
+import type { ServiceEntityMetadata, ActionEntityMetadata } from './entity-metadata-types.gen.js';
+
+/**
+ * Palisade entity metadata for UI components.
+ * Extracted from Cedar schema appliesTo blocks.
+ */
+export const PALISADE_ENTITIES: ServiceEntityMetadata = {
+  principals: ['Scanner'],
+  resources: ['Artifact', 'Package'],
+  actions: ['deploy_model', 'load_model', 'quarantine_artifact', 'scan_artifact', 'scan_package', 'validate_integrity', 'validate_provenance'],
+} as const;
+
+/**
+ * Per-action entity mapping for Palisade.
+ * Maps action names to their valid principals and resources.
+ */
+export const PALISADE_ACTION_ENTITIES: Record<string, ActionEntityMetadata> = {
+  'deploy_model': {
+    principals: ['Scanner'],
+    resources: ['Artifact'],
+  },
+  'load_model': {
+    principals: ['Scanner'],
+    resources: ['Artifact'],
+  },
+  'quarantine_artifact': {
+    principals: ['Scanner'],
+    resources: ['Artifact'],
+  },
+  'scan_artifact': {
+    principals: ['Scanner'],
+    resources: ['Artifact'],
+  },
+  'scan_package': {
+    principals: ['Scanner'],
+    resources: ['Package'],
+  },
+  'validate_integrity': {
+    principals: ['Scanner'],
+    resources: ['Artifact'],
+  },
+  'validate_provenance': {
+    principals: ['Scanner'],
+    resources: ['Artifact'],
+  },
+} as const;

package/src/schemas.test.ts

@@ -205,9 +205,7 @@ describe('Service-Specific Schemas', () => {
           tool_name: 'shell',
           mcp_server: 'filesystem',
           mcp_tool: 'shell',
-          server_name: 'filesystem',
           path: '/workspace',
-          file_path: '/workspace',
           cwd: '/workspace',
           workspace_root: '/workspace',
           threat_count: 3,
@@ -388,9 +386,7 @@ describe('Service-Specific Schemas', () => {
           tool_name: 'shell',
           mcp_server: 'filesystem',
           mcp_tool: 'shell',
-          server_name: 'filesystem',
           path: '/etc/passwd',
-          file_path: '/etc/passwd',
           cwd: '/workspace',
           workspace_root: '/workspace',
           threat_count: 5,