@highflame/policy 2.2.0 → 2.2.1

package/_schemas/guardrails/context.json

@@ -19,6 +19,18 @@
           "required": false,
           "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
         },
+        {
+          "key": "identity_type",
+          "type": "string",
+          "required": false,
+          "description": "Principal identity class projected from the token: 'human', 'agent', or 'service'. Use to apply identity-class-specific policies"
+        },
+        {
+          "key": "principal",
+          "type": "string",
+          "required": false,
+          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id). Absent when the token carries no principal claim"
+        },
         {
           "key": "request_id",
           "type": "string",
@@ -499,6 +511,18 @@
           "required": false,
           "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
         },
+        {
+          "key": "session_max_sensitivity",
+          "type": "string",
+          "required": false,
+          "description": "Highest data-sensitivity tier observed across the session (e.g. 'public', 'internal', 'confidential', 'restricted'). Use for session-level escalation policies"
+        },
+        {
+          "key": "session_original_request",
+          "type": "string",
+          "required": false,
+          "description": "The session's first user request, retained for drift / goal-hijack policies that compare later turns against the original intent"
+        },
         {
           "key": "agent_id",
           "type": "string",
@@ -547,6 +571,18 @@
           "required": false,
           "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
         },
+        {
+          "key": "identity_type",
+          "type": "string",
+          "required": false,
+          "description": "Principal identity class projected from the token: 'human', 'agent', or 'service'. Use to apply identity-class-specific policies"
+        },
+        {
+          "key": "principal",
+          "type": "string",
+          "required": false,
+          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id). Absent when the token carries no principal claim"
+        },
         {
           "key": "request_id",
           "type": "string",
@@ -589,6 +625,18 @@
           "required": false,
           "description": "Whether the tool is a built-in tool (vs MCP external tool). Built-in tools are generally more trusted"
         },
+        {
+          "key": "param_type_violation",
+          "type": "boolean",
+          "required": false,
+          "description": "True when any projected tool-call argument (action_params, CAP-ENF-007 / AARM R3) was present but failed type coercion. Lets a policy deny on a type violation instead of the wrong-typed value silently vanishing"
+        },
+        {
+          "key": "param_type_violations",
+          "type": "array",
+          "required": false,
+          "description": "Names of the tool-call arguments that were present but failed type coercion (action_params, CAP-ENF-007 / AARM R3)"
+        },
         {
           "key": "mcp_server",
           "type": "string",
@@ -1003,6 +1051,18 @@
           "required": false,
           "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
         },
+        {
+          "key": "session_max_sensitivity",
+          "type": "string",
+          "required": false,
+          "description": "Highest data-sensitivity tier observed across the session (e.g. 'public', 'internal', 'confidential', 'restricted'). Use for session-level escalation policies"
+        },
+        {
+          "key": "session_original_request",
+          "type": "string",
+          "required": false,
+          "description": "The session's first user request, retained for drift / goal-hijack policies that compare later turns against the original intent"
+        },
         {
           "key": "agent_id",
           "type": "string",
@@ -1051,6 +1111,18 @@
           "required": false,
           "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
         },
+        {
+          "key": "identity_type",
+          "type": "string",
+          "required": false,
+          "description": "Principal identity class projected from the token: 'human', 'agent', or 'service'. Use to apply identity-class-specific policies"
+        },
+        {
+          "key": "principal",
+          "type": "string",
+          "required": false,
+          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id). Absent when the token carries no principal claim"
+        },
         {
           "key": "request_id",
           "type": "string",
@@ -1195,6 +1267,18 @@
           "required": false,
           "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
         },
+        {
+          "key": "session_max_sensitivity",
+          "type": "string",
+          "required": false,
+          "description": "Highest data-sensitivity tier observed across the session (e.g. 'public', 'internal', 'confidential', 'restricted'). Use for session-level escalation policies"
+        },
+        {
+          "key": "session_original_request",
+          "type": "string",
+          "required": false,
+          "description": "The session's first user request, retained for drift / goal-hijack policies that compare later turns against the original intent"
+        },
         {
           "key": "agent_id",
           "type": "string",
@@ -1243,6 +1327,18 @@
           "required": false,
           "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
         },
+        {
+          "key": "identity_type",
+          "type": "string",
+          "required": false,
+          "description": "Principal identity class projected from the token: 'human', 'agent', or 'service'. Use to apply identity-class-specific policies"
+        },
+        {
+          "key": "principal",
+          "type": "string",
+          "required": false,
+          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id). Absent when the token carries no principal claim"
+        },
         {
           "key": "request_id",
           "type": "string",
@@ -1399,6 +1495,18 @@
           "required": false,
           "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
         },
+        {
+          "key": "session_max_sensitivity",
+          "type": "string",
+          "required": false,
+          "description": "Highest data-sensitivity tier observed across the session (e.g. 'public', 'internal', 'confidential', 'restricted'). Use for session-level escalation policies"
+        },
+        {
+          "key": "session_original_request",
+          "type": "string",
+          "required": false,
+          "description": "The session's first user request, retained for drift / goal-hijack policies that compare later turns against the original intent"
+        },
         {
           "key": "agent_id",
           "type": "string",
@@ -1447,6 +1555,18 @@
           "required": false,
           "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011), e.g. transfer:approve. Absent when the token carries no claim."
         },
+        {
+          "key": "identity_type",
+          "type": "string",
+          "required": false,
+          "description": "Principal identity class projected from the token: 'human', 'agent', or 'service'. Use to apply identity-class-specific policies"
+        },
+        {
+          "key": "principal",
+          "type": "string",
+          "required": false,
+          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id). Absent when the token carries no principal claim"
+        },
         {
           "key": "request_id",
           "type": "string",
@@ -1603,6 +1723,18 @@
           "required": false,
           "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
         },
+        {
+          "key": "session_max_sensitivity",
+          "type": "string",
+          "required": false,
+          "description": "Highest data-sensitivity tier observed across the session (e.g. 'public', 'internal', 'confidential', 'restricted'). Use for session-level escalation policies"
+        },
+        {
+          "key": "session_original_request",
+          "type": "string",
+          "required": false,
+          "description": "The session's first user request, retained for drift / goal-hijack policies that compare later turns against the original intent"
+        },
         {
           "key": "agent_id",
           "type": "string",

package/_schemas/guardrails/schema.cedarschema

@@ -99,6 +99,8 @@ namespace Guardrails {
         // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
         "role"?: String,
         "privilege_scope"?: Set<String>,
+        "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
+        "principal"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -208,6 +210,8 @@ namespace Guardrails {
         "session_max_pii_score"?: Long,
         "session_max_secret_score"?: Long,
         "session_cumulative_risk_score"?: Long,
+        "session_original_request"?: String,     // The session's first user request (drift / goal-hijack policies)
+        "session_max_sensitivity"?: String,      // Highest data-sensitivity tier seen this session
 
         // Usage Budget — multi-window token & cost enforcement (optional)
         // Emitted by usage_budget detector. Enforced across session/daily/monthly windows
@@ -241,6 +245,8 @@ namespace Guardrails {
         // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
         "role"?: String,
         "privilege_scope"?: Set<String>,
+        "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
+        "principal"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -392,6 +398,8 @@ namespace Guardrails {
         "session_max_pii_score"?: Long,
         "session_max_secret_score"?: Long,
         "session_cumulative_risk_score"?: Long,
+        "session_original_request"?: String,     // The session's first user request (drift / goal-hijack policies)
+        "session_max_sensitivity"?: String,      // Highest data-sensitivity tier seen this session
 
         // Agent Identity — authenticated agent principal metadata (optional)
         "agent_id"?: String,
@@ -407,6 +415,8 @@ namespace Guardrails {
         // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
         "role"?: String,
         "privilege_scope"?: Set<String>,
+        "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
+        "principal"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -440,6 +450,8 @@ namespace Guardrails {
         "session_max_pii_score"?: Long,
         "session_max_secret_score"?: Long,
         "session_cumulative_risk_score"?: Long,
+        "session_original_request"?: String,     // The session's first user request (drift / goal-hijack policies)
+        "session_max_sensitivity"?: String,      // Highest data-sensitivity tier seen this session
 
         // Usage Budget — multi-window token & cost enforcement (optional)
         // See ProcessPromptContext for full documentation.
@@ -470,6 +482,8 @@ namespace Guardrails {
         // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
         "role"?: String,
         "privilege_scope"?: Set<String>,
+        "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
+        "principal"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -507,6 +521,8 @@ namespace Guardrails {
         "session_max_pii_score"?: Long,
         "session_max_secret_score"?: Long,
         "session_cumulative_risk_score"?: Long,
+        "session_original_request"?: String,     // The session's first user request (drift / goal-hijack policies)
+        "session_max_sensitivity"?: String,      // Highest data-sensitivity tier seen this session
 
         // Usage Budget — multi-window token & cost enforcement (optional)
         // See ProcessPromptContext for full documentation.
@@ -537,6 +553,8 @@ namespace Guardrails {
         // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
         "role"?: String,
         "privilege_scope"?: Set<String>,
+        "identity_type"?: String,        // Principal identity class: "human" | "agent" | "service"
+        "principal"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)
         // Core metadata (required)
         "request_id": String,
         "timestamp": Long,
@@ -574,6 +592,8 @@ namespace Guardrails {
         "session_max_pii_score"?: Long,
         "session_max_secret_score"?: Long,
         "session_cumulative_risk_score"?: Long,
+        "session_original_request"?: String,     // The session's first user request (drift / goal-hijack policies)
+        "session_max_sensitivity"?: String,      // Highest data-sensitivity tier seen this session
 
         // Usage Budget — multi-window token & cost enforcement (optional)
         // See ProcessPromptContext for full documentation.

package/dist/ai_gateway-context.gen.d.ts

@@ -68,3 +68,8 @@ export declare const AiGatewayContextKey: {
     readonly WeaponsScore: "weapons_score";
 };
 export type AiGatewayContextKey = (typeof AiGatewayContextKey)[keyof typeof AiGatewayContextKey];
+/**
+ * The full set of authorable context attribute keys for AiGateway.
+ * Iterate this to enumerate the authorable surface (cockpit, conformance).
+ */
+export declare const AiGatewayContextKeys: readonly ["content", "crime_score", "detected_threats", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_score", "loop_count", "loop_detected", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "model_name", "model_provider", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "role", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "violence_score", "weapons_score"];

package/dist/ai_gateway-context.gen.js

@@ -69,3 +69,70 @@ export const AiGatewayContextKey = {
     ViolenceScore: 'violence_score',
     WeaponsScore: 'weapons_score',
 };
+/**
+ * The full set of authorable context attribute keys for AiGateway.
+ * Iterate this to enumerate the authorable surface (cockpit, conformance).
+ */
+export const AiGatewayContextKeys = [
+    AiGatewayContextKey.Content,
+    AiGatewayContextKey.CrimeScore,
+    AiGatewayContextKey.DetectedThreats,
+    AiGatewayContextKey.HateSpeechScore,
+    AiGatewayContextKey.HighestSeverity,
+    AiGatewayContextKey.IndirectInjectionScore,
+    AiGatewayContextKey.InjectionScore,
+    AiGatewayContextKey.InvisibleCharsDetected,
+    AiGatewayContextKey.InvisibleCharsScore,
+    AiGatewayContextKey.JailbreakScore,
+    AiGatewayContextKey.LoopCount,
+    AiGatewayContextKey.LoopDetected,
+    AiGatewayContextKey.MaxThreatSeverity,
+    AiGatewayContextKey.McpConfigRisk,
+    AiGatewayContextKey.McpRiskScore,
+    AiGatewayContextKey.McpServer,
+    AiGatewayContextKey.McpServerVerified,
+    AiGatewayContextKey.McpTool,
+    AiGatewayContextKey.ModelName,
+    AiGatewayContextKey.ModelProvider,
+    AiGatewayContextKey.PatternType,
+    AiGatewayContextKey.PiiCount,
+    AiGatewayContextKey.PiiDetected,
+    AiGatewayContextKey.PiiScore,
+    AiGatewayContextKey.PiiTypes,
+    AiGatewayContextKey.PrivilegeScope,
+    AiGatewayContextKey.ProfanityScore,
+    AiGatewayContextKey.Role,
+    AiGatewayContextKey.RugPullDetected,
+    AiGatewayContextKey.RugPullScore,
+    AiGatewayContextKey.SecretCount,
+    AiGatewayContextKey.SecretTypes,
+    AiGatewayContextKey.SecretsDetected,
+    AiGatewayContextKey.SequenceRisk,
+    AiGatewayContextKey.SessionCommandInjection,
+    AiGatewayContextKey.SessionCumulativeRiskScore,
+    AiGatewayContextKey.SessionInjectionDetected,
+    AiGatewayContextKey.SessionMaxCommandInjectionScore,
+    AiGatewayContextKey.SessionMaxInjectionScore,
+    AiGatewayContextKey.SessionMaxJailbreakScore,
+    AiGatewayContextKey.SessionMaxPiiScore,
+    AiGatewayContextKey.SessionMaxSecretScore,
+    AiGatewayContextKey.SessionPiiDetected,
+    AiGatewayContextKey.SessionPiiTypes,
+    AiGatewayContextKey.SessionSecretTypes,
+    AiGatewayContextKey.SessionSecretsDetected,
+    AiGatewayContextKey.SessionThreatTurns,
+    AiGatewayContextKey.SexualScore,
+    AiGatewayContextKey.SuspiciousPattern,
+    AiGatewayContextKey.ThreatCategories,
+    AiGatewayContextKey.ThreatCount,
+    AiGatewayContextKey.ToolCategory,
+    AiGatewayContextKey.ToolIsBuiltin,
+    AiGatewayContextKey.ToolIsSensitive,
+    AiGatewayContextKey.ToolName,
+    AiGatewayContextKey.ToolOperationClasses,
+    AiGatewayContextKey.ToolPoisoningDetected,
+    AiGatewayContextKey.ToolPoisoningScore,
+    AiGatewayContextKey.ToolRiskScore,
+    AiGatewayContextKey.ViolenceScore,
+    AiGatewayContextKey.WeaponsScore,
+];

package/dist/guardrails-context.gen.d.ts

@@ -40,6 +40,7 @@ export declare const GuardrailsContextKey: {
     readonly HallucinationScore: "hallucination_score";
     readonly HateSpeechScore: "hate_speech_score";
     readonly HighestSeverity: "highest_severity";
+    readonly IdentityType: "identity_type";
     readonly IndirectInjectionScore: "indirect_injection_score";
     readonly IndirectInjectionType: "indirect_injection_type";
     readonly InjectionDeepContextScore: "injection_deep_context_score";
@@ -67,6 +68,8 @@ export declare const GuardrailsContextKey: {
     readonly McpServerVerified: "mcp_server_verified";
     readonly McpTool: "mcp_tool";
     readonly MultiTurnDetection: "multi_turn_detection";
+    readonly ParamTypeViolation: "param_type_violation";
+    readonly ParamTypeViolations: "param_type_violations";
     readonly Path: "path";
     readonly PathTraversalDetected: "path_traversal_detected";
     readonly PathTraversalSeverity: "path_traversal_severity";
@@ -77,6 +80,7 @@ export declare const GuardrailsContextKey: {
     readonly PiiDetected: "pii_detected";
     readonly PiiScore: "pii_score";
     readonly PiiTypes: "pii_types";
+    readonly Principal: "principal";
     readonly PrivilegeScope: "privilege_scope";
     readonly ProfanityScore: "profanity_score";
     readonly RequestId: "request_id";
@@ -98,6 +102,8 @@ export declare const GuardrailsContextKey: {
     readonly SessionMaxJailbreakScore: "session_max_jailbreak_score";
     readonly SessionMaxPiiScore: "session_max_pii_score";
     readonly SessionMaxSecretScore: "session_max_secret_score";
+    readonly SessionMaxSensitivity: "session_max_sensitivity";
+    readonly SessionOriginalRequest: "session_original_request";
     readonly SessionPiiDetected: "session_pii_detected";
     readonly SessionPiiTypes: "session_pii_types";
     readonly SessionSecretTypes: "session_secret_types";
@@ -123,3 +129,8 @@ export declare const GuardrailsContextKey: {
     readonly WeaponsScore: "weapons_score";
 };
 export type GuardrailsContextKey = (typeof GuardrailsContextKey)[keyof typeof GuardrailsContextKey];
+/**
+ * The full set of authorable context attribute keys for Guardrails.
+ * Iterate this to enumerate the authorable surface (cockpit, conformance).
+ */
+export declare const GuardrailsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "detected_language", "detected_script", "detector_count", "direction", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "factuality_score", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "mcp_config_risk", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "multi_turn_detection", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal", "privilege_scope", "profanity_score", "request_id", "role", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "suspicious_pattern", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "violence_score", "weapons_score"];

package/dist/guardrails-context.gen.js

@@ -42,6 +42,7 @@ export const GuardrailsContextKey = {
     HallucinationScore: 'hallucination_score',
     HateSpeechScore: 'hate_speech_score',
     HighestSeverity: 'highest_severity',
+    IdentityType: 'identity_type',
     IndirectInjectionScore: 'indirect_injection_score',
     IndirectInjectionType: 'indirect_injection_type',
     InjectionDeepContextScore: 'injection_deep_context_score',
@@ -69,6 +70,8 @@ export const GuardrailsContextKey = {
     McpServerVerified: 'mcp_server_verified',
     McpTool: 'mcp_tool',
     MultiTurnDetection: 'multi_turn_detection',
+    ParamTypeViolation: 'param_type_violation',
+    ParamTypeViolations: 'param_type_violations',
     Path: 'path',
     PathTraversalDetected: 'path_traversal_detected',
     PathTraversalSeverity: 'path_traversal_severity',
@@ -79,6 +82,7 @@ export const GuardrailsContextKey = {
     PiiDetected: 'pii_detected',
     PiiScore: 'pii_score',
     PiiTypes: 'pii_types',
+    Principal: 'principal',
     PrivilegeScope: 'privilege_scope',
     ProfanityScore: 'profanity_score',
     RequestId: 'request_id',
@@ -100,6 +104,8 @@ export const GuardrailsContextKey = {
     SessionMaxJailbreakScore: 'session_max_jailbreak_score',
     SessionMaxPiiScore: 'session_max_pii_score',
     SessionMaxSecretScore: 'session_max_secret_score',
+    SessionMaxSensitivity: 'session_max_sensitivity',
+    SessionOriginalRequest: 'session_original_request',
     SessionPiiDetected: 'session_pii_detected',
     SessionPiiTypes: 'session_pii_types',
     SessionSecretTypes: 'session_secret_types',
@@ -124,3 +130,131 @@ export const GuardrailsContextKey = {
     ViolenceScore: 'violence_score',
     WeaponsScore: 'weapons_score',
 };
+/**
+ * The full set of authorable context attribute keys for Guardrails.
+ * Iterate this to enumerate the authorable surface (cockpit, conformance).
+ */
+export const GuardrailsContextKeys = [
+    GuardrailsContextKey.AgentFramework,
+    GuardrailsContextKey.AgentId,
+    GuardrailsContextKey.AgentPublisher,
+    GuardrailsContextKey.AgentTrustLevel,
+    GuardrailsContextKey.AgentType,
+    GuardrailsContextKey.BudgetExceeded,
+    GuardrailsContextKey.BudgetRemainingPct,
+    GuardrailsContextKey.CodeLanguages,
+    GuardrailsContextKey.CodeRatio,
+    GuardrailsContextKey.CommandInjectionDetected,
+    GuardrailsContextKey.CommandInjectionScore,
+    GuardrailsContextKey.CommandInjectionType,
+    GuardrailsContextKey.ContainsCode,
+    GuardrailsContextKey.ContainsNonAscii,
+    GuardrailsContextKey.ContentSafetyBlocked,
+    GuardrailsContextKey.ContentSafetyScore,
+    GuardrailsContextKey.ContentTopics,
+    GuardrailsContextKey.ContentType,
+    GuardrailsContextKey.ConversationTurn,
+    GuardrailsContextKey.CrimeScore,
+    GuardrailsContextKey.CrossOriginDetected,
+    GuardrailsContextKey.CrossOriginScore,
+    GuardrailsContextKey.CrossOriginType,
+    GuardrailsContextKey.DetectedLanguage,
+    GuardrailsContextKey.DetectedScript,
+    GuardrailsContextKey.DetectorCount,
+    GuardrailsContextKey.Direction,
+    GuardrailsContextKey.EncodedContentDetected,
+    GuardrailsContextKey.EncodedCount,
+    GuardrailsContextKey.EncodedScore,
+    GuardrailsContextKey.EncodedTypes,
+    GuardrailsContextKey.FactualityScore,
+    GuardrailsContextKey.HallucinationScore,
+    GuardrailsContextKey.HateSpeechScore,
+    GuardrailsContextKey.HighestSeverity,
+    GuardrailsContextKey.IdentityType,
+    GuardrailsContextKey.IndirectInjectionScore,
+    GuardrailsContextKey.IndirectInjectionType,
+    GuardrailsContextKey.InjectionDeepContextScore,
+    GuardrailsContextKey.InjectionPulseScore,
+    GuardrailsContextKey.InjectionScore,
+    GuardrailsContextKey.InjectionType,
+    GuardrailsContextKey.InvisibleCharsDetected,
+    GuardrailsContextKey.InvisibleCharsScore,
+    GuardrailsContextKey.IsEnglish,
+    GuardrailsContextKey.IsLatinScript,
+    GuardrailsContextKey.JailbreakDeepContextScore,
+    GuardrailsContextKey.JailbreakPulseScore,
+    GuardrailsContextKey.JailbreakScore,
+    GuardrailsContextKey.KeywordCategories,
+    GuardrailsContextKey.KeywordCount,
+    GuardrailsContextKey.KeywordMatched,
+    GuardrailsContextKey.LanguageConfidence,
+    GuardrailsContextKey.LoopCount,
+    GuardrailsContextKey.LoopDetected,
+    GuardrailsContextKey.LoopTool,
+    GuardrailsContextKey.McpConfigRisk,
+    GuardrailsContextKey.McpRiskScore,
+    GuardrailsContextKey.McpRiskType,
+    GuardrailsContextKey.McpServer,
+    GuardrailsContextKey.McpServerVerified,
+    GuardrailsContextKey.McpTool,
+    GuardrailsContextKey.MultiTurnDetection,
+    GuardrailsContextKey.ParamTypeViolation,
+    GuardrailsContextKey.ParamTypeViolations,
+    GuardrailsContextKey.Path,
+    GuardrailsContextKey.PathTraversalDetected,
+    GuardrailsContextKey.PathTraversalSeverity,
+    GuardrailsContextKey.PathTraversalType,
+    GuardrailsContextKey.PatternType,
+    GuardrailsContextKey.PhishingDetected,
+    GuardrailsContextKey.PiiCount,
+    GuardrailsContextKey.PiiDetected,
+    GuardrailsContextKey.PiiScore,
+    GuardrailsContextKey.PiiTypes,
+    GuardrailsContextKey.Principal,
+    GuardrailsContextKey.PrivilegeScope,
+    GuardrailsContextKey.ProfanityScore,
+    GuardrailsContextKey.RequestId,
+    GuardrailsContextKey.Role,
+    GuardrailsContextKey.RugPullDetected,
+    GuardrailsContextKey.RugPullScore,
+    GuardrailsContextKey.RugPullType,
+    GuardrailsContextKey.ScriptConfidence,
+    GuardrailsContextKey.SecretCount,
+    GuardrailsContextKey.SecretTypes,
+    GuardrailsContextKey.SecretsDetected,
+    GuardrailsContextKey.SentimentScore,
+    GuardrailsContextKey.SequenceRisk,
+    GuardrailsContextKey.SessionCommandInjection,
+    GuardrailsContextKey.SessionCumulativeRiskScore,
+    GuardrailsContextKey.SessionInjectionDetected,
+    GuardrailsContextKey.SessionMaxCommandInjectionScore,
+    GuardrailsContextKey.SessionMaxInjectionScore,
+    GuardrailsContextKey.SessionMaxJailbreakScore,
+    GuardrailsContextKey.SessionMaxPiiScore,
+    GuardrailsContextKey.SessionMaxSecretScore,
+    GuardrailsContextKey.SessionMaxSensitivity,
+    GuardrailsContextKey.SessionOriginalRequest,
+    GuardrailsContextKey.SessionPiiDetected,
+    GuardrailsContextKey.SessionPiiTypes,
+    GuardrailsContextKey.SessionSecretTypes,
+    GuardrailsContextKey.SessionSecretsDetected,
+    GuardrailsContextKey.SessionThreatTurns,
+    GuardrailsContextKey.SexualScore,
+    GuardrailsContextKey.SqlInjectionDetected,
+    GuardrailsContextKey.SqlInjectionScore,
+    GuardrailsContextKey.SqlInjectionType,
+    GuardrailsContextKey.SuspiciousPattern,
+    GuardrailsContextKey.Timestamp,
+    GuardrailsContextKey.ToolCategory,
+    GuardrailsContextKey.ToolIsBuiltin,
+    GuardrailsContextKey.ToolIsSensitive,
+    GuardrailsContextKey.ToolName,
+    GuardrailsContextKey.ToolOperationClasses,
+    GuardrailsContextKey.ToolPoisoningDetected,
+    GuardrailsContextKey.ToolPoisoningScore,
+    GuardrailsContextKey.ToolPoisoningType,
+    GuardrailsContextKey.ToolRiskScore,
+    GuardrailsContextKey.TopicConfidence,
+    GuardrailsContextKey.ViolenceScore,
+    GuardrailsContextKey.WeaponsScore,
+];

package/dist/index.d.ts

@@ -15,11 +15,11 @@ export * from './explain.js';
 export * from './condition-groups.js';
 export { AI_GATEWAY_SCHEMA, AI_GATEWAY_CONTEXT, GUARDRAILS_SCHEMA, GUARDRAILS_CONTEXT, OVERWATCH_SCHEMA, OVERWATCH_CONTEXT, PALISADE_SCHEMA, PALISADE_CONTEXT, SENTRY_SCHEMA, SENTRY_CONTEXT, } from './service-schemas.gen.js';
 export type { ContextAttribute, ActionContext, ServiceContext, } from './service-schemas.gen.js';
-export { AiGatewayContextKey } from './ai_gateway-context.gen.js';
-export { GuardrailsContextKey } from './guardrails-context.gen.js';
-export { OverwatchContextKey } from './overwatch-context.gen.js';
-export { PalisadeContextKey } from './palisade-context.gen.js';
-export { SentryContextKey } from './sentry-context.gen.js';
+export { AiGatewayContextKey, AiGatewayContextKeys } from './ai_gateway-context.gen.js';
+export { GuardrailsContextKey, GuardrailsContextKeys } from './guardrails-context.gen.js';
+export { OverwatchContextKey, OverwatchContextKeys } from './overwatch-context.gen.js';
+export { PalisadeContextKey, PalisadeContextKeys } from './palisade-context.gen.js';
+export { SentryContextKey, SentryContextKeys } from './sentry-context.gen.js';
 export { AI_GATEWAY_ENTITIES, AI_GATEWAY_ACTION_ENTITIES, } from './ai_gateway-entities.gen.js';
 export { GUARDRAILS_ENTITIES, GUARDRAILS_ACTION_ENTITIES, } from './guardrails-entities.gen.js';
 export { OVERWATCH_ENTITIES, OVERWATCH_ACTION_ENTITIES, } from './overwatch-entities.gen.js';

package/dist/index.js

@@ -32,11 +32,11 @@ export * from './condition-groups.js';
 // Service-specific schemas and context (inlined)
 export { AI_GATEWAY_SCHEMA, AI_GATEWAY_CONTEXT, GUARDRAILS_SCHEMA, GUARDRAILS_CONTEXT, OVERWATCH_SCHEMA, OVERWATCH_CONTEXT, PALISADE_SCHEMA, PALISADE_CONTEXT, SENTRY_SCHEMA, SENTRY_CONTEXT, } from './service-schemas.gen.js';
 // Service-specific context key enums
-export { AiGatewayContextKey } from './ai_gateway-context.gen.js';
-export { GuardrailsContextKey } from './guardrails-context.gen.js';
-export { OverwatchContextKey } from './overwatch-context.gen.js';
-export { PalisadeContextKey } from './palisade-context.gen.js';
-export { SentryContextKey } from './sentry-context.gen.js';
+export { AiGatewayContextKey, AiGatewayContextKeys } from './ai_gateway-context.gen.js';
+export { GuardrailsContextKey, GuardrailsContextKeys } from './guardrails-context.gen.js';
+export { OverwatchContextKey, OverwatchContextKeys } from './overwatch-context.gen.js';
+export { PalisadeContextKey, PalisadeContextKeys } from './palisade-context.gen.js';
+export { SentryContextKey, SentryContextKeys } from './sentry-context.gen.js';
 // Service-specific entity metadata (for UI - principals, resources, actions)
 export { AI_GATEWAY_ENTITIES, AI_GATEWAY_ACTION_ENTITIES, } from './ai_gateway-entities.gen.js';
 export { GUARDRAILS_ENTITIES, GUARDRAILS_ACTION_ENTITIES, } from './guardrails-entities.gen.js';

package/dist/overwatch-context.gen.d.ts

@@ -79,3 +79,8 @@ export declare const OverwatchContextKey: {
     readonly WorkspaceRoot: "workspace_root";
 };
 export type OverwatchContextKey = (typeof OverwatchContextKey)[keyof typeof OverwatchContextKey];
+/**
+ * The full set of authorable context attribute keys for Overwatch.
+ * Iterate this to enumerate the authorable surface (cockpit, conformance).
+ */
+export declare const OverwatchContextKeys: readonly ["content", "crime_score", "cwd", "detected_threats", "event", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_deep_context_score", "injection_pulse_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "loop_count", "loop_detected", "loop_tool", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "path", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "prompt_text", "response_content", "role", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "user_email", "violence_score", "weapons_score", "workspace_root"];