@highflame/policy 2.2.5 → 2.2.7

package/dist/agent_ops-defaults.gen.js

@@ -0,0 +1,156 @@
+// Code generated by highflame-policy-codegen. DO NOT EDIT.
+// Source: schemas/agent_ops/templates/templates.json
+//
+// AgentOps default policies and templates.
+// Cedar text is embedded at build time. PolicyRule[] can be parsed at runtime
+// using parseCedarToRules().
+// =============================================================================
+// EMBEDDED CEDAR POLICY TEXT
+// =============================================================================
+const AGENT_OPS_ORGANIZATION_PERMIT_BASELINE_CEDAR = `// =============================================================================
+// Baseline Permit (Default)
+// =============================================================================
+// Permits all AgentOps actions by default. Threat-specific forbid policies
+// override this when detectors fire. Cedar is default-deny: without at least
+// one permit rule, every request is denied regardless of forbid rules.
+//
+// Category:  organization
+// Namespace: AgentOps
+// =============================================================================
+
+@id("organization.permit-baseline")
+@name("Permit baseline")
+@description("Permits all AgentOps actions.")
+@severity("low")
+@tags("category:organization,posture:permit-default")
+permit (
+    principal,
+    action,
+    resource
+);
+`;
+// =============================================================================
+// CATEGORIES
+// =============================================================================
+export const AGENT_OPS_CATEGORIES = [
+    { id: 'threat-detection', name: 'Threat Detection', description: 'Detect and block injection, jailbreak, and adversarial attacks across all agent traffic.' },
+    { id: 'data-protection', name: 'Data Protection', description: 'Prevent secrets, PII, and sensitive data from leaking in prompts, responses, or tool calls.' },
+    { id: 'agent-security', name: 'Agent Security', description: 'Guard against tool poisoning, rug-pull attacks, and multi-agent delegation abuse.' },
+    { id: 'tool-permissioning', name: 'Tool Permissioning', description: 'Allow-list or block-list specific tools, MCP servers, and shell operations by risk tier.' },
+    { id: 'code-security', name: 'Code Security', description: 'Enforce safe coding patterns: no exfiltration commands, no destructive write operations.' },
+    { id: 'content-safety', name: 'Content Safety', description: 'Block harmful, toxic, or policy-violating content in agent inputs and outputs.' },
+    { id: 'organization', name: 'Organization', description: 'Organization-wide baselines and default permit/deny policies.' },
+];
+// =============================================================================
+// DEFAULT POLICIES
+// =============================================================================
+export const AGENT_OPS_DEFAULTS = [
+    {
+        id: 'organization.permit-baseline',
+        name: 'Baseline Permit',
+        description: 'Permits all AgentOps actions by default; threat-specific forbid policies override this when detectors fire.',
+        category: 'organization',
+        cedarText: AGENT_OPS_ORGANIZATION_PERMIT_BASELINE_CEDAR,
+        severity: 'low',
+        tags: ['category:organization', 'posture:permit-default'],
+        isActive: true,
+    },
+];
+// =============================================================================
+// ALL TEMPLATES
+// =============================================================================
+export const AGENT_OPS_TEMPLATES = [
+    {
+        id: 'organization.permit-baseline',
+        name: 'Baseline Permit',
+        description: 'Permits all AgentOps actions by default; threat-specific forbid policies override this when detectors fire.',
+        category: 'organization',
+        cedarText: AGENT_OPS_ORGANIZATION_PERMIT_BASELINE_CEDAR,
+        severity: 'low',
+        tags: ['category:organization', 'posture:permit-default'],
+        autoDeploy: true,
+    },
+];
+// =============================================================================
+// TEMPLATES METADATA
+// =============================================================================
+/** Raw templates.json metadata for the AgentOps service. */
+export const AGENT_OPS_TEMPLATES_JSON = `{
+  "service": "agent_ops",
+  "version": "1.0.0",
+  "description": "AgentOps policy templates — unified agent guardrails for code agents, MCP tools, and AI Gateway traffic",
+  "categories": [
+    {
+      "id": "threat-detection",
+      "name": "Threat Detection",
+      "description": "Detect and block injection, jailbreak, and adversarial attacks across all agent traffic."
+    },
+    {
+      "id": "data-protection",
+      "name": "Data Protection",
+      "description": "Prevent secrets, PII, and sensitive data from leaking in prompts, responses, or tool calls."
+    },
+    {
+      "id": "agent-security",
+      "name": "Agent Security",
+      "description": "Guard against tool poisoning, rug-pull attacks, and multi-agent delegation abuse."
+    },
+    {
+      "id": "tool-permissioning",
+      "name": "Tool Permissioning",
+      "description": "Allow-list or block-list specific tools, MCP servers, and shell operations by risk tier."
+    },
+    {
+      "id": "code-security",
+      "name": "Code Security",
+      "description": "Enforce safe coding patterns: no exfiltration commands, no destructive write operations."
+    },
+    {
+      "id": "content-safety",
+      "name": "Content Safety",
+      "description": "Block harmful, toxic, or policy-violating content in agent inputs and outputs."
+    },
+    {
+      "id": "organization",
+      "name": "Organization",
+      "description": "Organization-wide baselines and default permit/deny policies."
+    }
+  ],
+  "defaults": [
+    {
+      "id": "organization.permit-baseline",
+      "name": "Baseline Permit",
+      "description": "Permits all AgentOps actions by default; threat-specific forbid policies override this when detectors fire.",
+      "category": "organization",
+      "file": "defaults/baseline.cedar",
+      "severity": "low",
+      "tags": ["category:organization", "posture:permit-default"],
+      "is_active": true
+    }
+  ],
+  "templates": [
+    {
+      "id": "organization.permit-baseline",
+      "name": "Baseline Permit",
+      "description": "Permits all AgentOps actions by default; threat-specific forbid policies override this when detectors fire.",
+      "category": "organization",
+      "file": "defaults/baseline.cedar",
+      "severity": "low",
+      "tags": ["category:organization", "posture:permit-default"],
+      "auto_deploy": true
+    }
+  ]
+}
+`;
+// =============================================================================
+// HELPER FUNCTIONS
+// =============================================================================
+export function getAgentOpsDefaultsByCategory(category) {
+    return AGENT_OPS_DEFAULTS.filter(d => d.category === category);
+}
+export function getAgentOpsTemplatesByCategory(category) {
+    return AGENT_OPS_TEMPLATES.filter(t => t.category === category);
+}
+export function getAgentOpsTemplateById(id) {
+    return AGENT_OPS_TEMPLATES.find(t => t.id === id);
+}

package/dist/agent_ops-entities.gen.d.ts

@@ -0,0 +1,11 @@
+import type { ServiceEntityMetadata, ActionEntityMetadata } from './entity-metadata-types.gen.js';
+/**
+ * AgentOps entity metadata for UI components.
+ * Extracted from Cedar schema appliesTo blocks.
+ */
+export declare const AGENT_OPS_ENTITIES: ServiceEntityMetadata;
+/**
+ * Per-action entity mapping for AgentOps.
+ * Maps action names to their valid principals and resources.
+ */
+export declare const AGENT_OPS_ACTION_ENTITIES: Record<string, ActionEntityMetadata>;

package/dist/agent_ops-entities.gen.js

@@ -0,0 +1,37 @@
+// Code generated by highflame-policy-codegen. DO NOT EDIT.
+// Source: schemas/agent_ops/schema.cedarschema
+/**
+ * AgentOps entity metadata for UI components.
+ * Extracted from Cedar schema appliesTo blocks.
+ */
+export const AGENT_OPS_ENTITIES = {
+    principals: ['Agent', 'User'],
+    resources: ['Agent', 'App', 'Session'],
+    actions: ['call_tool', 'connect_server', 'process_prompt', 'read_file', 'write_file'],
+};
+/**
+ * Per-action entity mapping for AgentOps.
+ * Maps action names to their valid principals and resources.
+ */
+export const AGENT_OPS_ACTION_ENTITIES = {
+    'call_tool': {
+        principals: ['Agent', 'User'],
+        resources: ['Agent', 'Session'],
+    },
+    'connect_server': {
+        principals: ['Agent', 'User'],
+        resources: ['Agent', 'Session'],
+    },
+    'process_prompt': {
+        principals: ['Agent', 'User'],
+        resources: ['Agent', 'App', 'Session'],
+    },
+    'read_file': {
+        principals: ['Agent', 'User'],
+        resources: ['Agent', 'Session'],
+    },
+    'write_file': {
+        principals: ['Agent', 'User'],
+        resources: ['Agent', 'Session'],
+    },
+};

package/dist/index.d.ts

@@ -13,19 +13,23 @@ export * from './errors.js';
 export * from './annotations.js';
 export * from './explain.js';
 export * from './condition-groups.js';
-export { AI_GATEWAY_SCHEMA, AI_GATEWAY_CONTEXT, GUARDRAILS_SCHEMA, GUARDRAILS_CONTEXT, OVERWATCH_SCHEMA, OVERWATCH_CONTEXT, PALISADE_SCHEMA, PALISADE_CONTEXT, SENTRY_SCHEMA, SENTRY_CONTEXT, } from './service-schemas.gen.js';
+export { AGENT_OPS_SCHEMA, AGENT_OPS_CONTEXT, AI_GATEWAY_SCHEMA, AI_GATEWAY_CONTEXT, GUARDRAILS_SCHEMA, GUARDRAILS_CONTEXT, OVERWATCH_SCHEMA, OVERWATCH_CONTEXT, PALISADE_SCHEMA, PALISADE_CONTEXT, SENTRY_SCHEMA, SENTRY_CONTEXT, } from './service-schemas.gen.js';
 export type { ContextAttribute, ActionContext, ServiceContext, } from './service-schemas.gen.js';
+export { AgentOpsContextKey, AgentOpsContextKeys } from './agent_ops-context.gen.js';
 export { AiGatewayContextKey, AiGatewayContextKeys } from './ai_gateway-context.gen.js';
 export { GuardrailsContextKey, GuardrailsContextKeys } from './guardrails-context.gen.js';
 export { OverwatchContextKey, OverwatchContextKeys } from './overwatch-context.gen.js';
 export { PalisadeContextKey, PalisadeContextKeys } from './palisade-context.gen.js';
 export { SentryContextKey, SentryContextKeys } from './sentry-context.gen.js';
+export { AGENT_OPS_ENTITIES, AGENT_OPS_ACTION_ENTITIES, } from './agent_ops-entities.gen.js';
 export { AI_GATEWAY_ENTITIES, AI_GATEWAY_ACTION_ENTITIES, } from './ai_gateway-entities.gen.js';
 export { GUARDRAILS_ENTITIES, GUARDRAILS_ACTION_ENTITIES, } from './guardrails-entities.gen.js';
 export { OVERWATCH_ENTITIES, OVERWATCH_ACTION_ENTITIES, } from './overwatch-entities.gen.js';
 export { PALISADE_ENTITIES, PALISADE_ACTION_ENTITIES, } from './palisade-entities.gen.js';
 export { SENTRY_ENTITIES, SENTRY_ACTION_ENTITIES, } from './sentry-entities.gen.js';
 export type { ServiceEntityMetadata, ActionEntityMetadata } from './entity-metadata-types.gen.js';
+export { AGENT_OPS_DEFAULTS, AGENT_OPS_TEMPLATES, AGENT_OPS_CATEGORIES, AGENT_OPS_TEMPLATES_JSON, getAgentOpsDefaultsByCategory, getAgentOpsTemplatesByCategory, getAgentOpsTemplateById, } from './agent_ops-defaults.gen.js';
+export type { AgentOpsCategory, AgentOpsCategoryInfo, AgentOpsDefaultPolicy, AgentOpsTemplate, } from './agent_ops-defaults.gen.js';
 export { AI_GATEWAY_DEFAULTS, AI_GATEWAY_TEMPLATES, AI_GATEWAY_CATEGORIES, AI_GATEWAY_TEMPLATES_JSON, getAiGatewayDefaultsByCategory, getAiGatewayTemplatesByCategory, getAiGatewayTemplateById, } from './ai_gateway-defaults.gen.js';
 export type { AiGatewayCategory, AiGatewayCategoryInfo, AiGatewayDefaultPolicy, AiGatewayTemplate, } from './ai_gateway-defaults.gen.js';
 export { GUARDRAILS_DEFAULTS, GUARDRAILS_TEMPLATES, GUARDRAILS_CATEGORIES, GUARDRAILS_TEMPLATES_JSON, getGuardrailsDefaultsByCategory, getGuardrailsTemplatesByCategory, getGuardrailsTemplateById, } from './guardrails-defaults.gen.js';

package/dist/index.js

@@ -30,20 +30,23 @@ export * from './explain.js';
 // Condition groups (AST ↔ flat UI groups)
 export * from './condition-groups.js';
 // Service-specific schemas and context (inlined)
-export { AI_GATEWAY_SCHEMA, AI_GATEWAY_CONTEXT, GUARDRAILS_SCHEMA, GUARDRAILS_CONTEXT, OVERWATCH_SCHEMA, OVERWATCH_CONTEXT, PALISADE_SCHEMA, PALISADE_CONTEXT, SENTRY_SCHEMA, SENTRY_CONTEXT, } from './service-schemas.gen.js';
+export { AGENT_OPS_SCHEMA, AGENT_OPS_CONTEXT, AI_GATEWAY_SCHEMA, AI_GATEWAY_CONTEXT, GUARDRAILS_SCHEMA, GUARDRAILS_CONTEXT, OVERWATCH_SCHEMA, OVERWATCH_CONTEXT, PALISADE_SCHEMA, PALISADE_CONTEXT, SENTRY_SCHEMA, SENTRY_CONTEXT, } from './service-schemas.gen.js';
 // Service-specific context key enums
+export { AgentOpsContextKey, AgentOpsContextKeys } from './agent_ops-context.gen.js';
 export { AiGatewayContextKey, AiGatewayContextKeys } from './ai_gateway-context.gen.js';
 export { GuardrailsContextKey, GuardrailsContextKeys } from './guardrails-context.gen.js';
 export { OverwatchContextKey, OverwatchContextKeys } from './overwatch-context.gen.js';
 export { PalisadeContextKey, PalisadeContextKeys } from './palisade-context.gen.js';
 export { SentryContextKey, SentryContextKeys } from './sentry-context.gen.js';
 // Service-specific entity metadata (for UI - principals, resources, actions)
+export { AGENT_OPS_ENTITIES, AGENT_OPS_ACTION_ENTITIES, } from './agent_ops-entities.gen.js';
 export { AI_GATEWAY_ENTITIES, AI_GATEWAY_ACTION_ENTITIES, } from './ai_gateway-entities.gen.js';
 export { GUARDRAILS_ENTITIES, GUARDRAILS_ACTION_ENTITIES, } from './guardrails-entities.gen.js';
 export { OVERWATCH_ENTITIES, OVERWATCH_ACTION_ENTITIES, } from './overwatch-entities.gen.js';
 export { PALISADE_ENTITIES, PALISADE_ACTION_ENTITIES, } from './palisade-entities.gen.js';
 export { SENTRY_ENTITIES, SENTRY_ACTION_ENTITIES, } from './sentry-entities.gen.js';
 // Service-specific default policies, templates, and categories
+export { AGENT_OPS_DEFAULTS, AGENT_OPS_TEMPLATES, AGENT_OPS_CATEGORIES, AGENT_OPS_TEMPLATES_JSON, getAgentOpsDefaultsByCategory, getAgentOpsTemplatesByCategory, getAgentOpsTemplateById, } from './agent_ops-defaults.gen.js';
 export { AI_GATEWAY_DEFAULTS, AI_GATEWAY_TEMPLATES, AI_GATEWAY_CATEGORIES, AI_GATEWAY_TEMPLATES_JSON, getAiGatewayDefaultsByCategory, getAiGatewayTemplatesByCategory, getAiGatewayTemplateById, } from './ai_gateway-defaults.gen.js';
 export { GUARDRAILS_DEFAULTS, GUARDRAILS_TEMPLATES, GUARDRAILS_CATEGORIES, GUARDRAILS_TEMPLATES_JSON, getGuardrailsDefaultsByCategory, getGuardrailsTemplatesByCategory, getGuardrailsTemplateById, } from './guardrails-defaults.gen.js';
 export { OVERWATCH_DEFAULTS, OVERWATCH_TEMPLATES, OVERWATCH_CATEGORIES, OVERWATCH_TEMPLATES_JSON, getOverwatchDefaultsByCategory, getOverwatchTemplatesByCategory, getOverwatchTemplateById, } from './overwatch-defaults.gen.js';

package/dist/service-schemas.gen.d.ts

@@ -1,3 +1,9 @@
+/**
+ * AgentOps Cedar schema
+ *
+ * Full Cedar schema for agent_ops, embedded at codegen time.
+ */
+export declare const AGENT_OPS_SCHEMA = "// =============================================================================\n// AgentOps Cedar Schema\n// =============================================================================\n// Unified schema for all agent guardrail policies. Covers every request path\n// where an AI agent touches the Highflame platform:\n//   - LLM prompt/response (Guardrails path)\n//   - IDE tool calls and file access (Overwatch path)\n//   - MCP server connections (AI Gateway path)\n//\n// The context types are a superset of Guardrails, Overwatch, and AI Gateway\n// schemas. All extra fields are optional \u2014 Shield projects only what is present\n// in the request, Cedar ignores absent optional attributes.\n//\n// Service: highflame-shield (agent_ops product)\n// Namespace: AgentOps\n// =============================================================================\n\nnamespace AgentOps {\n    // =========================================================================\n    // Entity Types \u2014 ReBAC Hierarchy\n    // =========================================================================\n    // Entity hierarchy enables Cedar's `in` operator for policy scoping:\n    //   Account (org root)\n    //     \u2514\u2500\u2500 Project in [Account]\n    //           \u251C\u2500\u2500 App in [Project]\n    //           \u2502     \u2514\u2500\u2500 Session in [App, Agent]\n    //           \u2514\u2500\u2500 Agent in [Project]\n    //                 \u2514\u2500\u2500 Session in [App, Agent]\n    //\n    // Policy scoping examples:\n    //   resource in AgentOps::Project::\"<uuid>\"          \u2192 project-wide (all agents)\n    //   resource in AgentOps::Agent::\"<external_id>\"     \u2192 named agent + its sessions\n    //   resource == AgentOps::Agent::\"<external_id>\"     \u2192 named agent only (exact match)\n    //   resource in AgentOps::Account::\"<uuid>\"          \u2192 org-wide\n    // =========================================================================\n\n    /// Account represents an organization (top-level tenant)\n    entity Account;\n\n    /// Project represents a project within an account\n    entity Project in [Account];\n\n    /// User represents a principal (human or service) making requests\n    entity User;\n\n    /// Agent represents an AI agent (Claude, Cursor, Copilot, MCP client, etc.)\n    /// Used as both principal (who is acting) and resource (policy scoping target).\n    /// Agent + sessions: resource in AgentOps::Agent::\"<external_id>\" (hierarchy match)\n    /// Agent only:       resource == AgentOps::Agent::\"<external_id>\" (exact match)\n    entity Agent in [Project];\n\n    /// App represents a protected application (guardrails-enabled LLM app)\n    entity App in [Project];\n\n    /// Session represents an agentic conversation session with state tracking.\n    /// Sessions can belong to either an App or an Agent.\n    entity Session in [App, Agent];\n\n    // =========================================================================\n    // Actions\n    // =========================================================================\n\n    /// Process user prompts and AI responses for security threats and content violations\n    action \"process_prompt\" appliesTo {\n        principal: [User, Agent],\n        resource: [App, Agent, Session],\n        context: ProcessPromptContext\n    };\n\n    /// Execute tool calls (shell, file operations, MCP tools)\n    action \"call_tool\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: CallToolContext\n    };\n\n    /// Read file operations\n    action \"read_file\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: FileReadContext\n    };\n\n    /// Write file operations\n    action \"write_file\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: FileWriteContext\n    };\n\n    /// Connect to an MCP server\n    action \"connect_server\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: ConnectServerContext\n    };\n\n    // =========================================================================\n    // Context Types (Action-Specific)\n    // =========================================================================\n\n    /// Context for process_prompt action (user prompts & AI responses)\n    type ProcessPromptContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,        // Principal identity class: \"human\" | \"agent\" | \"service\" | \"mcp_server\"\n        \"principal\"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n        \"direction\": String,        // \"input\" | \"output\"\n        \"content_type\": String,     // \"prompt\" | \"response\" | \"tool_call\" | \"file\"\n        \"detector_count\": Long,\n\n        // IDE / workspace context (optional \u2014 present for Overwatch/code-agent traffic)\n        \"source\"?: String,           // Traffic origin: \"ide\" | \"cli\" | \"api\" | \"browser\"\n        \"event\"?: String,            // Event type: \"prompt\" | \"tool_call\" | \"file_read\" | ...\n        \"user_email\"?: String,       // Human operator email (IDE sessions)\n        \"cwd\"?: String,              // Current working directory\n        \"workspace_root\"?: String,   // IDE workspace root path\n\n        // Model context (optional \u2014 present for AI Gateway traffic)\n        \"model_name\"?: String,       // LLM model name: \"claude-3-5-sonnet\", \"gpt-4o\", ...\n        \"model_provider\"?: String,   // Model provider: \"anthropic\" | \"openai\" | \"google\" | ...\n\n        // Security - Injection & Jailbreak (optional)\n        \"injection_score\"?: Long,  // Combined injection confidence: MAX(pulse, deep_context)\n        \"jailbreak_score\"?: Long,  // Combined jailbreak confidence: MAX(pulse, deep_context)\n        \"injection_pulse_score\"?: Long,  // 0-100 Pulse single-turn classifier\n        \"injection_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n        \"jailbreak_pulse_score\"?: Long,  // 0-100 Pulse single-turn classifier\n        \"jailbreak_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n        \"injection_type\"?: String,       // \"prompt\" | \"sql\" | \"command\" | \"none\"\n        \"indirect_injection_score\"?: Long, // Indirect injection via tool outputs (0-100)\n\n        // Privacy - Secrets (optional)\n        \"secrets_detected\"?: Boolean,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,    // [\"aws_access_key\", \"github_token\", ...]\n\n        // Privacy - PII (optional)\n        \"pii_detected\"?: Boolean,\n        \"pii_count\"?: Long,\n        \"pii_types\"?: Set<String>,       // [\"email\", \"phone\", \"ssn\", \"credit_card\", ...]\n        \"pii_score\"?: Long,         // PII ML classifier confidence (0-100)\n\n        // Aggregated threat summary (optional \u2014 populated by aggregation detectors)\n        \"highest_severity\"?: String,     // \"critical\" | \"high\" | \"medium\" | \"low\" | \"none\"\n        \"threat_count\"?: Long,\n        \"threat_categories\"?: Set<String>,\n        \"detected_threats\"?: Set<String>,\n\n        // Trust & Safety - Toxicity (optional)\n        \"violence_score\"?: Long,         // 0-100\n        \"hate_speech_score\"?: Long,      // 0-100\n        \"sexual_score\"?: Long,           // 0-100\n        \"weapons_score\"?: Long,          // 0-100\n        \"crime_score\"?: Long,            // 0-100\n        \"profanity_score\"?: Long,        // 0-100\n\n        // Semantic - Topic Classification (optional)\n        \"content_topics\"?: Set<String>,      // [\"controlled_substances\", \"weapons_manufacturing\", ...]\n        \"topic_confidence\"?: Long,           // 0-100\n\n        // Security - Invisible Character Detection (optional)\n        \"invisible_chars_detected\"?: Boolean,\n        \"invisible_chars_score\"?: Long,      // 0-100\n\n        // Security - Pattern Detection (optional)\n        \"command_injection_detected\"?: Boolean,\n        \"command_injection_type\"?: String,       // \"reverse_shell\" | \"privilege_escalation\" | ...\n        \"command_injection_score\"?: Long,        // 0-100\n        \"path_traversal_detected\"?: Boolean,\n        \"path_traversal_severity\"?: String,      // \"critical\" | \"high\" | \"medium\" | \"low\" | \"none\"\n        \"path_traversal_type\"?: String,\n        \"sql_injection_detected\"?: Boolean,\n        \"sql_injection_type\"?: String,           // \"tautology\" | \"union_based\" | \"destructive\" | ...\n        \"sql_injection_score\"?: Long,            // 0-100\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Boolean,\n        \"cross_origin_type\"?: String,            // \"cross_origin_tool\" | \"cross_origin_server\" | \"none\"\n        \"cross_origin_score\"?: Long,             // 0-100\n\n        // Security - Encoded Injection (optional)\n        \"encoded_content_detected\"?: Boolean,\n        \"encoded_types\"?: Set<String>,           // [\"base64\", \"hex\", \"unicode\", \"url\", ...]\n        \"encoded_count\"?: Long,\n        \"encoded_score\"?: Long,                  // 0-100\n\n        // Language & Script Detection (optional)\n        \"detected_language\"?: String,            // ISO language code\n        \"is_english\"?: Boolean,\n        \"language_confidence\"?: Long,            // 0-100\n        \"detected_script\"?: String,              // \"latin\" | \"cyrillic\" | \"arabic\" | \"unknown\" | ...\n        \"is_latin_script\"?: Boolean,\n        \"script_confidence\"?: Long,              // 0-100\n\n        // Content Analysis (optional)\n        \"hallucination_score\"?: Long,\n        \"factuality_score\"?: Long,               // 0-100\n        \"sentiment_score\"?: Long,\n        \"contains_code\"?: Boolean,\n        \"code_languages\"?: Set<String>,\n        \"code_ratio\"?: Long,                     // 0-100\n        \"keyword_matched\"?: Boolean,\n        \"keyword_categories\"?: Set<String>,\n        \"keyword_count\"?: Long,\n        \"contains_non_ascii\"?: Boolean,\n        \"phishing_detected\"?: Boolean,\n        \"content_safety_score\"?: Long,           // 0-100\n        \"content_safety_blocked\"?: Boolean,\n\n        // Agentic - Multi-Turn Context (optional)\n        \"conversation_turn\"?: Long,\n        \"multi_turn_detection\"?: Boolean,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Usage Budget \u2014 multi-window token & cost enforcement (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,           // \"orchestrator\" | \"autonomous\" | \"tool_agent\" | \"human_proxy\"\n        \"agent_trust_level\"?: String,    // \"first_party\" | \"verified_third_party\" | \"unverified\"\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for call_tool action (agentic tool execution)\n    type CallToolContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,\n        \"principal\"?: String,\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // IDE / workspace context (optional)\n        \"source\"?: String,\n        \"event\"?: String,\n        \"user_email\"?: String,\n        \"cwd\"?: String,\n        \"workspace_root\"?: String,\n\n        // Tool Risk (optional)\n        \"tool_name\"?: String,\n        \"tool_risk_score\"?: Long,        // 0-100\n        \"tool_is_sensitive\"?: Boolean,\n        \"tool_category\"?: String,        // \"safe\" | \"sensitive\" | \"dangerous\"\n        \"tool_is_builtin\"?: Boolean,\n\n        // AARM R3 (CAP-ENF-007) \u2014 Action Parameter Validation\n        \"action_params\"?: {\n            \"amount\"?: Long,\n            \"count\"?: Long,\n            \"command\"?: String,\n            \"path\"?: String,\n            \"url\"?: String,\n            \"recipient\"?: String,\n            \"target\"?: String,\n            \"query\"?: String,\n        },\n        \"param_type_violation\"?: Boolean,\n        \"param_type_violations\"?: Set<String>,\n\n        // MCP context (optional)\n        \"mcp_server\"?: String,\n        \"mcp_tool\"?: String,\n        \"mcp_server_verified\"?: Boolean,\n\n        // Agentic - Behavioral Patterns (optional)\n        \"suspicious_pattern\"?: Boolean,\n        \"pattern_type\"?: String,         // \"data_exfiltration\" | \"secret_exfiltration\" | ...\n        \"sequence_risk\"?: Long,          // 0-100\n\n        // Agentic - Loop Detection (optional)\n        \"loop_detected\"?: Boolean,\n        \"loop_count\"?: Long,\n        \"loop_tool\"?: String,\n\n        // Security checks on tool arguments (optional)\n        \"secrets_detected\"?: Boolean,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Boolean,\n        \"pii_types\"?: Set<String>,\n        \"pii_count\"?: Long,\n        \"pii_score\"?: Long,\n        \"injection_score\"?: Long,\n        \"injection_pulse_score\"?: Long,\n        \"injection_deep_context_score\"?: Long,\n        \"indirect_injection_score\"?: Long,\n        \"indirect_injection_type\"?: String,      // Type of indirect injection detected\n\n        // Semantic - Topic Classification (optional)\n        \"content_topics\"?: Set<String>,      // [\"controlled_substances\", \"weapons_manufacturing\", ...]\n        \"topic_confidence\"?: Long,           // 0-100\n\n        // Security - Pattern Detection (optional)\n        \"command_injection_detected\"?: Boolean,\n        \"command_injection_type\"?: String,\n        \"command_injection_score\"?: Long,\n        \"path_traversal_detected\"?: Boolean,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n        \"sql_injection_detected\"?: Boolean,\n        \"sql_injection_type\"?: String,\n        \"sql_injection_score\"?: Long,\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Boolean,\n        \"cross_origin_type\"?: String,\n        \"cross_origin_score\"?: Long,\n\n        // Security - Invisible Character Detection (optional)\n        \"invisible_chars_detected\"?: Boolean,\n        \"invisible_chars_score\"?: Long,\n\n        // Security - Encoded Injection (optional)\n        \"encoded_content_detected\"?: Boolean,\n        \"encoded_types\"?: Set<String>,\n        \"encoded_count\"?: Long,\n        \"encoded_score\"?: Long,\n\n        // Agentic - Agent Security (optional)\n        \"tool_poisoning_detected\"?: Boolean,\n        \"tool_poisoning_score\"?: Long,\n        \"tool_poisoning_type\"?: String,\n        \"rug_pull_detected\"?: Boolean,\n        \"rug_pull_score\"?: Long,\n        \"rug_pull_type\"?: String,\n\n        // Agentic - MCP Risk (optional)\n        \"mcp_config_risk\"?: Boolean,\n        \"mcp_risk_type\"?: String,\n        \"mcp_risk_score\"?: Long,\n\n        // Tool Operation Classifier (optional)\n        \"tool_operation_classes\"?: Set<String>,\n\n        // Agentic - Multi-Turn Context (optional)\n        \"conversation_turn\"?: Long,\n        \"multi_turn_detection\"?: Boolean,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Usage Budget (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Aggregated threat summary (optional)\n        \"highest_severity\"?: String,\n        \"threat_count\"?: Long,\n        \"detected_threats\"?: Set<String>,\n\n        // Agent Identity (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n        // File & Path (optional)\n        \"path\"?: String,\n\n    };\n\n    /// Context for read_file action\n    type FileReadContext = {\n        // Identity (optional)\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,\n        \"principal\"?: String,\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // IDE / workspace context (optional)\n        \"source\"?: String,\n        \"event\"?: String,\n        \"user_email\"?: String,\n        \"cwd\"?: String,\n        \"workspace_root\"?: String,\n\n        // File path (optional)\n        \"path\"?: String,\n\n        // Security checks on file content (optional)\n        \"secrets_detected\"?: Boolean,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Boolean,\n        \"pii_types\"?: Set<String>,\n\n        // Security - Path Traversal (optional)\n        \"path_traversal_detected\"?: Boolean,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n\n        // Aggregated threat summary (optional)\n        \"highest_severity\"?: String,\n        \"threat_count\"?: Long,\n        \"detected_threats\"?: Set<String>,\n\n        // Session Detection History (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Usage Budget (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Agent Identity (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for write_file action\n    type FileWriteContext = {\n        // Identity (optional)\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,\n        \"principal\"?: String,\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // IDE / workspace context (optional)\n        \"source\"?: String,\n        \"event\"?: String,\n        \"user_email\"?: String,\n        \"cwd\"?: String,\n        \"workspace_root\"?: String,\n\n        // File path (optional)\n        \"path\"?: String,\n\n        // Security - Invisible Character Detection in write content (optional)\n        \"invisible_chars_detected\"?: Boolean,\n        \"invisible_chars_score\"?: Long,\n\n        // Security checks on content being written (optional)\n        \"secrets_detected\"?: Boolean,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Boolean,\n        \"pii_types\"?: Set<String>,\n\n        // Security - Path Traversal (optional)\n        \"path_traversal_detected\"?: Boolean,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n\n        // Aggregated threat summary (optional)\n        \"highest_severity\"?: String,\n        \"threat_count\"?: Long,\n        \"detected_threats\"?: Set<String>,\n\n        // Session Detection History (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Usage Budget (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Agent Identity (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for connect_server action (MCP server connections)\n    type ConnectServerContext = {\n        // Identity (optional)\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,\n        \"principal\"?: String,\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // IDE / workspace context (optional)\n        \"source\"?: String,\n        \"event\"?: String,\n        \"user_email\"?: String,\n        \"cwd\"?: String,\n        \"workspace_root\"?: String,\n\n        // MCP context (optional)\n        \"mcp_server\"?: String,\n        \"mcp_server_verified\"?: Boolean,\n\n        // Agentic - Agent Security (optional)\n        \"tool_poisoning_detected\"?: Boolean,\n        \"tool_poisoning_score\"?: Long,\n        \"tool_poisoning_type\"?: String,\n\n        // Agentic - MCP Risk (optional)\n        \"mcp_config_risk\"?: Boolean,\n        \"mcp_risk_type\"?: String,\n        \"mcp_risk_score\"?: Long,\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Boolean,\n        \"cross_origin_type\"?: String,\n        \"cross_origin_score\"?: Long,\n\n        // Aggregated threat summary (optional)\n        \"highest_severity\"?: String,\n        \"threat_count\"?: Long,\n        \"detected_threats\"?: Set<String>,\n\n        // Session Detection History (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Usage Budget (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Agent Identity (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n}\n";
 /**
  * AiGateway Cedar schema
  *
@@ -49,6 +55,10 @@ export interface ServiceContext {
     description: string;
     actions: ActionContext[];
 }
+/**
+ * AgentOps context metadata (parsed JSON)
+ */
+export declare const AGENT_OPS_CONTEXT: ServiceContext;
 /**
  * AiGateway context metadata (parsed JSON)
  */